Re: [PATCH net-next RFC] netfilter: flowtable: add CT metadata action for nft flowtables

[Elad Yifee]

On Wed, Sep 17, 2025 at 1:39 AM Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
>
> May I ask, where is the software plane extension for this feature?
> Will you add it for net/sched/act_ct.c?
>
> Adding the hardware offload feature only is a deal breaker IMO.
Software plane: This doesn’t add a new user feature, it just surfaces
existing CT state to offload so the software plane already exists
today via nft/TC. In software you can already set/match ct mark/labels
(e.g., tag flows), and once offloaded the exporter snapshots that so a
driver can map the tag to a HW queue/class if it wants per-flow QoS in
hardware. Drivers that don’t need it can simply accept and ignore the
metadata.

act_ct.c: Yes - I’ll include a small common helper so TC and nft
flowtable offloads produce identical CT metadata.

If there’s no objection to the direction, I’ll respin with:
- the common helper
- act_ct switched to it
- nft flowtable exporter appending CT metadata