Re: [PATCH conntrack] conntrack: label update requires a previous label in place

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Oct 11, 2023 at 11:55:03AM +0200, Pablo Neira Ayuso wrote:
> > You have to set an initial label if you plan to update it later on.  If
> > conntrack comes with no initial label, then it is not possible to attach
> > it later because conntrack extensions are created by the time the new
> > entry is created.
> > 
> > Skip entries with no label to skip ENOSPC error for conntracks that have
> > no initial label (this is assuming a scenario with conntracks with and
> > _without_ labels is possible, and the conntrack command line tool is used
> > to update all entries regardless they have or not an initial label, e.g.
> > conntrack -U --label-add "testlabel".
> 
> Still not fully correct.
> 
> Current behaviour is:
> 
> If there is at least one rule in the ruleset that uses the connlabel,
> then connlabel conntrack extension is always allocated.
> 
> I wonder if this needs a sysctl toggle just like
> nf_conntrack_timestamp. Otherwise I am not sure how to document this.

Rationale was that if you have no rules that check on labels then
there is never a need to allocate the space.

I'm working on a patchset that will also set/enable the label
extension if its enabled on the template. The idea is to convert
ovs and act_ct to it, currently they point-blank increment
net->ct.labels_used which means that all conntrack objects get the
label area allocated.

But thats not what the counter was (originally) meant to convey, it
was really 'number of connlabel rules'.

As soon as act_ct or ovs modules are loaded, then all the namespaces
see 'I need conntrack labels', which completely voids all attempts to
avoid ct->ext allocation.