epan/dissectors/packet-rtp.c

   1 /* packet-rtp.c
   2  *
   3  * Routines for RTP dissection
   4  * RTP = Real time Transport Protocol
   5  *
   6  * Copyright 2000, Philips Electronics N.V.
   7  * Written by Andreas Sikkema <h323@ramdyne.nl>
   8  *
   9  * $Id$
  10  *
  11  * Ethereal - Network traffic analyzer
  12  * By Gerald Combs <gerald@ethereal.com>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  28  */
  29
  30 /*
  31  * This dissector tries to dissect the RTP protocol according to Annex A
  32  * of ITU-T Recommendation H.225.0 (02/98) or RFC 1889
  33  *
  34  * RTP traffic is handled by an even UDP portnumber. This can be any
  35  * port number, but there is a registered port available, port 5004
  36  * See Annex B of ITU-T Recommendation H.225.0, section B.7
  37  *
  38  * This doesn't dissect older versions of RTP, such as:
  39  *
  40  *    the vat protocol ("version 0") - see
  41  *
  42  *      ftp://ftp.ee.lbl.gov/conferencing/vat/alpha-test/vatsrc-4.0b2.tar.gz
  43  *
  44  *    and look in "session-vat.cc" if you want to write a dissector
  45  *    (have fun - there aren't any nice header files showing the packet
  46  *    format);
  47  *
  48  *    version 1, as documented in
  49  *
  50  *      ftp://gaia.cs.umass.edu/pub/hgschulz/rtp/draft-ietf-avt-rtp-04.txt
  51  */
  52
  53
  54 #ifdef HAVE_CONFIG_H
  55 # include "config.h"
  56 #endif
  57
  58 #include <glib.h>
  59 #include <epan/packet.h>
  60
  61 #include <stdio.h>
  62 #include <string.h>
  63
  64 #include "packet-rtp.h"
  65 #include <epan/rtp_pt.h>
  66 #include <epan/conversation.h>
  67 #include <epan/tap.h>
  68
  69 #include <epan/prefs.h>
  70 #include <epan/emem.h>
  71
  72 static dissector_handle_t rtp_handle;
  73 static dissector_handle_t stun_handle;
  74
  75 static int rtp_tap = -1;
  76
  77 static dissector_table_t rtp_pt_dissector_table;
  78 static dissector_table_t rtp_dyn_pt_dissector_table;
  79
  80 /* RTP header fields             */
  81 static int proto_rtp           = -1;
  82 static int hf_rtp_version      = -1;
  83 static int hf_rtp_padding      = -1;
  84 static int hf_rtp_extension    = -1;
  85 static int hf_rtp_csrc_count   = -1;
  86 static int hf_rtp_marker       = -1;
  87 static int hf_rtp_payload_type = -1;
  88 static int hf_rtp_seq_nr       = -1;
  89 static int hf_rtp_timestamp    = -1;
  90 static int hf_rtp_ssrc         = -1;
  91 static int hf_rtp_csrc_item    = -1;
  92 static int hf_rtp_data         = -1;
  93 static int hf_rtp_padding_data = -1;
  94 static int hf_rtp_padding_count= -1;
  95
  96 /* RTP header extension fields   */
  97 static int hf_rtp_prof_define  = -1;
  98 static int hf_rtp_length       = -1;
  99 static int hf_rtp_hdr_ext      = -1;
 100
 101 /* RTP setup fields */
 102 static int hf_rtp_setup        = -1;
 103 static int hf_rtp_setup_frame  = -1;
 104 static int hf_rtp_setup_method = -1;
 105
 106 /* RTP fields defining a sub tree */
 107 static gint ett_rtp       = -1;
 108 static gint ett_csrc_list = -1;
 109 static gint ett_hdr_ext   = -1;
 110 static gint ett_rtp_setup = -1;
 111
 112
 113 #define RTP0_INVALID 0
 114 #define RTP0_STUN    1
 115
 116 static enum_val_t rtp_version0_types[] = {
 117         { "invalid", "Invalid RTP packets", RTP0_INVALID },
 118         { "stun", "STUN packets", RTP0_STUN },
 119         { NULL, NULL, 0 }
 120 };
 121 static guint global_rtp_version0_type = 0;
 122
 123 static dissector_handle_t data_handle;
 124
 125 static gboolean dissect_rtp_heur( tvbuff_t *tvb, packet_info *pinfo,
 126     proto_tree *tree );
 127 static void dissect_rtp( tvbuff_t *tvb, packet_info *pinfo,
 128     proto_tree *tree );
 129 static void show_setup_info(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 130 static void get_conv_info(packet_info *pinfo, struct _rtp_info *rtp_info);
 131
 132 /* Preferences bool to control whether or not setup info should be shown */
 133 static gboolean global_rtp_show_setup_info = TRUE;
 134
 135 /* Try heuristic RTP decode */
 136 static gboolean global_rtp_heur = FALSE;
 137
 138 /*
 139  * Fields in the first octet of the RTP header.
