Dirk Morris <dmorris@xxxxxxxxxxxx> wrote: > Currently the new ct id is a hash based on several attributes which do > not change throughout lifetime of the connection. However, the hash > includes the reply side tuple which does change during NAT on the > first packet. This means the ct id associated with the first packet of > a connection pre-NAT is different than it is post-NAT. This means if > you are using nfqueue or nflog in userspace the associated ct id > changes from pre-NAT on the first packet to post-NAT on the first > packet or all subsequent packets. > > Below is a patch that (I think) provides the same level of uniqueness > of the hash, but is consistent through the lifetime of the first > packet and afterwards because it only uses the original direction > tuple. This is unexpected, as the id function is only supposed to be called once the conntrack has been confirmed, at which point all NAT side effects are supposed to be done. In which case(s) does that assumption not hold?
