Re: [PATCH RFC] netfilter: nf_tables: add flowtable map for xdp offload

[Florian Westphal <fw@strlen.de>]

Toke Høiland-Jørgensen <toke@kernel.org> wrote:
> > From nft based flowtable offload we already had a feature request to
> > bounce flows back to normal path periodially, this was because people
> > wanted to make sure that long-living flows get revalidated vs. current
> > netfilter ruleset and not the one that was active at flow offload time.
> >
> > There was a patch for it, using a new sysctl, and author never came
> > back with an updated patch to handle this via the ruleset instead.
> 
> Right, if there's an existing policy knob for this it makes sense to
> support it in the XDP case as well, of course.
> 
> Does HW flow offload deal with that reordering case at all, BTW? I
> assume it could happen for that as well?

We do not have such a feature, only a request.  The patch was never
applied because we belive a sysctl based approach is not very flexible.

HW can bounce offloaded packets at any time.
SW fallback bounces packets that it cannot handle, currently those
are ip options or ip fragments.

FIN or RST moves flow back to slowpath permanently.