[nft PATCH 00/14] json: Do not reduce single-item arrays on output

[nft PATCH 00/14] json: Do not reduce single-item arrays on output

[Phil Sutter]

This series consists of noise (patches 1-13 and most of patch 14) with a
bit of signal in patch 14. This is because the relatively simple
adjustment to JSON output requires minor adjustments to many stored JSON
dumps in shell test suite and stored JSON output in py test suite. While
doing this, I noticed some dups and stale entries in py test suite. To
clean things up first, I ran tests/py/tools/test-sanitizer.sh, fixed the
warnings and sorted the changes into fixes for the respective commits.

Phil Sutter (14):
  tests: py: Drop duplicate test in any/meta.t
  tests: py: Drop stale entries since redundant test case removal
  tests: py: Drop stale payload from any/rawpayload.t.payload
  tests: py: Drop duplicate test from inet/geneve.t
  tests: py: Drop duplicate test from inet/gre.t
  tests: py: Drop duplicate test from inet/gretap.t
  tests: py: Drop stale entry from inet/tcp.t.json
  tests: py: Drop duplicate test from inet/vxlan.t
  tests: py: Drop redundant payloads for ip/ip.t
  tests: py: Drop stale entry from ip/snat.t.json
  tests: py: Drop stale entries from ip6/{ct,meta}.t.json
  tests: py: Drop stale entry from ip/snat.t.payload
  tests: py: Fix tests added for 'icmpv6 taddr' support
  json: Do not reduce single-item arrays on output

 src/json.c                                    |   8 +-
 tests/py/any/log.t.json.output                |  15 +-
 tests/py/any/meta.t                           |   1 -
 tests/py/any/meta.t.json                      |  38 ---
 tests/py/any/queue.t.json.output              | 117 ++++++++
 tests/py/any/rawpayload.t.payload             |   6 -
 tests/py/inet/fib.t.json                      |   8 +-
 tests/py/inet/fib.t.json.output               |  87 +++++-
 tests/py/inet/geneve.t                        |   1 -
 tests/py/inet/geneve.t.json                   |  29 --
 tests/py/inet/gre.t                           |   1 -
 tests/py/inet/gre.t.json                      |  17 --
 tests/py/inet/gretap.t                        |   1 -
 tests/py/inet/gretap.t.json                   |  17 --
 tests/py/inet/snat.t.json.output              |  22 ++
 tests/py/inet/synproxy.t.json                 |   8 +-
 tests/py/inet/synproxy.t.json.output          |   8 +-
 tests/py/inet/tcp.t.json                      |  31 ---
 tests/py/inet/vxlan.t                         |   1 -
 tests/py/inet/vxlan.t.json                    |  29 --
 tests/py/ip/ip.t.payload.bridge               | 261 ------------------
 tests/py/ip/ip.t.payload.inet                 | 176 ------------
 tests/py/ip/masquerade.t.json.output          |  46 +++
 tests/py/ip/redirect.t.json.output            | 118 ++++++++
 tests/py/ip/snat.t.json                       |  33 ---
 tests/py/ip/snat.t.json.output                |   8 +-
 tests/py/ip/snat.t.payload                    |  14 -
 tests/py/ip6/ct.t.json                        | 164 -----------
 tests/py/ip6/dst.t.json                       |  23 --
 tests/py/ip6/dst.t.payload.inet               |  10 -
 tests/py/ip6/dst.t.payload.ip6                |   8 -
 tests/py/ip6/frag.t.json                      | 121 --------
 tests/py/ip6/icmpv6.t                         |   2 -
 tests/py/ip6/icmpv6.t.json                    |  58 ----
 tests/py/ip6/icmpv6.t.json.output             |  36 +++
 tests/py/ip6/ip6.t.json                       |  40 ---
 tests/py/ip6/masquerade.t.json.output         |  46 +++
 tests/py/ip6/meta.t.json                      |  58 ----
 tests/py/ip6/redirect.t.json.output           |  70 +++++
 .../cache/dumps/0002_interval_0.json-nft      |   4 +-
 .../netdev_chain_dormant_autoremove.json-nft  |   4 +-
 .../json/dumps/0001set_statements_0.json-nft  |   4 +-
 tests/shell/testcases/json/single_flag        |  48 ++--
 .../listing/dumps/0010sets_0.json-nft         |   8 +-
 .../listing/dumps/0012sets_0.json-nft         |   8 +-
 .../listing/dumps/0022terse_0.json-nft        |   4 +-
 ...5interval_map_add_many_elements_0.json-nft |   4 +-
 .../dumps/0006interval_map_overlap_0.json-nft |   4 +-
 .../dumps/0008interval_map_delete_0.json-nft  |   4 +-
 .../maps/dumps/0012map_concat_0.json-nft      |   4 +-
 .../testcases/maps/dumps/0013map_0.json-nft   |   4 +-
 .../maps/dumps/delete_element.json-nft        |   4 +-
 .../dumps/delete_element_catchall.json-nft    |   4 +-
 .../maps/dumps/map_with_flags_0.json-nft      |   4 +-
 .../maps/dumps/named_ct_objects.json-nft      |   8 +-
 .../maps/dumps/named_limits.json-nft          |   8 +-
 .../maps/dumps/pipapo_double_flush.json-nft   |   4 +-
 .../maps/dumps/typeof_integer_0.json-nft      |   4 +-
 .../dumps/typeof_maps_add_delete.json-nft     |   4 +-
 .../maps/dumps/typeof_maps_update_0.json-nft  |   8 +-
 .../maps/dumps/vmap_timeout.json-nft          |   8 +-
 .../testcases/maps/dumps/vmap_unary.json-nft  |   4 +-
 .../dumps/0012different_defines_0.json-nft    |   8 +-
 .../nft-f/dumps/0025empty_dynset_0.json-nft   |  12 +-
 .../testcases/nft-i/dumps/set_0.json-nft      |   4 +-
 .../optimizations/dumps/merge_vmaps.json-nft  |   4 +-
 .../dumps/skip_unsupported.json-nft           |   4 +-
 .../packetpath/dumps/set_lookups.json-nft     |   8 +-
 .../dumps/0004replace_0.json-nft              |   4 +-
 .../dumps/0011reset_0.json-nft                |   4 +-
 .../sets/dumps/0001named_interval_0.json-nft  |  16 +-
 .../0002named_interval_automerging_0.json-nft |   4 +-
 .../0004named_interval_shadow_0.json-nft      |   4 +-
 .../0005named_interval_shadow_0.json-nft      |   4 +-
 .../dumps/0008comments_interval_0.json-nft    |   4 +-
 .../dumps/0009comments_timeout_0.json-nft     |   4 +-
 .../sets/dumps/0015rulesetflush_0.json-nft    |   4 +-
 .../dumps/0022type_selective_flush_0.json-nft |   4 +-
 .../sets/dumps/0024synproxy_0.json-nft        |   4 +-
 .../sets/dumps/0027ipv6_maps_ipv4_0.json-nft  |   4 +-
 .../sets/dumps/0028autoselect_0.json-nft      |  12 +-
 .../sets/dumps/0028delete_handle_0.json-nft   |   4 +-
 .../dumps/0032restore_set_simple_0.json-nft   |   8 +-
 .../dumps/0033add_set_simple_flat_0.json-nft  |   8 +-
 .../sets/dumps/0034get_element_0.json-nft     |  12 +-
 .../0035add_set_elements_flat_0.json-nft      |   4 +-
 .../sets/dumps/0038meter_list_0.json-nft      |   4 +-
 .../sets/dumps/0039delete_interval_0.json-nft |   4 +-
 .../0040get_host_endian_elements_0.json-nft   |   4 +-
 .../sets/dumps/0041interval_0.json-nft        |   4 +-
 .../sets/dumps/0042update_set_0.json-nft      |   4 +-
 .../dumps/0043concatenated_ranges_1.json-nft  |   8 +-
 .../dumps/0044interval_overlap_1.json-nft     |   4 +-
 .../sets/dumps/0046netmap_0.json-nft          |  16 +-
 .../sets/dumps/0049set_define_0.json-nft      |   4 +-
 .../dumps/0051set_interval_counter_0.json-nft |   4 +-
 .../sets/dumps/0052overlap_0.json-nft         |   4 +-
 .../sets/dumps/0054comments_set_0.json-nft    |   8 +-
 .../sets/dumps/0055tcpflags_0.json-nft        |   4 +-
 .../sets/dumps/0060set_multistmt_1.json-nft   |   4 +-
 .../sets/dumps/0062set_connlimit_0.json-nft   |   8 +-
 .../sets/dumps/0063set_catchall_0.json-nft    |   4 +-
 .../sets/dumps/0064map_catchall_0.json-nft    |   4 +-
 .../sets/dumps/0069interval_merge_0.json-nft  |   4 +-
 .../0071unclosed_prefix_interval_0.json-nft   |   8 +-
 .../sets/dumps/0073flat_interval_set.json-nft |   4 +-
 .../dumps/0074nested_interval_set.json-nft    |   4 +-
 .../sets/dumps/concat_interval_0.json-nft     |   8 +-
 .../sets/dumps/concat_nlmsg_overrun.json-nft  |   4 +-
 .../sets/dumps/dynset_missing.json-nft        |   4 +-
 .../sets/dumps/exact_overlap_0.json-nft       |   4 +-
 .../testcases/sets/dumps/inner_0.json-nft     |   4 +-
 .../sets/dumps/interval_size.json-nft         |   8 +-
 .../sets/dumps/meter_set_reuse.json-nft       |   4 +-
 .../dumps/range_with_same_start_end.json-nft  |   4 +-
 .../set_element_timeout_updates.json-nft      |   4 +-
 .../testcases/sets/dumps/set_eval_0.json-nft  |   4 +-
 .../sets/dumps/sets_with_ifnames.json-nft     |  12 +-
 .../sets/dumps/typeof_sets_concat.json-nft    |   4 +-
 .../transactions/dumps/0002table_0.json-nft   |   4 +-
 .../transactions/dumps/0037set_0.json-nft     |   4 +-
 .../transactions/dumps/0038set_0.json-nft     |   4 +-
 .../transactions/dumps/0039set_0.json-nft     |   4 +-
 .../transactions/dumps/0047set_0.json-nft     |   4 +-
 .../transactions/dumps/doubled-set.json-nft   |   4 +-
 .../transactions/dumps/table_onoff.json-nft   |   4 +-
 126 files changed, 944 insertions(+), 1305 deletions(-)
 create mode 100644 tests/py/inet/snat.t.json.output

-- 
2.49.0

[nft PATCH 01/14] tests: py: Drop duplicate test in any/meta.t

[Phil Sutter]

The expected invalid meta hour argument of 24:00 is tested already.

Fixes: a6717ae094db2 ("evaluate: Fix for 'meta hour' ranges spanning date boundaries")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/any/meta.t | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/py/any/meta.t b/tests/py/any/meta.t
index 74e4ba28343d9..c5ab2ad908c46 100644
--- a/tests/py/any/meta.t
+++ b/tests/py/any/meta.t
@@ -221,7 +221,6 @@ meta hour "00:01" drop;ok
 meta hour "01:01" drop;ok
 meta hour "02:02" drop;ok
 meta hour "03:03" drop;ok
-meta hour "24:00" drop;fail
 meta hour "23:59:60" drop;ok;meta hour "00:00" drop
 meta hour "00:00"-"02:02" drop;ok
 meta hour "01:01"-"03:03" drop;ok
-- 
2.49.0

[nft PATCH 02/14] tests: py: Drop stale entries since redundant test case removal

[Phil Sutter]

Fixed commit left stale JSON equivalents and payload records in place,
drop them.

Fixes: ec1ea13314fa5 ("tests: remove redundant test cases")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/any/meta.t.json        |  38 ----------
 tests/py/ip6/dst.t.json         |  23 ------
 tests/py/ip6/dst.t.payload.inet |  10 ---
 tests/py/ip6/dst.t.payload.ip6  |   8 ---
 tests/py/ip6/frag.t.json        | 121 --------------------------------
 tests/py/ip6/ip6.t.json         |  40 -----------
 6 files changed, 240 deletions(-)

diff --git a/tests/py/any/meta.t.json b/tests/py/any/meta.t.json
index 8dcd1e13243de..85406efc4d773 100644
--- a/tests/py/any/meta.t.json
+++ b/tests/py/any/meta.t.json
@@ -2294,44 +2294,6 @@
     }
 ]
 
-# meta cgroup {1048577-1048578}
-[
-    {
-        "match": {
-            "left": {
-                "meta": { "key": "cgroup" }
-            },
-            "op": "==",
-            "right": {
-                "set": [
-                    {
-                        "range": [ 1048577, 1048578 ]
-                    }
-                ]
-            }
-        }
-    }
-]
-
-# meta cgroup != { 1048577-1048578}
-[
-    {
-        "match": {
-            "left": {
-                "meta": { "key": "cgroup" }
-            },
-            "op": "!=",
-            "right": {
-                "set": [
-                    {
-                        "range": [ 1048577, 1048578 ]
-                    }
-                ]
-            }
-        }
-    }
-]
-
 # meta iif . meta oif { "lo" . "lo" }
 [
     {
diff --git a/tests/py/ip6/dst.t.json b/tests/py/ip6/dst.t.json
index e947a76f4f4a9..7ba4572c50bbe 100644
--- a/tests/py/ip6/dst.t.json
+++ b/tests/py/ip6/dst.t.json
@@ -290,26 +290,3 @@
         }
     }
 ]
-
-# dst hdrlength != { 33, 55, 67, 88}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "hdrlength",
-                    "name": "dst"
-                }
-            },
-            "op": "!=",
-            "right": {
-                "set": [
-                    33,
-                    55,
-                    67,
-                    88
-                ]
-            }
-        }
-    }
-]
diff --git a/tests/py/ip6/dst.t.payload.inet b/tests/py/ip6/dst.t.payload.inet
index 476fdbcd73630..eb7a87d577a31 100644
--- a/tests/py/ip6/dst.t.payload.inet
+++ b/tests/py/ip6/dst.t.payload.inet
@@ -117,13 +117,3 @@ ip6 test-ip6 input
   [ cmp eq reg 1 0x0000000a ]
   [ exthdr load ipv6 1b @ 60 + 1 => reg 1 ]
   [ lookup reg 1 set __set%d ]
-
-# dst hdrlength != { 33, 55, 67, 88}
-__set%d test-ip6 3
-__set%d test-ip6 0
-	element 00000021  : 0 [end]	element 00000037  : 0 [end]	element 00000043  : 0 [end]	element 00000058  : 0 [end]
-ip6 test-ip6 input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x0000000a ]
-  [ exthdr load ipv6 1b @ 60 + 1 => reg 1 ]
-  [ lookup reg 1 set __set%d 0x1 ]
diff --git a/tests/py/ip6/dst.t.payload.ip6 b/tests/py/ip6/dst.t.payload.ip6
index af3bab9b1f75f..ac1fc8b39a2b7 100644
--- a/tests/py/ip6/dst.t.payload.ip6
+++ b/tests/py/ip6/dst.t.payload.ip6
@@ -87,11 +87,3 @@ __set%d test-ip6 0
 ip6 test-ip6 input
   [ exthdr load ipv6 1b @ 60 + 1 => reg 1 ]
   [ lookup reg 1 set __set%d ]
-
-# dst hdrlength != { 33, 55, 67, 88}
-__set%d test-ip6 3
-__set%d test-ip6 0
-	element 00000021  : 0 [end]	element 00000037  : 0 [end]	element 00000043  : 0 [end]	element 00000058  : 0 [end]
-ip6 test-ip6 input
-  [ exthdr load ipv6 1b @ 60 + 1 => reg 1 ]
-  [ lookup reg 1 set __set%d 0x1 ]
diff --git a/tests/py/ip6/frag.t.json b/tests/py/ip6/frag.t.json
index b8c06dfb3429c..6953e872a8f97 100644
--- a/tests/py/ip6/frag.t.json
+++ b/tests/py/ip6/frag.t.json
@@ -230,46 +230,6 @@
     }
 ]
 
