Le jeudi 26 mai 2011 Ã 18:50 +0200, Pablo Neira Ayuso a Ãcrit : > Hi Eric, > > On 20/05/11 06:36, Kevin Cernekee wrote: > > Most SIP devices use a source port of 5060/udp on SIP requests, so the > > response automatically comes back to port 5060: > > > > phone_ip:5060 -> proxy_ip:5060 REGISTER > > proxy_ip:5060 -> phone_ip:5060 100 Trying > > > > The newer Cisco IP phones, however, use a randomly chosen high source > > port for the SIP request but expect the response on port 5060: > > > > phone_ip:49173 -> proxy_ip:5060 REGISTER > > proxy_ip:5060 -> phone_ip:5060 100 Trying > > > > Standard Linux NAT, with or without nf_nat_sip, will send the reply back > > to port 49173, not 5060: > > > > phone_ip:49173 -> proxy_ip:5060 REGISTER > > proxy_ip:5060 -> phone_ip:49173 100 Trying > > > > But the phone is not listening on 49173, so it will never see the reply. > > > > This patch modifies nf_*_sip to work around this quirk by extracting > > the SIP response port from the Via: header, iff the source IP in the > > packet header matches the source IP in the SIP request. > > > > Signed-off-by: Kevin Cernekee <cernekee@xxxxxxxxx> > > Acked-by: Eric Dumazet <eric.dumazet@xxxxxxxxx> > > Cc: Patrick McHardy <kaber@xxxxxxxxx> > > @Eric: could you please confirm that you ack'ed this patch? I don't find > the email with your explicit ack. Yes I did it ;) http://www.spinics.net/lists/netfilter/msg49632.html Thanks ! -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
