Skip to content

Commit

Permalink
sip: remove UPDATE method for detection
Browse files Browse the repository at this point in the history
As it is also used for HTTP/1
Remove it only for TCP and keep it for UDP.

Ticket: 7436
  • Loading branch information
catenacyber authored and victorjulien committed Dec 7, 2024
1 parent e5b98be commit 38d7900
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion rust/src/sip/sip.rs
Original file line number Diff line number Diff line change
Expand Up @@ -496,7 +496,6 @@ fn register_pattern_probe(proto: u8) -> i8 {
"ACK\0",
"BYE\0",
"CANCEL\0",
"UPDATE\0",
"REFER\0",
"PRACK\0",
"SUBSCRIBE\0",
Expand Down Expand Up @@ -526,6 +525,16 @@ fn register_pattern_probe(proto: u8) -> i8 {
0,
core::Direction::ToClient as u8,
);
if proto == core::IPPROTO_UDP {
r |= AppLayerProtoDetectPMRegisterPatternCS(
proto,
ALPROTO_SIP,
"UPDATE\0".as_ptr() as *const std::os::raw::c_char,
"UPDATE".len() as u16,
0,
core::Direction::ToServer as u8,
);
}
}

if r == 0 {
Expand Down

0 comments on commit 38d7900

Please sign in to comment.