-# frag reserved { 33-55}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "reserved",
-                    "name": "frag"
-                }
-            },
-	    "op": "==",
-            "right": {
-                "set": [
-                    { "range": [ 33, 55 ] }
-                ]
-            }
-        }
-    }
-]
-
-# frag reserved != { 33-55}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "reserved",
-                    "name": "frag"
-                }
-            },
-            "op": "!=",
-            "right": {
-                "set": [
-                    { "range": [ 33, 55 ] }
-                ]
-            }
-        }
-    }
-]
-
 # frag frag-off 22
 [
     {
@@ -384,46 +344,6 @@
     }
 ]
 
-# frag frag-off { 33-55}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "frag-off",
-                    "name": "frag"
-                }
-            },
-	    "op": "==",
-            "right": {
-                "set": [
-                    { "range": [ 33, 55 ] }
-                ]
-            }
-        }
-    }
-]
-
-# frag frag-off != { 33-55}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "frag-off",
-                    "name": "frag"
-                }
-            },
-            "op": "!=",
-            "right": {
-                "set": [
-                    { "range": [ 33, 55 ] }
-                ]
-            }
-        }
-    }
-]
-
 # frag reserved2 1
 [
     {
@@ -601,44 +521,3 @@
         }
     }
 ]
-
-# frag id { 33-55}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "id",
-                    "name": "frag"
-                }
-            },
-	    "op": "==",
-            "right": {
-                "set": [
-                    { "range": [ 33, 55 ] }
-                ]
-            }
-        }
-    }
-]
-
-# frag id != { 33-55}
-[
-    {
-        "match": {
-            "left": {
-                "exthdr": {
-                    "field": "id",
-                    "name": "frag"
-                }
-            },
-            "op": "!=",
-            "right": {
-                "set": [
-                    { "range": [ 33, 55 ] }
-                ]
-            }
-        }
-    }
-]
-
diff --git a/tests/py/ip6/ip6.t.json b/tests/py/ip6/ip6.t.json
index 49e5a2dd6355a..72d91cc74688d 100644
--- a/tests/py/ip6/ip6.t.json
+++ b/tests/py/ip6/ip6.t.json
@@ -571,46 +571,6 @@
     }
 ]
 
-# ip6 nexthdr { 33-44}
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "nexthdr",
-                    "protocol": "ip6"
-                }
-            },
-	    "op": "==",
-            "right": {
-                "set": [
-                    { "range": [ 33, 44 ] }
-                ]
-            }
-        }
-    }
-]
-
-# ip6 nexthdr != { 33-44}
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "nexthdr",
-                    "protocol": "ip6"
-                }
-            },
-            "op": "!=",
-            "right": {
-                "set": [
-                    { "range": [ 33, 44 ] }
-                ]
-            }
-        }
-    }
-]
-
 # ip6 nexthdr 33-44
 [
     {
-- 
2.49.0

[nft PATCH 03/14] tests: py: Drop stale payload from any/rawpayload.t.payload

[Phil Sutter]

There never was a test corresponding to this payload.

Fixes: 857904bdfaf7a ("tests: py: extend raw payload match tests")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/any/rawpayload.t.payload | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tests/py/any/rawpayload.t.payload b/tests/py/any/rawpayload.t.payload
index c093d5d8932f1..dfc651e2886a9 100644
--- a/tests/py/any/rawpayload.t.payload
+++ b/tests/py/any/rawpayload.t.payload
@@ -111,12 +111,6 @@ inet test-inet input
   [ bitwise reg 1 = ( reg 1 & 0x00000060 ) ^ 0x00000000 ]
   [ cmp eq reg 1 0x00000040 ]
 
-# @ih,2,1 0x1
-inet test-inet input
-  [ payload load 1b @ inner header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x00000020 ) ^ 0x00000000 ]
-  [ cmp eq reg 1 0x00000020 ]
-
 # @ih,35,3 0x2
 inet test-inet input
   [ payload load 1b @ inner header + 4 => reg 1 ]
-- 
2.49.0

[nft PATCH 04/14] tests: py: Drop duplicate test from inet/geneve.t

[Phil Sutter]

The test was duplicate since day 1. The duplicate JSON equivalent was
added later (semi-automated), remove it as well.

Fixes: 2b9143bc7ab81 ("tests: py: add geneve tests")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/inet/geneve.t      |  1 -
 tests/py/inet/geneve.t.json | 29 -----------------------------
 2 files changed, 30 deletions(-)

diff --git a/tests/py/inet/geneve.t b/tests/py/inet/geneve.t
index 101f6dfcdb7e8..ad46272091ad2 100644
--- a/tests/py/inet/geneve.t
+++ b/tests/py/inet/geneve.t
@@ -17,7 +17,6 @@ udp dport 6081 geneve icmp type echo-reply;ok
 udp dport 6081 geneve ether saddr 62:87:4d:d6:19:05;ok
 udp dport 6081 geneve vlan id 10;ok
 udp dport 6081 geneve ip dscp 0x02;ok
-udp dport 6081 geneve ip dscp 0x02;ok
 udp dport 6081 geneve ip saddr . geneve ip daddr { 1.2.3.4 . 4.3.2.1 };ok
 
 udp dport 6081 geneve ip saddr set 1.2.3.4;fail
diff --git a/tests/py/inet/geneve.t.json b/tests/py/inet/geneve.t.json
index a299fcd2d0545..15899180dea36 100644
--- a/tests/py/inet/geneve.t.json
+++ b/tests/py/inet/geneve.t.json
@@ -264,35 +264,6 @@
     }
 ]
 
-# udp dport 6081 geneve ip dscp 0x02
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "dport",
-                    "protocol": "udp"
-                }
-            },
-            "op": "==",
-            "right": 6081
-        }
-    },
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "dscp",
-                    "protocol": "ip",
-                    "tunnel": "geneve"
-                }
-            },
-            "op": "==",
-            "right": 2
-        }
-    }
-]
-
 # udp dport 6081 geneve ip saddr . geneve ip daddr { 1.2.3.4 . 4.3.2.1 }
 [
     {
-- 
2.49.0

[nft PATCH 05/14] tests: py: Drop duplicate test from inet/gre.t

[Phil Sutter]

The test was duplicate since day 1. The duplicate JSON equivalent was
added later (semi-automated), remove it as well.

Fixes: c04ef8d104ec6 ("tests: py: add gre tests")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/inet/gre.t      |  1 -
 tests/py/inet/gre.t.json | 17 -----------------
 2 files changed, 18 deletions(-)

diff --git a/tests/py/inet/gre.t b/tests/py/inet/gre.t
index a3e046a1aea5c..a21e67eab2fd1 100644
--- a/tests/py/inet/gre.t
+++ b/tests/py/inet/gre.t
@@ -16,7 +16,6 @@ gre icmp type echo-reply;ok
 gre ether saddr 62:87:4d:d6:19:05;fail
 gre vlan id 10;fail
 gre ip dscp 0x02;ok
-gre ip dscp 0x02;ok
 gre ip saddr . gre ip daddr { 1.2.3.4 . 4.3.2.1 };ok
 
 gre ip saddr set 1.2.3.4;fail
diff --git a/tests/py/inet/gre.t.json b/tests/py/inet/gre.t.json
index c4431764849f7..a354e6bd4d17c 100644
--- a/tests/py/inet/gre.t.json
+++ b/tests/py/inet/gre.t.json
@@ -121,23 +121,6 @@
     }
 ]
 
-# gre ip dscp 0x02
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "dscp",
-                    "protocol": "ip",
-                    "tunnel": "gre"
-                }
-            },
-            "op": "==",
-            "right": 2
-        }
-    }
-]
-
 # gre ip saddr . gre ip daddr { 1.2.3.4 . 4.3.2.1 }
 [
     {
-- 
2.49.0

[nft PATCH 06/14] tests: py: Drop duplicate test from inet/gretap.t

[Phil Sutter]

The test was duplicate since day 1. The duplicate JSON equivalent was
added later (semi-automated), remove it as well.

Fixes: 39a68d9ffd25c ("tests: py: add gretap tests")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/inet/gretap.t      |  1 -
 tests/py/inet/gretap.t.json | 17 -----------------
 2 files changed, 18 deletions(-)

diff --git a/tests/py/inet/gretap.t b/tests/py/inet/gretap.t
index cd7ee2158edef..f88896fdede7f 100644
--- a/tests/py/inet/gretap.t
+++ b/tests/py/inet/gretap.t
@@ -15,7 +15,6 @@ gretap icmp type echo-reply;ok
 gretap ether saddr 62:87:4d:d6:19:05;ok
 gretap vlan id 10;ok
 gretap ip dscp 0x02;ok
-gretap ip dscp 0x02;ok
 gretap ip saddr . gretap ip daddr { 1.2.3.4 . 4.3.2.1 };ok
 
 gretap ip saddr set 1.2.3.4;fail
diff --git a/tests/py/inet/gretap.t.json b/tests/py/inet/gretap.t.json
index 36fa97825f9a2..6c16a083b8496 100644
--- a/tests/py/inet/gretap.t.json
+++ b/tests/py/inet/gretap.t.json
@@ -139,23 +139,6 @@
     }
 ]
 
-# gretap ip dscp 0x02
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "dscp",
-                    "protocol": "ip",
-                    "tunnel": "gretap"
-                }
-            },
-            "op": "==",
-            "right": 2
-        }
-    }
-]
-
 # gretap ip saddr . gretap ip daddr { 1.2.3.4 . 4.3.2.1 }
 [
     {
-- 
2.49.0

[nft PATCH 07/14] tests: py: Drop stale entry from inet/tcp.t.json

[Phil Sutter]

The test was changed but JSON equivalents not updated. Commit
c0b685951fabb ("json: fix parse of flagcmp expression") then added an
equivalent matching the changed test, so just drop the old one.

Fixes: c3d57114f119b ("parser_bison: add shortcut syntax for matching flags without binary operations")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/inet/tcp.t.json | 31 -------------------------------
 1 file changed, 31 deletions(-)

diff --git a/tests/py/inet/tcp.t.json b/tests/py/inet/tcp.t.json
index 28dd4341f08b5..88c6c59d19d69 100644
--- a/tests/py/inet/tcp.t.json
+++ b/tests/py/inet/tcp.t.json
@@ -910,37 +910,6 @@
     }
 ]
 
-# tcp flags & (syn|fin) == (syn|fin)
-[
-    {
-        "match": {
-            "left": {
-                "&": [
-                    {
-                        "payload": {
-                            "field": "flags",
-                            "protocol": "tcp"
-                        }
-                    },
-                    {
-                        "|": [
-                            "syn",
-                            "fin"
-                        ]
-                    }
-                ]
-            },
-            "op": "==",
-            "right": {
-                "|": [
-                    "syn",
-                    "fin"
-                ]
-            }
-        }
-    }
-]
-
 # tcp flags & (fin | syn | rst | psh | ack | urg | ecn | cwr) == fin | syn | rst | psh | ack | urg | ecn | cwr
 [
     {
-- 
2.49.0

[nft PATCH 08/14] tests: py: Drop duplicate test from inet/vxlan.t

[Phil Sutter]

The test was duplicate since day 1. The duplicate JSON equivalent was
added later (semi-automated), remove it as well.

Fixes: df81baa4c2bef ("tests: py: add vxlan tests")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/inet/vxlan.t      |  1 -
 tests/py/inet/vxlan.t.json | 29 -----------------------------
 2 files changed, 30 deletions(-)

diff --git a/tests/py/inet/vxlan.t b/tests/py/inet/vxlan.t
index 10cdb7a44082e..b6db0fe3be8ca 100644
--- a/tests/py/inet/vxlan.t
+++ b/tests/py/inet/vxlan.t
@@ -17,7 +17,6 @@ udp dport 4789 vxlan icmp type echo-reply;ok
 udp dport 4789 vxlan ether saddr 62:87:4d:d6:19:05;ok
 udp dport 4789 vxlan vlan id 10;ok
 udp dport 4789 vxlan ip dscp 0x02;ok
-udp dport 4789 vxlan ip dscp 0x02;ok
 udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 };ok
 
 udp dport 4789 vxlan ip saddr set 1.2.3.4;fail
diff --git a/tests/py/inet/vxlan.t.json b/tests/py/inet/vxlan.t.json
index 91b3d29458b34..3c147cb36bbcf 100644
--- a/tests/py/inet/vxlan.t.json
+++ b/tests/py/inet/vxlan.t.json
@@ -264,35 +264,6 @@
     }
 ]
 
-# udp dport 4789 vxlan ip dscp 0x02
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "dport",
-                    "protocol": "udp"
-                }
-            },
-            "op": "==",
-            "right": 4789
-        }
-    },
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "dscp",
-                    "protocol": "ip",
-                    "tunnel": "vxlan"
-                }
-            },
-            "op": "==",
-            "right": 2
-        }
-    }
-]
-
 # udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 }
 [
     {
-- 
2.49.0

[nft PATCH 09/14] tests: py: Drop redundant payloads for ip/ip.t

[Phil Sutter]

Each was present multiple times, introduced probably by copying from a
respective .got file.

