Re: [PATCH nf] netfilter: nf_conntrack_sip: only honour Via: port in original direction

On Wed, Oct 07, 2026 at 12:52:19PM -0300, Joas Antonio wrote:

Hi,

How the issue was discovered: manual code inspection of
nf_conntrack_sip.c / nf_nat_sip.c, assisted by an LLM (hence the
Assisted-by: tag), while auditing the conntrack helpers for
direction-handling issues.

I then confirmed it at runtime on 602042bf29f6 (QEMU, arm64) with
client -> router -> server network namespaces, the router running
nft masquerade and a "sip" ct helper on udp/5060. When the server
sends a request with "Via: SIP/2.0/UDP <server-ip>:4444", the client
behind the NAT receives that request and a following plain UDP payload
on port 4444; with the patch applied both arrive on 5060.

Sorry, this cannot be nf material.

It looks fairly theoretical to me, maybe for correctness patch? Is
this assuming a rogue server and packet spoofing?

Thanks,
Joas


Em qua., 7 de out. de 2026 às 12:30, [off-list ref] escreveu:

quoted

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

-- 
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@gmail.com
LinkedIn