]> git.proxmox.com Git - mirror_ubuntu-disco-kernel.git/commit
netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones
authorKevin Cernekee <cernekee@gmail.com>
Mon, 17 Dec 2012 18:33:58 +0000 (18:33 +0000)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 17 Jan 2013 20:12:44 +0000 (21:12 +0100)
commit7266507d89991fa1e989283e4e032c6d9357fe26
treeaca858b5ac98c695d8b636a9d27549a3af37e016
parent247fa82be1301e4f89eaa5dc10be62a9cc84e8c5
netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones

Most SIP devices use a source port of 5060/udp on SIP requests, so the
response automatically comes back to port 5060:

    phone_ip:5060 -> proxy_ip:5060   REGISTER
    proxy_ip:5060 -> phone_ip:5060   100 Trying

The newer Cisco IP phones, however, use a randomly chosen high source
port for the SIP request but expect the response on port 5060:

    phone_ip:49173 -> proxy_ip:5060  REGISTER
    proxy_ip:5060 -> phone_ip:5060   100 Trying

Standard Linux NAT, with or without nf_nat_sip, will send the reply back
to port 49173, not 5060:

    phone_ip:49173 -> proxy_ip:5060  REGISTER
    proxy_ip:5060 -> phone_ip:49173  100 Trying

But the phone is not listening on 49173, so it will never see the reply.

This patch modifies nf_*_sip to work around this quirk by extracting
the SIP response port from the Via: header, iff the source IP in the
packet header matches the source IP in the SIP request.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/linux/netfilter/nf_conntrack_sip.h
net/netfilter/nf_conntrack_sip.c
net/netfilter/nf_nat_sip.c