Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > If the motion for these hooks in the driver is to match for 'oif vrf', > now that there is an egress hook, it might make more sense to filter > from there based on the interface rather than adding these hook calls > from the vrf driver? > > I wonder if, in the future, it makes sense to entirely disable these > hooks in the vrf driver and rely on egress hook? Agree, it would be better to support ingress+egress hhoks from vrf so vrf specific filtering can be done per-device. I don't think we can just remove the existing NF_HOOK()s in vrf though. We could add toggles to disable them, but I'm not sure how to best expose that (ip link attribute, ethtool, sysctl ...)...?
