private void Parse(PDUStreamReader reader, SIPMsg msg)
{
var tag = string.Empty;
var value = string.Empty;
// message body
if (reader.Peek() > 0)
{
var line = reader.ReadLine();
//Console.WriteLine("++ BODY ++");
while (line != null)
{
this.ParseSIPBodyLine(line, ref tag, ref value);
//Console.WriteLine("\"" + _tag + "\" : \"" + _value + "\"");
//Console.WriteLine(_line.Length.ToString() + ": \"" + _line.ToString() + "\"");
string[] values;
switch (tag)
{
case "c":
values = value.Split(' ');
if (values.Length < 2)
{
msg.Valid = false;
msg.InvalidReason = "wrong format in message body: '" + line + "'";
return;
}
if (values[1] == "IP4")
{
this.RTPAddress = values[2];
}
break;
case "m":
values = value.Split(' ');
if (values.Length < 2)
{
msg.Valid = false;
msg.InvalidReason = "wrong format in message body: '" + line + "'";
return;
}
this.RTPPort = values[1];
break;
case "a":
values = value.Split(' ');
if (values.Count() == 2 && values[0].Contains("rtpmap:")) // codecs' descriptions
{
this.PossibleCodecs.Add(values[1] + " (" + values[0].Split(':')[1] + ")");
}
break;
default:
break;
}
line = reader.ReadLine();
}
//Console.WriteLine("---------");
}
}
private static void ParseChunk(PDUStreamReader reader, StringBuilder sb)
{
var chunkStart = true;
var chunkSize = 0;
while (true)
{
if (chunkStart)
{
var line = reader.ReadLine();
if (line == null)
{
return;
}
// TODO check if correct chunk coding or else unread
chunkSize = Convert.ToInt32(line, 16);
chunkStart = false;
}
else
{
var data = new char[chunkSize];
var read = 0;
do
{
var len = reader.Read(data, read, data.Length - read);
if (len == 0)
{
return;
}
read += len;
} while(read < chunkSize);
sb.Append(data);
// chunk boundary
if (reader.ReadLine() == null)
{
return;
}
chunkStart = true;
}
if (chunkSize == 0)
{
/*
* // read last line - chunk boundary
* if(reader.ReadLine() == null)
* {
* reader.NewMessage();
* reader.ReadLine(); // TODO unread line if not empty string
* }
* break;
*/
reader.ReadLine();
return;
}
}
}
private void Parse(PDUStreamReader reader, SIPMsg msg)
{
var tag = string.Empty;
var value = string.Empty;
var parameters = new Dictionary <string, string>();
var line = reader.ReadLine();
if (line == null)
{
msg.Valid = false;
msg.InvalidReason = "End of stream reached sooner than expected";
return;
}
//Console.WriteLine("++ HEADER ++");
while (line != null && line != "\n" && line != string.Empty)
//while (_line != null && _line != "\n" && _line != string.Empty)
{
parameters.Clear();
this.ParseSIPHeaderLine(line, ref tag, ref value, ref parameters);
switch (tag)
{
case "To":
case "t":
this.To += value;
break;
case "From":
case "f":
this.From += value;
break;
case "Contact":
this.Contact += value;
break;
case "Call-ID":
case "CallID":
case "i":
this.CallID += value;
//Console.WriteLine(_line);
break;
default:
break;
}
line = reader.ReadLine();
}
}
public void TestStreamReaderMore()
{
var captureFile = this.PrepareCaptureForProcessing(Pcaps.Default.sip_caps_sip_rtcp_pcap);
this.FrameworkController.ProcessCapture(captureFile);
this._conversations = this.L7Conversations.Where(c => c.ApplicationTags.Contains("SIP")).ToArray();
var counter = 0;
string line;
foreach (var conversation in this._conversations)
{
var stream = new PDUStreamBasedProvider(conversation, EfcPDUProviderType.SingleMessage);
var reader = new PDUStreamReader(stream, Encoding.ASCII);
do
{
counter++;
Console.WriteLine(counter + ". message ######### ");
do
{
line = reader.ReadLine();
Console.WriteLine(line);
} while(line != null);
} while(reader.NewMessage());
}
}
public void Parse(PDUStreamReader reader)
{
//Console.WriteLine("parse");
var stream = reader.PDUStreamBasedProvider;
//if(stream == null)
// Console.WriteLine("stream null");
//Console.WriteLine("before stream.GetCurrentPDU().FirstSeen");
if (stream.GetCurrentPDU() != null)
{
this.FirstSeen = stream.GetCurrentPDU().FirstSeen;
this.ExportSources.Add(stream.GetCurrentPDU());
