Re: [PATCH nf-next v4 3/3] netfilter: nftables: add connlabel set support

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Mon, Mar 14, 2016 at 03:09:14PM +0100, Florian Westphal wrote:
> Conntrack labels are currently sized depending on the iptables
> ruleset, i.e. if we're asked to test or set bits 1, 2, and 65 then we
> would allocate enough room to store at least bit 65.
> 
> However, with nft, the input is just a register with arbitrary runtime
> content.
> 
> We therefore ask for the upper ceiling we currently have, which is
> enough room to store 128 bits.

We can probably allow passing the label value as attribute to the
nft_ct expression so you don't have to use the upper ceiling. Patrick
suggested something similar for nft_ct set helper support.

BTW, during NetDev 0.1 he also suggested an alternative to maps that
would suit well for this case, the idea is to use the NFT_SET_EXT_EXPR
to store the connlabel set expression and build a dictionary as
alternative, it would be something like:

        ip saddr map {
                1.2.3.4 : connlabel bitset foo,
        }

So based on the source IP address, for the matching key we run the
expression on the data part of the element.

> Alternatively, we could alter nf_connlabel_replace to increase
> net->ct.label_words at run time, but since 128 bits is not that
> big we'd only save sizeof(long) so it doesn't seem worth it for now.

That's right, we save little memory.

Sorry for this late spinning on this, giving another think after
looking at nf_connlabels_replace() that we don't have it xt_connlabel.