Re: [PATCH nf] netfilter: nft_ct: enable labels for get case too

[Florian Westphal <fw@strlen.de>]

Antonio Ojea <aojea@google.com> wrote:
> Hi Florian, I'm trying to add a kselftest

Thanks!

> but it seems the conntrack
> tool fails to add the label if the /etc/xtables/connlabel.conf file
> does not exist. This is the behavior I'm observing:
> - conntrack -U:
>   - fails if the file does not exist
>   - works if the file exists, but if the entry does not exist in the
> file the tool throws an error but the label is added
> - conntrack -L -o label
>   - does not output the label if the file does not exist or is empty.
>   - if the file exists and the ct entry label exists in the file, then
> it's correctly displayed in conntrack -L
>   - if the file exists but  the label is not present in the file, the
> output has a labels statement but is empty

Hmm, this isn't ideal, it should resort to a hexdump in that case
(on -L), needs a fix.

> Can you give me advice on how to proceed?

Best advice I can give is to check if conntrack tool supports
--labelmap option (not in any released version, added in June this
year).

And then add a custom temporary config file via 'mktemp' + feed that
file to conntrack.