From: Florian Westphal <fw@strlen.de>
To: netfilter-devel@vger.kernel.org
Subject: nftables monitor json mode is broken
Date: Wed, 27 Aug 2025 19:12:36 +0200 [thread overview]
Message-ID: <aK88hFryFONk4a6P@strlen.de> (raw)
Hi,
as subject says, 'nft monitor -j' is broken.
Example:
./run-tests.sh -j testcases/object.t
monitor: running tests from file object.t
monitor output differs!
--- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk 2025-08-27 19:05:08.039619097 +0200
+++ /tmp/tmp.emU4zIN8UT/tmp.jBOL3aIrp5 2025-08-27 19:05:09.062551248 +0200
@@ -1 +1 @@
-{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 26214400, "used": 0, "inv": false}}}
+{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 0, "used": 0, "inv": false}}}
monitor output differs!
--- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk 2025-08-27 19:05:10.095619097 +0200
+++ /tmp/tmp.emU4zIN8UT/tmp.Guz55knY19 2025-08-27 19:05:11.117393075 +0200
@@ -1 +1 @@
-{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 1, "per": "second", "burst": 5}}}
+{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 0, "per": "error"}}}
I did notice this weeks ago but thought it was a problem on my end
and then didn't have time to investigate closer.
But its in fact broken on kernel side, since
netfilter: nf_tables: Reintroduce shortened deletion notifications
In short, unlike the normal output, json output wants to dump
everything, but the notifications no longer include the extra data, just
the bare minimum to identify the object being deleted.
As noone has complained so far I am inclinded to delete the
tests and rip out json support from monitor mode, it seems noone
uses it or even runs the tests for it.
Alternatives i see are:
1. implement a cache and query it
2. rework the json mode to be forgiving as to what is set
and what isn't in the object.
Object here also means any object reported in any delete kind,
not just NFT_MSG_DELOBJ. This applies to set elements etc. too,
json expects the full info, but the kernel notifications no longer
provide this.
Alternative options?
Thanks.
next reply other threads:[~2025-08-27 17:12 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-27 17:12 Florian Westphal [this message]
2025-08-27 18:19 ` nftables monitor json mode is broken Pablo Neira Ayuso
2025-08-27 18:37 ` Pablo Neira Ayuso
2025-08-28 9:29 ` Florian Westphal
2025-08-28 12:27 ` Pablo Neira Ayuso
2025-08-27 20:55 ` Phil Sutter
2025-08-27 21:10 ` Phil Sutter
2025-08-28 9:31 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aK88hFryFONk4a6P@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).