From a0980228efa9cb4c2546dbbaaa9475db04f59cce Mon Sep 17 00:00:00 2001 From: Vitaly Lavrov Date: Tue, 31 Oct 2017 22:04:14 +0300 Subject: [PATCH] Bug fix. Protocol SIP: command 'CANCEL sip:' is not recognized. Add sip.pcap for tests ( Source: https://wiki.wireshark.org/SIP ). --- src/lib/protocols/sip.c | 2 +- tests/pcap/sip.pcap | Bin 0 -> 50975 bytes tests/result/sip.pcap.out | 8 ++++++++ 3 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 tests/pcap/sip.pcap create mode 100644 tests/result/sip.pcap.out diff --git a/src/lib/protocols/sip.c b/src/lib/protocols/sip.c index 94386d61e..67459f562 100644 --- a/src/lib/protocols/sip.c +++ b/src/lib/protocols/sip.c @@ -121,7 +121,7 @@ void ndpi_search_sip_handshake(struct ndpi_detection_module_struct } if ((memcmp(packet_payload, "CANCEL ", 7) == 0 || memcmp(packet_payload, "cancel ", 7) == 0) - && (memcmp(&packet_payload[4], "SIP:", 4) == 0 || memcmp(&packet_payload[4], "sip:", 4) == 0)) { + && (memcmp(&packet_payload[7], "SIP:", 4) == 0 || memcmp(&packet_payload[7], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip CANCEL.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; diff --git a/tests/pcap/sip.pcap b/tests/pcap/sip.pcap new file mode 100644 index 0000000000000000000000000000000000000000..8cd7f47612ccf9255e6cb8b98054a81c12ef1e03 GIT binary patch literal 50975 zcmeHw34BxMmG6}|f`f?-HjtMPZfPb>r^wuWF)H_>O^s#GP4pJaEdPex?PoL(M z$_hn-R&_$k$}DyDJ0L4_mQ+<`FP>e1v%El26i=XQ9snnIEyh-s?}iF}rT^_t^* zwE#yi!-p)^Ru|x$fCrY__qm$WYyXbsEc2EZ;P9^bQl0&7m**kLqt+DQJiM}`M)TN< z%HVwk_yW!2LLw+xj2D;SCFL%shA-7TH4c{(2N~tFBnTucGbH<*#FsdwT5q|_<5;Ju39M@02@j6I4Gkd( zJHZelWhZ%plynY$pa_NINgf1jsk$Cb(Hv_uwNN1PDHx`a0YrV$5*1ro`Yx#$Dfwg7`8eisdIm>XjR8#Yi%agdh8T>Uj*&BiN+Z$1^v!uka zGR*++3;~(!0sW_sq*&3x|1{{J+l=tGLw}w!I0#R$K$b)xVuGl`kGctO5j%Ch$!QL!8lYo5)5*@ou&v0!WYsYz@XK(9WV@XB*_XqLop1e(yAuN0-}Dip0qxuSm4cYQUT03Ze0oH4G++Ga+U8-ttj#bEY5mm=Plx