Re: [PATCH conntrack] conntrack: label update requires a previous label in place

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Oct 11, 2023 at 01:10:29PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Oct 11, 2023 at 11:55:03AM +0200, Pablo Neira Ayuso wrote:
> > > You have to set an initial label if you plan to update it later on.  If
> > > conntrack comes with no initial label, then it is not possible to attach
> > > it later because conntrack extensions are created by the time the new
> > > entry is created.
> > > 
> > > Skip entries with no label to skip ENOSPC error for conntracks that have
> > > no initial label (this is assuming a scenario with conntracks with and
> > > _without_ labels is possible, and the conntrack command line tool is used
> > > to update all entries regardless they have or not an initial label, e.g.
> > > conntrack -U --label-add "testlabel".
> > 
> > Still not fully correct.
> > 
> > Current behaviour is:
> > 
> > If there is at least one rule in the ruleset that uses the connlabel,
> > then connlabel conntrack extension is always allocated.
> > 
> > I wonder if this needs a sysctl toggle just like
> > nf_conntrack_timestamp. Otherwise I am not sure how to document this.
> 
> Rationale was that if you have no rules that check on labels then
> there is never a need to allocate the space.
> 
> I'm working on a patchset that will also set/enable the label
> extension if its enabled on the template. The idea is to convert
> ovs and act_ct to it, currently they point-blank increment
> net->ct.labels_used which means that all conntrack objects get the
> label area allocated.
> 
> But thats not what the counter was (originally) meant to convey, it
> was really 'number of connlabel rules'.

> As soon as act_ct or ovs modules are loaded, then all the namespaces
> see 'I need conntrack labels', which completely voids all attempts to
> avoid ct->ext allocation.

OK, so instead a of per-netns sysctl toggle, you propose to use the
conntrack template to selectively enable this.