Re: nftables monitor json mode is broken

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Aug 27, 2025 at 07:12:36PM +0200, Florian Westphal wrote:
> Hi,
> 
> as subject says, 'nft monitor -j' is broken.
> Example:
> 
> ./run-tests.sh -j testcases/object.t
> monitor: running tests from file object.t
> monitor output differs!
> --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk  2025-08-27 19:05:08.039619097 +0200
> +++ /tmp/tmp.emU4zIN8UT/tmp.jBOL3aIrp5  2025-08-27 19:05:09.062551248 +0200
> @@ -1 +1 @@
> -{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 26214400, "used": 0, "inv": false}}}
> +{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 0, "used": 0, "inv": false}}}
> monitor output differs!
> --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk  2025-08-27 19:05:10.095619097 +0200
> +++ /tmp/tmp.emU4zIN8UT/tmp.Guz55knY19  2025-08-27 19:05:11.117393075 +0200
> @@ -1 +1 @@
> -{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 1, "per": "second", "burst": 5}}}
> +{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 0, "per": "error"}}}
> 
> I did notice this weeks ago but thought it was a problem on my end
> and then didn't have time to investigate closer.
> 
> But its in fact broken on kernel side, since
> 
> netfilter: nf_tables: Reintroduce shortened deletion notifications
> 
> In short, unlike the normal output, json output wants to dump
> everything, but the notifications no longer include the extra data, just
> the bare minimum to identify the object being deleted.
> 
> As noone has complained so far I am inclinded to delete the
> tests and rip out json support from monitor mode, it seems noone
> uses it or even runs the tests for it.

Why? Is unfixable to consider this?

> Alternatives i see are:
> 1. implement a cache and query it

There is a cache infrastructure, monitor only need to use it.

> 2. rework the json mode to be forgiving as to what is set
>    and what isn't in the object.
>
> Object here also means any object reported in any delete kind,
> not just NFT_MSG_DELOBJ.  This applies to set elements etc. too,
> json expects the full info, but the kernel notifications no longer
> provide this.

But it does not make sense to provide the full information, delete
object should just provide the handle to identify, to remain in parity
with the native syntax.

> Alternative options?