New protocol support: SIP #7181
Conversation
|
Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually? |
| func TestParseDetailNameAddr(t *testing.T) { | ||
| sip := sipPlugin{} | ||
| name_addr:="\"display_name\"<sip:[email protected]:5060;user=phone>;hogehoge" | ||
| display_name, user_info, host, port, uri_params, params:=sip.parseDetailNameAddr(name_addr) |
There was a problem hiding this comment.
don't use underscores in Go names; var display_name should be displayName
don't use underscores in Go names; var user_info should be userInfo
don't use underscores in Go names; var uri_params should be uriParams
|
|
||
| func TestParseDetailNameAddr(t *testing.T) { | ||
| sip := sipPlugin{} | ||
| name_addr:="\"display_name\"<sip:[email protected]:5060;user=phone>;hogehoge" |
There was a problem hiding this comment.
don't use underscores in Go names; var name_addr should be nameAddr
|
|
||
| func TestPaseDetailURI(t *testing.T){ | ||
| var uri string | ||
| var user_info string; var host string; var port string; var uri_params []string |
There was a problem hiding this comment.
don't use underscores in Go names; var user_info should be userInfo
don't use underscores in Go names; var uri_params should be uriParams
|
|
||
| raw_text :="test raw string" | ||
| method_text:="INVITE" | ||
| phrase_text:="OK" |
There was a problem hiding this comment.
don't use underscores in Go names; var phrase_text should be phraseText
| sip.setFromConfig(&cfg) | ||
|
|
||
| raw_text :="test raw string" | ||
| method_text:="INVITE" |
There was a problem hiding this comment.
don't use underscores in Go names; var method_text should be methodText
| from:=`"0311112222"<sip:[email protected]:5060>;tag=FromTag` | ||
| to:=`<sip:[email protected]>;tag=ToTag` | ||
| cseq_num:=6789 | ||
| cseq_method:="INVITE" |
There was a problem hiding this comment.
don't use underscores in Go names; var cseq_method should be cseqMethod
| status_text:="Ringing" | ||
| from:=`"0311112222"<sip:[email protected]:5060>;tag=FromTag` | ||
| to:=`<sip:[email protected]>;tag=ToTag` | ||
| cseq_num:=6789 |
There was a problem hiding this comment.
don't use underscores in Go names; var cseq_num should be cseqNum
| sip.initDetailOption() | ||
| raw_text :="test raw string" | ||
| status_number:=(uint16)(180) | ||
| status_text:="Ringing" |
There was a problem hiding this comment.
don't use underscores in Go names; var status_text should be statusText
| sip.parseDetail=true | ||
| sip.initDetailOption() | ||
| raw_text :="test raw string" | ||
| status_number:=(uint16)(180) |
There was a problem hiding this comment.
don't use underscores in Go names; var status_number should be statusNumber
|
|
||
| sip.parseDetail=true | ||
| sip.initDetailOption() | ||
| raw_text :="test raw string" |
There was a problem hiding this comment.
don't use underscores in Go names; var raw_text should be rawText
| func TestParseDetailNameAddr(t *testing.T) { | ||
| sip := sipPlugin{} | ||
| name_addr:="\"display_name\"<sip:[email protected]:5060;user=phone>;hogehoge" | ||
| display_name, user_info, host, port, uri_params, params:=sip.parseDetailNameAddr(name_addr) |
There was a problem hiding this comment.
don't use underscores in Go names; var display_name should be displayName
don't use underscores in Go names; var user_info should be userInfo
don't use underscores in Go names; var uri_params should be uriParams
|
|
||
| func TestParseDetailNameAddr(t *testing.T) { | ||
| sip := sipPlugin{} | ||
| name_addr:="\"display_name\"<sip:[email protected]:5060;user=phone>;hogehoge" |
There was a problem hiding this comment.
don't use underscores in Go names; var name_addr should be nameAddr
|
|
||
| func TestPaseDetailURI(t *testing.T){ | ||
| var uri string | ||
| var user_info string; var host string; var port string; var uri_params []string |
There was a problem hiding this comment.
don't use underscores in Go names; var user_info should be userInfo
don't use underscores in Go names; var uri_params should be uriParams
|
|
||
| raw_text :="test raw string" | ||
| method_text:="INVITE" | ||
| phrase_text:="OK" |
There was a problem hiding this comment.
don't use underscores in Go names; var phrase_text should be phraseText
| sip.setFromConfig(&cfg) | ||
|
|
||
| raw_text :="test raw string" | ||
| method_text:="INVITE" |
There was a problem hiding this comment.
