Actions
Bug #9233
open
GL
GL
sip: requests split across TCP segments are not identified
Bug #9233:
sip: requests split across TCP segments are not identified
Affected Versions:
Effort:
Difficulty:
Label:
Description
SIP methods whose pattern is confirmed by a probing parser are only detected when the whole request line is in the first segment. The SIP probe is registered with pp_max_depth 0, so it gives up as soon as the request line is incomplete. OPTIONS and UPDATE are then detected as HTTP, and the other methods get no protocol.
Example:
NOTIFY with a long Request-URI, split after 40 bytes:
segment 1: NOTIFY sip:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
segment 2: bbbb...@example.com SIP/2.0\r\n...
The flow gets app_proto null. The same request with OPTIONS gets app_proto: http.
Actions