On 8/28/15 10:14 PM, David Miller wrote:

From: David Ahern <redacted>
Date: Fri, 28 Aug 2015 17:34:20 -0700

quoted

Currently the VRF driver registers an Rx handler for enslaved devices.
The handler switches the skb->dev to the VRF device and sends it back for
another pass. While this works fine a side effect is that it bypasses
netfilter with the skb set to the original device.

Looking at how to provide that feature a few options come to mind:
1. Have the rx handler in the VRF driver duplicate some of the processing
    of ip_rcv up to the NF_HOOK and then switch the skb->dev to vrf device.

2. Run NF_HOOK in ip_rcv twice -- once with orig_dev and then again for dev.

3. Introduce an L3 rx-handler that provides the option of hooking packets
    at L3 rather than the current backlog loop.

This RFC looks at option 3. I wanted to get opinions on the approach
versus other options.

No way, this is not going to pass.

I'll drop this option. Thanks for the quick response.