nf_conntrack_count is increasing

["Гаврилов Игорь" <iggorok@yandex.ua>]

Hello everyone! I need your advice. I'm trying to improve cls_flow, so that it could get information about NATed addresses on ingress interface. I have changed the code from net/sched/act_connmark.c to make it possible:
	if (ct == NULL){						\
		        switch (tc_skb_protocol(skb)) {			\
		        case htons(ETH_P_IP):				\
                		proto = NFPROTO_IPV4; 			\
				break;					\
		        case htons(ETH_P_IPV6):				\
				proto = NFPROTO_IPV6;			\
				break;					\
			default: goto fallback;				\
	        } 							\
									\
	if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, &tuple)) \
                goto fallback;						\
        zone.id = NF_CT_DEFAULT_ZONE_ID;				\
        zone.dir = NF_CT_DEFAULT_ZONE_DIR;				\
									\
        thash = nf_conntrack_find_get(dev_net(skb->dev), &zone, &tuple);\
        if (!thash) goto fallback;					\
        ct = nf_ct_tuplehash_to_ctrack(thash);				\
	result = ct->tuplehash[(thash->tuple.dst.dir == IP_CT_DIR_REPLY) ? IP_CT_DIR_ORIGINAL : IP_CT_DIR_REPLY].tuple.src.member;	\
	} else {							\
If nf_ct_get() fails to retrieve information from sk_buff, which is obvious on ingress, I use nf_ct_get_tuplepr() and nf_conntrack_find_get() like in net/sched/act_connmark.c, but I have encountered a problem - after a while traffic stops forwarding with the message "nf_conntrack: table is full" and conntrack -F doesn't help - nf_conntrack_count remains large - about 200k. Can anyone advise me how to fix this issue?