Improve SIP packet detection using heuristic parsing

Packet++/header/SipLayer.h

@@ -69,6 +69,17 @@ namespace pcpp
 	class SipLayer : public TextBasedProtocolMessage
 	{
 	public:
+		/// SIP parse result types
+		enum class SipParseResult
+		{
+			/// Unknown or invalid format
+			Unknown = 0,
+			/// The message is a SIP request
+			Request = 1,
+			/// The message is a SIP response
+			Response = 2,
+		};
+
 		/// The length of the body of many SIP response messages is determined by a SIP header field called
 		/// "Content-Length". This method parses this field, extracts its value and return it. If this field doesn't
 		/// exist 0 is returned
@@ -114,6 +125,31 @@ namespace pcpp
 			return port == 5060 || port == 5061;
 		}
 
+		/// A heuristic method that attempts to identify SIP packets without fully parsing them
+		/// @param[in] data A pointer to the raw packet data
+		/// @param[in] dataLen Size of the data in bytes
+		/// @return A SipParseResult indicating whether the data is a SIP Request, Response, or Unknown
+		static SipParseResult detectSipMessageType(const uint8_t* data, size_t dataLen);
+
+		/// A constructor that creates the layer from an existing packet raw data
+		/// @param[in] data A pointer to the raw data (will be casted to @ref arphdr)
+		/// @param[in] dataLen Size of the data in bytes
+		/// @param[in] prevLayer A pointer to the previous layer
+		/// @param[in] packet A pointer to the Packet instance where layer will be stored in
+		/// @param[in] srcPort Source port number to check
+		/// @param[in] dstPort Dest port number to check
+		/// @return A newly allocated SIP layer of type request or response, or nullptr if parsing fails
+		static SipLayer* parseSipLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet,
+		                               uint16_t srcPort, uint16_t dstPort);
+
+		/// A constructor that creates the layer from an existing packet raw data
+		/// @param[in] data A pointer to the raw data (will be casted to @ref arphdr)
+		/// @param[in] dataLen Size of the data in bytes
+		/// @param[in] prevLayer A pointer to the previous layer
+		/// @param[in] packet A pointer to the Packet instance where layer will be stored in
+		/// @return A newly allocated SIP layer of type request or response, or nullptr if parsing fails
+		static SipLayer* parseSipLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet);
+
 	protected:
 		SipLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, ProtocolType protocol)
 		    : TextBasedProtocolMessage(data, dataLen, prevLayer, packet, protocol)
@@ -531,6 +567,18 @@ namespace pcpp
 		/// @return The parsed SIP method
 		static SipRequestLayer::SipMethod parseMethod(const char* data, size_t dataLen);
 
+		/// A static method for parsing the SIP version out of raw data
+		/// @param[in] data The raw data
+		/// @param[in] dataLen The raw data length
+		/// @return The parsed SIP version string or an empty string if parsing fails
+		static std::string parseVersion(const char* data, size_t dataLen);
+
+		/// A static method for parsing the Request-URI out of raw data
+		/// @param[in] data The raw data
+		/// @param[in] dataLen The raw data length
+		/// @return The parsed Request-URI string or an empty string if parsing fails
+		static std::string parseUri(const char* data, size_t dataLen);
+
 		/// @return The size in bytes of the SIP request first line
 		int getSize() const
 		{

Packet++/src/SipLayer.cpp

@@ -34,6 +34,23 @@ namespace pcpp
 		{ "UPDATE",    SipRequestLayer::SipMethod::SipUPDATE    },
 	};
 
+	const std::unordered_map<std::string, SipRequestLayer::SipMethod> SipMethodShortMap{
+		{ "INV", SipRequestLayer::SipMethod::SipINVITE    },
+        { "ACK", SipRequestLayer::SipMethod::SipACK       },
+		{ "BYE", SipRequestLayer::SipMethod::SipBYE       },
+        { "CAN", SipRequestLayer::SipMethod::SipCANCEL    },
+		{ "REG", SipRequestLayer::SipMethod::SipREGISTER  },
+        { "PRA", SipRequestLayer::SipMethod::SipPRACK     },
+		{ "OPT", SipRequestLayer::SipMethod::SipOPTIONS   },
+        { "SUB", SipRequestLayer::SipMethod::SipSUBSCRIBE },
+		{ "NOT", SipRequestLayer::SipMethod::SipNOTIFY    },
+        { "PUB", SipRequestLayer::SipMethod::SipPUBLISH   },
+		{ "INF", SipRequestLayer::SipMethod::SipINFO      },
+        { "REF", SipRequestLayer::SipMethod::SipREFER     },
+		{ "MES", SipRequestLayer::SipMethod::SipMESSAGE   },
+        { "UPD", SipRequestLayer::SipMethod::SipUPDATE    },
+	};
+
 	// -------- Class SipLayer -----------------
 
 	int SipLayer::getContentLength() const
@@ -103,6 +120,85 @@ namespace pcpp
 		}
 	}
 
