Currently the new ct id is a hash based on several attributes which do
not change throughout lifetime of the connection. However, the hash
includes the reply side tuple which does change during NAT on the
first packet. This means the ct id associated with the first packet of
a connection pre-NAT is different than it is post-NAT. This means if
you are using nfqueue or nflog in userspace the associated ct id
changes from pre-NAT on the first packet to post-NAT on the first
packet or all subsequent packets.
Below is a patch that (I think) provides the same level of uniqueness
of the hash, but is consistent through the lifetime of the first
packet and afterwards because it only uses the original direction
tuple.
Signed-off-by: Dirk Morris <dmorris@xxxxxxxxxxxx>
---
nf_conntrack_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a542761..eae4898 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -471,7 +471,8 @@ u32 nf_ct_get_id(const struct nf_conn *ct)
a = (unsigned long)ct;
b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
c = (unsigned long)ct->ext;
- d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
+ d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+ sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
&ct_id_seed);
#ifdef CONFIG_64BIT
return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
