diff --git a/CHANGES b/CHANGES index 42ac97e455..f13ae0b58c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +2.4-125 | 2015-09-03 20:10:36 -0700 + + * Move SIP analyzer to flowunit instead of datagram Addresses + BIT-1458 (Vlad Grigorescu) + 2.4-122 | 2015-08-31 14:39:41 -0700 * Add a number of out-of-bound checks to layer 2 code. Addresses diff --git a/VERSION b/VERSION index 4365e48ae5..248c05d20d 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4-122 +2.4-125 diff --git a/src/analyzer/protocol/sip/sip-protocol.pac b/src/analyzer/protocol/sip/sip-protocol.pac index ce26b8be95..15f07df44a 100644 --- a/src/analyzer/protocol/sip/sip-protocol.pac +++ b/src/analyzer/protocol/sip/sip-protocol.pac @@ -1,16 +1,6 @@ -enum ExpectBody { - BODY_EXPECTED, - BODY_NOT_EXPECTED, - BODY_MAYBE, -}; - type SIP_TOKEN = RE/[^()<>@,;:\\"\/\[\]?={} \t]+/; type SIP_WS = RE/[ \t]*/; -type SIP_COLON = RE/:/; -type SIP_TO_EOL = RE/[^\r\n]*/; -type SIP_EOL = RE/(\r\n){1,2}/; type SIP_URI = RE/[[:alnum:]@[:punct:]]+/; -type SIP_NL = RE/(\r\n)/; type SIP_PDU(is_orig: bool) = case is_orig of { true -> request: SIP_Request; @@ -18,14 +8,12 @@ type SIP_PDU(is_orig: bool) = case is_orig of { }; type SIP_Request = record { - request: SIP_RequestLine; - newline: SIP_NL; + request: SIP_RequestLine &oneline; msg: SIP_Message; }; type SIP_Reply = record { - reply: SIP_ReplyLine; - newline: SIP_NL; + reply: SIP_ReplyLine &oneline; msg: SIP_Message; }; @@ -34,7 +22,7 @@ type SIP_RequestLine = record { : SIP_WS; uri: SIP_URI; : SIP_WS; - version: SIP_Version; + version: SIP_Version &restofdata; } &oneline; type SIP_ReplyLine = record { @@ -42,7 +30,7 @@ type SIP_ReplyLine = record { : SIP_WS; status: SIP_Status; : SIP_WS; - reason: SIP_TO_EOL; + reason: bytestring &restofdata; } &oneline; type SIP_Status = record { @@ -52,7 +40,7 @@ type SIP_Status = record { }; type SIP_Version = record { - : "SIP/"; + : "SIP/"; vers_str: RE/[0-9]+\.[0-9]+/; } &let { vers_num: double = bytestring_to_double(vers_str); @@ -69,11 +57,10 @@ type SIP_HEADER_NAME = RE/[^: \t]+/; type SIP_Header = record { name: SIP_HEADER_NAME; : SIP_WS; - : SIP_COLON; + : ":"; : SIP_WS; - value: SIP_TO_EOL; - : SIP_EOL; -} &oneline &byteorder=bigendian; + value: bytestring &restofdata; +} &oneline; type SIP_Body = record { body: bytestring &length = $context.flow.get_content_length(); diff --git a/src/analyzer/protocol/sip/sip.pac b/src/analyzer/protocol/sip/sip.pac index f527a90117..15addb8c1e 100644 --- a/src/analyzer/protocol/sip/sip.pac +++ b/src/analyzer/protocol/sip/sip.pac @@ -21,7 +21,7 @@ connection SIP_Conn(bro_analyzer: BroAnalyzer) { %include sip-protocol.pac flow SIP_Flow(is_orig: bool) { - datagram = SIP_PDU(is_orig) withcontext(connection, this); + flowunit = SIP_PDU(is_orig) withcontext(connection, this); }; %include sip-analyzer.pac diff --git a/src/analyzer/protocol/sip/sip_TCP.pac b/src/analyzer/protocol/sip/sip_TCP.pac index 5546d28ece..2e51675dea 100644 --- a/src/analyzer/protocol/sip/sip_TCP.pac +++ b/src/analyzer/protocol/sip/sip_TCP.pac @@ -24,7 +24,7 @@ connection SIP_Conn(bro_analyzer: BroAnalyzer) { %include sip-protocol.pac flow SIP_Flow(is_orig: bool) { - datagram = SIP_PDU(is_orig) withcontext(connection, this); + flowunit = SIP_PDU(is_orig) withcontext(connection, this); }; %include sip-analyzer.pac diff --git a/testing/btest/Baseline/scripts.base.protocols.sip.wireshark/sip.log b/testing/btest/Baseline/scripts.base.protocols.sip.wireshark/sip.log