Re: list elements of set

"Kerin Millar" <[email protected]> Sat, 27 Sep 2025 20:19:42 +0100
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
On Sat, 27 Sep 2025, at 6:24 PM, Slavko wrote:
> Dňa 27. septembra 2025 10:59:54 UTC používateľ Kerin Millar 
> <[email protected]> napísal:
>
>>You could parse JSON with the popular jq utility, or some other JSON parser of your choosing.
>
> Yes, one can parse JSON with jq, but it is not simple task for shell, as
> output of list sets is, hmm, i don't know how to describe it:
>
> 1. the nftables is list of objects, thus one must first filter the "metadata"
>    object, it is first list item, but who know if it is guaranted

I don't think this particular criticism carries much weight.

The presence of a header means that the "json_schema_version" number can be incremented in the event that the JSON schema changes. It further makes it trivial for a given program to determine whether it is compatible with the incoming stream.

I was surprised to find that there exists some documentation in the form of libnftables-json(5). It promises that the first object is a metadata object. I can think of no technical reason for this promise not to hold for all future schema.

> 2. then one must distinguish, is set object has elem key (empty sets miss it
> 3. then one  must determine elem key's type, as it can be list of values
>    (scalar) or list of objects
> 4. then one must decide if value of elem object is in elem or prefix key
> 5. then one must again distinguish, if value of elem.elem key is scalar
>    or object
> 6. and finally decide key(s) of that object to get real value (val, prefix,
>    concat)

All of this is true. The irregularity complicates the programming, placing a greater burden upon the user. It seems only fair to ask why it is so.

>
> Thus yes, it is valid JSON, which is parseable by standard JSON's tools,
> but with jq one need either to construct horrible script, or create set of
> simple sctpts on per set base...
>
> I currently play with it in python, and with my real set of sets, i am
> still on step 5 (of above). 
>
> Please, why is JSON output as non user friendly and differs by set's
> settings?

Presumably, interval maps are stored differently. I suspect that it was easier to implement the current schema than it would have been to implement a schema that is more regular in nature. Of course, this is merely a guess on my part.

-- 
Kerin Millar