Allow bpfilter to perform connection tracking, similarly to nftables, in order to allow/deny traffic based on a connection state. This will require extensive design to ensure proper performance. There are two approaches possible: - Rely on (recent?) BPF connection tracking kfunc - Re-implement connection tracking in BPF: [[similar to Cilium's approach](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-31752-active-connection-tracking.md)](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-31752-active-connection-tracking.md), avoids kernel lock contention if traffic is high
Allow bpfilter to perform connection tracking, similarly to nftables, in order to allow/deny traffic based on a connection state.
This will require extensive design to ensure proper performance. There are two approaches possible: