Re: [PATCH v2 net-next 2/2] vrf: run conntrack only in context of lower/physdev for locally generated packets

Pablo Neira Ayuso [off-list ref] wrote:

If the motion for these hooks in the driver is to match for 'oif vrf',
now that there is an egress hook, it might make more sense to filter
from there based on the interface rather than adding these hook calls
from the vrf driver?

I wonder if, in the future, it makes sense to entirely disable these
hooks in the vrf driver and rely on egress hook?

Agree, it would be better to support ingress+egress hhoks from vrf
so vrf specific filtering can be done per-device.

I don't think we can just remove the existing NF_HOOK()s in vrf though.

We could add toggles to disable them, but I'm not sure how to best
expose that (ip link attribute, ethtool, sysctl ...)...?