}
else
{
this.ExportSources.Add(stream.Conversation);
}
//Console.WriteLine("after stream.GetCurrentPDU().FirstSeen");
this.Frames.AddRange(stream.ProcessedFrames);
//Console.WriteLine("parsing of SIP message, frame numbers: " + string.Join(",", this.FrameGuids.ToArray()));
var startLine = reader.ReadLine();
var startLineSplit = new string[] { "" };
if (startLine != null)
{
startLineSplit = startLine.Split(' ');
}
if (startLineSplit[0].IndexOf("SIP", StringComparison.OrdinalIgnoreCase) == 0)
{
// status
this.Type = SIPMsgType.Status;
this.StatusLine = new SIPStatusLine(startLineSplit, out this._valid, out this.InvalidReason);
}
else
{
// request
this.Type = SIPMsgType.Request;
this.RequestLine = new SIPRequestLine(startLineSplit, out this._valid, out this.InvalidReason);
}
if (!this.Valid)
{
return;
}
// message header
this.Headers = new SIPHeaders(reader, this);
if (this.Headers == null)
{
this.Valid = false;
}
if (this.Valid)
{
this.Body = new SIPBody(reader, this);
}
}
protected void Parse(PDUStreamReader reader)
{
var line = reader.ReadLine();
while (!line.IsNullOrEmpty())
{
var fieldNameIndex = line.IndexOf(':');
var fieldName = line.Substring(0, fieldNameIndex);
var fieldValue = line.Substring(fieldNameIndex + 1, line.Length - fieldName.Length - 1).Trim();
if (this.Fields.ContainsKey(fieldName))
{
this.Fields[fieldName].Add(fieldValue);
}
else
{
this.Fields[fieldName] = new List <string>
{
fieldValue
};
}
line = reader.ReadLine();
}
}
private void Parse(PDUStreamReader reader)
{
var stream = reader.BaseStream as PDUStreamBasedProvider;
//char[] buffer = new char[1024];
//_reader.Read(buffer, 0, 1024);
try
{
var line = reader.ReadLine();
if (stream.GetCurrentPDU() != null)
{
this.ExportSources.Add(stream.GetCurrentPDU());
this.TimeStamp = stream.GetCurrentPDU().FirstSeen;
this.Frames.AddRange(stream.GetCurrentPDU().FrameList);
}
else
{
this.ExportSources.Add(stream.Conversation);
}
if (line == null)
{
this.Valid = false;
this.InvalidReason = "Nothing to read.";
return;
}
if (line.StartsWith("HTTP"))
{
// HTTP Response
this.HTTPHeader = new HttpResponseHeader(reader, line);
}
else if (line.StartsWith("OPTIONS") || line.StartsWith("GET") || line.StartsWith("HEAD") || line.StartsWith("POST") || line.StartsWith("PUT") ||
line.StartsWith("DELETE") || line.StartsWith("TRACE") || line.StartsWith("CONNECT"))
{
// HTTP Request
this.HTTPHeader = new HttpRequestHeader(reader, line);
}
else
{
this.Valid = false;
this.InvalidReason = "Not a HTTP message.";
return;
}
// Check for Message content
if (this.HTTPHeader.Fields.ContainsKey("Transfer-Encoding") && this.HTTPHeader.Fields["Transfer-Encoding"].Contains("chunked"))
{
this.HTTPContent = new HTTPContent(reader, HTTPContent.TransferCoding.CHUNKED);
}
else if (this.HTTPHeader.Fields.ContainsKey("Content-Length") && !this.HTTPHeader.Fields["Content-Length"].Contains("0"))
{
this.HTTPContent = new HTTPContent(reader, HTTPContent.TransferCoding.IDENTITY, this.HTTPHeader.Fields["Content-Length"][0]);
}
else
{
this.HTTPContent = new HTTPContent();
}
// If encoded try to decode
if (this.HTTPHeader.Fields.ContainsKey("Content-Encoding"))
{
var encoding = this.HTTPHeader.Fields["Content-Encoding"].Last();
var gzippedBytes = this.HTTPContent.Content;
var si = new MemoryStream(gzippedBytes);
var so = new MemoryStream();
var db = new byte[512];
int i;
switch (encoding)
{
case "gzip":
var gzs = new GZipStream(si, CompressionMode.Decompress);
while ((i = gzs.Read(db, 0, db.Length)) != 0)
{
so.Write(db, 0, i);
}
this.HTTPContent.Content = so.ToArray();
break;
case "deflate":
var ds = new DeflateStream(si, CompressionMode.Decompress);
while ((i = ds.Read(db, 0, db.Length)) != 0)
{
so.Write(db, 0, i);
}
this.HTTPContent.Content = so.ToArray();
break;
default:
break;
}
}
if (this.HTTPContent?.Content != null)
{
this.SaveContent();
}
}
catch (Exception)
{
this.Valid = false;
this.InvalidReason = "Message parsing failed.";
}
}