+	SipLayer::SipParseResult SipLayer::detectSipMessageType(const uint8_t* data, size_t dataLen)
+	{
+		if (!data || dataLen < 3)
+		{
+			return SipLayer::SipParseResult::Unknown;
+		}
+
+		if (data[0] == 'S' && data[1] == 'I' && data[2] == 'P')
+		{
+			return SipLayer::SipParseResult::Response;
+		}
+
+		auto it = SipMethodShortMap.find(std::string(data, data + 3));
+		if (it != SipMethodShortMap.end())
+		{
+			return SipLayer::SipParseResult::Request;
+		}
+		return SipLayer::SipParseResult::Unknown;
+	}
+
+	SipLayer* SipLayer::parseSipLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet, uint16_t srcPort,
+	                                  uint16_t dstPort)
+	{
+		if (!(SipLayer::isSipPort(srcPort) || SipLayer::isSipPort(dstPort)))
+		{
+			return nullptr;
+		}
+
+		if (SipRequestFirstLine::parseMethod(reinterpret_cast<char*>(data), dataLen) !=
+		    SipRequestLayer::SipMethodUnknown)
+		{
+			return new SipRequestLayer(data, dataLen, prevLayer, packet);
+		}
+
+		if (SipResponseFirstLine::parseStatusCode(reinterpret_cast<char*>(data), dataLen) !=
+		        SipResponseLayer::SipStatusCodeUnknown &&
+		    SipResponseFirstLine::parseVersion(reinterpret_cast<char*>(data), dataLen) != "")
+		{
+			return new SipResponseLayer(data, dataLen, prevLayer, packet);
+		}
+
+		return nullptr;
+	}
+
+	SipLayer* SipLayer::parseSipLayer(uint8_t* data, size_t dataLen, Layer* prevLayer, Packet* packet)
+	{
+		SipLayer::SipParseResult sipParseResult = detectSipMessageType(data, dataLen);
+
+		if (sipParseResult == SipLayer::SipParseResult::Unknown)
+		{
+			return nullptr;
+		}
+
+		if (sipParseResult == SipLayer::SipParseResult::Request)
+		{
+			if (SipRequestFirstLine::parseMethod(reinterpret_cast<char*>(data), dataLen) !=
+			        SipRequestLayer::SipMethodUnknown &&
+			    SipRequestFirstLine::parseUri(reinterpret_cast<char*>(data), dataLen) != "" &&
+			    SipRequestFirstLine::parseVersion(reinterpret_cast<char*>(data), dataLen) != "")
+			{
+				return new SipRequestLayer(data, dataLen, prevLayer, packet);
+			}
+			return nullptr;
+		}
+
+		if (sipParseResult == SipLayer::SipParseResult::Response)
+		{
+			if (SipResponseFirstLine::parseStatusCode(reinterpret_cast<char*>(data), dataLen) !=
+			        SipResponseLayer::SipStatusCodeUnknown &&
+			    SipResponseFirstLine::parseVersion(reinterpret_cast<char*>(data), dataLen) != "")
+			{
+				return new SipResponseLayer(data, dataLen, prevLayer, packet);
+			}
+			return nullptr;
+		}
+
+		return nullptr;
+	}
+
 	// -------- Class SipRequestFirstLine -----------------
 
 	SipRequestFirstLine::SipRequestFirstLine(SipRequestLayer* sipRequest) : m_SipRequest(sipRequest)
@@ -208,6 +304,108 @@ namespace pcpp
 		return methodAdEnum->second;
 	}
 