Fixes: 77def2d43466e ("netlink_delinearize: support for bitfield payload statement with binary operation")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/ip/ip.t.payload.bridge | 261 --------------------------------
 tests/py/ip/ip.t.payload.inet   | 176 ---------------------
 2 files changed, 437 deletions(-)

diff --git a/tests/py/ip/ip.t.payload.bridge b/tests/py/ip/ip.t.payload.bridge
index 94da3e9092d35..663f87d7b4acf 100644
--- a/tests/py/ip/ip.t.payload.bridge
+++ b/tests/py/ip/ip.t.payload.bridge
@@ -829,264 +829,3 @@ bridge test-bridge input
   [ payload load 2b @ network header + 0 => reg 1 ]
   [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
   [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect0
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000200 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000100 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect0
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp | lephb
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fbff ) ^ 0x00000400 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-# ip dscp set ip dscp & lephb
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x000007ff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & 0x1f
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x00007fff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version | 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ffef ) ^ 0x00000010 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version & 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ff1f ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength | 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fffe ) ^ 0x00000001 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength & 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect0
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000200 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000100 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect0
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp | lephb
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fbff ) ^ 0x00000400 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-# ip dscp set ip dscp & lephb
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x000007ff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & 0x1f
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x00007fff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version | 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ffef ) ^ 0x00000010 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version & 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ff1f ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength | 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fffe ) ^ 0x00000001 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength & 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect0
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000200 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000100 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect0
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp | lephb
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fbff ) ^ 0x00000400 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-# ip dscp set ip dscp & lephb
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x000007ff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & 0x1f
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x00007fff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version | 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ffef ) ^ 0x00000010 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version & 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ff1f ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength | 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fffe ) ^ 0x00000001 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength & 1
-bridge test-bridge input
-  [ meta load protocol => reg 1 ]
-  [ cmp eq reg 1 0x00000008 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
index 2004a3ebd1c06..b8ab49c871430 100644
--- a/tests/py/ip/ip.t.payload.inet
+++ b/tests/py/ip/ip.t.payload.inet
@@ -829,179 +829,3 @@ inet test-inet input
   [ payload load 2b @ network header + 0 => reg 1 ]
   [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
   [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect0
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000200 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000100 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect0
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp | lephb
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fbff ) ^ 0x00000400 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & lephb
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x000007ff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & 0x1f
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x00007fff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version | 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ffef ) ^ 0x00000010 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version & 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ff1f ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength | 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fffe ) ^ 0x00000001 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength & 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect0
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000200 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn | ect1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000100 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect0
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000feff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip ecn set ip ecn & ect1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fdff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp | lephb
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fbff ) ^ 0x00000400 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & lephb
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x000007ff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip dscp set ip dscp & 0x1f
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x00007fff ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version | 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ffef ) ^ 0x00000010 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip version set ip version & 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000ff1f ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength | 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fffe ) ^ 0x00000001 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-
-# ip hdrlength set ip hdrlength & 1
-inet test-inet input
-  [ meta load nfproto => reg 1 ]
-  [ cmp eq reg 1 0x00000002 ]
-  [ payload load 2b @ network header + 0 => reg 1 ]
-  [ bitwise reg 1 = ( reg 1 & 0x0000fff1 ) ^ 0x00000000 ]
-  [ payload write reg 1 => 2b @ network header + 0 csum_type 1 csum_off 10 csum_flags 0x0 ]
-- 
2.49.0

[nft PATCH 10/14] tests: py: Drop stale entry from ip/snat.t.json

[Phil Sutter]

The test syntax was changed, but the respective JSON equivalent remained
in place.

Fixes: 9b169bfc650eb ("src: remove STMT_NAT_F_INTERVAL flags and interval keyword")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/ip/snat.t.json | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/tests/py/ip/snat.t.json b/tests/py/ip/snat.t.json
index 967560e636a97..60bd0932f3c09 100644
--- a/tests/py/ip/snat.t.json
+++ b/tests/py/ip/snat.t.json
@@ -283,39 +283,6 @@
     }
 ]
 
-# snat ip interval to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 }
-[
-    {
-        "snat": {
-            "addr": {
-                "map": {
-                    "data": {
-                        "set": [
-                            [
-                                "10.141.11.4",
-                                {
-                                    "range": [
-                                        "192.168.2.2",
-                                        "192.168.2.4"
-                                    ]
-                                }
-                            ]
-                        ]
-                    },
-                    "key": {
-                        "payload": {
-                            "field": "saddr",
-                            "protocol": "ip"
-                        }
-                    }
-                }
-            },
-            "family": "ip",
-            "type_flags": "interval"
-        }
-    }
-]
-
 # snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 }
 [
     {
-- 
2.49.0

[nft PATCH 11/14] tests: py: Drop stale entries from ip6/{ct,meta}.t.json

[Phil Sutter]

Looks like these were added by accident, fixed commit did not add these
test cases.

Fixes: 8221d86e616bd ("tests: py: add test-cases for ct and packet mark payload expressions")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/ip6/ct.t.json   | 164 ---------------------------------------
 tests/py/ip6/meta.t.json |  58 --------------
 2 files changed, 222 deletions(-)

diff --git a/tests/py/ip6/ct.t.json b/tests/py/ip6/ct.t.json
index 2633c2b9433c0..6c1cf33e2dd69 100644
--- a/tests/py/ip6/ct.t.json
+++ b/tests/py/ip6/ct.t.json
@@ -1,167 +1,3 @@
-# ct mark set ip6 dscp lshift 2 or 0x10
-[
-    {
-        "mangle": {
-            "key": {
-                "ct": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "<<": [
-                            {
-                                "payload": {
-                                    "field": "dscp",
-                                    "protocol": "ip6"
-                                }
-                            },
-                            2
-                        ]
-                    },
-                    16
-                ]
-            }
-        }
-    }
-]
-
-# ct mark set ip6 dscp lshift 26 or 0x10
-[
-    {
-        "mangle": {
-            "key": {
-                "ct": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "<<": [
-                            {
-                                "payload": {
-                                    "field": "dscp",
-                                    "protocol": "ip6"
-                                }
-                            },
-                            26
-                        ]
-                    },
-                    16
-                ]
-            }
-        }
-    }
-]
-
-# ct mark set ip6 dscp << 2 | 0x10
-[
-    {
-        "mangle": {
-            "key": {
-                "ct": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "<<": [
-                            {
-                                "payload": {
-                                    "field": "dscp",
-                                    "protocol": "ip6"
-                                }
-                            },
-                            2
-                        ]
-                    },
-                    16
-                ]
-            }
-        }
-    }
-]
-
-# ct mark set ip6 dscp << 26 | 0x10
-[
-    {
-        "mangle": {
-            "key": {
-                "ct": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "<<": [
-                            {
-                                "payload": {
-                                    "field": "dscp",
-                                    "protocol": "ip6"
-                                }
-                            },
-                            26
-                        ]
-                    },
-                    16
-                ]
-            }
-        }
-    }
-]
-
-# ct mark set ip6 dscp | 0x04
-[
-    {
-        "mangle": {
-            "key": {
-                "ct": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "payload": {
-                            "field": "dscp",
-                            "protocol": "ip6"
-                        }
-                    },
-                    4
-                ]
-            }
-        }
-    }
-]
-
-# ct mark set ip6 dscp | 0xff000000
-[
-    {
-        "mangle": {
-            "key": {
-                "ct": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "payload": {
-                            "field": "dscp",
-                            "protocol": "ip6"
-                        }
-                    },
-                    4278190080
-                ]
-            }
-        }
-    }
-]
-
 # ct mark set ip6 dscp << 2 | 0x10
 [
     {
diff --git a/tests/py/ip6/meta.t.json b/tests/py/ip6/meta.t.json
index 1a2394d84ecda..87251f0a61a9d 100644
--- a/tests/py/ip6/meta.t.json
+++ b/tests/py/ip6/meta.t.json
@@ -195,64 +195,6 @@
     }
 ]
 
-# meta mark set ip6 dscp lshift 2 or 0x10
-[
-    {
-        "mangle": {
-            "key": {
-                "meta": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "<<": [
-                            {
-                                "payload": {
-                                    "field": "dscp",
-                                    "protocol": "ip6"
-                                }
-                            },
-                            2
-                        ]
-                    },
-                    16
-                ]
-            }
-        }
-    }
-]
-
-# meta mark set ip6 dscp lshift 26 or 0x10
-[
-    {
-        "mangle": {
-            "key": {
-                "meta": {
-                    "key": "mark"
-                }
-            },
-            "value": {
-                "|": [
-                    {
-                        "<<": [
-                            {
-                                "payload": {
-                                    "field": "dscp",
-                                    "protocol": "ip6"
-                                }
-                            },
-                            26
-                        ]
-                    },
-                    16
-                ]
-            }
-        }
-    }
-]
-
 # meta mark set ip6 dscp << 2 | 0x10
 [
     {
-- 
2.49.0

[nft PATCH 12/14] tests: py: Drop stale entry from ip/snat.t.payload

[Phil Sutter]

This payload actually belongs to ip/dnat.t.payload, fixed commit added
it to the wrong file.

Fixes: 8f3048954d40d ("evaluate: postpone transport protocol match check after nat expression evaluation")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/ip/snat.t.payload | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/tests/py/ip/snat.t.payload b/tests/py/ip/snat.t.payload
index 7044d7b023bb7..ef45489959704 100644
--- a/tests/py/ip/snat.t.payload
+++ b/tests/py/ip/snat.t.payload
@@ -135,17 +135,3 @@ ip
   [ payload load 2b @ transport header + 2 => reg 9 ]
   [ lookup reg 1 set __map%d dreg 1 ]
   [ nat snat ip addr_min reg 1 proto_min reg 9 ]
-
-# ip daddr 192.168.0.1 dnat to tcp dport map { 443 : 10.141.10.4 . 8443, 80 : 10.141.10.4 . 8080 }
-__map%d x b size 2
-__map%d x 0
-        element 0000bb01  : 040a8d0a 0000fb20 0 [end]   element 00005000  : 040a8d0a 0000901f 0 [end]
-ip
-  [ payload load 4b @ network header + 16 => reg 1 ]
-  [ cmp eq reg 1 0x0100a8c0 ]
-  [ meta load l4proto => reg 1 ]
-  [ cmp eq reg 1 0x00000006 ]
-  [ payload load 2b @ transport header + 2 => reg 1 ]
-  [ lookup reg 1 set __map%d dreg 1 ]
-  [ nat dnat ip addr_min reg 1 proto_min reg 9 ]
-
-- 
2.49.0

[nft PATCH 13/14] tests: py: Fix tests added for 'icmpv6 taddr' support

[Phil Sutter]

There was a duplicate test, also stored JSON equivalents should match
input as much as possible. The expected deviation in output (just like
with standard syntax) is stored in the .json.output file instead.

Fixes: 2e86f45d0260a ("icmpv6: Allow matching target address in NS/NA, redirect and MLD")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 tests/py/ip6/icmpv6.t             |  2 --
 tests/py/ip6/icmpv6.t.json        | 58 -------------------------------
 tests/py/ip6/icmpv6.t.json.output | 36 +++++++++++++++++++
 3 files changed, 36 insertions(+), 60 deletions(-)

diff --git a/tests/py/ip6/icmpv6.t b/tests/py/ip6/icmpv6.t
index 7632bfd878f47..5108b427a60a5 100644
--- a/tests/py/ip6/icmpv6.t
+++ b/tests/py/ip6/icmpv6.t
@@ -91,8 +91,6 @@ icmpv6 type nd-neighbor-solicit icmpv6 taddr 2001:db8::133;ok
 icmpv6 type nd-neighbor-advert icmpv6 taddr 2001:db8::133;ok
 icmpv6 taddr 2001:db8::133;ok;icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect} icmpv6 taddr 2001:db8::133
 
-icmpv6 taddr 2001:db8::133;ok;icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect} icmpv6 taddr 2001:db8::133
-
 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect} icmpv6 taddr 2001:db8::133;ok
 icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } icmpv6 taddr 2001:db8::133;ok
 icmpv6 daddr 2001:db8::133;ok
diff --git a/tests/py/ip6/icmpv6.t.json b/tests/py/ip6/icmpv6.t.json
index 9df886dd22772..5c36aabaaaee5 100644
--- a/tests/py/ip6/icmpv6.t.json
+++ b/tests/py/ip6/icmpv6.t.json
@@ -1250,64 +1250,6 @@
 
 # icmpv6 taddr 2001:db8::133
 [
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "type",
-                    "protocol": "icmpv6"
-                }
-            },
-            "op": "==",
-            "right": {
-                "set": [
-                    "mld-listener-query",
-                    "mld-listener-report",
-                    "mld-listener-done",
-                    "nd-neighbor-solicit",
-                    "nd-neighbor-advert",
-                    "nd-redirect"
-                ]
-            }
-        }
-    },
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "taddr",
-                    "protocol": "icmpv6"
-                }
-            },
-            "op": "==",
-            "right": "2001:db8::133"
-        }
-    }
-]
-
-# icmpv6 taddr 2001:db8::133
-[
-    {
-        "match": {
-            "left": {
-                "payload": {
-                    "field": "type",
-                    "protocol": "icmpv6"
-                }
-            },
-            "op": "==",
-            "right": {
-                "set": [
-                    "mld-listener-query",
-                    "mld-listener-report",
-                    "mld-listener-done",
-                    "nd-neighbor-solicit",
-                    "nd-neighbor-advert",
-                    "nd-redirect"
-                ]
-            }
-        }
-    },
     {
         "match": {
             "left": {
diff --git a/tests/py/ip6/icmpv6.t.json.output b/tests/py/ip6/icmpv6.t.json.output
index 5d33780ee82ba..568bdb533910a 100644
--- a/tests/py/ip6/icmpv6.t.json.output
+++ b/tests/py/ip6/icmpv6.t.json.output
@@ -696,3 +696,39 @@
     }
 ]
 
+# icmpv6 taddr 2001:db8::133
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "type",
+                    "protocol": "icmpv6"
+                }
+            },
+            "op": "==",
+            "right": {
+                "set": [
+                    "mld-listener-query",
+                    "mld-listener-report",
+                    "mld-listener-done",
+                    "nd-neighbor-solicit",
+                    "nd-neighbor-advert",
+                    "nd-redirect"
+                ]
+            }
+        }
+    },
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "taddr",
+                    "protocol": "icmpv6"
+                }
+            },
+            "op": "==",
+            "right": "2001:db8::133"
+        }
+    }
+]
-- 
2.49.0

[nft PATCH 14/14] json: Do not reduce single-item arrays on output

[Phil Sutter]

This is a partial revert of commit a740f2036ad0d ("json: Introduce
json_add_array_new()"), keeping the function but eliminating its primary
task which is to replace arrays of size 1 by their only item. While
support for this on input is convenient for users, it means extra casing
in JSON output parsers to cover for it. The minor reduction in output
size does not justify that.

