Re: [PATCH V2] netfilter: nf_conntrack: table full detailed log

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> I was thinking, does the packet logging exposes already the
> net->ns.inum? IIUC the goal is to find what netns is dropping what
> packet and the reason for the packet drop, not only in this case but
> in every case, to ease finding the needle in the stack. If so, then it
> probably makes sense to consolidate this around nf_log()
> infrastructure.

No, it doesn't.  It also depends on the backend:
for syslog, nothing will be logged unless nf_log_all_netns sysctl is
enabled.

For nflog, it is logged, to the relevant namespaces ulogd, or not in
case that netns doesn't have ulogd running.

For syslog one could extend nf_log_dump_packet_common() but I'm not sure
how forgiving existing log parsers are when this gets additional
field.

Also, would (in case we use this for the "table full" condition), should
this log unconditionally or does it need a new sysctl?

Does it need auto-ratelimit (probably yes, its called during packet
flood so we dont want to flood syslog/ulog)?

> Anyway, maybe I'm overdoing, I'll be fine with this approach if you
> consider it good enough to improve the situation.

I think its better than current state of affairs since it at least
allows to figure out which netns is experiencing this.