Reassemble SIP bodies fails with out of order packets
Summary
When SIP body data is received out of order, the "Reassemble SIP bodies spanning multiple TCP segments" option fails, with all packets for that SIP message marked as TCP instead of SIP.
Steps to reproduce
PCAP file attached.
With TCP options set: "Allow subdissector to reassemble TCP stream", "Reassemble out-of-order segments", "Analyze TCP sequence numbers". (note "Use relative sequence numbers" is FALSE).
With the SIP option set: "Reassemble SIP headers spanning multiple TCP segments"
Note "Reassemble SIP bodies..." is OFF.
- Packet 1 is shown as SIP Continuation
- Packet 2 is shown as TCP
- Packet 3 is shown as SIP, reassembled from packets 2 and 3
What is the current bug behavior?
If "Reassemble SIP bodies..." is turned on, all packets are shown as TCP.
What is the expected correct behavior?
I would expect:
- Packet 1 is shown as TCP
- Packet 2 is shown as TCP
- Packet 3 is shown as SIP, reassembled from packets 2, 3 and 1
(or some error message about why this failed)
Sample capture file
Relevant logs and/or screenshots
With Reassemble SIP bodies off:
With Reassemble SIP bodies turned on:
Note that if you use editcap/mergecap to rearrange the packets (not changing anything else), the SIP body reassembly works fine, eg this pcap file:
gives:
Please note that I'm very happy to assist with a fix for this as this is important for our project, however I would need some pointers about where to start as I am unfamiliar with the code.
Build information
3.6.7 (v3.6.7-0-g4a304d7ec222)
Compiled (64-bit) using Clang 13.0.0 (clang-1300.0.29.30), with Qt 5.15.3, with
libpcap, without POSIX capabilities, with GLib 2.68.4, with zlib 1.2.11, with
Lua 5.2.4, with GnuTLS 3.6.15 and PKCS #11 support, with Gcrypt 1.8.7, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.46.0, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.9, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using Sparkle, with SpeexDSP (using system
library), with Minizip.
Running on macOS 12.5, build 21G72 (Darwin 21.6.0), with 32768 MB of physical
memory, with GLib 2.68.4, with zlib 1.2.11, with Qt 5.15.3, with libpcap 1.9.1,
with c-ares 1.15.0, with GnuTLS 3.6.15, with Gcrypt 1.8.7, with nghttp2 1.46.0,
with brotli 1.0.9, with LZ4 1.9.2, with Zstandard 1.4.2, with libsmi 0.4.8, with
dark display mode, with HiDPI, with LC_TYPE=C, binary plugins supported (21
loaded).