On 8/28/15 10:14 PM, David Miller wrote:

From: Eric Dumazet <redacted>
Date: Fri, 28 Aug 2015 18:31:07 -0700

quoted

On Fri, 2015-08-28 at 17:34 -0700, David Ahern wrote:

quoted

Currently the VRF driver registers an Rx handler for enslaved devices.
The handler switches the skb->dev to the VRF device and sends it back for
another pass. While this works fine a side effect is that it bypasses
netfilter with the skb set to the original device.

Arg ... yet another hook in packet processing fast path...

What are long term plans for VRF ? Will it stay VRF-Lite or what ?

+1

Cumulus Networks is invested in the VRF solution, and we will be here 
for the long haul. We want a feature complete, performant and stable 
solution for open networking. My preference is for a built-in solution 
rather than a bolted on one and I am trying to do that by engaging the 
community and getting feedback early for decisions and preferences.

As for the details, I am finishing IPv4 integration now. Basic VRF-lite 
situations work great and I have tested a few IPsec and MPLS setups as 
well. I have one more patch to address Tom's comment regarding 
udp_sendmsg; I need to verify it works for fragmentation and I'll push 
it out. After that I will start on IPv6 next week.

David