 140  */
 141
 142 /* Version is the first 2 bits of the first octet*/
 143 #define RTP_VERSION(octet)      ((octet) >> 6)
 144
 145 /* Padding is the third bit; No need to shift, because true is any value
 146    other than 0! */
 147 #define RTP_PADDING(octet)      ((octet) & 0x20)
 148
 149 /* Extension bit is the fourth bit */
 150 #define RTP_EXTENSION(octet)    ((octet) & 0x10)
 151
 152 /* CSRC count is the last four bits */
 153 #define RTP_CSRC_COUNT(octet)   ((octet) & 0xF)
 154
 155 static const value_string rtp_version_vals[] =
 156 {
 157         { 0, "Old VAT Version" },
 158         { 1, "First Draft Version" },
 159         { 2, "RFC 1889 Version" },
 160         { 0, NULL },
 161 };
 162
 163 /*
 164  * Fields in the second octet of the RTP header.
 165  */
 166
 167 /* Marker is the first bit of the second octet */
 168 #define RTP_MARKER(octet)       ((octet) & 0x80)
 169
 170 /* Payload type is the last 7 bits */
 171 #define RTP_PAYLOAD_TYPE(octet) ((octet) & 0x7F)
 172
 173 const value_string rtp_payload_type_vals[] =
 174 {
 175         { PT_PCMU,      "ITU-T G.711 PCMU" },
 176         { PT_1016,      "USA Federal Standard FS-1016" },
 177         { PT_G721,      "ITU-T G.721" },
 178         { PT_GSM,       "GSM 06.10" },
 179         { PT_G723,      "ITU-T G.723" },
 180         { PT_DVI4_8000, "DVI4 8000 samples/s" },
 181         { PT_DVI4_16000, "DVI4 16000 samples/s" },
 182         { PT_LPC,       "Experimental linear predictive encoding from Xerox PARC" },
 183         { PT_PCMA,      "ITU-T G.711 PCMA" },
 184         { PT_G722,      "ITU-T G.722" },
 185         { PT_L16_STEREO, "16-bit uncompressed audio, stereo" },
 186         { PT_L16_MONO,  "16-bit uncompressed audio, monaural" },
 187         { PT_QCELP,     "Qualcomm Code Excited Linear Predictive coding" },
 188         { PT_CN,        "Comfort noise" },
 189         { PT_MPA,       "MPEG-I/II Audio"},
 190         { PT_G728,      "ITU-T G.728" },
 191         { PT_DVI4_11025, "DVI4 11025 samples/s" },
 192         { PT_DVI4_22050, "DVI4 22050 samples/s" },
 193         { PT_G729,      "ITU-T G.729" },
 194         { PT_CN_OLD,    "Comfort noise (old)" },
 195         { PT_CELB,      "Sun CellB video encoding" },
 196         { PT_JPEG,      "JPEG-compressed video" },
 197         { PT_NV,        "'nv' program" },
 198         { PT_H261,      "ITU-T H.261" },
 199         { PT_MPV,       "MPEG-I/II Video"},
 200         { PT_MP2T,      "MPEG-II transport streams"},
 201         { PT_H263,      "ITU-T H.263" },
 202         { 0,            NULL },
 203 };
 204
 205 const value_string rtp_payload_type_short_vals[] =
 206 {
 207        { PT_PCMU,      "g711U" },
 208        { PT_1016,      "fs-1016" },
 209        { PT_G721,      "g721" },
 210        { PT_GSM,       "GSM" },
 211        { PT_G723,      "g723" },
 212        { PT_DVI4_8000, "DVI4 8k" },
 213        { PT_DVI4_16000, "DVI4 16k" },
 214        { PT_LPC,       "Exp. from Xerox PARC" },
 215        { PT_PCMA,      "g711A" },
 216        { PT_G722,      "g722" },
 217        { PT_L16_STEREO, "16-bit audio, stereo" },
 218        { PT_L16_MONO,  "16-bit audio, monaural" },
 219        { PT_QCELP,     "Qualcomm" },
 220        { PT_CN,        "CN" },
 221        { PT_MPA,       "MPEG-I/II Audio"},
 222        { PT_G728,      "g728" },
 223        { PT_DVI4_11025, "DVI4 11k" },
 224        { PT_DVI4_22050, "DVI4 22k" },
 225        { PT_G729,      "g729" },
 226        { PT_CN_OLD,    "CN(old)" },
 227        { PT_CELB,      "CellB" },
 228        { PT_JPEG,      "JPEG" },
 229        { PT_NV,        "NV" },
 230        { PT_H261,      "h261" },
 231        { PT_MPV,       "MPEG-I/II Video"},
 232        { PT_MP2T,      "MPEG-II streams"},
 233        { PT_H263,      "h263" },
 234        { 0,            NULL },
 235 };
 236
 237 void
 238 rtp_free_hash_dyn_payload(GHashTable *rtp_dyn_payload)
 239 {
 240         if (rtp_dyn_payload == NULL) return;
 241         g_hash_table_destroy(rtp_dyn_payload);
 242         rtp_dyn_payload = NULL;
 243 }
 244
 245 /* Set up an RTP conversation */
 246 void rtp_add_address(packet_info *pinfo,
 247                      address *addr, int port,
 248                      int other_port,
 249                      const gchar *setup_method, guint32 setup_frame_number, GHashTable *rtp_dyn_payload)
 250 {
 251         address null_addr;
 252         conversation_t* p_conv;
 253         struct _rtp_conversation_info *p_conv_data = NULL;
 254
 255         /*
 256          * If this isn't the first time this packet has been processed,
 257          * we've already done this work, so we don't need to do it
 258          * again.
 259          */
 260         if (pinfo->fd->flags.visited)
 261         {
 262                 return;
 263         }
 264
 265         SET_ADDRESS(&null_addr, AT_NONE, 0, NULL);
 266
 267         /*
 268          * Check if the ip address and port combination is not
 269          * already registered as a conversation.
