Ulrich Weber <ulrich.we...@gmail.com> wrote:
> we had a customer with a Cisco Phone using SIP over TCP
> which subscribed to 15 Phone numbers.
> 
> Since 15 subscribe calls dont fit in one packet, these
> requests were fragmented in multiple TCP packets.
> 
> One of these fragments gets rejected then by nf_conntrack_sip with:
> nf_ct_sip: dropping packet: cannot parse cseq
> 
> The Cisco phone will send retransmits, which got dropped too,
> times out after some time, reconnects and same games
> starts again...
> 
> I know the proper solution would be TCP defragmentation
> in the nf_conntrack_sip kernel module. However I'm not
> sure if this is worth the effort.

I think an even better solution would be a SIP proxy that can
inject expectations to keep datapath in kernel and only deals with
the signalling traffic.

> What about just accepting unparsable TCP SIP packets?

I wonder why this patch did not fix your problem:

3a7b21eaf4fb3c971bdb47a98f570550ddfe4471
Author: Patrick McHardy <ka...@trash.net>
netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the 
packet

It specifically deals with this problem (l7 size larger than packet
size).

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to