how to config Conn instance when snat is used?

[shanba]

type Con struct {
Origin *IPTuple
Reply *IPTuple
ProtoInfo *ProtoInfo
CounterOrigin *Counter
CounterReply *Counter
Helper *Helper
SeqAdjOrig *SeqAdj
SeqAdjRepl *SeqAdj
ID *uint32
Status *uint32
Use *uint32
Mark *uint32
MarkMask *uint32
Timeout *uint32
Zone *uint16
Timestamp *Timestamp
SecCtx *SecCtx
Exp *Exp
}

Through above structure, don't find the something likes nat ip, eg. --nat-src-ip params when using conntrack-tools， then how to set Conn instance when use snat？ I set the Status of IPS_SRC_NAT_BIT, and then create a session, while dump session found only low 3 bit can set(IPS_SEEN_REPLY, IPS_ASSURED.....), but IPS_SRC_NAT_BIT not seted, so, am i using it in a wrong way ?

[florianl]

I'm not aware of a --nat-src-ip option. Can you point to public documentation of it, so I can read up on it? At the moment I'm not sure about the request.
Can you provide a command line which showcases what you are trying to achieve with this package?

Even if Status is of type uint32, the Kernel does not accept everything - see:
https://github.com/torvalds/linux/blob/626bf91a292e2035af5b9d9cce35c5c138dfe06d/net/netfilter/nf_conntrack_netlink.c#L1884-L1905

[shanba]

Sorry for update after so many days!
yeah， I notice that there are two conntrack attribute are ignored, ctaNatSrc and ctaNatDst. This is the key point of the problem. When i add this two attributes to netlink msg, all works fine! As expect, i can specify the snat ip when create a conntrack entry， and then dump status of the conntrack，can find the IPS_SRC_NAT_BIT is seted. So, my question is why CAN NOT accept ctaNatSrc and ctaNatDst attribute like others in function ? for example, ctaTupleOrig. I notice some docs says they are deprecated, i'm confused.

[florianl]

Thanks for the update. And glad to hear it is not an issue or bug with this package.

The kernel applies some checks on given arguments and depending on the kernel version this can end in different results. So its hard to tell or help without more details. Also I don't know which documentation you are using which declares something as deprecated.

[shanba]

oh， let me describe simplely!

1. kernel can handle a conntrack netlink attribute type named CTA_NAT_SRC, right? at least in kernel v5.10, code is there. when this attribute is encode in netlink msg, then kernel receive msg and set IPS_SRC_NAT bit in ct->status.
2. go-conntrack package, also declare conntrack attribute ctaNatSrc, BUT, did't encode into netlink msg? In function nestAttributes, not found encoding this attribute.

const (
ctaUnspec = iota
ctaTupleOrig
ctaTupleReply
ctaStatus
ctaProtoinfo
ctaHelp
【ctaNatSrc】 <-------------------------------see here
ctaTimeout
ctaMark
ctaCountersOrig
ctaCountersReply
ctaUse
ctaID
ctaNatDst
ctaTupleMaster
ctaSeqAdjOrig
ctaSeqAdjRepl
ctaSecmark
ctaZone
ctaSecCtx
ctaTimestamp
ctaMarkMask
ctaLables
ctaLablesMask
)

so , is this reasonable?

[florianl]

ok - I see you point. ctaNatSrc and ctaNatDst is not yet implemented completly.

With #31 I have started implementing it and apprecheate feedback.

I'm mostly interested in output from the logger, that can be attached via https://pkg.go.dev/github.com/florianl/go-conntrack#Config

[shanba]

Thank you for doing that! and thank you for your patience！