zA+(SQ_XUdx@-y~+JOVd?1yA}o69mre6s3`h!k{o@vRxW05DaoE%McPAqJ+DS*BuNp)-aeP&h#88!z=&pJ90!vkA1u>crDVg zqd=MwBPpE8JmJ{EA|8R8!NMPBqG--e$vj1p9Kk0aEUc7!pkP5!B2UR8p)(AjK)gwl zDHe_&siYn|z6|>DyEdz1$BMZISWGs9MarIKm4gEo6yz1K1UOi<#4(Hj0qWk2hNw9T z5%#{J3Y;t{EUWwtfCXy}7T1I`C8UqhI1?{Q1k2E*Ai(LC3dB|sHCfgOMG#0yR+Z#& zCZyr~o9S^MJ5I|CAmG4{9eK0-;=sPR^f%c=h_u*?QH~waT5n=AFbr9m2-e1S-fwND zg~aqezVm~?T0>$EzHr_E92j%%QtZJFe~M5@-Vl5VBVT5q!Yi>C)zr8Y2jrco_9cso z{pnJWD?%_l6(PSWCcHA+I)8kCVmUj@3Y-jw_YhSY0{ZYS=))g>F&di+>VTf`q!#RJ z6^oE{negvs>w;xHKMzNL&cpDJzJ8O{@a4wv=OPZzPTM#0<9Rl#;bq3~pG6%0H5guW zECpMYiWyJ%mrq?(;Y7n4Sn(m$)OKi#xTNjT3F35tc&WQNlvotMmU#=uS@ao@@$ltO1t-pk4? zQWVV%`FE1rU4>G*Al+tajp~L^g0Lsb;45A0hBU9J{~Sp0gH%M{7$e)z01y8fnV1L6 zv@abms;Y85RN$Y{6ufBGyeassq6M?&d}j(ibNQSpV6pF>vuFywu%xtj;ey3e@C6G? zi|<}O1xDPx5M>0eDTE-Ns}PV6k_XWOf^W#N!JjC2Bjgk^=A_Q7%o_B5T!D1TtW2da z(mT9`1WH@1E|h9jhYP1s&JVt*v}9`0(h{7&1zhBD3Wvi6snFwfS4-{!0(UFbwNnLn zqv=%vy()#j3WFWrnK>)`WeT6mQyd&+g#QDL&s{t}_@Z9zbr-;|sCKDZA!U48jpkG# z-)~J;CfaY4f0}8v-`vK2>m1&1!~1P`zYTQ1O@{sU<6l|sH;=L3+K2bs@O~TKZv)+L zUx)p6Ha`P<1RNvu^a;hekaILOXYO>wCDEQkd@|+!Tki}wN5~QN8u_od-Hxwy)p`sj zfIDh%M>Q(okepuJ>%wbm28mMolJ6s@=Lhn^ha%lvta;XG9;lUZxbZpnxgqXkJfWu?O%TGJ+oOb z-2Pk|_7li0Mo+kJWNWI}fQJ8RtJ!wg)^FS4qsU3}jrtZjU7v1|Z&4y@U0=r|q4Fan zu)Us9Rswt65LoN5z+&)Y2VY>bL12e>SqiM)5LolDz=njt=77L5o*9ibfN4ihAM^fw zzj^;whP70zL#RKF`uY!~UgOe8RB!NIz5mG#aZ1bB&%pCi|g^O$MMm z8v-cGoBs!>e;oGOcf64R3yfLTR)OsSL`#Di1y+R17buNYdyVr062%51+IFDKAe7B- zS)%+8452iJ2xXW@MGh|yzFEEp1Xh@nWyPcZ!4TMwhXpny%<=*d*gxH2DX=FEfju=W zupuF^MIf*lg_Z()$`II-!vY%;0xJc9ZS7363MKp)32ee6NMLX2uuZmku%eAKwjipeB zq(Hl{Si?R6$8R|7g9i_Kd|{u}pqlH)jI?5BI}LW`LRiv=o&5-gzxyN0;ZGaG)riCY z8HTHwnO2|vYh(C|h{N~7@cZg5hyTGCUJ`Nm2QYl)q*0gx8GPso4|%07sdxzu&&x9p zPc8bvQBwvVL73w~;hn+;lEWvk6iIU;1Ig}$B#~5r6iMY%43$sQ`7~=Bjv~V6KbH&;xxPoXv69RZkE?EN;;nUM zhUa*d5fvz3A$f&|$|Z?nS&3#7Y$6o!