Fixes: a740f2036ad0d ("json: Introduce json_add_array_new()")
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1806
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/json.c                                    |   8 +-
 tests/py/any/log.t.json.output                |  15 ++-
 tests/py/any/queue.t.json.output              | 117 +++++++++++++++++
 tests/py/inet/fib.t.json                      |   8 +-
 tests/py/inet/fib.t.json.output               |  87 ++++++++++++-
 tests/py/inet/snat.t.json.output              |  22 ++++
 tests/py/inet/synproxy.t.json                 |   8 +-
 tests/py/inet/synproxy.t.json.output          |   8 +-
 tests/py/ip/masquerade.t.json.output          |  46 +++++++
 tests/py/ip/redirect.t.json.output            | 118 ++++++++++++++++++
 tests/py/ip/snat.t.json.output                |   8 +-
 tests/py/ip6/masquerade.t.json.output         |  46 +++++++
 tests/py/ip6/redirect.t.json.output           |  70 +++++++++++
 .../cache/dumps/0002_interval_0.json-nft      |   4 +-
 .../netdev_chain_dormant_autoremove.json-nft  |   4 +-
 .../json/dumps/0001set_statements_0.json-nft  |   4 +-
 tests/shell/testcases/json/single_flag        |  48 +++----
 .../listing/dumps/0010sets_0.json-nft         |   8 +-
 .../listing/dumps/0012sets_0.json-nft         |   8 +-
 .../listing/dumps/0022terse_0.json-nft        |   4 +-
 ...5interval_map_add_many_elements_0.json-nft |   4 +-
 .../dumps/0006interval_map_overlap_0.json-nft |   4 +-
 .../dumps/0008interval_map_delete_0.json-nft  |   4 +-
 .../maps/dumps/0012map_concat_0.json-nft      |   4 +-
 .../testcases/maps/dumps/0013map_0.json-nft   |   4 +-
 .../maps/dumps/delete_element.json-nft        |   4 +-
 .../dumps/delete_element_catchall.json-nft    |   4 +-
 .../maps/dumps/map_with_flags_0.json-nft      |   4 +-
 .../maps/dumps/named_ct_objects.json-nft      |   8 +-
 .../maps/dumps/named_limits.json-nft          |   8 +-
 .../maps/dumps/pipapo_double_flush.json-nft   |   4 +-
 .../maps/dumps/typeof_integer_0.json-nft      |   4 +-
 .../dumps/typeof_maps_add_delete.json-nft     |   4 +-
 .../maps/dumps/typeof_maps_update_0.json-nft  |   8 +-
 .../maps/dumps/vmap_timeout.json-nft          |   8 +-
 .../testcases/maps/dumps/vmap_unary.json-nft  |   4 +-
 .../dumps/0012different_defines_0.json-nft    |   8 +-
 .../nft-f/dumps/0025empty_dynset_0.json-nft   |  12 +-
 .../testcases/nft-i/dumps/set_0.json-nft      |   4 +-
 .../optimizations/dumps/merge_vmaps.json-nft  |   4 +-
 .../dumps/skip_unsupported.json-nft           |   4 +-
 .../packetpath/dumps/set_lookups.json-nft     |   8 +-
 .../dumps/0004replace_0.json-nft              |   4 +-
 .../dumps/0011reset_0.json-nft                |   4 +-
 .../sets/dumps/0001named_interval_0.json-nft  |  16 ++-
 .../0002named_interval_automerging_0.json-nft |   4 +-
 .../0004named_interval_shadow_0.json-nft      |   4 +-
 .../0005named_interval_shadow_0.json-nft      |   4 +-
 .../dumps/0008comments_interval_0.json-nft    |   4 +-
 .../dumps/0009comments_timeout_0.json-nft     |   4 +-
 .../sets/dumps/0015rulesetflush_0.json-nft    |   4 +-
 .../dumps/0022type_selective_flush_0.json-nft |   4 +-
 .../sets/dumps/0024synproxy_0.json-nft        |   4 +-
 .../sets/dumps/0027ipv6_maps_ipv4_0.json-nft  |   4 +-
 .../sets/dumps/0028autoselect_0.json-nft      |  12 +-
 .../sets/dumps/0028delete_handle_0.json-nft   |   4 +-
 .../dumps/0032restore_set_simple_0.json-nft   |   8 +-
 .../dumps/0033add_set_simple_flat_0.json-nft  |   8 +-
 .../sets/dumps/0034get_element_0.json-nft     |  12 +-
 .../0035add_set_elements_flat_0.json-nft      |   4 +-
 .../sets/dumps/0038meter_list_0.json-nft      |   4 +-
 .../sets/dumps/0039delete_interval_0.json-nft |   4 +-
 .../0040get_host_endian_elements_0.json-nft   |   4 +-
 .../sets/dumps/0041interval_0.json-nft        |   4 +-
 .../sets/dumps/0042update_set_0.json-nft      |   4 +-
 .../dumps/0043concatenated_ranges_1.json-nft  |   8 +-
 .../dumps/0044interval_overlap_1.json-nft     |   4 +-
 .../sets/dumps/0046netmap_0.json-nft          |  16 ++-
 .../sets/dumps/0049set_define_0.json-nft      |   4 +-
 .../dumps/0051set_interval_counter_0.json-nft |   4 +-
 .../sets/dumps/0052overlap_0.json-nft         |   4 +-
 .../sets/dumps/0054comments_set_0.json-nft    |   8 +-
 .../sets/dumps/0055tcpflags_0.json-nft        |   4 +-
 .../sets/dumps/0060set_multistmt_1.json-nft   |   4 +-
 .../sets/dumps/0062set_connlimit_0.json-nft   |   8 +-
 .../sets/dumps/0063set_catchall_0.json-nft    |   4 +-
 .../sets/dumps/0064map_catchall_0.json-nft    |   4 +-
 .../sets/dumps/0069interval_merge_0.json-nft  |   4 +-
 .../0071unclosed_prefix_interval_0.json-nft   |   8 +-
 .../sets/dumps/0073flat_interval_set.json-nft |   4 +-
 .../dumps/0074nested_interval_set.json-nft    |   4 +-
 .../sets/dumps/concat_interval_0.json-nft     |   8 +-
 .../sets/dumps/concat_nlmsg_overrun.json-nft  |   4 +-
 .../sets/dumps/dynset_missing.json-nft        |   4 +-
 .../sets/dumps/exact_overlap_0.json-nft       |   4 +-
 .../testcases/sets/dumps/inner_0.json-nft     |   4 +-
 .../sets/dumps/interval_size.json-nft         |   8 +-
 .../sets/dumps/meter_set_reuse.json-nft       |   4 +-
 .../dumps/range_with_same_start_end.json-nft  |   4 +-
 .../set_element_timeout_updates.json-nft      |   4 +-
 .../testcases/sets/dumps/set_eval_0.json-nft  |   4 +-
 .../sets/dumps/sets_with_ifnames.json-nft     |  12 +-
 .../sets/dumps/typeof_sets_concat.json-nft    |   4 +-
 .../transactions/dumps/0002table_0.json-nft   |   4 +-
 .../transactions/dumps/0037set_0.json-nft     |   4 +-
 .../transactions/dumps/0038set_0.json-nft     |   4 +-
 .../transactions/dumps/0039set_0.json-nft     |   4 +-
 .../transactions/dumps/0047set_0.json-nft     |   4 +-
 .../transactions/dumps/doubled-set.json-nft   |   4 +-
 .../transactions/dumps/table_onoff.json-nft   |   4 +-
 100 files changed, 908 insertions(+), 165 deletions(-)
 create mode 100644 tests/py/inet/snat.t.json.output

diff --git a/src/json.c b/src/json.c
index 977f55667fc20..4c8b4f347627b 100644
--- a/src/json.c
+++ b/src/json.c
@@ -62,14 +62,10 @@ static int json_array_extend_new(json_t *array, json_t *other_array)
 
 static void json_add_array_new(json_t *obj, const char *name, json_t *array)
 {
-	if (json_array_size(array) > 1) {
+	if (json_array_size(array))
 		json_object_set_new(obj, name, array);
-	} else {
-		if (json_array_size(array))
-			json_object_set(obj, name,
-					json_array_get(array, 0));
+	else
 		json_decref(array);
-	}
 }
 
 static json_t *expr_print_json(const struct expr *expr, struct output_ctx *octx)
diff --git a/tests/py/any/log.t.json.output b/tests/py/any/log.t.json.output
index 051c448b6fc75..bec70a3507b80 100644
--- a/tests/py/any/log.t.json.output
+++ b/tests/py/any/log.t.json.output
@@ -9,7 +9,20 @@
 [
     {
         "log": {
-            "flags": "all"
+            "flags": [
+                "all"
+            ]
+        }
+    }
+]
+
+# log flags all
+[
+    {
+        "log": {
+            "flags": [
+                "all"
+            ]
         }
     }
 ]
diff --git a/tests/py/any/queue.t.json.output b/tests/py/any/queue.t.json.output
index 1104d7602ba95..ea3722383f113 100644
--- a/tests/py/any/queue.t.json.output
+++ b/tests/py/any/queue.t.json.output
@@ -7,3 +7,120 @@
     }
 ]
 
+# queue num 4-5 fanout
+[
+    {
+        "queue": {
+            "flags": [
+                "fanout"
+            ],
+            "num": {
+                "range": [
+                    4,
+                    5
+                ]
+            }
+        }
+    }
+]
+
+# queue num 4-5 bypass
+[
+    {
+        "queue": {
+            "flags": [
+                "bypass"
+            ],
+            "num": {
+                "range": [
+                    4,
+                    5
+                ]
+            }
+        }
+    }
+]
+
+# queue flags bypass to numgen inc mod 65536
+[
+    {
+        "queue": {
+            "flags": [
+                "bypass"
+            ],
+            "num": {
+                "numgen": {
+                    "mod": 65536,
+                    "mode": "inc",
+                    "offset": 0
+                }
+            }
+        }
+    }
+]
+
+# queue flags bypass to 65535
+[
+    {
+        "queue": {
+            "flags": [
+                "bypass"
+            ],
+            "num": 65535
+        }
+    }
+]
+
+# queue flags bypass to 1-65535
+[
+    {
+        "queue": {
+            "flags": [
+                "bypass"
+            ],
+            "num": {
+                "range": [
+                    1,
+                    65535
+                ]
+            }
+        }
+    }
+]
+
+# queue flags bypass to oifname map { "eth0" : 0, "ppp0" : 2, "eth1" : 2 }
+[
+    {
+        "queue": {
+            "flags": [
+                "bypass"
+            ],
+            "num": {
+                "map": {
+                    "data": {
+                        "set": [
+                            [
+                                "eth0",
+                                0
+                            ],
+                            [
+                                "ppp0",
+                                2
+                            ],
+                            [
+                                "eth1",
+                                2
+                            ]
+                        ]
+                    },
+                    "key": {
+                        "meta": {
+                            "key": "oifname"
+                        }
+                    }
+                }
+            }
+        }
+    }
+]
+
diff --git a/tests/py/inet/fib.t.json b/tests/py/inet/fib.t.json
index 14a6249ad9b2a..2bfe4f70b8392 100644
--- a/tests/py/inet/fib.t.json
+++ b/tests/py/inet/fib.t.json
@@ -100,9 +100,7 @@
         "match": {
             "left": {
                 "fib": {
-                    "flags": [
-                        "daddr"
-                    ],
+                    "flags": "daddr",
                     "result": "check"
                 }
             },
@@ -118,9 +116,7 @@
         "match": {
             "left": {
                 "fib": {
-                    "flags": [
-                        "daddr"
-                    ],
+                    "flags": "daddr",
                     "result": "check"
                 }
             },
diff --git a/tests/py/inet/fib.t.json.output b/tests/py/inet/fib.t.json.output
index e8d016698b93a..d3396dd26daf3 100644
--- a/tests/py/inet/fib.t.json.output
+++ b/tests/py/inet/fib.t.json.output
@@ -43,7 +43,9 @@
         "match": {
             "left": {
                 "fib": {
-                    "flags": "daddr",
+                    "flags": [
+                        "daddr"
+                    ],
                     "result": "check"
                 }
             },
@@ -59,7 +61,9 @@
         "match": {
             "left": {
                 "fib": {
-                    "flags": "daddr",
+                    "flags": [
+                        "daddr"
+                    ],
                     "result": "check"
                 }
             },
@@ -69,3 +73,82 @@
     }
 ]
 
+# fib daddr check vmap { missing : drop, exists : accept }
+[
+    {
+        "vmap": {
+            "data": {
+                "set": [
+                    [
+                        false,
+                        {
+                            "drop": null
+                        }
+                    ],
+                    [
+                        true,
+                        {
+                            "accept": null
+                        }
+                    ]
+                ]
+            },
+            "key": {
+                "fib": {
+                    "flags": [
+                        "daddr"
+                    ],
+                    "result": "check"
+                }
+            }
+        }
+    }
+]
+
+# meta mark set fib daddr check . ct mark map { exists . 0x00000000 : 0x00000001 }
+[
+    {
+        "mangle": {
+            "key": {
+                "meta": {
+                    "key": "mark"
+                }
+            },
+            "value": {
+                "map": {
+                    "data": {
+                        "set": [
+                            [
+                                {
+                                    "concat": [
+                                        true,
+                                        0
+                                    ]
+                                },
+                                1
+                            ]
+                        ]
+                    },
+                    "key": {
+                        "concat": [
+                            {
+                                "fib": {
+                                    "flags": [
+                                        "daddr"
+                                    ],
+                                    "result": "check"
+                                }
+                            },
+                            {
+                                "ct": {
+                                    "key": "mark"
+                                }
+                            }
+                        ]
+                    }
+                }
+            }
+        }
+    }
+]
+
diff --git a/tests/py/inet/snat.t.json.output b/tests/py/inet/snat.t.json.output
new file mode 100644
index 0000000000000..5b9588606c5c3
--- /dev/null
+++ b/tests/py/inet/snat.t.json.output
@@ -0,0 +1,22 @@
+# iifname "foo" masquerade random
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "iifname"
+                }
+            },
+            "op": "==",
+            "right": "foo"
+        }
+    },
+    {
+        "masquerade": {
+            "flags": [
+                "random"
+            ]
+        }
+    }
+]
+
diff --git a/tests/py/inet/synproxy.t.json b/tests/py/inet/synproxy.t.json
index 1dd85a6144db6..b3cec09496d81 100644
--- a/tests/py/inet/synproxy.t.json
+++ b/tests/py/inet/synproxy.t.json
@@ -19,9 +19,7 @@
 [
     {
         "synproxy": {
-            "flags": [
-                "timestamp"
-            ]
+            "flags": "timestamp"
         }
     }
 ]
@@ -56,9 +54,7 @@
 [
     {
         "synproxy": {
-            "flags": [
-                "sack-perm"
-            ]
+            "flags": "sack-perm"
         }
     }
 ]
diff --git a/tests/py/inet/synproxy.t.json.output b/tests/py/inet/synproxy.t.json.output
index e32cdfb885e1b..a1d81bfec92e3 100644
--- a/tests/py/inet/synproxy.t.json.output
+++ b/tests/py/inet/synproxy.t.json.output
@@ -2,7 +2,9 @@
 [
     {
         "synproxy": {
-            "flags": "timestamp"
+            "flags": [
+                "timestamp"
+            ]
         }
     }
 ]
@@ -11,7 +13,9 @@
 [
     {
         "synproxy": {
-            "flags": "sack-perm"
+            "flags": [
+                "sack-perm"
+            ]
         }
     }
 ]
diff --git a/tests/py/ip/masquerade.t.json.output b/tests/py/ip/masquerade.t.json.output
index 58e7e290a1e79..8ca5a426d200a 100644
--- a/tests/py/ip/masquerade.t.json.output
+++ b/tests/py/ip/masquerade.t.json.output
@@ -121,3 +121,49 @@
     }
 ]
 
