Re: [PATCH RFC] netfilter: nf_tables: add flowtable map for xdp offload

["Toke Høiland-Jørgensen" <toke@kernel.org>]

Florian Westphal <fw@strlen.de> writes:

> Toke Høiland-Jørgensen <toke@kernel.org> wrote:
>> > It might make more sense to intentionally have packets
>> > flow through the normal path periodically so neigh entries are up to
>> > date.
>> 
>> Hmm, I see what you mean, but I worry that this would lead to some nasty
>> latency blips when a flow transitions back and forth between kernel and
>> XDP paths. Also, there's a reordering problem as the state is changed:
>> the first goes through the stack, sets the flow state to active, then
>> gets transmitted. But while that sits in the qdisc waiting to go out on
>> the wire, the next packet arrives, gets handled by the XDP fastpath and
>> ends up overtaking the first packet on the TX side. Not sure we have a
>> good solution for this in general :(
>
> From nft based flowtable offload we already had a feature request to
> bounce flows back to normal path periodially, this was because people
> wanted to make sure that long-living flows get revalidated vs. current
> netfilter ruleset and not the one that was active at flow offload time.
>
> There was a patch for it, using a new sysctl, and author never came
> back with an updated patch to handle this via the ruleset instead.

Right, if there's an existing policy knob for this it makes sense to
support it in the XDP case as well, of course.

Does HW flow offload deal with that reordering case at all, BTW? I
assume it could happen for that as well?

-Toke