Since kernel 3.9, NAT for SIP protocol seems to be broken for some SIP providers, with these error messages : May 19 22:20:45 lxorgfr kernel: [ 55.223319] nf_ct_sip: dropping packet: cannot NAT SIP message IN= OUT= SRC=212.27.52.5 DST=192.168.128.30 LEN=338 TOS=0x00 PREC=0x00 TTL=55 ID=0 DF PROTO=UDP SPT=5060 DPT=49027 LEN=318 I think this problem has been introduced in nf_nat_sip.c, between v3.8 and v3.9 with this specific change: @@ -222,6 +231,7 @@ false); if (!mangle_packet(skb, protoff, dataoff, dptr, datalen, poff, plen, buffer, buflen)) + nf_ct_helper_log(skb, ct, "cannot mangle received"); return NF_DROP; } This patch restores the correct logic: --- nf_nat_sip.c.orig 2013-04-29 02:36:01.000000000 +0200 +++ nf_nat_sip.c 2013-05-20 22:46:47.270956349 +0200 @@ -230,9 +230,10 @@ &ct->tuplehash[!dir].tuple.src.u3, false); if (!mangle_packet(skb, protoff, dataoff, dptr, datalen, - poff, plen, buffer, buflen)) + poff, plen, buffer, buflen)) { nf_ct_helper_log(skb, ct, "cannot mangle received"); return NF_DROP; + } } /* The rport= parameter (RFC 3581) contains the port number
This is commit: commit 5aed93875cd88502f04a0d4517b8a2d89a849773 Author: Balazs Peter Odor <balazs> Date: Sat Jun 22 19:24:43 2013 +0200 netfilter: nf_nat_sip: fix mangling In (b20ab9c netfilter: nf_ct_helper: better logging for dropped packets) there were some missing brackets around the logging information, thus always returning drop. Closes https://bugzilla.kernel.org/show_bug.cgi?id=60061 Signed-off-by: Balazs Peter Odor <balazs> Signed-off-by: Pablo Neira Ayuso <pablo> it was included in v3.10 and has not been backported in 3.9.x. Fabrice, if you update to kernel-3.10.10-200.fc19.x86_64.rpm it'll be included. Thanks for the report, Michele
*********** MASS BUG UPDATE ************** We apologize for the inconvenience. There is a large number of bugs to go through and several of them have gone stale. Due to this, we are doing a mass bug update across all of the Fedora 18 kernel bugs. Fedora 18 has now been rebased to 3.11.4-101.fc18. Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel. If you have moved on to Fedora 19, and are still experiencing this issue, please change the version to Fedora 19. If you experience different issues, please open a new bug report for those.
Yes, this bug is fixed with these newer kernels. So I close this bug report. Thanks!