[3.5.y.z extended stable] Patch "netfilter: nf_ct_sip: don't drop packets with offsets pointing" has been added to staging queue

Luis Henriques luis.henriques at canonical.com
Tue Nov 19 13:18:31 UTC 2013

This is a note to let you know that I have just added a patch titled

    netfilter: nf_ct_sip: don't drop packets with offsets pointing

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:


If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



>From 009bcdd52eb6df0bd6171f9ccf1f79d9700ee981 Mon Sep 17 00:00:00 2001
From: Patrick McHardy <kaber at trash.net>
Date: Fri, 5 Apr 2013 08:13:30 +0000
Subject: netfilter: nf_ct_sip: don't drop packets with offsets pointing
 outside the packet

commit 3a7b21eaf4fb3c971bdb47a98f570550ddfe4471 upstream.

Some Cisco phones create huge messages that are spread over multiple packets.
After calculating the offset of the SIP body, it is validated to be within
the packet and the packet is dropped otherwise. This breaks operation of
these phones. Since connection tracking is supposed to be passive, just let
those packets pass unmodified and untracked.

Signed-off-by: Patrick McHardy <kaber at trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
Cc: William Roberts <bill.c.roberts at gmail.com>
[ luis: backported to 3.5: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
 net/netfilter/nf_conntrack_sip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 93faf6a..4a8c55b 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1468,7 +1468,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,

 		msglen = origlen = end - dptr;
 		if (msglen > datalen)
-			return NF_DROP;
+			return NF_ACCEPT;

 		ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
 		if (ret != NF_ACCEPT)

More information about the kernel-team mailing list