 270          */
 271         p_conv = find_conversation( setup_frame_number, addr, &null_addr, PT_UDP, port, other_port,
 272                                 NO_ADDR_B | (!other_port ? NO_PORT_B : 0));
 273
 274         /*
 275          * If not, create a new conversation.
 276          */
 277         if ( !p_conv || p_conv->setup_frame != setup_frame_number) {
 278                 p_conv = conversation_new( setup_frame_number, addr, &null_addr, PT_UDP,
 279                                            (guint32)port, (guint32)other_port,
 280                                                                    NO_ADDR2 | (!other_port ? NO_PORT2 : 0));
 281         }
 282
 283         /* Set dissector */
 284         conversation_set_dissector(p_conv, rtp_handle);
 285
 286         /*
 287          * Check if the conversation has data associated with it.
 288          */
 289         p_conv_data = conversation_get_proto_data(p_conv, proto_rtp);
 290
 291         /*
 292          * If not, add a new data item.
 293          */
 294         if ( ! p_conv_data ) {
 295                 /* Create conversation data */
 296                 p_conv_data = se_alloc(sizeof(struct _rtp_conversation_info));
 297                 p_conv_data->rtp_dyn_payload = NULL;
 298
 299                 conversation_add_proto_data(p_conv, proto_rtp, p_conv_data);
 300         }
 301
 302         /*
 303          * Update the conversation data.
 304          */
 305         /* Free the hash if already exists */
 306         rtp_free_hash_dyn_payload(p_conv_data->rtp_dyn_payload);
 307
 308         strncpy(p_conv_data->method, setup_method, MAX_RTP_SETUP_METHOD_SIZE);
 309         p_conv_data->method[MAX_RTP_SETUP_METHOD_SIZE] = '\0';
 310         p_conv_data->frame_number = setup_frame_number;
 311         p_conv_data->rtp_dyn_payload = rtp_dyn_payload;
 312 }
 313
 314 static gboolean
 315 dissect_rtp_heur( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
 316 {
 317         guint8      octet1, octet2;
 318         unsigned int version;
 319         unsigned int payload_type;
 320         unsigned int offset = 0;
 321
 322         /* This is a heuristic dissector, which means we get all the UDP
 323          * traffic not sent to a known dissector and not claimed by
 324          * a heuristic dissector called before us!
 325          */
 326
 327         if (! global_rtp_heur)
 328                 return FALSE;
 329
 330         /* Get the fields in the first octet */
 331         octet1 = tvb_get_guint8( tvb, offset );
 332         version = RTP_VERSION( octet1 );
 333
 334         if (version == 0) {
 335                 switch (global_rtp_version0_type) {
 336                 case RTP0_STUN:
 337                         call_dissector(stun_handle, tvb, pinfo, tree);
 338                         return TRUE;
 339
 340                 case RTP0_INVALID:
 341                 default:
 342                         return FALSE; /* Unknown or unsupported version */
 343                 }
 344         } else if (version != 2) {
 345                 /* Unknown or unsupported version */
 346                 return FALSE;
 347         }
 348
 349         /* Get the fields in the second octet */
 350         octet2 = tvb_get_guint8( tvb, offset + 1 );
 351         payload_type = RTP_PAYLOAD_TYPE( octet2 );
 352         /*      if (payload_type == PT_PCMU ||
 353          *                   payload_type == PT_PCMA)
 354          *           payload_type == PT_G729)
 355          *       */
 356         if (payload_type <= PT_H263) {
 357                 dissect_rtp( tvb, pinfo, tree );
 358                 return TRUE;
 359         }
 360         else {
 361                 return FALSE;
 362         }
 363 }
 364
 365 static void
 366 dissect_rtp_data( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 367     proto_tree *rtp_tree, int offset, unsigned int data_len,
 368     unsigned int data_reported_len, unsigned int payload_type )
 369 {
 370         tvbuff_t *newtvb;
 371         struct _rtp_conversation_info *p_conv_data = NULL;
 372         gboolean found_match = FALSE;
 373
 374         newtvb = tvb_new_subset( tvb, offset, data_len, data_reported_len );
 375
 376         /* if the payload type is dynamic (96 to 127), we check if the conv is set and we look for the pt definition */
 377         if ( (payload_type >=96) && (payload_type <=127) ) {
 378                 p_conv_data = p_get_proto_data(pinfo->fd, proto_rtp);
 379                 if (p_conv_data && p_conv_data->rtp_dyn_payload) {
 380                         gchar *payload_type_str = NULL;
 381                         payload_type_str = g_hash_table_lookup(p_conv_data->rtp_dyn_payload, &payload_type);
 382                         if (payload_type_str)
 383                                 found_match = dissector_try_string(rtp_dyn_pt_dissector_table,
 384                                                                                                         payload_type_str, newtvb, pinfo, tree);
 385                 }
 386         }
 387         /* if we don't found, it is static OR could be set static from the preferences */
 388         if (found_match == FALSE)
 389                 if (!dissector_try_port(rtp_pt_dissector_table, payload_type, newtvb, pinfo, tree))
 390                         proto_tree_add_item( rtp_tree, hf_rtp_data, newtvb, 0, -1, FALSE );
 391
 392 }
 393
 394 static void
