On Thu, Sep 11, 2014 at 06:35:35PM +0100, Patrick McHardy wrote: > On Thu, Sep 11, 2014 at 07:22:10PM +0200, Pablo Neira Ayuso wrote: > > On Thu, Sep 11, 2014 at 06:57:31PM +0200, Pablo Neira Ayuso wrote: > > > On Thu, Sep 11, 2014 at 05:45:58PM +0100, Patrick McHardy wrote: > > > > > > > > > > Right, I can put the genid notification in a different nfnetlink > > > > > multicast group (NFNLGRP_NFTABLES_GENID) to avoid false positives if > > > > > you like the idea, we have plenty of spare groups. > > > > > > > > I don't think that's a really good idea since the ordering between the > > > > rule notifications and the commit notification wouldn't be reliable. > > > > Same thing is probably true for state notifications, not entirely > > > > sure yet if they could reasonably be sent to a different group. > > > > > > Indeed, we have to stick to one single group. > > > > Oh, you can subscribe to several groups from one single socket. So you > > get them notifications in order. IIRC, the grouping just provides a > > way to filter out what you don't want to listen. > > > > Correct, but at that point we're back to square one because we don't > know why the error orginated :) Right. I'm considering the (likely spamming) stateful notifications that we'll have at some point. Those we can put them in NFNLGRP_NFTABLES_STATES or something similar. So we leave NFNLGRP_NFTABLES for rule-set updates only (including the genid notification, of course). -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
