From: Florian Westphal <fw@strlen.de>
To: Ulrich Weber <ulrich.weber@gmail.com>
Cc: netfilter-devel@vger.kernel.org, Patrick McHardy <kaber@trash.net>
Subject: Re: [RFC] SIP conntrack handler and TCP fragmentation
Date: Wed, 12 Oct 2016 09:52:12 +0200 [thread overview]
Message-ID: <20161012075212.GA26177@breakpoint.cc> (raw)
In-Reply-To: <c92b64f3-9f69-eb7c-402c-3e489f73a527@gmail.com>
Ulrich Weber <ulrich.weber@gmail.com> wrote:
> we had a customer with a Cisco Phone using SIP over TCP
> which subscribed to 15 Phone numbers.
>
> Since 15 subscribe calls dont fit in one packet, these
> requests were fragmented in multiple TCP packets.
>
> One of these fragments gets rejected then by nf_conntrack_sip with:
> nf_ct_sip: dropping packet: cannot parse cseq
>
> The Cisco phone will send retransmits, which got dropped too,
> times out after some time, reconnects and same games
> starts again...
>
> I know the proper solution would be TCP defragmentation
> in the nf_conntrack_sip kernel module. However I'm not
> sure if this is worth the effort.
I think an even better solution would be a SIP proxy that can
inject expectations to keep datapath in kernel and only deals with
the signalling traffic.
> What about just accepting unparsable TCP SIP packets?
I wonder why this patch did not fix your problem:
3a7b21eaf4fb3c971bdb47a98f570550ddfe4471
Author: Patrick McHardy <kaber@trash.net>
netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet
It specifically deals with this problem (l7 size larger than packet
size).
next prev parent reply other threads:[~2016-10-12 8:17 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-12 7:38 [RFC] SIP conntrack handler and TCP fragmentation Ulrich Weber
2016-10-12 7:52 ` Florian Westphal [this message]
2016-10-12 8:52 ` Ulrich Weber
2016-10-12 11:41 ` Florian Westphal
2016-10-12 12:27 ` Ulrich Weber
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161012075212.GA26177@breakpoint.cc \
--to=fw@strlen.de \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=ulrich.weber@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.