On Wed, Oct 11, 2023 at 01:10:29PM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Wed, Oct 11, 2023 at 11:55:03AM +0200, Pablo Neira Ayuso wrote: > > > You have to set an initial label if you plan to update it later on. If > > > conntrack comes with no initial label, then it is not possible to attach > > > it later because conntrack extensions are created by the time the new > > > entry is created. > > > > > > Skip entries with no label to skip ENOSPC error for conntracks that have > > > no initial label (this is assuming a scenario with conntracks with and > > > _without_ labels is possible, and the conntrack command line tool is used > > > to update all entries regardless they have or not an initial label, e.g. > > > conntrack -U --label-add "testlabel". > > > > Still not fully correct. > > > > Current behaviour is: > > > > If there is at least one rule in the ruleset that uses the connlabel, > > then connlabel conntrack extension is always allocated. > > > > I wonder if this needs a sysctl toggle just like > > nf_conntrack_timestamp. Otherwise I am not sure how to document this. > > Rationale was that if you have no rules that check on labels then > there is never a need to allocate the space. > > I'm working on a patchset that will also set/enable the label > extension if its enabled on the template. The idea is to convert > ovs and act_ct to it, currently they point-blank increment > net->ct.labels_used which means that all conntrack objects get the > label area allocated. > > But thats not what the counter was (originally) meant to convey, it > was really 'number of connlabel rules'. > As soon as act_ct or ovs modules are loaded, then all the namespaces > see 'I need conntrack labels', which completely voids all attempts to > avoid ct->ext allocation. OK, so instead a of per-netns sysctl toggle, you propose to use the conntrack template to selectively enable this.
