Re: [PATCH net-next RFC] netfilter: flowtable: add CT metadata action for nft flowtables

[Elad Yifee <eladwf@gmail.com>]

On Thu, Sep 25, 2025 at 1:51 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> You have to show me there is no mismatch.
>
> This is exposing the current ct mark/label to your hardware, the
> flowtable infrastructure (the software representation) makes no use of
> this information from the flowtable datapath, can you explain how you
> plan to use this?
>
> Thanks.

Thanks for getting back to this.

My goal is per-flow HW QoS on offloaded connections. Once a flow is
promoted to the nft flowtable fast path, nft rules that set packet
marks are bypassed, so a driver no longer has a stable tag to map to
HW queues. The conntrack mark/labels are flow-scoped and persist
across offload, which is why I’d like to expose them to the driver as
metadata at the hardware offload boundary.

To address your “no mismatch” concern: this wouldn’t change the
software datapath at all, it would only surface existing CT state to
hardware. Could you advise on the best way to proceed here? Would an
offload-only exposure (drivers may use it or ignore it) be acceptable,
or would you prefer a specific software-side representation before we
add the hardware export?