|7JNnZpgu#x`xT81r5Km?4gyw+##ju^@wBh+03%R#XxIbwJh}*cv;R}*$a#{!)*q4E7$ea}^9XzlH>^2zRwhFKH5W!; zkHV2Ydcu7io4aB!LjQ4>%;;}>psg}+tZ%&%y$(*|S`u{U`%&Hgmo&T#%4)#^Jywz@ z^1!}{exBb6(s*d;C@X*W0FuUp|7n&+Fs<^hF#O2)(b#vPnLK*Jg_%}TaR?31O)(Eo zyX*GLNp@KKM3)4}U?l{j^A$}%Q@H4b*+a=!MKx5Y6fY~Y7pP)r&pfc+G6`W?v^r^l zVg+c(3`Kr~AoDB~*69qVsL-vI=P0Nkh18z7E8YOSW*be==ewL!aDu__sjWf@%`8rc z1q@xlviRKjrM_R>TNW2I3895?F_z^eC5<(?C3grrzS6$>RY03P7j4*SFdOIzXE8SD zFlzJ$DK)bg+biF=x0l6)H;Kkw9$a-*OAhC?qA|UDJaGdxD73*}mCZ=19s0wP0;kcW zHEo!d0AsMgTkp;>k`EOMEzL}*9Evw^?8)V^|W)jkDfkT;O)v4X!tmrdARLA4xSy1t~VSd0_*1>?2gU>pcAag!UjmJ z58FaR+u>&szT8yk)vGIt`2Zkjx%&(Ngb19p4d`N?zKu3|`-l4O-{Dzc9YL;u!u7u1 z8k}`wo21Z&tV|^DQ$VP10$&|H;g&81bilB5Q$j4=nFB|AEnSkjt(zx2I6^hKt|H-c zT{#void87M%SB6m%RDRn9cU9Q=p6_5kPxh*f@dtUG^Y>*P0=bVB(Y=OK2VQ)$KHVL z2h~7NI2@$>u~I^Ckav?A4pM%JJvb3)@vB1ZG-RFS83mD5>CgF6sdNl~Czs7Na+N6^q#noVB! zE2P?YEy~1lL9Nl#2l=2`lYxBS2tmH{l-G=W$?F(u7G)gp7l#s?;7{;30ptV-;R%{T z^02l^r{K`|HR^sHF#PcX0|mu!#{>o4_f?Wq0SjrBlHi81q+LDsA?Qf=+as~7U0~~%TNS}C#!H#hY9|o4;U~T z3jS)-SN0Vo8P^o@D$PNEE}aIp$HVPvy&NfqYYO>mb4?-A1^2ld<7P_Z{?UvVN$D4A zp0Eijf{WaT&BiTo6IAfLpD9VQ9f$_aDgvGS9%>wPaEPYc1BMC_PE%x-R5+F6pqnDx z)I!5;i=vXu7VBp~Jr*3zz}^B=f}U`wNO`FeZWe<8^+hvOq&zD;J{VBJ^3ZgO6j6tD z2CgYlRMWnT;5hZCIXs~Xnz^-b^Z`Q~D$EzI1){^I5YV;ZONppsG`^(qG%c|VtLSht zC_z6xijWy-844}aXpI%s;1};088=@#-)6?Yw zs&=qXItw>kB|l_owQC0qf(qPMB!gn8G$rU7sgn{-N|eHAN#skTM(mr}G-s3*U;3%R zmv)*#(DvbNgL07{^v>lO4w~aLEUU`0Dh>z)Nm+nfI?Pvd#RP(sC?Gcz-7U?^1kX}4 zj8{O3{IAI7Hj8ep%GZuE_`6NtIa!3MpR2i&6j?