+# udp dport 53 masquerade random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "masquerade": {
+            "flags": [
+                "random"
+            ]
+        }
+    }
+]
+
+# udp dport 53 masquerade persistent
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "masquerade": {
+            "flags": [
+                "persistent"
+            ]
+        }
+    }
+]
+
diff --git a/tests/py/ip/redirect.t.json.output b/tests/py/ip/redirect.t.json.output
index 4646c60a81d89..09f1e48d26c55 100644
--- a/tests/py/ip/redirect.t.json.output
+++ b/tests/py/ip/redirect.t.json.output
@@ -1,3 +1,49 @@
+# udp dport 53 redirect random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "random"
+            ]
+        }
+    }
+]
+
+# udp dport 53 redirect persistent
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "persistent"
+            ]
+        }
+    }
+]
+
 # udp dport 53 redirect random,persistent,fully-random
 [
     {
@@ -144,3 +190,75 @@
     }
 ]
 
+# tcp dport 9128 redirect to :993 random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "tcp"
+                }
+            },
+            "op": "==",
+            "right": 9128
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "random"
+            ],
+            "port": 993
+        }
+    }
+]
+
+# tcp dport 9128 redirect to :993 fully-random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "tcp"
+                }
+            },
+            "op": "==",
+            "right": 9128
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "fully-random"
+            ],
+            "port": 993
+        }
+    }
+]
+
+# tcp dport 9128 redirect to :123 persistent
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "tcp"
+                }
+            },
+            "op": "==",
+            "right": 9128
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "persistent"
+            ],
+            "port": 123
+        }
+    }
+]
+
diff --git a/tests/py/ip/snat.t.json.output b/tests/py/ip/snat.t.json.output
index 2a99780131d96..19eba25652015 100644
--- a/tests/py/ip/snat.t.json.output
+++ b/tests/py/ip/snat.t.json.output
@@ -241,8 +241,12 @@
                 }
             },
             "family": "ip",
-            "flags": "netmap",
-            "type_flags": "prefix"
+            "flags": [
+                "netmap"
+            ],
+            "type_flags": [
+                "prefix"
+            ]
         }
     }
 ]
diff --git a/tests/py/ip6/masquerade.t.json.output b/tests/py/ip6/masquerade.t.json.output
index 31d0cd9a7e4b5..21ed4f63d1dbd 100644
--- a/tests/py/ip6/masquerade.t.json.output
+++ b/tests/py/ip6/masquerade.t.json.output
@@ -96,3 +96,49 @@
     }
 ]
 
+# udp dport 53 masquerade random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "masquerade": {
+            "flags": [
+                "random"
+            ]
+        }
+    }
+]
+
+# udp dport 53 masquerade persistent
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "masquerade": {
+            "flags": [
+                "persistent"
+            ]
+        }
+    }
+]
+
diff --git a/tests/py/ip6/redirect.t.json.output b/tests/py/ip6/redirect.t.json.output
index 0174cc7d7b916..69c7b03d6c051 100644
--- a/tests/py/ip6/redirect.t.json.output
+++ b/tests/py/ip6/redirect.t.json.output
@@ -144,3 +144,73 @@
     }
 ]
 
+# udp dport 53 redirect random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "random"
+            ]
+        }
+    }
+]
+
+# udp dport 53 redirect persistent
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "udp"
+                }
+            },
+            "op": "==",
+            "right": 53
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "persistent"
+            ]
+        }
+    }
+]
+
+# tcp dport 9128 redirect to :993 random
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "dport",
+                    "protocol": "tcp"
+                }
+            },
+            "op": "==",
+            "right": 9128
+        }
+    },
+    {
+        "redirect": {
+            "flags": [
+                "random"
+            ],
+            "port": 993
+        }
+    }
+]
+
diff --git a/tests/shell/testcases/cache/dumps/0002_interval_0.json-nft b/tests/shell/testcases/cache/dumps/0002_interval_0.json-nft
index 5e2b9b420b6db..fa15d658dcd5c 100644
--- a/tests/shell/testcases/cache/dumps/0002_interval_0.json-nft
+++ b/tests/shell/testcases/cache/dumps/0002_interval_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/chains/dumps/netdev_chain_dormant_autoremove.json-nft b/tests/shell/testcases/chains/dumps/netdev_chain_dormant_autoremove.json-nft
index 9151d42f17d91..7f1c76c965954 100644
--- a/tests/shell/testcases/chains/dumps/netdev_chain_dormant_autoremove.json-nft
+++ b/tests/shell/testcases/chains/dumps/netdev_chain_dormant_autoremove.json-nft
@@ -12,7 +12,9 @@
         "family": "netdev",
         "name": "test",
         "handle": 0,
-        "flags": "dormant"
+        "flags": [
+          "dormant"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/json/dumps/0001set_statements_0.json-nft b/tests/shell/testcases/json/dumps/0001set_statements_0.json-nft
index ecc7eade91a60..91db43e29ea9f 100644
--- a/tests/shell/testcases/json/dumps/0001set_statements_0.json-nft
+++ b/tests/shell/testcases/json/dumps/0001set_statements_0.json-nft
@@ -34,7 +34,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/json/single_flag b/tests/shell/testcases/json/single_flag
index f0a608ad84120..1d70f249a5716 100755
--- a/tests/shell/testcases/json/single_flag
+++ b/tests/shell/testcases/json/single_flag
@@ -47,10 +47,10 @@ JSON_TABLE_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0,
 JSON_TABLE_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_TABLE_1")
 
 STD_TABLE_2=$(sed 's/\(flags dormant\)/\1,persist/' <<< "$STD_TABLE_1")
-JSON_TABLE_2=$(sed 's/\("flags":\) \("dormant"\)/\1 [\2, "persist"]/' <<< "$JSON_TABLE_1")
+JSON_TABLE_2=$(sed 's/\("dormant"\)/\1, "persist"/' <<< "$JSON_TABLE_1_EQUIV")
 
-back_n_forth "$STD_TABLE_1" "$JSON_TABLE_1"
-json_equiv "$JSON_TABLE_1_EQUIV" "$JSON_TABLE_1"
+back_n_forth "$STD_TABLE_1" "$JSON_TABLE_1_EQUIV"
+json_equiv "$JSON_TABLE_1" "$JSON_TABLE_1_EQUIV"
 back_n_forth "$STD_TABLE_2" "$JSON_TABLE_2"
 
 #
@@ -67,10 +67,10 @@ JSON_SET_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}},
 JSON_SET_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_SET_1")
 
 STD_SET_2=$(sed 's/\(flags interval\)/\1,timeout/' <<< "$STD_SET_1")
-JSON_SET_2=$(sed 's/\("flags":\) \("interval"\)/\1 [\2, "timeout"]/' <<< "$JSON_SET_1")
+JSON_SET_2=$(sed 's/\("interval"\)/\1, "timeout"/' <<< "$JSON_SET_1_EQUIV")
 
-back_n_forth "$STD_SET_1" "$JSON_SET_1"
-json_equiv "$JSON_SET_1_EQUIV" "$JSON_SET_1"
+back_n_forth "$STD_SET_1" "$JSON_SET_1_EQUIV"
+json_equiv "$JSON_SET_1" "$JSON_SET_1_EQUIV"
 back_n_forth "$STD_SET_2" "$JSON_SET_2"
 
 #
@@ -86,10 +86,10 @@ JSON_FIB_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}},
 JSON_FIB_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_FIB_1")
 
 STD_FIB_2=$(sed 's/\(fib saddr\)/\1 . iif/' <<< "$STD_FIB_1")
-JSON_FIB_2=$(sed 's/\("flags":\) \("saddr"\)/\1 [\2, "iif"]/' <<< "$JSON_FIB_1")
+JSON_FIB_2=$(sed 's/\("saddr"\)/\1, "iif"/' <<< "$JSON_FIB_1_EQUIV")
 
-back_n_forth "$STD_FIB_1" "$JSON_FIB_1"
-json_equiv "$JSON_FIB_1_EQUIV" "$JSON_FIB_1"
+back_n_forth "$STD_FIB_1" "$JSON_FIB_1_EQUIV"
+json_equiv "$JSON_FIB_1" "$JSON_FIB_1_EQUIV"
 back_n_forth "$STD_FIB_2" "$JSON_FIB_2"
 
 #
@@ -105,10 +105,10 @@ JSON_NAT_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}},
 JSON_NAT_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_NAT_1")
 
 STD_NAT_2=$(sed 's/\(persistent\)/random,\1/' <<< "$STD_NAT_1")
-JSON_NAT_2=$(sed 's/\("flags":\) \("persistent"\)/\1 ["random", \2]/' <<< "$JSON_NAT_1")
+JSON_NAT_2=$(sed 's/\("persistent"\)/"random", \1/' <<< "$JSON_NAT_1_EQUIV")
 
-back_n_forth "$STD_NAT_1" "$JSON_NAT_1"
-json_equiv "$JSON_NAT_1_EQUIV" "$JSON_NAT_1"
+back_n_forth "$STD_NAT_1" "$JSON_NAT_1_EQUIV"
+json_equiv "$JSON_NAT_1" "$JSON_NAT_1_EQUIV"
 back_n_forth "$STD_NAT_2" "$JSON_NAT_2"
 
 #
@@ -124,10 +124,10 @@ JSON_LOG_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}},
 JSON_LOG_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_LOG_1")
 
 STD_LOG_2=$(sed 's/\(tcp sequence\)/\1,options/' <<< "$STD_LOG_1")
-JSON_LOG_2=$(sed 's/\("flags":\) \("tcp sequence"\)/\1 [\2, "tcp options"]/' <<< "$JSON_LOG_1")
+JSON_LOG_2=$(sed 's/\("tcp sequence"\)/\1, "tcp options"/' <<< "$JSON_LOG_1_EQUIV")
 
-back_n_forth "$STD_LOG_1" "$JSON_LOG_1"
-json_equiv "$JSON_LOG_1_EQUIV" "$JSON_LOG_1"
+back_n_forth "$STD_LOG_1" "$JSON_LOG_1_EQUIV"
+json_equiv "$JSON_LOG_1" "$JSON_LOG_1_EQUIV"
 back_n_forth "$STD_LOG_2" "$JSON_LOG_2"
 
 #
@@ -143,10 +143,10 @@ JSON_SYNPROXY_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle":
 JSON_SYNPROXY_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_SYNPROXY_1")
 
 STD_SYNPROXY_2=$(sed 's/\(sack-perm\)/timestamp \1/' <<< "$STD_SYNPROXY_1")
-JSON_SYNPROXY_2=$(sed 's/\("flags":\) \("sack-perm"\)/\1 ["timestamp", \2]/' <<< "$JSON_SYNPROXY_1")
+JSON_SYNPROXY_2=$(sed 's/\("sack-perm"\)/"timestamp", \1/' <<< "$JSON_SYNPROXY_1_EQUIV")
 
-back_n_forth "$STD_SYNPROXY_1" "$JSON_SYNPROXY_1"
-json_equiv "$JSON_SYNPROXY_1_EQUIV" "$JSON_SYNPROXY_1"
+back_n_forth "$STD_SYNPROXY_1" "$JSON_SYNPROXY_1_EQUIV"
+json_equiv "$JSON_SYNPROXY_1" "$JSON_SYNPROXY_1_EQUIV"
 back_n_forth "$STD_SYNPROXY_2" "$JSON_SYNPROXY_2"
 
 #
@@ -164,10 +164,10 @@ JSON_SYNPROXY_OBJ_1='{"nftables": [{"table": {"family": "ip", "name": "t", "hand
 JSON_SYNPROXY_OBJ_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_SYNPROXY_OBJ_1")
 
 STD_SYNPROXY_OBJ_2=$(sed 's/ \(sack-perm\)/timestamp \1/' <<< "$STD_SYNPROXY_OBJ_1")
-JSON_SYNPROXY_OBJ_2=$(sed 's/\("flags":\) \("sack-perm"\)/\1 ["timestamp", \2]/' <<< "$JSON_SYNPROXY_OBJ_1")
+JSON_SYNPROXY_OBJ_2=$(sed 's/\("sack-perm"\)/"timestamp", \1/' <<< "$JSON_SYNPROXY_OBJ_1_EQUIV")
 
-back_n_forth "$STD_SYNPROXY_OBJ_1" "$JSON_SYNPROXY_OBJ_1"
-json_equiv "$JSON_SYNPROXY_OBJ_1_EQUIV" "$JSON_SYNPROXY_OBJ_1"
+back_n_forth "$STD_SYNPROXY_OBJ_1" "$JSON_SYNPROXY_OBJ_1_EQUIV"
+json_equiv "$JSON_SYNPROXY_OBJ_1" "$JSON_SYNPROXY_OBJ_1_EQUIV"
 back_n_forth "$STD_SYNPROXY_OBJ_2" "$JSON_SYNPROXY_OBJ_2"
 
 #
@@ -183,8 +183,8 @@ JSON_QUEUE_1='{"nftables": [{"table": {"family": "ip", "name": "t", "handle": 0}
 JSON_QUEUE_1_EQUIV=$(sed 's/\("flags":\) \([^}]*\)/\1 [\2]/' <<< "$JSON_QUEUE_1")
 
 STD_QUEUE_2=$(sed 's/\(bypass\)/\1,fanout/' <<< "$STD_QUEUE_1")
-JSON_QUEUE_2=$(sed 's/\("flags":\) \("bypass"\)/\1 [\2, "fanout"]/' <<< "$JSON_QUEUE_1")
+JSON_QUEUE_2=$(sed 's/\("bypass"\)/\1, "fanout"/' <<< "$JSON_QUEUE_1_EQUIV")
 
