Hi all, we had a customer with a Cisco Phone using SIP over TCP which subscribed to 15 Phone numbers. Since 15 subscribe calls dont fit in one packet, these requests were fragmented in multiple TCP packets. One of these fragments gets rejected then by nf_conntrack_sip with: nf_ct_sip: dropping packet: cannot parse cseq The Cisco phone will send retransmits, which got dropped too, times out after some time, reconnects and same games starts again... I know the proper solution would be TCP defragmentation in the nf_conntrack_sip kernel module. However I'm not sure if this is worth the effort. What about just accepting unparsable TCP SIP packets? Cheers Ulrich
From 084a77a72bfc1c5c655f51618bfe885a216ce88b Mon Sep 17 00:00:00 2001 From: Ulrich Weber <ulrich.weber@xxxxxxxxxxxx> Date: Wed, 12 Oct 2016 09:27:23 +0200 Subject: [PATCH] nf_conntrack_sip: relax SIP validation for TCP Due TCP fragmentation we cant assume full SIP messages all the time. Therefore Accept all packets, even unparsable. Signed-off-by: Ulrich Weber <ulrich.weber@xxxxxxxxx> --- net/netfilter/nf_conntrack_sip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 621b81c..7700556 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1562,7 +1562,10 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, hooks->seq_adjust(skb, protoff, tdiff); } - return ret; + /* Due TCP fragmentation we cant assume full SIP messages all the time. + * Therefore Accept all packets, even unparsable. + */ + return NF_ACCEPT; } static int sip_help_udp(struct sk_buff *skb, unsigned int protoff, -- 2.7.4