 395 dissect_rtp( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
 396 {
 397         proto_item *ti            = NULL;
 398         proto_tree *rtp_tree      = NULL;
 399         proto_tree *rtp_csrc_tree = NULL;
 400         guint8      octet1, octet2;
 401         unsigned int version;
 402         gboolean    padding_set;
 403         gboolean    extension_set;
 404         unsigned int csrc_count;
 405         gboolean    marker_set;
 406         unsigned int payload_type;
 407         gchar *payload_type_str = NULL;
 408         unsigned int i            = 0;
 409         unsigned int hdr_extension= 0;
 410         unsigned int padding_count;
 411         gint        length, reported_length;
 412         int         data_len;
 413         unsigned int offset = 0;
 414         guint16     seq_num;
 415         guint32     timestamp;
 416         guint32     sync_src;
 417         guint32     csrc_item;
 418         struct _rtp_conversation_info *p_conv_data = NULL;
 419
 420         /* Can tap up to 4 RTP packets within same packet */
 421         static struct _rtp_info rtp_info_arr[4];
 422         static int rtp_info_current=0;
 423         struct _rtp_info *rtp_info;
 424
 425         rtp_info_current++;
 426         if (rtp_info_current==4) {
 427                 rtp_info_current=0;
 428         }
 429         rtp_info = &rtp_info_arr[rtp_info_current];
 430
 431         /* Get the fields in the first octet */
 432         octet1 = tvb_get_guint8( tvb, offset );
 433         version = RTP_VERSION( octet1 );
 434
 435         if (version == 0) {
 436                 switch (global_rtp_version0_type) {
 437                 case RTP0_STUN:
 438                         call_dissector(stun_handle, tvb, pinfo, tree);
 439                         return;
 440
 441                 case RTP0_INVALID:
 442                 default:
 443                         ; /* Unknown or unsupported version (let it fall through */
 444                 }
 445         }
 446
 447         /* fill in the rtp_info structure */
 448         rtp_info->info_version = version;
 449         if (version != 2) {
 450                 /*
 451                  * Unknown or unsupported version.
 452                  */
 453                 if ( check_col( pinfo->cinfo, COL_PROTOCOL ) )   {
 454                         col_set_str( pinfo->cinfo, COL_PROTOCOL, "RTP" );
 455                 }
 456
 457                 if ( check_col( pinfo->cinfo, COL_INFO) ) {
 458                         col_add_fstr( pinfo->cinfo, COL_INFO,
 459                             "Unknown RTP version %u", version);
 460                 }
 461
 462                 if ( tree ) {
 463                         ti = proto_tree_add_item( tree, proto_rtp, tvb, offset, -1, FALSE );
 464                         rtp_tree = proto_item_add_subtree( ti, ett_rtp );
 465
 466                         proto_tree_add_uint( rtp_tree, hf_rtp_version, tvb,
 467                             offset, 1, octet1);
 468                 }
 469                 return;
 470         }
 471
 472         padding_set = RTP_PADDING( octet1 );
 473         extension_set = RTP_EXTENSION( octet1 );
 474         csrc_count = RTP_CSRC_COUNT( octet1 );
 475
 476         /* Get the fields in the second octet */
 477         octet2 = tvb_get_guint8( tvb, offset + 1 );
 478         marker_set = RTP_MARKER( octet2 );
 479         payload_type = RTP_PAYLOAD_TYPE( octet2 );
 480
 481         /* Get the subsequent fields */
 482         seq_num = tvb_get_ntohs( tvb, offset + 2 );
 483         timestamp = tvb_get_ntohl( tvb, offset + 4 );
 484         sync_src = tvb_get_ntohl( tvb, offset + 8 );
 485
 486         /* fill in the rtp_info structure */
 487         rtp_info->info_padding_set = padding_set;
 488         rtp_info->info_padding_count = 0;
 489         rtp_info->info_marker_set = marker_set;
 490         rtp_info->info_payload_type = payload_type;
 491         rtp_info->info_seq_num = seq_num;
 492         rtp_info->info_timestamp = timestamp;
 493         rtp_info->info_sync_src = sync_src;
 494         rtp_info->info_setup_frame_num = 0;
 495         rtp_info->info_payload_type_str = NULL;
 496
 497         /*
 498          * Do we have all the data?
 499          */
 500         length = tvb_length_remaining(tvb, offset);
 501         reported_length = tvb_reported_length_remaining(tvb, offset);
 502         if (reported_length >= 0 && length >= reported_length) {
 503                 /*
 504                  * Yes.
 505                  */
 506                 rtp_info->info_all_data_present = TRUE;
 507                 rtp_info->info_data_len = reported_length;
 508
 509                 /*
 510                  * Save the pointer to raw rtp data (header + payload incl.
 511                  * padding).
 512                  * That should be safe because the "epan_dissect_t"
 513                  * constructed for the packet has not yet been freed when
 514                  * the taps are called.
 515                  * (Destroying the "epan_dissect_t" will end up freeing
 516                  * all the tvbuffs and hence invalidating pointers to
 517                  * their data.)
 518                  * See "add_packet_to_packet_list()" for details.
 519                  */
 520                 rtp_info->info_data = tvb_get_ptr(tvb, 0, -1);
 521         } else {
 522                 /*
 523                  * No - packet was cut short at capture time.
