Re: [PATCH nf] netfilter: nf_conntrack_sip: only honour Via: port in original direction

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Oct 07, 2026 at 12:52:19PM -0300, Joas Antonio wrote:
> Hi,
> 
> How the issue was discovered: manual code inspection of
> nf_conntrack_sip.c / nf_nat_sip.c, assisted by an LLM (hence the
> Assisted-by: tag), while auditing the conntrack helpers for
> direction-handling issues.
> 
> I then confirmed it at runtime on 602042bf29f6 (QEMU, arm64) with
> client -> router -> server network namespaces, the router running
> nft masquerade and a "sip" ct helper on udp/5060. When the server
> sends a request with "Via: SIP/2.0/UDP <server-ip>:4444", the client
> behind the NAT receives that request and a following plain UDP payload
> on port 4444; with the patch applied both arrive on 5060.

Sorry, this cannot be nf material.

It looks fairly theoretical to me, maybe for correctness patch? Is
this assuming a rogue server and packet spoofing?

> Thanks,
> Joas
> 
> 
> Em qua., 7 de out. de 2026 às 12:30, <netdev-bot+sinfo@kernel.org> escreveu:
> >
> > Hi!
> >
> > This is an automated message. This series looks like a fix, but its
> > commit messages seem to be missing some information:
> >
> >  - How the issue was discovered, e.g. hit in production, hit during
> >    development, syzbot report, manual code inspection, LLM or static
> >    analysis tool scan.
> >
> > Please do not repost the series just to address the above. Instead,
> > reply to this email with the missing information, so that reviewers
> > can take it into account. If the series needs another revision for
> > other reasons, please include the information in the commit messages
> > then.
> >
> > The evaluation is done by an LLM so it may be wrong, if you think
> > that is the case please reply and explain.
> 
> 
> 
> -- 
> Joas Antonio dos Santos
> Cyber Security Specialist and Ethical Hacker
> joasantonio108@gmail.com
> LinkedIn