Re: [PATCH nf] netfilter: nf_conntrack_sip: only honour Via: port in original direction

On Wed, Oct 07, 2026, Pablo Neira Ayuso wrote:

Sorry, this cannot be nf material.
It looks fairly theoretical to me, maybe for correctness patch? Is
this assuming a rogue server and packet spoofing?

It assumes a rogue (or compromised) SIP peer, but no spoofing: the
peer only uses its own address in the Via: header, so any SIP server
or proxy the client talks to can do it. The effect is limited to that
peer's own flow: it can pick which port >= 1024 its datagrams are
delivered to on the NATed host, instead of the mapped port.

So I agree it is not urgent. I will resend it for nf-next as a
correctness fix, with how it was found in the commit message.

Thanks,
Joas


Em qua., 7 de out. de 2026 às 16:44, Pablo Neira Ayuso
[off-list ref] escreveu:

On Wed, Oct 07, 2026 at 12:52:19PM -0300, Joas Antonio wrote:

quoted

Hi,

How the issue was discovered: manual code inspection of
nf_conntrack_sip.c / nf_nat_sip.c, assisted by an LLM (hence the
Assisted-by: tag), while auditing the conntrack helpers for
direction-handling issues.

I then confirmed it at runtime on 602042bf29f6 (QEMU, arm64) with
client -> router -> server network namespaces, the router running
nft masquerade and a "sip" ct helper on udp/5060. When the server
sends a request with "Via: SIP/2.0/UDP <server-ip>:4444", the client
behind the NAT receives that request and a following plain UDP payload
on port 4444; with the patch applied both arrive on 5060.

Sorry, this cannot be nf material.

It looks fairly theoretical to me, maybe for correctness patch? Is
this assuming a rogue server and packet spoofing?

quoted

Thanks,
Joas


Em qua., 7 de out. de 2026 às 12:30, [off-list ref] escreveu:

quoted

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

--
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@gmail.com
LinkedIn

-- 
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@gmail.com
LinkedIn