 524                  */
 525                 rtp_info->info_all_data_present = FALSE;
 526                 rtp_info->info_data_len = 0;
 527                 rtp_info->info_data = NULL;
 528         }
 529
 530         /* Look for conv and add to the frame if found */
 531         get_conv_info(pinfo, rtp_info);
 532
 533         if ( check_col( pinfo->cinfo, COL_PROTOCOL ) )   {
 534                 col_set_str( pinfo->cinfo, COL_PROTOCOL, "RTP" );
 535         }
 536
 537         /* if it is dynamic payload, let use the conv data to see if it is defined */
 538         if ( (payload_type>95) && (payload_type<128) ) {
 539                 /* Use existing packet info if available */
 540                 p_conv_data = p_get_proto_data(pinfo->fd, proto_rtp);
 541                 if (p_conv_data && p_conv_data->rtp_dyn_payload){
 542                         payload_type_str = g_hash_table_lookup(p_conv_data->rtp_dyn_payload, &payload_type);
 543                         rtp_info->info_payload_type_str = payload_type_str;
 544                 }
 545         }
 546
 547         if ( check_col( pinfo->cinfo, COL_INFO) ) {
 548                 col_add_fstr( pinfo->cinfo, COL_INFO,
 549                     "Payload type=%s, SSRC=%u, Seq=%u, Time=%u%s",
 550                         payload_type_str ? payload_type_str : val_to_str( payload_type, rtp_payload_type_vals,"Unknown (%u)" ),
 551                     sync_src,
 552                     seq_num,
 553                     timestamp,
 554                     marker_set ? ", Mark" : "");
 555         }
 556
 557
 558         if ( tree ) {
 559                 proto_tree *item;
 560                 /* Create RTP protocol tree */
 561                 ti = proto_tree_add_item(tree, proto_rtp, tvb, offset, -1, FALSE );
 562                 rtp_tree = proto_item_add_subtree(ti, ett_rtp );
 563
 564                 /* Conversation setup info */
 565                 if (global_rtp_show_setup_info)
 566                 {
 567                         show_setup_info(tvb, pinfo, rtp_tree);
 568                 }
 569
 570                 proto_tree_add_uint( rtp_tree, hf_rtp_version, tvb,
 571                     offset, 1, octet1 );
 572                 proto_tree_add_boolean( rtp_tree, hf_rtp_padding, tvb,
 573                     offset, 1, octet1 );
 574                 proto_tree_add_boolean( rtp_tree, hf_rtp_extension, tvb,
 575                     offset, 1, octet1 );
 576                 proto_tree_add_uint( rtp_tree, hf_rtp_csrc_count, tvb,
 577                     offset, 1, octet1 );
 578                 offset++;
 579
 580                 proto_tree_add_boolean( rtp_tree, hf_rtp_marker, tvb, offset,
 581                     1, octet2 );
 582
 583                 item = proto_tree_add_uint_format( rtp_tree, hf_rtp_payload_type, tvb,
 584                     offset, 1, octet2, "Payload type: %s (%u)",
 585                         payload_type_str ? payload_type_str : val_to_str( payload_type, rtp_payload_type_vals,"Unknown"),
 586                         payload_type);
 587
 588                 offset++;
 589
 590                 /* Sequence number 16 bits (2 octets) */
 591                 proto_tree_add_uint( rtp_tree, hf_rtp_seq_nr, tvb, offset, 2, seq_num );
 592                 offset += 2;
 593
 594                 /* Timestamp 32 bits (4 octets) */
 595                 proto_tree_add_uint( rtp_tree, hf_rtp_timestamp, tvb, offset, 4, timestamp );
 596                 offset += 4;
 597
 598                 /* Synchronization source identifier 32 bits (4 octets) */
 599                 proto_tree_add_uint( rtp_tree, hf_rtp_ssrc, tvb, offset, 4, sync_src );
 600                 offset += 4;
 601         } else {
 602                 offset += 12;
 603         }
 604         /* CSRC list*/
 605         if ( csrc_count > 0 ) {
 606                 if ( tree ) {
 607                         ti = proto_tree_add_text(rtp_tree, tvb, offset, csrc_count * 4, "Contributing Source identifiers");
 608                         rtp_csrc_tree = proto_item_add_subtree( ti, ett_csrc_list );
 609                 }
 610                 for (i = 0; i < csrc_count; i++ ) {
 611                         csrc_item = tvb_get_ntohl( tvb, offset );
 612                         if ( tree ) proto_tree_add_uint_format( rtp_csrc_tree,
 613                             hf_rtp_csrc_item, tvb, offset, 4,
 614                             csrc_item,
 615                             "CSRC item %d: %u",
 616                             i, csrc_item );
 617                         offset += 4;
 618                 }
 619         }
 620
 621         /* Optional RTP header extension */
 622         if ( extension_set ) {
 623                 /* Defined by profile field is 16 bits (2 octets) */
 624                 if ( tree ) proto_tree_add_uint( rtp_tree, hf_rtp_prof_define, tvb, offset, 2, tvb_get_ntohs( tvb, offset ) );
 625                 offset += 2;
 626
 627                 hdr_extension = tvb_get_ntohs( tvb, offset );
 628                 if ( tree ) proto_tree_add_uint( rtp_tree, hf_rtp_length, tvb,
 629                     offset, 2, hdr_extension);
 630                 offset += 2;
 631                 if ( hdr_extension > 0 ) {
 632                         if ( tree ) {
 633                                 ti = proto_tree_add_text(rtp_tree, tvb, offset, csrc_count * 4, "Header extensions");
 634                                 /* I'm re-using the old tree variable here
 635                                    from the CSRC list!*/
 636                                 rtp_csrc_tree = proto_item_add_subtree( ti,
 637                                     ett_hdr_ext );
 638                         }
 639                         for (i = 0; i < hdr_extension; i++ ) {
 640                                 if ( tree ) proto_tree_add_uint( rtp_csrc_tree, hf_rtp_hdr_ext, tvb, offset, 4, tvb_get_ntohl( tvb, offset ) );
 641                                 offset += 4;
 642                         }
 643                 }
 644         }
 645
 646         if ( padding_set ) {
 647                 /*
 648                  * This RTP frame has padding - find it.