index 19f05ec1b9..047fa4e2d1 100644 --- a/testing/btest/Baseline/scripts.base.protocols.sip.wireshark/sip.log +++ b/testing/btest/Baseline/scripts.base.protocols.sip.wireshark/sip.log @@ -3,7 +3,7 @@ #empty_field (empty) #unset_field - #path sip -#open 2015-04-30-03-33-33 +#open 2015-09-03-21-02-33 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method uri date request_from request_to response_from response_to reply_to call_id seq subject request_path response_path user_agent status_code status_msg warning request_body_len response_body_len content_type #types time string addr port addr port count string string string string string string string string string string string vector[string] vector[string] string count string string string string string 1120469572.844249 CXWv6p3arKYeMETxOg 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - ;tag=00-04092-1701af62-120c67172 - 578222729-4665d775@578222732-4665d772 68 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 401 Unauthorized - 0 0 - @@ -37,8 +37,9 @@ 1120470900.060556 CIPOse170MGiRM1Qf4 192.168.1.2 5060 212.242.33.35 5060 0 ACK sip:0097239287044@sip.cybercity.dk - "arik" ;tag=00-04083-1701ba17-57d493ef5 - - - 24487391-449bf2a0@192.168.1.2 2 ACK - SIP/2.0/UDP 192.168.1.2 (empty) - - - - 0 - - 1120470966.443914 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk - "arik" "arik" ;tag=00-04079-1701ba6f-3e08e2f66 - 11894297-4432a9f8@192.168.1.2 1 INVITE - SIP/2.0/UDP 192.168.1.2:5060 SIP/2.0/UDP 192.168.1.2:5060;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 407 authentication required - 270 0 - 1120470966.606422 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk Mon, 04 Jul 2005 09:56:06 GMT "arik" "arik" - 11894297-4432a9f8@192.168.1.2 2 INVITE - SIP/2.0/UDP 192.168.1.2:5060,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 100 Trying - 270 0 - +1120470966.606422 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk Mon, 04 Jul 2005 09:56:06 GMT "arik" "arik" ;tag=00-04075-1701baa2-2dfdf7c21 - 11894297-4432a9f8@192.168.1.2 2 INVITE - SIP/2.0/UDP 192.168.1.2:5060,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 183 In band info available - 270 199 application/sdp 1120470966.606422 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 INVITE sip:35104724@sip.cybercity.dk Mon, 04 Jul 2005 09:56:06 GMT "arik" "arik" ;tag=00-04075-1701baa2-2dfdf7c21 - 11894297-4432a9f8@192.168.1.2 2 INVITE - SIP/2.0/UDP 192.168.1.2:5060,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 480 Error - 270 0 application/sdp 1120470984.353086 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - ;tag=00-04074-1701bac9-1daa0b4c5 - 29858147-465b0752@29858051-465b07b2 5 REGISTER - SIP/2.0/UDP 192.168.1.2,SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 401 Unauthorized - 0 0 - 1120471018.723316 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - - 29858147-465b0752@29858051-465b07b2 6 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 100 Trying - 0 0 - 1120471018.723316 C7XEbhP654jzLoe3a 192.168.1.2 5060 212.242.33.35 5060 0 REGISTER sip:sip.cybercity.dk - ;tag=00-04087-1701bae7-76fb74995 - 29858147-465b0752@29858051-465b07b2 6 REGISTER - SIP/2.0/UDP 192.168.1.2 SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060,SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060 Nero SIPPS IP Phone Version 2.0.51.16 200 OK - 0 0 - -#close 2015-04-30-03-33-33 +#close 2015-09-03-21-02-33