From: Mike Manning <mmann...@vyatta.att-mail.com> Date: Wed, 7 Nov 2018 15:36:01 +0000
> Services currently have to be VRF-aware if they are using an unbound > socket. One cannot have multiple service instances running in the > default and other VRFs for services that are not VRF-aware and listen > on an unbound socket. This is because there is no easy way of isolating > packets received in the default VRF from those arriving in other VRFs. > > This series provides this isolation for stream sockets subject to the > existing kernel parameter net.ipv4.tcp_l3mdev_accept not being set, > given that this is documented as allowing a single service instance to > work across all VRF domains. Similarly, net.ipv4.udp_l3mdev_accept is > checked for datagram sockets, and net.ipv4.raw_l3mdev_accept is > introduced for raw sockets. The functionality applies to UDP & TCP > services as well as those using raw sockets, and is for IPv4 and IPv6. > > Example of running ssh instances in default and blue VRF: ... Series applied, thanks Mike.