 649                  *
 650                  * The padding count is found in the LAST octet of
 651                  * the packet; it contains the number of octets
 652                  * that can be ignored at the end of the packet.
 653                  */
 654                 if (tvb_length(tvb) < tvb_reported_length(tvb)) {
 655                         /*
 656                          * We don't *have* the last octet of the
 657                          * packet, so we can't get the padding
 658                          * count.
 659                          *
 660                          * Put an indication of that into the
 661                          * tree, and just put in a raw data
 662                          * item.
 663                          */
 664                         if ( tree ) proto_tree_add_text(rtp_tree, tvb, 0, 0,
 665                             "Frame has padding, but not all the frame data was captured");
 666                         call_dissector(data_handle,
 667                             tvb_new_subset(tvb, offset, -1, -1),
 668                             pinfo, rtp_tree);
 669                         return;
 670                 }
 671
 672                 padding_count = tvb_get_guint8( tvb,
 673                     tvb_reported_length( tvb ) - 1 );
 674                 data_len =
 675                     tvb_reported_length_remaining( tvb, offset ) - padding_count;
 676
 677                 rtp_info->info_payload_offset = offset;
 678                 rtp_info->info_payload_len = tvb_length_remaining(tvb, offset);
 679                 rtp_info->info_padding_count = padding_count;
 680
 681                 if (data_len > 0) {
 682                         /*
 683                          * There's data left over when you take out
 684                          * the padding; dissect it.
 685                          */
 686                         dissect_rtp_data( tvb, pinfo, tree, rtp_tree,
 687                             offset,
 688                             data_len,
 689                             data_len,
 690                             payload_type );
 691                         offset += data_len;
 692                 } else if (data_len < 0) {
 693                         /*
 694                          * The padding count is bigger than the
 695                          * amount of RTP payload in the packet!
 696                          * Clip the padding count.
 697                          *
 698                          * XXX - put an item in the tree to indicate
 699                          * that the padding count is bogus?
 700                          */
 701                         padding_count =
 702                             tvb_reported_length_remaining(tvb, offset);
 703                 }
 704                 if (padding_count > 1) {
 705                         /*
 706                          * There's more than one byte of padding;
 707                          * show all but the last byte as padding
 708                          * data.
 709                          */
 710                         if ( tree ) proto_tree_add_item( rtp_tree, hf_rtp_padding_data,
 711                             tvb, offset, padding_count - 1, FALSE );
 712                         offset += padding_count - 1;
 713                 }
 714                 /*
 715                  * Show the last byte in the PDU as the padding
 716                  * count.
 717                  */
 718                 if ( tree ) proto_tree_add_item( rtp_tree, hf_rtp_padding_count,
 719                     tvb, offset, 1, FALSE );
 720         }
 721         else {
 722                 /*
 723                  * No padding.
 724                  */
 725                 dissect_rtp_data( tvb, pinfo, tree, rtp_tree, offset,
 726                     tvb_length_remaining( tvb, offset ),
 727                     tvb_reported_length_remaining( tvb, offset ),
 728                     payload_type );
 729                 rtp_info->info_payload_offset = offset;
 730                 rtp_info->info_payload_len = tvb_length_remaining(tvb, offset);
 731         }
 732         if (!pinfo->in_error_pkt)
 733                 tap_queue_packet(rtp_tap, pinfo, rtp_info);
 734 }
 735
 736 /* Look for conversation info */
 737 static void get_conv_info(packet_info *pinfo, struct _rtp_info *rtp_info)
 738 {
 739         /* Conversation and current data */
 740         conversation_t *p_conv = NULL;
 741         struct _rtp_conversation_info *p_conv_data = NULL;
 742
 743         /* Use existing packet info if available */
 744         p_conv_data = p_get_proto_data(pinfo->fd, proto_rtp);
 745
 746         if (!p_conv_data)
 747         {
 748                 /* First time, get info from conversation */
 749                 p_conv = find_conversation(pinfo->fd->num, &pinfo->net_dst, &pinfo->net_src,
 750                                            pinfo->ptype,
 751                                            pinfo->destport, pinfo->srcport, NO_ADDR_B);
 752                 if (p_conv)
 753                 {
 754                         /* Create space for packet info */
 755                         struct _rtp_conversation_info *p_conv_packet_data;
 756                         p_conv_data = conversation_get_proto_data(p_conv, proto_rtp);
 757
 758                         if (p_conv_data) {
 759                                 /* Save this conversation info into packet info */
 760                                 p_conv_packet_data = se_alloc(sizeof(struct _rtp_conversation_info));
 761                                 g_snprintf(p_conv_packet_data->method, MAX_RTP_SETUP_METHOD_SIZE, "%s", p_conv_data->method);
 762                                 p_conv_packet_data->method[MAX_RTP_SETUP_METHOD_SIZE]=0;
 763                                 p_conv_packet_data->frame_number = p_conv_data->frame_number;
 764                                 p_conv_packet_data->rtp_dyn_payload = p_conv_data->rtp_dyn_payload;
 765                                 p_add_proto_data(pinfo->fd, proto_rtp, p_conv_packet_data);
 766                         }
 767                 }
 768         }
 769         if (p_conv_data) rtp_info->info_setup_frame_num = p_conv_data->frame_number;
 770 }
 771
 772
 773 /* Display setup info */
 774 static void show_setup_info(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 775 {
 776         /* Conversation and current data */
 777         struct _rtp_conversation_info *p_conv_data = NULL;
 778                 proto_tree *rtp_setup_tree;
 779         proto_item *ti;
 780
 781         /* Use existing packet info if available */
 782         p_conv_data = p_get_proto_data(pinfo->fd, proto_rtp);
 783
 784         if (!p_conv_data) return;
 785
