search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
185 stars 65 forks source link

support sctp transport #152

Closed eryx67 closed 4 years ago

eryx67 commented 4 years ago

added SCTP transport layer for decoding

claassistantio commented 4 years ago

CLA assistant check
All committers have signed the CLA.

negbie commented 4 years ago

Hi @eryx67 thanks. Thought about implementing sctp and diameter some time ago because you get it almost for free in gopacket but forgot it somehow ;) Thanks for this.

negbie commented 4 years ago

I did not test it so fingers crossed that you did the testing :D Btw things like

        case 0: //DATA
            pkt.Payload = sctp.Payload[16:]
        case 64: //IDATA
            pkt.Payload = sctp.Payload[20:]

can go crash quite easily so maybe you could check the length too ;)

eryx67 commented 4 years ago

I did not test it so fingers crossed that you did the testing :D Btw things like

Yes, I've done tests with pcap files and on wire. If I understand gopacket code correctly it makes packet checking but doesn't expose results as layers: https://github.com/google/gopacket/blob/0ad7f2610e344e58c1c95e2adda5c3258da8e97b/layers/sctp.go#L38

negbie commented 4 years ago

Ok nice! It depends on the layer implementation, some make the Packet length check some don't. The newer ones makes them normally. I did not look into the gopacket sctp layer implementation but when a sctp packet for case 0 is always at least 16bytes long and in case 64 20 bytes your code should be safe and no length check is needed.