From 58a5b32b2d5c7b6b755121930b6752e6c714f24f Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 11 Oct 2023 11:21:40 +0200 Subject: conntrack: ct label update requires proper ruleset As of kernel 6.6-rc, your ruleset must use either the 'connlabel' match in iptables or the 'ct label' statement in nftables to attach labels to conntrack entries. Update documentation to describe this behaviour. This patch addresses a corner case scenario: conntrack already contains entries but ruleset that specifies connlabel did not get loaded yet. In such case, skip ENOSPC errors for conntracks that have no ct label extension. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1622 Signed-off-by: Pablo Neira Ayuso --- src/conntrack.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src') diff --git a/src/conntrack.c b/src/conntrack.c index f9758d7..c1551ca 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -2195,6 +2195,11 @@ static int mnl_nfct_update_cb(const struct nlmsghdr *nlh, void *data) /* the entry has vanish in middle of the update */ if (errno == ENOENT) goto destroy_ok; + else if (cmd->options & (CT_OPT_ADD_LABEL | CT_OPT_DEL_LABEL) && + !nfct_attr_is_set(ct, ATTR_CONNLABELS) && + errno == ENOSPC) + goto destroy_ok; + exit_error(OTHER_PROBLEM, "Operation failed: %s", err2str(errno, CT_UPDATE)); -- cgit v1.2.3