&L@QnvXW23+rq9@$HvVHFNucn6h zSDl@d884#nrPx;0pUe?3uz@~IMyxQnz>&#PJkmDd1l&Vo;DpGKcAghSh7|_k5=fi z>6+j~KX+GM6S9<$Iz}T)gsMXm6&YRHEpu?9KytbYRZ_r|1>jFg5^r=y3jVFh>DYY` zG(b-u@Vmzke#b+=kNfNH0Qg00tsa|_7_es+UhMRUj7xbfcUk-=wpRNPc8b4!v5Btx zfaJ!d>DU*r#^~v@&gcB=d{@XifAqkA1=hJwTlLu1*t8Kt%}K2G+N!Vm0A)9jw(8Nb z%4FrB4#sEYSl!Obs>W+@@oUnfhY6^|RM>W>znNjhKc6%Br_mt+sRZiXXZ!H+-w%pi z;Y5_O2zG@RHG$TnHzE&Jp>VV2JG~@Dnczb1k&Z5_p>0>pcVk7^)k)%?NEbesenZ^+ z^Q9*O(7+H;Pc~x%2?L1DvyBIcW0!WMoyo(kQXDPA)s=Mek2NU^#U3#KQK#y=}*! zaCSI|rYIUXJ14V*#w#W>5&yv%$q5=S#(i)W8@mjE)-{O*nXjmfz}c@&EGQ9b7%dhg zY7md786EDOh3nmQI3W;d2{McnRbXU^<&$@Ch7|k{b4Ou05Clh0c#I+i`fnJCMt>g? zqc}V9-+C<{iCZ0<#ilQYH)57!9NtJAdThc3ArL1};Pxxn2{NjavNi(=B>KZerct-- zfV~j~>KaK@dr7hy%|f99LGm)m!@+9uvW#R&WsHT&2yE&^uff1xSJ62|ekhaV%3nMJ$aA(jAi-1#c^u?hff) z7B|)A!nNfBxFZlK7BrgYd6V4_b)VzFU>SHfr}a&! z==;^pF>ClLB154RScaw~Q5S||*74rFi-ZX&F}NXBn&Q7|F>AEXF55?9wcxd*C!Fh~ zz$MwpbARGhGuKI3{9osK&1Awc>;CjNR`Sz(wRGI%C$RB){h-7`))EwVKqO5gWd>qv z8l+`v6x4L-(x8W|qk^38Or0R?1e`GXi=iY=x6>LSXq3+Nb7-1qwAuDg z#A<+SqbD5fZCYigVYELsgT3wE-{}FP9d!|Ukv?J72*#=VQP=q6)K*IsFeO2o9d(K^ z$hrRz^=lvk%$|iUhQ>qa2^T@yoXRUm1Y|bT7u@@j_>=PLFEFe63!l{Ps zC;qU?lV+-6d+O(R1*k^sVU_;2Ypl#-0AZB?&cq&7iH`6|52#onYZN1m#J8&|4SNk( zB6`Bbm-26Zrsy?`FXd;?GzG;c(0H*EmnEkPR~+juTv{VJswBAz93Sf_SrWtv5=ZS5 zOV_#~89{Qpt59A7bl#j=qqhfk<3lxkIn3x{YN+`PT0v}9`0(h^)i|0EX{EiT}oP**DSc-_^KyFkE8 zX3Z~}Di8!Q6_zRZI)PqaVtU=}g)3GIP-Gsd^}?~~*eO6H^n|Om?R`HgEitRL?dAU$ zRBPx^g3s}IT%K#7#mQ3BMVeIOau(pL^97cerbx9lS|L)buYmf3%zaXyuB2m5kT`n6 z>8@>6Wsl);{Mk%*ZQsd%^?LC*5+c(vaN_>KDS)N0Qc+CFKG<`AElI}?!os5`eD$%t zl~>W~k1O}D{_VBI&b`>bPWbq-8(jZ_VQKI4t@~HM8{?mxv|A@k7&GR!?A-AcV{e_1 zmX@Ajvtc9B({CP|e#_0-V{cAROB<1zk_u7Al&q{Q%$AxpDhtDGDXF%M4BJhkM~_Oy zMr2^AsTm_|X&D)}Ou9A4u}aR%$p$-|MK_dKCpDrlG*cS)-JE9Tk){7 zJhuYPl9My6X8D;h%d*f}{{Mf5Sw4$l>2+w9&hot6irm~h$0}zA}?>e zQ+voW8r}XpdYyM-Wo-g>Rff6RSu_8vfQmzt5TU( zQIRtyJA3SHlO|0ZUy8!8c#N_ujv}^Oqv;`m(n#ojldm-qw2dNLO=H zb7yDs?uH#ZwzOS2-F5otkxn$rzuROvOQYf4I4yLR+gvcq{|mGHJ(}f~w)T#;&XYZ- zPj&V5JYTm?Qr)Y{>h_;K+u7C9*nQ$y=awxyw=^`jH1627ee>oGkA45~$2V-)v}wbJ z$2P!Ek8RpmU%zWxJ^b(H&711$H$L|L#~$CXbw|U_-CK7zw03rPb#%A4wIA#5IlSWV zz6<9sTyF2|?rv*rZEf7Sb^F%(&6_sW@7T3%*Y0h*cQ-ZduHU?