Re: [PATCH RFC] netfilter: nf_tables: add flowtable map for xdp offload

[Florian Westphal <fw@strlen.de>]

Toke Høiland-Jørgensen <toke@kernel.org> wrote:
> > It might make more sense to intentionally have packets
> > flow through the normal path periodically so neigh entries are up to
> > date.
> 
> Hmm, I see what you mean, but I worry that this would lead to some nasty
> latency blips when a flow transitions back and forth between kernel and
> XDP paths. Also, there's a reordering problem as the state is changed:
> the first goes through the stack, sets the flow state to active, then
> gets transmitted. But while that sits in the qdisc waiting to go out on
> the wire, the next packet arrives, gets handled by the XDP fastpath and
> ends up overtaking the first packet on the TX side. Not sure we have a
> good solution for this in general :(

From nft based flowtable offload we already had a feature request to
bounce flows back to normal path periodially, this was because people
wanted to make sure that long-living flows get revalidated vs. current
netfilter ruleset and not the one that was active at flow offload time.

There was a patch for it, using a new sysctl, and author never came
back with an updated patch to handle this via the ruleset instead.