[RFC] SIP conntrack handler and TCP fragmentation

[Ulrich Weber <ulrich.weber@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 672 bytes --]

Hi all,

we had a customer with a Cisco Phone using SIP over TCP
which subscribed to 15 Phone numbers.

Since 15 subscribe calls dont fit in one packet, these
requests were fragmented in multiple TCP packets.

One of these fragments gets rejected then by nf_conntrack_sip with:
nf_ct_sip: dropping packet: cannot parse cseq

The Cisco phone will send retransmits, which got dropped too,
times out after some time, reconnects and same games
starts again...

I know the proper solution would be TCP defragmentation
in the nf_conntrack_sip kernel module. However I'm not
sure if this is worth the effort.
What about just accepting unparsable TCP SIP packets?

Cheers
 Ulrich

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-nf_conntrack_sip-relax-SIP-validation-for-TCP.patch --]
[-- Type: text/x-patch; name="0001-nf_conntrack_sip-relax-SIP-validation-for-TCP.patch", Size: 1099 bytes --]

From 084a77a72bfc1c5c655f51618bfe885a216ce88b Mon Sep 17 00:00:00 2001
From: Ulrich Weber <ulrich.weber@riverbed.com>
Date: Wed, 12 Oct 2016 09:27:23 +0200
Subject: [PATCH] nf_conntrack_sip: relax SIP validation for TCP

Due TCP fragmentation we cant assume full SIP messages all the time.
Therefore Accept all packets, even unparsable.

Signed-off-by: Ulrich Weber <ulrich.weber@gmail.com>
---
 net/netfilter/nf_conntrack_sip.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 621b81c..7700556 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1562,7 +1562,10 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
 			hooks->seq_adjust(skb, protoff, tdiff);
 	}
 
-	return ret;
+	/* Due TCP fragmentation we cant assume full SIP messages all the time.
+	 * Therefore Accept all packets, even unparsable.
+	 */
+	return NF_ACCEPT;
 }
 
 static int sip_help_udp(struct sk_buff *skb, unsigned int protoff,
-- 
2.7.4