Martin Willi recently proposed addition of new xt_slavedev module to allow matching the real interface within a VRF domain. This adds an nft equivalent: meta sdif "realdev" accept meta sdifname "realdev" accept In case packet had no vrf slave, sdif stores 0 or "" name, just like 'oif/oifname' would on input. sdif(name) is restricted to the ipv4/ipv6 input and forward hooks, as it depends on ip(6) stack parsing/storing info in skb->cb[]. Because meta main eval function is now exceeding more than 200 LOC, the first patches are diet work to debloat the function by using helpers where appropriate. Last patch adds the sdif/sdifname functionality. Function old new delta nft_meta_get_eval_pkttype_lo - 588 +588 nft_meta_get_eval_time - 404 +404 nft_meta_get_eval_skugid - 397 +397 nft_meta_get_eval_cgroup - 234 +234 nft_meta_get_eval_sif - 148 +148 nft_meta_get_eval_kind - 138 +138 nft_meta_get_eval_sifname - 91 +91 nft_meta_get_validate 111 169 +58 nft_prandom_u32 - 20 +20 nft_meta_get_eval 2904 1261 -1643 Total: Before=6076, After=6511, chg +7.16%