+	std::string SipRequestFirstLine::parseUri(const char* data, size_t dataLen)
+	{
+		if (data == nullptr || dataLen == 0)
+		{
+			PCPP_LOG_DEBUG("Empty data in SIP request line");
+			return "";
+		}
+
+		// Find the position of the first space (end of METHOD)
+		size_t firstSpaceIndex = 0;
+		while (firstSpaceIndex < dataLen && data[firstSpaceIndex] != ' ')
+		{
+			firstSpaceIndex++;
+		}
+
+		if (firstSpaceIndex == dataLen || firstSpaceIndex == 0)
+		{
+			PCPP_LOG_DEBUG("No space found after METHOD in SIP request line");
+			return "";
+		}
+
+		// URI starts right after the first space
+		const char* uriStart = data + firstSpaceIndex + 1;
+
+		// Continue searching from after the first space to find the second space
+		size_t secondSpaceIndex = firstSpaceIndex + 1;
+		while (secondSpaceIndex < dataLen && data[secondSpaceIndex] != ' ')
+		{
+			secondSpaceIndex++;
+		}
+
+		if (secondSpaceIndex == dataLen)
+		{
+			PCPP_LOG_DEBUG("Couldn't find space before SIP version in SIP request line");
+			return "";
+		}
+
+		size_t uriLen = static_cast<size_t>(secondSpaceIndex - (firstSpaceIndex + 1));
+
+		if (uriLen == 0)
+		{
+			PCPP_LOG_DEBUG("URI part is empty in SIP request line");
+			return "";
+		}
+
+		return std::string(uriStart, uriLen);
+	}
+
+	std::string SipRequestFirstLine::parseVersion(const char* data, size_t dataLen)
+	{
+		if (data == nullptr || dataLen == 0)
+		{
+			PCPP_LOG_DEBUG("Empty data in SIP request line for version parsing");
+			return "";
+		}
+
+		size_t firstLineEnd = 0;
+		while (firstLineEnd < dataLen && data[firstLineEnd] != '\n' && data[firstLineEnd] != '\r')
+		{
+			firstLineEnd++;
+		}
+
+		if (firstLineEnd == 0)
+		{
+			PCPP_LOG_DEBUG("Empty request line");
+			return "";
+		}
+
+		// Find the last space by searching from the end manually
+		size_t lastSpaceIndex = firstLineEnd;
+		while (lastSpaceIndex > 0 && data[lastSpaceIndex - 1] != ' ')
+		{
+			lastSpaceIndex--;
+		}
+
+		if (lastSpaceIndex == 0 || lastSpaceIndex == firstLineEnd)
+		{
+			PCPP_LOG_DEBUG("No space found before SIP version in request line");
+			return "";
+		}
+
+		// Version starts right after the last space
+		const char* versionStart = data + lastSpaceIndex;
+		size_t versionLen = firstLineEnd - lastSpaceIndex;
+
+		// Minimum length for "SIP/x.y"
+		if (versionLen < 7)
+		{
+			PCPP_LOG_DEBUG("Version part too short");
+			return "";
+		}
+
+		// Basic validation: must start with "SIP/"
+		if (versionStart[0] != 'S' || versionStart[1] != 'I' || versionStart[2] != 'P' || versionStart[3] != '/')
+		{
+			PCPP_LOG_DEBUG("SIP request version does not begin with 'SIP/'");
+			return "";
+		}
+
+		return std::string(versionStart, versionLen);
+	}
+
 	void SipRequestFirstLine::parseVersion()
 	{
 		if (m_SipRequest->getDataLen() < static_cast<size_t>(m_UriOffset))

Packet++/src/UdpLayer.cpp

@@ -109,16 +109,7 @@ namespace pcpp
 		         (DnsLayer::isDnsPort(portDst) || DnsLayer::isDnsPort(portSrc)))
 			m_NextLayer = new DnsLayer(udpData, udpDataLen, this, getAttachedPacket());
 		else if (SipLayer::isSipPort(portDst) || SipLayer::isSipPort(portSrc))
-		{
-			if (SipRequestFirstLine::parseMethod((char*)udpData, udpDataLen) != SipRequestLayer::SipMethodUnknown)
-				m_NextLayer = new SipRequestLayer(udpData, udpDataLen, this, getAttachedPacket());
-			else if (SipResponseFirstLine::parseStatusCode((char*)udpData, udpDataLen) !=
-			             SipResponseLayer::SipStatusCodeUnknown &&
-			         SipResponseFirstLine::parseVersion((char*)udpData, udpDataLen) != "")
-				m_NextLayer = new SipResponseLayer(udpData, udpDataLen, this, getAttachedPacket());
-			else
-				m_NextLayer = new PayloadLayer(udpData, udpDataLen, this, getAttachedPacket());
-		}
+			m_NextLayer = SipLayer::parseSipLayer(udpData, udpDataLen, this, getAttachedPacket(), portSrc, portDst);
 		else if ((RadiusLayer::isRadiusPort(portDst) || RadiusLayer::isRadiusPort(portSrc)) &&
 		         RadiusLayer::isDataValid(udpData, udpDataLen))
 			m_NextLayer = new RadiusLayer(udpData, udpDataLen, this, getAttachedPacket());
@@ -152,7 +143,15 @@ namespace pcpp
 			if (!m_NextLayer)
 				m_NextLayer = new PayloadLayer(udpData, udpDataLen, this, getAttachedPacket());
 		}
-		else
+
+		// If a valid layer was found, return immediately
+		if (m_NextLayer)
+			return;
+
+		// Here, heuristics for all protocols should be invoked to determine the correct layer
+		m_NextLayer = SipLayer::parseSipLayer(udpData, udpDataLen, this, getAttachedPacket());
+
+		if (!m_NextLayer)
 			m_NextLayer = new PayloadLayer(udpData, udpDataLen, this, getAttachedPacket());
 	}