don't use underscores in Go names; var method_text should be methodText
| from:=`"0311112222"<sip:[email protected]:5060>;tag=FromTag` | ||
| to:=`<sip:[email protected]>;tag=ToTag` | ||
| cseq_num:=6789 | ||
| cseq_method:="INVITE" |
There was a problem hiding this comment.
don't use underscores in Go names; var cseq_method should be cseqMethod
| status_text:="Ringing" | ||
| from:=`"0311112222"<sip:[email protected]:5060>;tag=FromTag` | ||
| to:=`<sip:[email protected]>;tag=ToTag` | ||
| cseq_num:=6789 |
There was a problem hiding this comment.
don't use underscores in Go names; var cseq_num should be cseqNum
| sip.initDetailOption() | ||
| raw_text :="test raw string" | ||
| status_number:=(uint16)(180) | ||
| status_text:="Ringing" |
There was a problem hiding this comment.
don't use underscores in Go names; var status_text should be statusText
| sip.parseDetail=true | ||
| sip.initDetailOption() | ||
| raw_text :="test raw string" | ||
| status_number:=(uint16)(180) |
There was a problem hiding this comment.
don't use underscores in Go names; var status_number should be statusNumber
|
|
||
| sip.parseDetail=true | ||
| sip.initDetailOption() | ||
| raw_text :="test raw string" |
There was a problem hiding this comment.
don't use underscores in Go names; var raw_text should be rawText
|
|
||
| raw_text :="test raw string" | ||
| method_text:="INVITE" | ||
| phrase_text:="OK" |
There was a problem hiding this comment.
don't use underscores in Go names; var phrase_text should be phraseText
| headers := map[string][]common.NetString{} | ||
| to_h:=[]common.NetString{} | ||
| to_h=append(to_h,common.NetString(to)) | ||
| from_h:=[]common.NetString{} |
There was a problem hiding this comment.
don't use underscores in Go names; var from_h should be fromH
|
|
||
| sip.parseDetail=true | ||
| sip.initDetailOption() | ||
| raw_text :="test raw string" |
There was a problem hiding this comment.
don't use underscores in Go names; var raw_text should be rawText
| methodText := "INVITE" | ||
| from := `"0311112222"<sip:[email protected]:5060>;tag=FromTag` | ||
| to := `<sip:[email protected]>` | ||
| requestUri := "sip:+8137890123;npdi;[email protected]:5060;user=phone;transport=udp" |
There was a problem hiding this comment.
var requestUri should be requestURI
packetbeat/protos/sip/sipPlugin.go
Outdated
| prevChar = ' ' | ||
| pos := -1 | ||
| _ = port | ||
| in_addr := false |
There was a problem hiding this comment.
don't use underscores in Go names; var in_addr should be inAddr
packetbeat/protos/sip/sipPlugin.go
Outdated
| return user_info, host, port, params | ||
| } | ||
|
|
||
| func (sip *sipPlugin) parseDetailNameAddr(addr string) (display_name string, user_info string, host string, port string, addrparams []string, params []string) { |
There was a problem hiding this comment.
don't use underscores in Go names; method result display_name should be displayName
don't use underscores in Go names; method result user_info should be userInfo
packetbeat/protos/sip/sipPlugin.go
Outdated
| pos := -1 | ||
| ppos := -1 | ||
| epos := len(addr) | ||
| in_v6 := false |
There was a problem hiding this comment.
don't use underscores in Go names; var in_v6 should be inV6
packetbeat/protos/sip/sipPlugin.go
Outdated
| sip.publishMessage(sipMsg) | ||
| } | ||
|
|
||
| func (sip *sipPlugin) parseDetailURI(addr string) (user_info string, host string, port string, params []string) { |
There was a problem hiding this comment.
don't use underscores in Go names; method result user_info should be userInfo
packetbeat/protos/sip/sipMessage.go
Outdated
| sdp_lines := strings.Split(string(rawData), "\r\n") | ||
| for i := 0; i < len(sdp_lines); i++ { | ||
|
|
||
| key_val := strings.SplitN(sdp_lines[i], "=", 2) |
There was a problem hiding this comment.
don't use underscores in Go names; var key_val should be keyVal
packetbeat/protos/sip/sipMessage.go
Outdated
|
|
||
| func (msg *sipMessage) parseBody_SDP(rawData []byte) (body *map[string][]common.NetString, err error) { | ||
| body = &map[string][]common.NetString{} | ||
| sdp_lines := strings.Split(string(rawData), "\r\n") |
There was a problem hiding this comment.
don't use underscores in Go names; var sdp_lines should be sdpLines
packetbeat/protos/sip/sipMessage.go
Outdated
| return nil | ||
| } | ||
|
|
||
| func (msg *sipMessage) parseBody_SDP(rawData []byte) (body *map[string][]common.NetString, err error) { |
There was a problem hiding this comment.
