On Tue, Oct 26, 2021 at 02:58:58PM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > If the motion for these hooks in the driver is to match for 'oif vrf', > > now that there is an egress hook, it might make more sense to filter > > from there based on the interface rather than adding these hook calls > > from the vrf driver? > > > > I wonder if, in the future, it makes sense to entirely disable these > > hooks in the vrf driver and rely on egress hook? > > Agree, it would be better to support ingress+egress hhoks from vrf > so vrf specific filtering can be done per-device. > > I don't think we can just remove the existing NF_HOOK()s in vrf though. I understand, there are people relying on this. > We could add toggles to disable them, but I'm not sure how to best > expose that (ip link attribute, ethtool, sysctl ...)...? I would make it global toggle. As you mentioned it might be good to explore an alternative to this via the ingress+egress hooks now that the usecases are better known?
