Re: [PATCH] selftests: nft_queue: conntrack expiration requeue

[Antonio Ojea <aojea@google.com>]

>
> Or, set/clear the label from the nfqueue program itself when setting accept
> verdict (via nested NFQA_CT + CTA_MARK/LABELS).
>
> Same with connmark, but I know that this might be impossible
> due to those being used for policy routing etc.
>

This works pretty good, and is really neat

ct mark 0x66000000 ct state established,related accept
queue flags bypass to 98

So I just need to set the mark/label on the verdict and clear the mark
or the label via netlink and it gets requeued.

I can make it work with connmark very easily but labels seem a better
fit because they allow me to set different values and avoid
compatibility issues.
However, I'm not able to make this work with labels, I do not know if
it is a problem on my side, I'm not able to use the userspace
conntrack tool too.
I think I'm setting the label correctly but the output of conntrack -L
or conntrack -L -o labels do not show anything.
If I try to set the label manually it also fails with ENOSPC

conntrack -U -d 10.244.2.2 --label-add net
conntrack v1.4.8 (conntrack-tools): Operation failed: No space left on device