don't use underscores in Go names; method parseBody_SDP should be parseBodySDP
packetbeat/protos/sip/sipMessage.go
Outdated
| _ = err | ||
| if err != nil { | ||
| debugf("%s : parseError", lower_case_content_type) | ||
| return fmt.Errorf("invalid %s format.", lower_case_content_type) |
There was a problem hiding this comment.
error strings should not be capitalized or end with punctuation or a newline
packetbeat/protos/sip/sipMessage.go
Outdated
| // Switch the function with body content type | ||
| // TODO: Now, it is supported only SDP, | ||
| // more SIP body application support (I planning to support SIP-I(ISUP)/Multi-part) | ||
| lower_case_content_type := strings.ToLower(string(getLastElementStrArray(contenttype_array))) |
There was a problem hiding this comment.
don't use underscores in Go names; var lower_case_content_type should be lowerCaseContentType
|
Hi @tj8000rpm . https://www.elastic.co/guide/en/beats/devguide/current/beats-contributing.html#update-scripts |
|
Hi @st1t , |
packetbeat/protos/sip/README.md
Outdated
| @@ -0,0 +1,375 @@ | |||
| # SIP(Session Initiation Protocol) for packetbeat | |||
| The SIP(Session Initiation Protocol) is a communications protocol for signaling and controlling multimedia communication sessions. SIP is used many VoIP applications at not only enterprise uses but also telecom careers. | |||
There was a problem hiding this comment.
Here and in some other places you use careers to mean carriers.
| - name: status-phrase | ||
| type: keyword | ||
| description: > | ||
| SIP Response , status phrase |
There was a problem hiding this comment.
nit: remove extra space before comma
packetbeat/protos/sip/sip.go
Outdated
|
|
||
| // MessegeStatus | ||
| const ( | ||
| SipStatusReceived = 0 |
There was a problem hiding this comment.
you can use iota initialization for these and the other constants in this file
https://github.com/golang/go/wiki/Iota
packetbeat/protos/sip/sipMessage.go
Outdated
|
|
||
| // Convert compact form to full form | ||
| if len(key) == 1 { | ||
| switch key { |
There was a problem hiding this comment.
can you replace this switch with a map[byte]string ?
|
Pinging @elastic/siem (Team:SIEM) |
|
Out of curiosity, is this no longer being considered? |
|
hi all. |
|
Hi @tj8000rpm, i've waited such a long time for someone to take on this task. Looks like you're almost on the finish line here :) Appreciate your work! /Robin |
|
I've also been waiting for SIP support for a very long time now. Do you have any ETA on when it might be available for version 7? Thanks! |
|
💚 CLA has been signed |
❕ Build Aborted
Expand to view the summary
Build stats
Log outputExpand to view the last 100 lines of log output
|
|
cla/check |
|
Hi @tj8000rpm I'm trying to get this merged (finally!). It seems there is a problem with the CLA. I see that the last few commits are not attributed to your user, but to Also, this needs a changelog entry, in
But feel free to use your own wording. |
|
@adriansr And I also added a CHANGELOG entry. |
❕ Build Aborted
Expand to view the summary
Build stats
Test stats 🧪
Log outputExpand to view the last 100 lines of log output
|
|
jenkins run tests |
|
@tj8000rpm Let's try to merge this once again 💪 It would be nice to update the branch, since CHANGELOG is conflicted and probably would be a good idea to run In general it looks fine, if you can would be nice to rename the files to Thanks for your patience one more time ❤️ hopefully we'll get this through sooner than later 🎉 |
|
Hello @tj8000rpm! Please let us know if you need any help or want us to do the changes ourselves :) Thanks! ❤️ |
|
Linking an open issue with some possible SIP mappings that align well with ECS: elastic/ecs#420 @marc-gr Would you mind working with us to adjust the fields from this PR with the ones from the linked issue? We still need to review them a bit, but feel they are pretty good already. |
That is awesome! I have been taking a look at this branch and the merge/rebase of it is quite tricky since is quite old. @tj8000rpm since it seems that this is something we want to move forward soon, I'll be opening a new PR based on this one to solve the issues and add the new field mappings so you do not lose authorship since you did all the work ❤️ 🙇♂️ |
|
@ebeahan @tj8000rpm I opened #21221 to follow with the changes and ECS mappings. I am closing this to avoid confusion. |
Hi all. I implemented a new protocol SIP to packetbeat. #152
The SIP(Session Initiation Protocol) is a communications protocol for signaling and controlling multimedia communication sessions. SIP is used many VoIP applications at not only enterprise uses but also telecom careers.
SIP is text-base protocol like HTTP. But SIP has various unique features like :
Therefore, I implemented with following plans.
More detail is writen in README.md