|sky1Ct-0gMrwi|! zRr*GeA)e$qr%qgW?Z9VOKkK=8`pmH{oyU)Moj!iF=ZlY@ ze}3k}^WHpgX<6-qhxeU3($R79lLN0DoHMgbtt*q(uPgT)>^armarDUPPhP$H(!K8a zFZ7%`u>WLt*QqmSJKH+D+xNfs$;apaeE6fK@4b8F;wMGx*DHFRUX?R3r=r5O%3X(K z`QW$_7W=XaECS3@36b0^-Ko;G4c+AWjDtx~Gx+=}wN@viY> zVJ}S_myO!-8d7|YkfyBcs<Akpp6t1Bc}20eyjm}t=bl^o z=JNRqA6@an{tGY6b*p81m0ANE!c$lK+VL;WotwY(>cLAVyUupEG&bz4-?n`_=zIOv zZQD22Z``l+^cw1xJmK}|4?VU}n4K1DR$BrF^{oUNw(Ruvy z%a`|GfnRv#vro_OzkKRS&xx*%=9cD`j`sGmXF6LOo0@hsHEwBWYHDnQP214W+R@q3 z1uKbWdDovTX9*!YnB}U_S#IuxS^gGg`97LuYePrt&K2*;`ysrTN=0Q z+PHb+*2c!Roej;cZSBXK+glsqZM$K)cQ!V(wRE&L?A!&bUB9`$ep~(4rrm&04V`B@ z8+Y#BwsGsuUGSxwyN>i+xqS4<#gkV~w0Cx#yma!|na>ZuTlz&0z)^E^LqkjV$y1;e z-7T#!v99ACfIi!IZ*6L6>Fzkw+_q&)Tg%zb)`r(%miIrIj=^=5#?yxtY^+K*X8BLS zS&}>VVeTm#9@~p$pcw*yz5d;vS3%;pzXZQzB;f9-4X_s2Sz5LPZ(_qlm&vvJ~uX&(mR0{c~a_o02v{QYKn@+mX#R@wp^1eUe>x@ zU{dm}vNDk-+?bz%Wdeqxr;pbN{MAT!B}2T%cJjSIFeEvZcjnm+im=UepYg{cAk~#r zB`C;Xl;r1pSZMV?GhHPadgrMe9N9Ch2BjskPO=O`NkTIF!*qgXct_rdy#ZQ*o^Xsv zd7%ml zQpRYax`5^eaKuQ{K=Q&;G84=Yred)?@6_nw=LunS7bX7|X xUi>?=MG0oo-F(BonN#nxx+$RQ0b}@{h{HJ;{+k6ER-f)Lh6h-=Vb6k}{@;FoktzTH literal 0 HcmV?d00001 diff --git a/tests/result/sip.pcap.out b/tests/result/sip.pcap.out new file mode 100644 index 000000000..8f1dfb3d2 --- /dev/null +++ b/tests/result/sip.pcap.out @@ -0,0 +1,8 @@ +RTP 9 1926 1 +SIP 102 47087 2 +RTCP 1 146 1 + + 1 UDP 192.168.1.2:5060 <-> 212.242.33.35:5060 [proto: 100/SIP][53 pkts/21940 bytes <-> 31 pkts/15635 bytes] + 2 UDP 192.168.1.2:5060 <-> 200.68.120.81:5060 [proto: 100/SIP][15 pkts/7568 bytes <-> 3 pkts/1944 bytes] + 3 UDP 192.168.1.2:30000 -> 212.242.33.36:40392 [proto: 87/RTP][9 pkts/1926 bytes -> 0 pkts/0 bytes] + 4 UDP 192.168.1.2:30001 -> 212.242.33.36:40393 [proto: 165/RTCP][1 pkts/146 bytes -> 0 pkts/0 bytes]