Does it go through the FTP messages to find out the data-connection tuple (dst_ip, dst_prt, src_ip, src_prt) ? I know that is way too impractical to implement.
Yes, that is exactly what it does. Why do you think it's too impractical?
You can look at the code yourself here:
Edit: OK, after your later comments I think I now understand what you meant.
The kernel would only need to analyze the beginning of the first few data packets of every TCP connection to see if it looks like a FTP control connection or not, and only mark the actual FTP control connections for further analysis. Only the connections that look like FTP would be monitored for data-connection tuples.
But a few years ago, it turned out that such fully-automatic tracking could be abused for malicious purposes. So with modern kernels, you now need to explicitly set up iptables connection tracking helper rules for protocols that need them, and that means if you use a non-default destination port for the FTP connection, you'll need a custom rule for that. But now you can fully control which interfaces, ports and connection destinations/directions will get the tracking helpers and which will not.
The connection tracking helper rule for FTP in regular should look like this:
iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp
If you have a firewall that only accepts connections to specific inbound ports, you might also need a rule like this in your INPUT and/or FORWARD chain to accept the inbound active FTP connections:
iptables -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
For data connections of control connections using a non-default port, you'll need a slightly modified rule, e.g. to accept data connections belonging to a control connection in port 2121:
iptables -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp-2121 -p tcp --dport 1024: -j ACCEPT
By the way, there are several connection tracking helper modules available:
ftp for FTP protocol, obviously.
irc for the Internet Relay Chat protocol. Port numbers will vary.
netbios-ns which you should not need for anything any more, since the WannaCry worm proved the SMB 1.0 protocol (that was used with the old NetBIOS style Windows filesharing) has a fatal flaw. Standard port for this would be 137/UDP.
snmp for the Simple Network Management Protocol, standard port 161/UDP.
Q.931 for h.323 video-conferencing sub-protocols (the old Microsoft NetMeeting etc). Ports 1719/UDP and 1720/TCP respectively.
sip for the SIP internet telephony protocol. Standard port 5060, both TCP and UDP supported.
sane for the network protocol of the SANE scanner software, standard port 6566/TCP.
pptp for the RFC2637 Point-to-Point Tunneling Protocol, a form of VPN.
tftp if you need to pass TFTP connections across a NAT.
amanda for the network protocol of Amanda backup software.