search

NetComposer / nksip

Erlang SIP application server
Apache License 2.0
358 stars 127 forks source link

Workaround for malicious/broken SIP-clients #52

Open lemenkov opened 9 years ago

lemenkov commented 9 years ago

Hello All!

Some nasty SIP-clients sends only \n instead of \r\n (malicious SIP scanners). We shouldn't crash on these packets.

Actually I'm not sure about how we should handle this. RFC 3261 states clearly that the only allowed line terminator is CRLF, however previous RFC 2543 does allows line endings with CR, LF, and CRLF. Also some people advise allowing CRLF, CR, and LF as a line delimiters when parsing incoming SIP packets (see http://www.networksorcery.com/enp/protocol/sip.htm).

What other thinks about this? Is it worth fixing at all?

kalta commented 9 years ago

Maybe we could add a global config options, and accept that optionally if you activate it. Global options are compiled and very fast.