Re: [PATCH ulogd2] nfct: add network namespace support

[Florian Westphal <fw@strlen.de>]

Corubba Smith <corubba@gmx.de> wrote:
> Add a new option which allows opening the netlink socket in a different
> network namespace. This way you can run ulogd in one (management)
> network namespace which is able to talk with your export target (e.g.
> database or IPFIX collector), and import flows from multiple (customer)
> network namespaces.

Makes sense to me.

> This commit only implements it for NFCT. I wanted to gather some
> feedback before also implementing it for the other netlink-based
> plugins.

Does it make sense to have this configured on a per-plugin basis?

>    Input plugins:
>      NFLOG plugin:			${enable_nflog}
>      NFCT plugin:			${enable_nfct}

> +#ifdef NETNS_SUPPORT
> +	if (strlen(target_netns_path) > 0) {
> +		errno = 0;
> +		original_netns_fd = open("/proc/self/ns/net", O_RDONLY | O_CLOEXEC);
> +		if (original_netns_fd < 0) {
> +			ulogd_log(ULOGD_FATAL, "error opening original network namespace: %s\n", strerror(errno));
> +			goto err_ons;
> +		}

I think that in order to not have copypastry in all relevant plugins
it would be better to turn code in the NETNS_SUPPORT ifdefs section
into library helpers.

The helpers would always exist; in case ulogd2 is built without
support they would raise an error.

That would also keep the ifdef out of plugin code.