-back_n_forth "$STD_QUEUE_1" "$JSON_QUEUE_1"
-json_equiv "$JSON_QUEUE_1_EQUIV" "$JSON_QUEUE_1"
+back_n_forth "$STD_QUEUE_1" "$JSON_QUEUE_1_EQUIV"
+json_equiv "$JSON_QUEUE_1" "$JSON_QUEUE_1_EQUIV"
 back_n_forth "$STD_QUEUE_2" "$JSON_QUEUE_2"
diff --git a/tests/shell/testcases/listing/dumps/0010sets_0.json-nft b/tests/shell/testcases/listing/dumps/0010sets_0.json-nft
index 6aa99b4e16d24..efca892e3667b 100644
--- a/tests/shell/testcases/listing/dumps/0010sets_0.json-nft
+++ b/tests/shell/testcases/listing/dumps/0010sets_0.json-nft
@@ -62,7 +62,9 @@
         "table": "test_arp",
         "type": "inet_service",
         "handle": 0,
-        "flags": "constant"
+        "flags": [
+          "constant"
+        ]
       }
     },
     {
@@ -104,7 +106,9 @@
         "table": "filter",
         "type": "inet_service",
         "handle": 0,
-        "flags": "constant"
+        "flags": [
+          "constant"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/listing/dumps/0012sets_0.json-nft b/tests/shell/testcases/listing/dumps/0012sets_0.json-nft
index 6aa99b4e16d24..efca892e3667b 100644
--- a/tests/shell/testcases/listing/dumps/0012sets_0.json-nft
+++ b/tests/shell/testcases/listing/dumps/0012sets_0.json-nft
@@ -62,7 +62,9 @@
         "table": "test_arp",
         "type": "inet_service",
         "handle": 0,
-        "flags": "constant"
+        "flags": [
+          "constant"
+        ]
       }
     },
     {
@@ -104,7 +106,9 @@
         "table": "filter",
         "type": "inet_service",
         "handle": 0,
-        "flags": "constant"
+        "flags": [
+          "constant"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/listing/dumps/0022terse_0.json-nft b/tests/shell/testcases/listing/dumps/0022terse_0.json-nft
index 1a33d6888033b..bd6383dac5e37 100644
--- a/tests/shell/testcases/listing/dumps/0022terse_0.json-nft
+++ b/tests/shell/testcases/listing/dumps/0022terse_0.json-nft
@@ -33,7 +33,9 @@
         "table": "filter",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "10.10.10.10",
           "10.10.11.11"
diff --git a/tests/shell/testcases/maps/dumps/0005interval_map_add_many_elements_0.json-nft b/tests/shell/testcases/maps/dumps/0005interval_map_add_many_elements_0.json-nft
index f9ac5bce9315b..d1a4629500533 100644
--- a/tests/shell/testcases/maps/dumps/0005interval_map_add_many_elements_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/0005interval_map_add_many_elements_0.json-nft
@@ -22,7 +22,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "ipv4_addr",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/0006interval_map_overlap_0.json-nft b/tests/shell/testcases/maps/dumps/0006interval_map_overlap_0.json-nft
index d6b32d0f8204c..1e983219ae0d4 100644
--- a/tests/shell/testcases/maps/dumps/0006interval_map_overlap_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/0006interval_map_overlap_0.json-nft
@@ -22,7 +22,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "ipv4_addr",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/0008interval_map_delete_0.json-nft b/tests/shell/testcases/maps/dumps/0008interval_map_delete_0.json-nft
index 09cb6c8578ffb..bd3c6cc7ebf55 100644
--- a/tests/shell/testcases/maps/dumps/0008interval_map_delete_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/0008interval_map_delete_0.json-nft
@@ -34,7 +34,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "mark",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             "127.0.0.2",
diff --git a/tests/shell/testcases/maps/dumps/0012map_concat_0.json-nft b/tests/shell/testcases/maps/dumps/0012map_concat_0.json-nft
index 85384c5329614..88bf4984dbde7 100644
--- a/tests/shell/testcases/maps/dumps/0012map_concat_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/0012map_concat_0.json-nft
@@ -50,7 +50,9 @@
         },
         "handle": 0,
         "map": "verdict",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/0013map_0.json-nft b/tests/shell/testcases/maps/dumps/0013map_0.json-nft
index 2c8d21b43f20e..e91a269d8e6e6 100644
--- a/tests/shell/testcases/maps/dumps/0013map_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/0013map_0.json-nft
@@ -38,7 +38,9 @@
         ],
         "handle": 0,
         "map": "verdict",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/delete_element.json-nft b/tests/shell/testcases/maps/dumps/delete_element.json-nft
index 69a0d3a25b7c9..3b7c5f240e245 100644
--- a/tests/shell/testcases/maps/dumps/delete_element.json-nft
+++ b/tests/shell/testcases/maps/dumps/delete_element.json-nft
@@ -40,7 +40,9 @@
         },
         "handle": 0,
         "map": "classid",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/delete_element_catchall.json-nft b/tests/shell/testcases/maps/dumps/delete_element_catchall.json-nft
index 65053f2c50136..48b183f172025 100644
--- a/tests/shell/testcases/maps/dumps/delete_element_catchall.json-nft
+++ b/tests/shell/testcases/maps/dumps/delete_element_catchall.json-nft
@@ -40,7 +40,9 @@
         },
         "handle": 0,
         "map": "classid",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             "*",
diff --git a/tests/shell/testcases/maps/dumps/map_with_flags_0.json-nft b/tests/shell/testcases/maps/dumps/map_with_flags_0.json-nft
index 94ec5f751ba57..97b7e94e59fa4 100644
--- a/tests/shell/testcases/maps/dumps/map_with_flags_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/map_with_flags_0.json-nft
@@ -22,7 +22,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "ipv4_addr",
-        "flags": "timeout"
+        "flags": [
+          "timeout"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/maps/dumps/named_ct_objects.json-nft b/tests/shell/testcases/maps/dumps/named_ct_objects.json-nft
index 5258d87cf6f5f..c0f270e372b24 100644
--- a/tests/shell/testcases/maps/dumps/named_ct_objects.json-nft
+++ b/tests/shell/testcases/maps/dumps/named_ct_objects.json-nft
@@ -111,7 +111,9 @@
         },
         "handle": 0,
         "map": "ct expectation",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
@@ -140,7 +142,9 @@
         },
         "handle": 0,
         "map": "ct helper",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/named_limits.json-nft b/tests/shell/testcases/maps/dumps/named_limits.json-nft
index 07e2892915392..3c6845ac43b42 100644
--- a/tests/shell/testcases/maps/dumps/named_limits.json-nft
+++ b/tests/shell/testcases/maps/dumps/named_limits.json-nft
@@ -144,7 +144,9 @@
         },
         "handle": 0,
         "map": "limit",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
@@ -284,7 +286,9 @@
         },
         "handle": 0,
         "map": "limit",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/pipapo_double_flush.json-nft b/tests/shell/testcases/maps/dumps/pipapo_double_flush.json-nft
index dc793a65f16dd..ef8c3930f8153 100644
--- a/tests/shell/testcases/maps/dumps/pipapo_double_flush.json-nft
+++ b/tests/shell/testcases/maps/dumps/pipapo_double_flush.json-nft
@@ -33,7 +33,9 @@
         ],
         "handle": 0,
         "map": "verdict",
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/maps/dumps/typeof_integer_0.json-nft b/tests/shell/testcases/maps/dumps/typeof_integer_0.json-nft
index 8dea5c170a847..1df729b40a74f 100644
--- a/tests/shell/testcases/maps/dumps/typeof_integer_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/typeof_integer_0.json-nft
@@ -48,7 +48,9 @@
         },
         "handle": 0,
         "map": "verdict",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/maps/dumps/typeof_maps_add_delete.json-nft b/tests/shell/testcases/maps/dumps/typeof_maps_add_delete.json-nft
index 8b18a78d6982f..effe02dcf8364 100644
--- a/tests/shell/testcases/maps/dumps/typeof_maps_add_delete.json-nft
+++ b/tests/shell/testcases/maps/dumps/typeof_maps_add_delete.json-nft
@@ -50,7 +50,9 @@
         "handle": 0,
         "map": "mark",
         "size": 64,
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "timeout": 300,
         "stmt": [
           {
diff --git a/tests/shell/testcases/maps/dumps/typeof_maps_update_0.json-nft b/tests/shell/testcases/maps/dumps/typeof_maps_update_0.json-nft
index b79237d0838db..731514663b1aa 100644
--- a/tests/shell/testcases/maps/dumps/typeof_maps_update_0.json-nft
+++ b/tests/shell/testcases/maps/dumps/typeof_maps_update_0.json-nft
@@ -39,7 +39,9 @@
         "handle": 0,
         "map": "mark",
         "size": 65535,
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "timeout": 360
       }
     },
@@ -59,7 +61,9 @@
         "handle": 0,
         "map": "mark",
         "size": 65535,
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "timeout": 60
       }
     },
diff --git a/tests/shell/testcases/maps/dumps/vmap_timeout.json-nft b/tests/shell/testcases/maps/dumps/vmap_timeout.json-nft
index 2d7d8cc2306cd..71e9a9ee9f21b 100644
--- a/tests/shell/testcases/maps/dumps/vmap_timeout.json-nft
+++ b/tests/shell/testcases/maps/dumps/vmap_timeout.json-nft
@@ -66,7 +66,9 @@
         "type": "inet_service",
         "handle": 0,
         "map": "verdict",
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "gc-interval": 10,
         "elem": [
           [
@@ -105,7 +107,9 @@
         },
         "handle": 0,
         "map": "verdict",
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "gc-interval": 10,
         "elem": [
           [
diff --git a/tests/shell/testcases/maps/dumps/vmap_unary.json-nft b/tests/shell/testcases/maps/dumps/vmap_unary.json-nft
index 08583f9bc3032..df0a07d9773bf 100644
--- a/tests/shell/testcases/maps/dumps/vmap_unary.json-nft
+++ b/tests/shell/testcases/maps/dumps/vmap_unary.json-nft
@@ -51,7 +51,9 @@
         },
         "handle": 0,
         "map": "verdict",
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/nft-f/dumps/0012different_defines_0.json-nft b/tests/shell/testcases/nft-f/dumps/0012different_defines_0.json-nft
index 1b2e342047f4b..0e7ea228501b4 100644
--- a/tests/shell/testcases/nft-f/dumps/0012different_defines_0.json-nft
+++ b/tests/shell/testcases/nft-f/dumps/0012different_defines_0.json-nft
@@ -529,7 +529,9 @@
           {
             "queue": {
               "num": 0,
-              "flags": "bypass"
+              "flags": [
+                "bypass"
+              ]
             }
           }
         ]
@@ -768,7 +770,9 @@
                   }
                 }
               },
-              "flags": "bypass"
+              "flags": [
+                "bypass"
+              ]
             }
           }
         ]
diff --git a/tests/shell/testcases/nft-f/dumps/0025empty_dynset_0.json-nft b/tests/shell/testcases/nft-f/dumps/0025empty_dynset_0.json-nft
index 63d6764172ff6..0cde23b00000a 100644
--- a/tests/shell/testcases/nft-f/dumps/0025empty_dynset_0.json-nft
+++ b/tests/shell/testcases/nft-f/dumps/0025empty_dynset_0.json-nft
@@ -27,7 +27,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "dynamic",
+        "flags": [
+          "dynamic"
+        ],
         "elem": [
           {
             "elem": {
@@ -62,7 +64,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
@@ -78,7 +82,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "dynamic",
+        "flags": [
+          "dynamic"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/nft-i/dumps/set_0.json-nft b/tests/shell/testcases/nft-i/dumps/set_0.json-nft
index 61e4b99e40775..da3456eff1871 100644
--- a/tests/shell/testcases/nft-i/dumps/set_0.json-nft
+++ b/tests/shell/testcases/nft-i/dumps/set_0.json-nft
@@ -21,7 +21,9 @@
         "table": "foo",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "10.1.1.1",
           "10.1.1.2"
diff --git a/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft b/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft
index f058d6f1db069..e87f1c4c082eb 100644
--- a/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft
+++ b/tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft
@@ -46,7 +46,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft b/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft
index bf5a8cec53630..d6347b1eeed6e 100644
--- a/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft
+++ b/tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft
@@ -29,7 +29,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/packetpath/dumps/set_lookups.json-nft b/tests/shell/testcases/packetpath/dumps/set_lookups.json-nft
index 23f4b17fc53c3..bcf6914e95cb9 100644
--- a/tests/shell/testcases/packetpath/dumps/set_lookups.json-nft
+++ b/tests/shell/testcases/packetpath/dumps/set_lookups.json-nft
@@ -36,7 +36,9 @@
           "iface_index"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
@@ -111,7 +113,9 @@
         "table": "t",
         "type": "iface_index",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "lo"
         ]
diff --git a/tests/shell/testcases/rule_management/dumps/0004replace_0.json-nft b/tests/shell/testcases/rule_management/dumps/0004replace_0.json-nft
index 811cb73804f5d..767e80f14ff26 100644
--- a/tests/shell/testcases/rule_management/dumps/0004replace_0.json-nft
+++ b/tests/shell/testcases/rule_management/dumps/0004replace_0.json-nft
@@ -38,7 +38,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/rule_management/dumps/0011reset_0.json-nft b/tests/shell/testcases/rule_management/dumps/0011reset_0.json-nft
index e57dee799b4f3..bc242467e22a7 100644
--- a/tests/shell/testcases/rule_management/dumps/0011reset_0.json-nft
+++ b/tests/shell/testcases/rule_management/dumps/0011reset_0.json-nft
@@ -38,7 +38,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic",
+        "flags": [
+          "dynamic"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/0001named_interval_0.json-nft b/tests/shell/testcases/sets/dumps/0001named_interval_0.json-nft
index 9200154a6ed85..b9c66a21aa084 100644
--- a/tests/shell/testcases/sets/dumps/0001named_interval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0001named_interval_0.json-nft
@@ -29,7 +29,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "range": [
@@ -53,7 +55,9 @@
         "table": "t",
         "type": "ipv6_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
@@ -77,7 +81,9 @@
         "table": "t",
         "type": "inet_proto",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "range": [
@@ -101,7 +107,9 @@
         "table": "t",
         "type": "inet_service",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "range": [
diff --git a/tests/shell/testcases/sets/dumps/0002named_interval_automerging_0.json-nft b/tests/shell/testcases/sets/dumps/0002named_interval_automerging_0.json-nft
index b083ecb52bb52..4c0be67000a02 100644
--- a/tests/shell/testcases/sets/dumps/0002named_interval_automerging_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0002named_interval_automerging_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/0004named_interval_shadow_0.json-nft b/tests/shell/testcases/sets/dumps/0004named_interval_shadow_0.json-nft
index c79d9ba8518af..c55858fa9c9b9 100644
--- a/tests/shell/testcases/sets/dumps/0004named_interval_shadow_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0004named_interval_shadow_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv6_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/0005named_interval_shadow_0.json-nft b/tests/shell/testcases/sets/dumps/0005named_interval_shadow_0.json-nft
index 464661e62ae14..a75681f36cb8e 100644
--- a/tests/shell/testcases/sets/dumps/0005named_interval_shadow_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0005named_interval_shadow_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv6_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/0008comments_interval_0.json-nft b/tests/shell/testcases/sets/dumps/0008comments_interval_0.json-nft
index e7152413d4bb9..c6f5aa68837ce 100644
--- a/tests/shell/testcases/sets/dumps/0008comments_interval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0008comments_interval_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/0009comments_timeout_0.json-nft b/tests/shell/testcases/sets/dumps/0009comments_timeout_0.json-nft
index a67a06707106d..2418b39a76a06 100644
--- a/tests/shell/testcases/sets/dumps/0009comments_timeout_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0009comments_timeout_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/0015rulesetflush_0.json-nft b/tests/shell/testcases/sets/dumps/0015rulesetflush_0.json-nft
index 86d7eb6a4b6b1..6268e216aa03c 100644
--- a/tests/shell/testcases/sets/dumps/0015rulesetflush_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0015rulesetflush_0.json-nft
@@ -36,7 +36,9 @@
         "table": "filter",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/0022type_selective_flush_0.json-nft b/tests/shell/testcases/sets/dumps/0022type_selective_flush_0.json-nft
index dcb62eb739d56..c617139235c23 100644
--- a/tests/shell/testcases/sets/dumps/0022type_selective_flush_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0022type_selective_flush_0.json-nft
@@ -49,7 +49,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 1024,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/0024synproxy_0.json-nft b/tests/shell/testcases/sets/dumps/0024synproxy_0.json-nft
index dd71bb394442d..0af613333592d 100644
--- a/tests/shell/testcases/sets/dumps/0024synproxy_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0024synproxy_0.json-nft
@@ -58,7 +58,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "synproxy",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/sets/dumps/0027ipv6_maps_ipv4_0.json-nft b/tests/shell/testcases/sets/dumps/0027ipv6_maps_ipv4_0.json-nft
index 75d8b46d86a10..b9251ffa58900 100644
--- a/tests/shell/testcases/sets/dumps/0027ipv6_maps_ipv4_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0027ipv6_maps_ipv4_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv6_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/0028autoselect_0.json-nft b/tests/shell/testcases/sets/dumps/0028autoselect_0.json-nft
index 05fc072c3ca7f..5968b2e0c11f0 100644
--- a/tests/shell/testcases/sets/dumps/0028autoselect_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0028autoselect_0.json-nft
@@ -34,7 +34,9 @@
         "type": "inet_proto",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
@@ -45,7 +47,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
@@ -56,7 +60,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 1024,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/0028delete_handle_0.json-nft b/tests/shell/testcases/sets/dumps/0028delete_handle_0.json-nft
index 9e5f708df3a74..96314141bc084 100644
--- a/tests/shell/testcases/sets/dumps/0028delete_handle_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0028delete_handle_0.json-nft
@@ -30,7 +30,9 @@
         "table": "test-ip",
         "type": "inet_service",
         "handle": 0,
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "timeout": 10845
       }
     },
diff --git a/tests/shell/testcases/sets/dumps/0032restore_set_simple_0.json-nft b/tests/shell/testcases/sets/dumps/0032restore_set_simple_0.json-nft
index 7a723150c1a35..4d194bff1b164 100644
--- a/tests/shell/testcases/sets/dumps/0032restore_set_simple_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0032restore_set_simple_0.json-nft
@@ -25,7 +25,9 @@
           "ipv4_addr"
         ],
         "handle": 0,
-        "flags": "timeout"
+        "flags": [
+          "timeout"
+        ]
       }
     },
     {
@@ -38,7 +40,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "timeout"
+        "flags": [
+          "timeout"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/sets/dumps/0033add_set_simple_flat_0.json-nft b/tests/shell/testcases/sets/dumps/0033add_set_simple_flat_0.json-nft
index 5697652859078..16684438c37f2 100644
--- a/tests/shell/testcases/sets/dumps/0033add_set_simple_flat_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0033add_set_simple_flat_0.json-nft
@@ -25,7 +25,9 @@