 786         /* Create setup info subtree with summary info. */
 787         ti =  proto_tree_add_string_format(tree, hf_rtp_setup, tvb, 0, 0,
 788                                                                "",
 789                                                                "Stream setup by %s (frame %u)",
 790                                                                p_conv_data->method,
 791                                                                p_conv_data->frame_number);
 792                 PROTO_ITEM_SET_GENERATED(ti);
 793                 rtp_setup_tree = proto_item_add_subtree(ti, ett_rtp_setup);
 794                 if (rtp_setup_tree)
 795                 {
 796                         /* Add details into subtree */
 797                         proto_item* item = proto_tree_add_uint(rtp_setup_tree, hf_rtp_setup_frame,
 798                                                                tvb, 0, 0, p_conv_data->frame_number);
 799                         PROTO_ITEM_SET_GENERATED(item);
 800                         item = proto_tree_add_string(rtp_setup_tree, hf_rtp_setup_method,
 801                                                      tvb, 0, 0, p_conv_data->method);
 802                         PROTO_ITEM_SET_GENERATED(item);
 803                 }
 804 }
 805
 806
 807 void
 808 proto_register_rtp(void)
 809 {
 810         static hf_register_info hf[] =
 811         {
 812                 {
 813                         &hf_rtp_version,
 814                         {
 815                                 "Version",
 816                                 "rtp.version",
 817                                 FT_UINT8,
 818                                 BASE_DEC,
 819                                 VALS(rtp_version_vals),
 820                                 0xC0,
 821                                 "", HFILL
 822                         }
 823                 },
 824                 {
 825                         &hf_rtp_padding,
 826                         {
 827                                 "Padding",
 828                                 "rtp.padding",
 829                                 FT_BOOLEAN,
 830                                 8,
 831                                 NULL,
 832                                 0x20,
 833                                 "", HFILL
 834                         }
 835                 },
 836                 {
 837                         &hf_rtp_extension,
 838                         {
 839                                 "Extension",
 840                                 "rtp.ext",
 841                                 FT_BOOLEAN,
 842                                 8,
 843                                 NULL,
 844                                 0x10,
 845                                 "", HFILL
 846                         }
 847                 },
 848                 {
 849                         &hf_rtp_csrc_count,
 850                         {
 851                                 "Contributing source identifiers count",
 852                                 "rtp.cc",
 853                                 FT_UINT8,
 854                                 BASE_DEC,
 855                                 NULL,
 856                                 0x0F,
 857                                 "", HFILL
 858                         }
 859                 },
 860                 {
 861                         &hf_rtp_marker,
 862                         {
 863                                 "Marker",
 864                                 "rtp.marker",
 865                                 FT_BOOLEAN,
 866                                 8,
 867                                 NULL,
 868                                 0x80,
 869                                 "", HFILL
 870                         }
 871                 },
 872                 {
 873                         &hf_rtp_payload_type,
 874                         {
 875                                 "Payload type",
 876                                 "rtp.p_type",
 877                                 FT_UINT8,
 878                                 BASE_DEC,
 879                                 NULL,
 880                                 0x7F,
 881                                 "", HFILL
 882                         }
 883                 },
 884                 {
 885                         &hf_rtp_seq_nr,
 886                         {
 887                                 "Sequence number",
 888                                 "rtp.seq",
 889                                 FT_UINT16,
 890                                 BASE_DEC,
 891                                 NULL,
 892                                 0x0,
 893                                 "", HFILL
 894                         }
 895                 },
 896                 {
 897                         &hf_rtp_timestamp,
 898                         {
 899                                 "Timestamp",
 900                                 "rtp.timestamp",
 901                                 FT_UINT32,
 902                                 BASE_DEC,
 903                                 NULL,
 904                                 0x0,
 905                                 "", HFILL
 906                         }
 907                 },
 908                 {
 909                         &hf_rtp_ssrc,
 910                         {
 911                                 "Synchronization Source identifier",
 912                                 "rtp.ssrc",
 913                                 FT_UINT32,
 914                                 BASE_DEC,
 915                                 NULL,
 916                                 0x0,
 917                                 "", HFILL
 918                         }
 919                 },
 920                 {
 921                         &hf_rtp_prof_define,
 922                         {
 923                                 "Defined by profile",
 924                                 "rtp.ext.profile",
 925                                 FT_UINT16,
 926                                 BASE_DEC,
 927                                 NULL,
 928                                 0x0,
 929                                 "", HFILL
 930                         }
 931                 },
 932                 {
 933                         &hf_rtp_length,
 934                         {
 935                                 "Extension length",
 936                                 "rtp.ext.len",
 937                                 FT_UINT16,
 938                                 BASE_DEC,
 939                                 NULL,
 940                                 0x0,
 941                                 "", HFILL
 942                         }
