nf_ct_match_reverse(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

πŸ’… nf_ct_match_reverse(9) πŸ’…

okay so bestie, welcome to the Kernel API Manual β€” today's main character is nf_ct_match_reverse, and honestly? she's a lil detective for conntrack flows. let's get into it πŸ•΅οΈβ€β™€οΈβœ¨


✨ NAME ✨

nf_ct_match_reverse β€” check if ct1 and ct2 refer to identical flow 🫢


🌈 SYNOPSIS 🌈

bool nf_ct_match_reverse (const struct nf_conn *ct1 , const struct
       nf_conn *ct2 );

like, she takes two const struct nf_conn * and hands you back a bool. no cap. πŸ’…


πŸŽ€ ARGUMENTS πŸŽ€

  • ct1 β€” the conntrack in the hash table you're checking against. she's the reference point, the blueprint, the one already sitting in the table πŸ‘‘
  • ct2 β€” the merge candidate. the new girl. the one we're like "hmm, are you actually the same person as ct1 but backwards?" πŸ™ˆ

πŸ¦‹ DESCRIPTION πŸ¦‹

so here's the vibe: this returns true if ct1 and ct2 happen to refer to the same flow, but in opposing directions. like literally:

ct1: a:b -> c:d
ct2: c:d -> a:b

and this holds for both directions, bestie. both of 'em. πŸ”₯

if that's the case, then ct2 should not have been created at all, because the skb should have been picked up as an ESTABLISHED flow. periodt. but 😭 β€” ct1 was not yet committed to the hash table before the skb that created ct2 had arrived. so we get this awkward little "oops, two of the same flow" moment. it's giving race condition energy ngl πŸ’€

also note: we don't compare netns because ct entries in different net namespaces cannot clash to begin with. so like, no need, it's simply not a thing, iykyk 🧚


⭐ RETURN ⭐

true if ct1 and ct2 are identical when swapping origin/reply. slay. βœ…


🌸 SEE ALSO 🌸


and that's the page!! πŸ’– this lil manual came from the source/version ./net/netfilter, dated October 2026 β€” so like, mark your calendars, screenshot it, send it to the group chat, mwah πŸ’‹πŸŽ€

πŸ“¦ where this page comes from