           "ipv4_addr"
         ],
         "handle": 0,
-        "flags": "timeout"
+        "flags": [
+          "timeout"
+        ]
       }
     },
     {
@@ -38,7 +40,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "timeout"
+        "flags": [
+          "timeout"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/sets/dumps/0034get_element_0.json-nft b/tests/shell/testcases/sets/dumps/0034get_element_0.json-nft
index 4f5ba0aaac578..bfc0e4a0f5886 100644
--- a/tests/shell/testcases/sets/dumps/0034get_element_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0034get_element_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "inet_service",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           10,
           {
@@ -47,7 +49,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "10.0.0.1",
           {
@@ -87,7 +91,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
diff --git a/tests/shell/testcases/sets/dumps/0035add_set_elements_flat_0.json-nft b/tests/shell/testcases/sets/dumps/0035add_set_elements_flat_0.json-nft
index f9fe4e6f113ea..e4c77147b88f6 100644
--- a/tests/shell/testcases/sets/dumps/0035add_set_elements_flat_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0035add_set_elements_flat_0.json-nft
@@ -21,7 +21,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/sets/dumps/0038meter_list_0.json-nft b/tests/shell/testcases/sets/dumps/0038meter_list_0.json-nft
index 6f6555d224371..5b13f59a72615 100644
--- a/tests/shell/testcases/sets/dumps/0038meter_list_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0038meter_list_0.json-nft
@@ -44,7 +44,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 128,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/0039delete_interval_0.json-nft b/tests/shell/testcases/sets/dumps/0039delete_interval_0.json-nft
index afa819584e5b3..d6e46aad20a50 100644
--- a/tests/shell/testcases/sets/dumps/0039delete_interval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0039delete_interval_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "range": [
diff --git a/tests/shell/testcases/sets/dumps/0040get_host_endian_elements_0.json-nft b/tests/shell/testcases/sets/dumps/0040get_host_endian_elements_0.json-nft
index 486ca453281e4..4b6cf03c45961 100644
--- a/tests/shell/testcases/sets/dumps/0040get_host_endian_elements_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0040get_host_endian_elements_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "mark",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "range": [
diff --git a/tests/shell/testcases/sets/dumps/0041interval_0.json-nft b/tests/shell/testcases/sets/dumps/0041interval_0.json-nft
index c59a65ae29fd8..14a393305a3f3 100644
--- a/tests/shell/testcases/sets/dumps/0041interval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0041interval_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "192.168.2.196"
         ]
diff --git a/tests/shell/testcases/sets/dumps/0042update_set_0.json-nft b/tests/shell/testcases/sets/dumps/0042update_set_0.json-nft
index 3f98e120d19bd..bc1d4cc2284d8 100644
--- a/tests/shell/testcases/sets/dumps/0042update_set_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0042update_set_0.json-nft
@@ -39,7 +39,9 @@
         "type": "ether_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/0043concatenated_ranges_1.json-nft b/tests/shell/testcases/sets/dumps/0043concatenated_ranges_1.json-nft
index 5ce063d7e4304..92b59c861de10 100644
--- a/tests/shell/testcases/sets/dumps/0043concatenated_ranges_1.json-nft
+++ b/tests/shell/testcases/sets/dumps/0043concatenated_ranges_1.json-nft
@@ -24,7 +24,9 @@
           "ipv6_addr"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
@@ -1582,7 +1584,9 @@
           "ipv4_addr"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
diff --git a/tests/shell/testcases/sets/dumps/0044interval_overlap_1.json-nft b/tests/shell/testcases/sets/dumps/0044interval_overlap_1.json-nft
index 8f82990af70d6..f4aae383524ff 100644
--- a/tests/shell/testcases/sets/dumps/0044interval_overlap_1.json-nft
+++ b/tests/shell/testcases/sets/dumps/0044interval_overlap_1.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "inet_service",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           25,
           30,
diff --git a/tests/shell/testcases/sets/dumps/0046netmap_0.json-nft b/tests/shell/testcases/sets/dumps/0046netmap_0.json-nft
index 55f1a2ad28c76..2b67252d6ec40 100644
--- a/tests/shell/testcases/sets/dumps/0046netmap_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0046netmap_0.json-nft
@@ -92,8 +92,12 @@
                   }
                 }
               },
-              "flags": "netmap",
-              "type_flags": "prefix"
+              "flags": [
+                "netmap"
+              ],
+              "type_flags": [
+                "prefix"
+              ]
             }
           }
         ]
@@ -156,8 +160,12 @@
                   }
                 }
               },
-              "flags": "netmap",
-              "type_flags": "prefix"
+              "flags": [
+                "netmap"
+              ],
+              "type_flags": [
+                "prefix"
+              ]
             }
           }
         ]
diff --git a/tests/shell/testcases/sets/dumps/0049set_define_0.json-nft b/tests/shell/testcases/sets/dumps/0049set_define_0.json-nft
index 98ccafd463cc4..f8495bab8b0f3 100644
--- a/tests/shell/testcases/sets/dumps/0049set_define_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0049set_define_0.json-nft
@@ -33,7 +33,9 @@
         "table": "filter",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "auto-merge": true,
         "elem": [
           "1.1.1.1"
diff --git a/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.json-nft b/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.json-nft
index 96cb397f0c584..b468b5f9044ca 100644
--- a/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.json-nft
@@ -33,7 +33,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/0052overlap_0.json-nft b/tests/shell/testcases/sets/dumps/0052overlap_0.json-nft
index 1ea8ede677aa3..96d5fbccd7d40 100644
--- a/tests/shell/testcases/sets/dumps/0052overlap_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0052overlap_0.json-nft
@@ -21,7 +21,9 @@
         "table": "filter",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "auto-merge": true,
         "elem": [
           "10.10.10.10",
diff --git a/tests/shell/testcases/sets/dumps/0054comments_set_0.json-nft b/tests/shell/testcases/sets/dumps/0054comments_set_0.json-nft
index a729392270c01..3fd6d37e18103 100644
--- a/tests/shell/testcases/sets/dumps/0054comments_set_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0054comments_set_0.json-nft
@@ -22,7 +22,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "comment": "test",
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     },
     {
@@ -34,7 +36,9 @@
         "handle": 0,
         "comment": "another test",
         "map": "ipv4_addr",
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/sets/dumps/0055tcpflags_0.json-nft b/tests/shell/testcases/sets/dumps/0055tcpflags_0.json-nft
index 0232ad6f28e3b..e37139f334466 100644
--- a/tests/shell/testcases/sets/dumps/0055tcpflags_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0055tcpflags_0.json-nft
@@ -21,7 +21,9 @@
         "table": "test",
         "type": "tcp_flag",
         "handle": 0,
-        "flags": "constant",
+        "flags": [
+          "constant"
+        ],
         "elem": [
           {
             "|": [
diff --git a/tests/shell/testcases/sets/dumps/0060set_multistmt_1.json-nft b/tests/shell/testcases/sets/dumps/0060set_multistmt_1.json-nft
index 99805e553da0e..6098dc563141f 100644
--- a/tests/shell/testcases/sets/dumps/0060set_multistmt_1.json-nft
+++ b/tests/shell/testcases/sets/dumps/0060set_multistmt_1.json-nft
@@ -34,7 +34,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic",
+        "flags": [
+          "dynamic"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/0062set_connlimit_0.json-nft b/tests/shell/testcases/sets/dumps/0062set_connlimit_0.json-nft
index 7a948b1da0cff..c5e60e36c89ea 100644
--- a/tests/shell/testcases/sets/dumps/0062set_connlimit_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0062set_connlimit_0.json-nft
@@ -22,7 +22,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
@@ -33,7 +35,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic",
+        "flags": [
+          "dynamic"
+        ],
         "stmt": [
           {
             "ct count": {
diff --git a/tests/shell/testcases/sets/dumps/0063set_catchall_0.json-nft b/tests/shell/testcases/sets/dumps/0063set_catchall_0.json-nft
index fcfe9830f3600..3006f75a8fcc6 100644
--- a/tests/shell/testcases/sets/dumps/0063set_catchall_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0063set_catchall_0.json-nft
@@ -55,7 +55,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/0064map_catchall_0.json-nft b/tests/shell/testcases/sets/dumps/0064map_catchall_0.json-nft
index b7496ac853f10..64dd26670528b 100644
--- a/tests/shell/testcases/sets/dumps/0064map_catchall_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0064map_catchall_0.json-nft
@@ -50,7 +50,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "ipv4_addr",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/sets/dumps/0069interval_merge_0.json-nft b/tests/shell/testcases/sets/dumps/0069interval_merge_0.json-nft
index 7868cb3359160..d7b32f8cc0e24 100644
--- a/tests/shell/testcases/sets/dumps/0069interval_merge_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0069interval_merge_0.json-nft
@@ -21,7 +21,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "auto-merge": true,
         "elem": [
           {
diff --git a/tests/shell/testcases/sets/dumps/0071unclosed_prefix_interval_0.json-nft b/tests/shell/testcases/sets/dumps/0071unclosed_prefix_interval_0.json-nft
index 588c2b1b6689c..6b579a2e09fff 100644
--- a/tests/shell/testcases/sets/dumps/0071unclosed_prefix_interval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/0071unclosed_prefix_interval_0.json-nft
@@ -29,7 +29,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
@@ -53,7 +55,9 @@
         "table": "t",
         "type": "ipv6_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/0073flat_interval_set.json-nft b/tests/shell/testcases/sets/dumps/0073flat_interval_set.json-nft
index e4649a7d0c22e..e2fb6214238fa 100644
--- a/tests/shell/testcases/sets/dumps/0073flat_interval_set.json-nft
+++ b/tests/shell/testcases/sets/dumps/0073flat_interval_set.json-nft
@@ -32,7 +32,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "counter",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/sets/dumps/0074nested_interval_set.json-nft b/tests/shell/testcases/sets/dumps/0074nested_interval_set.json-nft
index e4649a7d0c22e..e2fb6214238fa 100644
--- a/tests/shell/testcases/sets/dumps/0074nested_interval_set.json-nft
+++ b/tests/shell/testcases/sets/dumps/0074nested_interval_set.json-nft
@@ -32,7 +32,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "counter",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             {
diff --git a/tests/shell/testcases/sets/dumps/concat_interval_0.json-nft b/tests/shell/testcases/sets/dumps/concat_interval_0.json-nft
index 3283f26958f71..d65065e4f0947 100644
--- a/tests/shell/testcases/sets/dumps/concat_interval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/concat_interval_0.json-nft
@@ -25,7 +25,9 @@
           "inet_service"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "stmt": [
           {
             "counter": null
@@ -43,7 +45,9 @@
           "mark"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
diff --git a/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.json-nft b/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.json-nft
index 2a8d233e81d26..db9f547b45c87 100644
--- a/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.json-nft
+++ b/tests/shell/testcases/sets/dumps/concat_nlmsg_overrun.json-nft
@@ -25,7 +25,9 @@
           "ipv4_addr"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "elem": {
diff --git a/tests/shell/testcases/sets/dumps/dynset_missing.json-nft b/tests/shell/testcases/sets/dumps/dynset_missing.json-nft
index 9de5b821f79e7..ad8a7cc0564a8 100644
--- a/tests/shell/testcases/sets/dumps/dynset_missing.json-nft
+++ b/tests/shell/testcases/sets/dumps/dynset_missing.json-nft
@@ -34,7 +34,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/exact_overlap_0.json-nft b/tests/shell/testcases/sets/dumps/exact_overlap_0.json-nft
index 7bba69d54556a..958d1e5cf6caf 100644
--- a/tests/shell/testcases/sets/dumps/exact_overlap_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/exact_overlap_0.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/sets/dumps/inner_0.json-nft b/tests/shell/testcases/sets/dumps/inner_0.json-nft
index 581d534012e44..e5dc198f436be 100644
--- a/tests/shell/testcases/sets/dumps/inner_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/inner_0.json-nft
@@ -74,7 +74,9 @@
         },
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/interval_size.json-nft b/tests/shell/testcases/sets/dumps/interval_size.json-nft
index 96fc54fc811c6..3ae54e0815378 100644
--- a/tests/shell/testcases/sets/dumps/interval_size.json-nft
+++ b/tests/shell/testcases/sets/dumps/interval_size.json-nft
@@ -29,7 +29,9 @@
         },
         "handle": 0,
         "size": 1,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "auto-merge": true,
         "elem": [
           {
@@ -56,7 +58,9 @@
         },
         "handle": 0,
         "size": 1,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "0.0.0.0"
         ]
diff --git a/tests/shell/testcases/sets/dumps/meter_set_reuse.json-nft b/tests/shell/testcases/sets/dumps/meter_set_reuse.json-nft
index 9210c90b158d4..ab4ac06184d03 100644
--- a/tests/shell/testcases/sets/dumps/meter_set_reuse.json-nft
+++ b/tests/shell/testcases/sets/dumps/meter_set_reuse.json-nft
@@ -33,7 +33,9 @@
         ],
         "handle": 0,
         "size": 65535,
-        "flags": "dynamic"
+        "flags": [
+          "dynamic"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft b/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
index e1daa8f86529f..c4682475917e5 100644
--- a/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
+++ b/tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft
@@ -21,7 +21,9 @@
         "table": "t",
         "type": "inet_service",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           10,
           30,
diff --git a/tests/shell/testcases/sets/dumps/set_element_timeout_updates.json-nft b/tests/shell/testcases/sets/dumps/set_element_timeout_updates.json-nft
index acb2f1f4944ac..d92d8d7a54940 100644
--- a/tests/shell/testcases/sets/dumps/set_element_timeout_updates.json-nft
+++ b/tests/shell/testcases/sets/dumps/set_element_timeout_updates.json-nft
@@ -40,7 +40,9 @@
           }
         },
         "handle": 0,
-        "flags": "timeout",
+        "flags": [
+          "timeout"
+        ],
         "timeout": 60
       }
     }
diff --git a/tests/shell/testcases/sets/dumps/set_eval_0.json-nft b/tests/shell/testcases/sets/dumps/set_eval_0.json-nft
index 6f4f4c61600b2..6f692381b6f7c 100644
--- a/tests/shell/testcases/sets/dumps/set_eval_0.json-nft
+++ b/tests/shell/testcases/sets/dumps/set_eval_0.json-nft
@@ -33,7 +33,9 @@
         "table": "nat",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft b/tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft
index 77ca50868f26f..ac4284293c32a 100644
--- a/tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft
+++ b/tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft
@@ -71,7 +71,9 @@
         "table": "testifsets",
         "type": "ifname",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           "abcdef*",
           "othername",
@@ -115,7 +117,9 @@
           "ifname"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
@@ -162,7 +166,9 @@
         "type": "ifname",
         "handle": 0,
         "map": "verdict",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             "abcdef*",
diff --git a/tests/shell/testcases/sets/dumps/typeof_sets_concat.json-nft b/tests/shell/testcases/sets/dumps/typeof_sets_concat.json-nft
index ffb97f77288f4..144cd743ac7c9 100644
--- a/tests/shell/testcases/sets/dumps/typeof_sets_concat.json-nft
+++ b/tests/shell/testcases/sets/dumps/typeof_sets_concat.json-nft
@@ -199,7 +199,9 @@
         },
         "handle": 0,
         "size": 16,
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/transactions/dumps/0002table_0.json-nft b/tests/shell/testcases/transactions/dumps/0002table_0.json-nft
index b1fefc31e1f0a..70960a94204a3 100644
--- a/tests/shell/testcases/transactions/dumps/0002table_0.json-nft
+++ b/tests/shell/testcases/transactions/dumps/0002table_0.json-nft
@@ -12,7 +12,9 @@
         "family": "ip",
         "name": "x",
         "handle": 0,
-        "flags": "dormant"
+        "flags": [
+          "dormant"
+        ]
       }
     },
     {
diff --git a/tests/shell/testcases/transactions/dumps/0037set_0.json-nft b/tests/shell/testcases/transactions/dumps/0037set_0.json-nft
index f9fe4e6f113ea..e4c77147b88f6 100644
--- a/tests/shell/testcases/transactions/dumps/0037set_0.json-nft
+++ b/tests/shell/testcases/transactions/dumps/0037set_0.json-nft
@@ -21,7 +21,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval"
+        "flags": [
+          "interval"
+        ]
       }
     }
   ]
diff --git a/tests/shell/testcases/transactions/dumps/0038set_0.json-nft b/tests/shell/testcases/transactions/dumps/0038set_0.json-nft
index 5f97d09e82c6c..0a36f4a809a0d 100644
--- a/tests/shell/testcases/transactions/dumps/0038set_0.json-nft
+++ b/tests/shell/testcases/transactions/dumps/0038set_0.json-nft
@@ -21,7 +21,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/transactions/dumps/0039set_0.json-nft b/tests/shell/testcases/transactions/dumps/0039set_0.json-nft
index 5f97d09e82c6c..0a36f4a809a0d 100644
--- a/tests/shell/testcases/transactions/dumps/0039set_0.json-nft
+++ b/tests/shell/testcases/transactions/dumps/0039set_0.json-nft
@@ -21,7 +21,9 @@
         "table": "x",
         "type": "ipv4_addr",
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "prefix": {
diff --git a/tests/shell/testcases/transactions/dumps/0047set_0.json-nft b/tests/shell/testcases/transactions/dumps/0047set_0.json-nft
index fb6348f229b57..a7e677b2e702c 100644
--- a/tests/shell/testcases/transactions/dumps/0047set_0.json-nft
+++ b/tests/shell/testcases/transactions/dumps/0047set_0.json-nft
@@ -22,7 +22,9 @@
         "type": "ipv4_addr",
         "handle": 0,
         "map": "classid",
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           [
             "10.1.26.2",
diff --git a/tests/shell/testcases/transactions/dumps/doubled-set.json-nft b/tests/shell/testcases/transactions/dumps/doubled-set.json-nft
index 1b9af211945ec..2dced1240528f 100644
--- a/tests/shell/testcases/transactions/dumps/doubled-set.json-nft
+++ b/tests/shell/testcases/transactions/dumps/doubled-set.json-nft
@@ -24,7 +24,9 @@
           "ifname"
         ],
         "handle": 0,
-        "flags": "interval",
+        "flags": [
+          "interval"
+        ],
         "elem": [
           {
             "concat": [
diff --git a/tests/shell/testcases/transactions/dumps/table_onoff.json-nft b/tests/shell/testcases/transactions/dumps/table_onoff.json-nft
index a7583e8c4efc4..9b48ca4744a65 100644
--- a/tests/shell/testcases/transactions/dumps/table_onoff.json-nft
+++ b/tests/shell/testcases/transactions/dumps/table_onoff.json-nft
@@ -12,7 +12,9 @@
         "family": "ip",
         "name": "t",
         "handle": 0,
-        "flags": "dormant"
+        "flags": [
+          "dormant"
+        ]
       }
     },
     {
-- 
2.49.0

