siprocket

Fast SIP and SDP Parser

siprocket is intended for Monitoring applications that need to parse SIP messages on the fly. It allows fast and structured access to the most commonly needed fields from both the SIP header and SDP payload. While intended for use in packet capture systems it could also be adapted to SIP Client and Server tasks.

Performance:

Without concurrency siprocket can parse approx 100k messages per second on a average xeon CPU. Depending on your application you may be able to parse concurrently which would greatly increase the throughput. The size and complexity of the SIP messages you have to parse will also influence performance.

Install:

Install using go get -u github.com/marv2097/siprocket Add the Import "github.com/marv2097/siprocket" in your code.

Usage:

siprocket expects data from a capture interface, socket or file as a slice of bytes. In most applications you will have already parsed the lower layers and pass the SIP payload to siprocket to be parsed. The output from the Parse function is a stuct that contains all of the top level items found in the SIP message. These can then be accessed using a simple dot notation. Most outputs are also slices of bytes with the exception of a few fields.

In this simple example we will use a SIP message defined directly in our code below. It will parse the message and print out the user-part of the 'From' and 'To' header fields.

// Load up a test message
raw := []byte("SIP/2.0 200 OK\r\n" +
              "Via: SIP/2.0/UDP 192.168.2.242:5060;received=22.23.24.25;branch=z9hG4bK5ea22bdd74d079b9;alias;rport=5060\r\n" +
              "To: <sip:JohnSmith@mycompany.com>;tag=aprqu3hicnhaiag03-2s7kdq2000ob4\r\n" +
              "From: sip:HarryJones@mycompany.com;tag=89ddf2f1700666f272fb861443003888\r\n" +
              "CSeq: 57413 REGISTER\r\n" +
              "Call-ID: b5deab6380c4e57fa20486e493c68324\r\n" +
              "Contact: <sip:JohnSmith@192.168.2.242:5060>;expires=192\r\n\r\n")

// Parse the sip data
sip := siprocket.Parse(raw)

// Print out the To User-part.
fmt.Print("From: ", string(sip.From.User), " To: ", string(sip.To.User))

Will Print From: HarryJones To: JohnSmith

Output Data Structure

Many of the SIP headers are in simple key value pairs. For example the Call-ID field, these kinds of fields all share the same format used to store them. It has a slice of bytes for the value, and an optional source variable.

type sipVal struct {
	Value []byte // Sip Value
	Src   []byte // Full source if needed
}

To access them we just reference the field name followed by the word Value. So if we wanted to get the Call-ID from the example above we would just reference sip.CallId.Value. Other fields that support this format are:

Header Field	Reference
User-Agent	Ua
Expires	Exp
Max-Forwards	MaxFwd
Call-Id	CallId
Content-Type	ContType
Content-Length	ContLen

More complicated fields have specific structs to hold the data they contain, for example the From and To header field has each section broken out and are identical:

type sipTo struct {
	UriType  string // Type of URI sip, sips, tel etc
	Name     []byte // Named portion of URI
	User     []byte // User part
	Host     []byte // Host part
	Port     []byte // Port number
	Tag      []byte // Tag
	UserType []byte // User Type
	Src      []byte // Full source if needed
}

Multiple values

When a field is present in the SIP header multiple times we can use a slice of its struct to hold the multiple values. These can then be itterated over with the range keyword or their size checked with the len keyword. An example of this is the Via header field. There can be multiple Via's in a SIP message and they are kept in order as the message is parsed from the first line to the last.

For a Via, The key part of the SipMsg struct is shown along with the sipVia struct:

type SipMsg struct
    Via []sipVia    // Slice of SIP Vias
    

type sipVia struct {
	Trans  string // Type of Transport udp, tcp, tls, sctp etc
	Host   []byte // Host part
	Port   []byte // Port number
	Branch []byte //
	Rport  []byte //
	Maddr  []byte //
	Ttl    []byte //
	Rcvd   []byte //
	Src    []byte // Full source if needed
}

The SDP Attributes field also supports multiple entries.

SDP

If SDP is found within a SIP message then it will be parsed too. Media Descriptions, Attributes and Connection Data are all available from the SDP payload. If you wanted to get the media port number from an INVITE with SDP and convert it to an integer, you could use something like:

	port, _ := strconv.Atoi(string(sip.Sdp.MediaDesc.Port))

Reading SIP from other sources

In most real world applications you want to read SIP from an external source. This may be a file, network socket or capture device. If you are wanting to capture with pf_ring then you can checkout my cutdown pf_ring go library.