Re: [PATCH nf-next 3/3 v2] netfilter: nf_tables: export rule-set generation ID

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Sep 11, 2014 at 06:35:35PM +0100, Patrick McHardy wrote:
> On Thu, Sep 11, 2014 at 07:22:10PM +0200, Pablo Neira Ayuso wrote:
> > On Thu, Sep 11, 2014 at 06:57:31PM +0200, Pablo Neira Ayuso wrote:
> > > On Thu, Sep 11, 2014 at 05:45:58PM +0100, Patrick McHardy wrote:
> > > > > 
> > > > > Right, I can put the genid notification in a different nfnetlink
> > > > > multicast group (NFNLGRP_NFTABLES_GENID) to avoid false positives if
> > > > > you like the idea, we have plenty of spare groups.
> > > > 
> > > > I don't think that's a really good idea since the ordering between the
> > > > rule notifications and the commit notification wouldn't be reliable.
> > > > Same thing is probably true for state notifications, not entirely
> > > > sure yet if they could reasonably be sent to a different group.
> > > 
> > > Indeed, we have to stick to one single group.
> > 
> > Oh, you can subscribe to several groups from one single socket. So you
> > get them notifications in order. IIRC, the grouping just provides a
> > way to filter out what you don't want to listen.
> > 
> 
> Correct, but at that point we're back to square one because we don't
> know why the error orginated :)

Right. I'm considering the (likely spamming) stateful notifications
that we'll have at some point. Those we can put them in
NFNLGRP_NFTABLES_STATES or something similar.  So we leave
NFNLGRP_NFTABLES for rule-set updates only (including the genid
notification, of course).