Re: [nft PATCH 00/14] json: Do not reduce single-item arrays on output

[Pablo Neira Ayuso]

On Wed, Aug 13, 2025 at 07:05:35PM +0200, Phil Sutter wrote:
> This series consists of noise (patches 1-13 and most of patch 14) with a
> bit of signal in patch 14. This is because the relatively simple
> adjustment to JSON output requires minor adjustments to many stored JSON
> dumps in shell test suite and stored JSON output in py test suite. While
> doing this, I noticed some dups and stale entries in py test suite. To
> clean things up first, I ran tests/py/tools/test-sanitizer.sh, fixed the
> warnings and sorted the changes into fixes for the respective commits.

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

I will follow up with a patch to partially revert the fib check change
for JSON too.

Re: [nft PATCH 00/14] json: Do not reduce single-item arrays on output

[Phil Sutter]

On Mon, Aug 18, 2025 at 04:16:21PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Aug 13, 2025 at 07:05:35PM +0200, Phil Sutter wrote:
> > This series consists of noise (patches 1-13 and most of patch 14) with a
> > bit of signal in patch 14. This is because the relatively simple
> > adjustment to JSON output requires minor adjustments to many stored JSON
> > dumps in shell test suite and stored JSON output in py test suite. While
> > doing this, I noticed some dups and stale entries in py test suite. To
> > clean things up first, I ran tests/py/tools/test-sanitizer.sh, fixed the
> > warnings and sorted the changes into fixes for the respective commits.
> 
> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

Series applied, thanks!

> I will follow up with a patch to partially revert the fib check change
> for JSON too.

Hmm. That one seems like a sensible change and not just a simplification
of output. I guess if we take this approach seriously, we should agree
on (and communicate) an upgrade path for JSON output. In detail (from
the top of my head):

1) What changes are considered compatible (and which not)
2) In which situations are incompatible changes acceptable
3) How to inform users of the incompatible change

I'd suggest something like:

1) Additions only, no changes of property values or names
2) Critical bug fixes or new (major?) versions
3) Bump JSON_SCHEMA_VERSION? Or is the "version" property in "metainfo"
   sufficient if bumped anyway?

Cheers, Phil

Re: [nft PATCH 00/14] json: Do not reduce single-item arrays on output

[Pablo Neira Ayuso]

On Mon, Aug 18, 2025 at 11:07:34PM +0200, Phil Sutter wrote:
> On Mon, Aug 18, 2025 at 04:16:21PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, Aug 13, 2025 at 07:05:35PM +0200, Phil Sutter wrote:
> > > This series consists of noise (patches 1-13 and most of patch 14) with a
> > > bit of signal in patch 14. This is because the relatively simple
> > > adjustment to JSON output requires minor adjustments to many stored JSON
> > > dumps in shell test suite and stored JSON output in py test suite. While
> > > doing this, I noticed some dups and stale entries in py test suite. To
> > > clean things up first, I ran tests/py/tools/test-sanitizer.sh, fixed the
> > > warnings and sorted the changes into fixes for the respective commits.
> > 
> > Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Series applied, thanks!
> 
> > I will follow up with a patch to partially revert the fib check change
> > for JSON too.
> 
> Hmm. That one seems like a sensible change and not just a simplification
> of output.

Actually, I don't find an easy way to retain backward compatibility in
the JSON output for fib without reverting:

commit 525b58568dca5ab9998595fc45313eac2764b6b1
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Jun 24 18:11:10 2025 +0200

    fib: allow to use it in set statements

commit f4b646032acff4d743ad4f734aaca68e9264bdbb
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Jun 24 18:11:06 2025 +0200

    fib: allow to check if route exists in maps

I am not sure I want to do that, because then the fib expression
cannot be used with sets/maps.

The "check" trick was a "smart" workaround, I don't have a way to know
if you want to check for the presence of the real oif, without peeking
on the relational right hand side, which only works for rules without
set/map.

Peeking on the right hand side does not work to decide the semantics
of the right hand side for relationals, but not for set and maps,
because those could be empty, hence this "check" field.

Maybe, simply retain backward compatibility for the fib check with
relational expression would do the trick? But I am not sure the JSON
parser provides context on whether the expression is being used in a
relational.

> I guess if we take this approach seriously, we should agree
> on (and communicate) an upgrade path for JSON output. In detail (from
> the top of my head):
> 
> 1) What changes are considered compatible (and which not)
> 2) In which situations are incompatible changes acceptable
> 3) How to inform users of the incompatible change
> 
> I'd suggest something like:
> 
> 1) Additions only, no changes of property values or names
> 2) Critical bug fixes or new (major?) versions
> 3) Bump JSON_SCHEMA_VERSION? Or is the "version" property in "metainfo"
>    sufficient if bumped anyway?

This was going to be an issue sooner or later.

Updating the JSON representation would require to maintain backward
compatibility, changes would need to happen in a less incremental way
because you don't want to change the schema so often.

And this would also require to extend tests/ to deal with the
different versions? Which is going to be very tricky, it sounds like a
no-go.

Then all this means that everything is set in stone for third party
parsers, and that we have to forget the idea the JSON representation
can be incrementally refined, and simply add more stuff on top of it
as you suggest.

Re: [nft PATCH 00/14] json: Do not reduce single-item arrays on output

[Pablo Neira Ayuso]

On Tue, Aug 19, 2025 at 01:24:52AM +0200, Pablo Neira Ayuso wrote:
> On Mon, Aug 18, 2025 at 11:07:34PM +0200, Phil Sutter wrote:
> > On Mon, Aug 18, 2025 at 04:16:21PM +0200, Pablo Neira Ayuso wrote:
> > > On Wed, Aug 13, 2025 at 07:05:35PM +0200, Phil Sutter wrote:
> > > > This series consists of noise (patches 1-13 and most of patch 14) with a
> > > > bit of signal in patch 14. This is because the relatively simple
> > > > adjustment to JSON output requires minor adjustments to many stored JSON
> > > > dumps in shell test suite and stored JSON output in py test suite. While
> > > > doing this, I noticed some dups and stale entries in py test suite. To
> > > > clean things up first, I ran tests/py/tools/test-sanitizer.sh, fixed the
> > > > warnings and sorted the changes into fixes for the respective commits.
> > > 
> > > Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > 
> > Series applied, thanks!
> > 
> > > I will follow up with a patch to partially revert the fib check change
> > > for JSON too.
> > 
> > Hmm. That one seems like a sensible change and not just a simplification
> > of output.
> 
> Actually, I don't find an easy way to retain backward compatibility in
> the JSON output for fib without reverting:
> 
> commit 525b58568dca5ab9998595fc45313eac2764b6b1
> Author: Pablo Neira Ayuso <pablo@netfilter.org>
> Date:   Tue Jun 24 18:11:10 2025 +0200
> 
>     fib: allow to use it in set statements
> 
> commit f4b646032acff4d743ad4f734aaca68e9264bdbb
> Author: Pablo Neira Ayuso <pablo@netfilter.org>
> Date:   Tue Jun 24 18:11:06 2025 +0200
> 
>     fib: allow to check if route exists in maps
> 
> I am not sure I want to do that, because then the fib expression
> cannot be used with sets/maps.

I found a way, it is not "nice" but it helps to address the current
issue:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20250819092342.721798-1-pablo@netfilter.org/