Re: [PATCH v2 net-next 2/2] vrf: run conntrack only in context of lower/physdev for locally generated packets

Hi,

One question about this.

On Mon, Oct 25, 2021 at 04:14:00PM +0200, Florian Westphal wrote:

The VRF driver invokes netfilter for output+postrouting hooks so that users
can create rules that check for 'oif $vrf' rather than lower device name.

If the motion for these hooks in the driver is to match for 'oif vrf',
now that there is an egress hook, it might make more sense to filter
from there based on the interface rather than adding these hook calls
from the vrf driver?

I wonder if, in the future, it makes sense to entirely disable these
hooks in the vrf driver and rely on egress hook?