 943                 },
 944                 {
 945                         &hf_rtp_csrc_item,
 946                         {
 947                                 "CSRC item",
 948                                 "rtp.csrc.item",
 949                                 FT_UINT32,
 950                                 BASE_DEC,
 951                                 NULL,
 952                                 0x0,
 953                                 "", HFILL
 954                         }
 955                 },
 956                 {
 957                         &hf_rtp_hdr_ext,
 958                         {
 959                                 "Header extension",
 960                                 "rtp.hdr_ext",
 961                                 FT_UINT32,
 962                                 BASE_DEC,
 963                                 NULL,
 964                                 0x0,
 965                                 "", HFILL
 966                         }
 967                 },
 968                 {
 969                         &hf_rtp_data,
 970                         {
 971                                 "Payload",
 972                                 "rtp.payload",
 973                                 FT_BYTES,
 974                                 BASE_HEX,
 975                                 NULL,
 976                                 0x0,
 977                                 "", HFILL
 978                         }
 979                 },
 980                 {
 981                         &hf_rtp_padding_data,
 982                         {
 983                                 "Padding data",
 984                                 "rtp.padding.data",
 985                                 FT_BYTES,
 986                                 BASE_HEX,
 987                                 NULL,
 988                                 0x0,
 989                                 "", HFILL
 990                         }
 991                 },
 992                 {
 993                         &hf_rtp_padding_count,
 994                         {
 995                                 "Padding count",
 996                                 "rtp.padding.count",
 997                                 FT_UINT8,
 998                                 BASE_DEC,
 999                                 NULL,
1000                                 0x0,
1001                                 "", HFILL
1002                         }
1003                 },
1004                 {
1005                         &hf_rtp_setup,
1006                         {
1007                                 "Stream setup",
1008                                 "rtp.setup",
1009                                 FT_STRING,
1010                                 BASE_NONE,
1011                                 NULL,
1012                                 0x0,
1013                                 "Stream setup, method and frame number", HFILL
1014                         }
1015                 },
1016                 {
1017                         &hf_rtp_setup_frame,
1018                         {
1019                                 "Setup frame",
1020                                 "rtp.setup-frame",
1021                                 FT_FRAMENUM,
1022                                 BASE_NONE,
1023                                 NULL,
1024                                 0x0,
1025                                 "Frame that set up this stream", HFILL
1026                         }
1027                 },
1028                 {
1029                         &hf_rtp_setup_method,
1030                         {
1031                                 "Setup Method",
1032                                 "rtp.setup-method",
1033                                 FT_STRING,
1034                                 BASE_NONE,
1035                                 NULL,
1036                                 0x0,
1037                                 "Method used to set up this stream", HFILL
1038                         }
1039                 }
1040
1041         };
1042
1043         static gint *ett[] =
1044         {
1045                 &ett_rtp,
1046                 &ett_csrc_list,
1047                 &ett_hdr_ext,
1048                 &ett_rtp_setup
1049         };
1050
1051         module_t *rtp_module;
1052
1053
1054         proto_rtp = proto_register_protocol("Real-Time Transport Protocol",
1055             "RTP", "rtp");
1056         proto_register_field_array(proto_rtp, hf, array_length(hf));
1057         proto_register_subtree_array(ett, array_length(ett));
1058
1059         register_dissector("rtp", dissect_rtp, proto_rtp);
1060
1061         rtp_tap = register_tap("rtp");
1062
1063         rtp_pt_dissector_table = register_dissector_table("rtp.pt",
1064                                                           "RTP payload type", FT_UINT8, BASE_DEC);
1065         rtp_dyn_pt_dissector_table = register_dissector_table("rtp_dyn_payload_type",
1066                                                                                                     "Dynamic RTP payload type", FT_STRING, BASE_NONE);
1067
1068
1069         rtp_module = prefs_register_protocol(proto_rtp, NULL);
1070
1071         prefs_register_bool_preference(rtp_module, "show_setup_info",
1072                                        "Show stream setup information",
1073                                        "Where available, show which protocol and frame caused "
1074                                        "this RTP stream to be created",
1075                                        &global_rtp_show_setup_info);
1076
1077         prefs_register_bool_preference(rtp_module, "heuristic_rtp",
1078                                        "Try to decode RTP outside of conversations",
1079                                        "If call control SIP/H323/RTSP/.. messages are missing in the trace, "
1080                                        "RTP isn't decoded without this",
1081                                        &global_rtp_heur);
1082
1083         prefs_register_enum_preference(rtp_module, "version0_type",
1084                                        "Treat RTP version 0 packets as",
1085                                        "If an RTP version 0 packet is encountered, it can be treated as an invalid packet or a STUN packet",
1086                                        &global_rtp_version0_type,
1087                                        rtp_version0_types, FALSE);
1088 }
1089
1090 void
1091 proto_reg_handoff_rtp(void)
1092 {
1093         data_handle = find_dissector("data");
1094         stun_handle = find_dissector("stun");
1095         /*
1096          * Register this dissector as one that can be selected by a
1097          * UDP port number.
1098          */
1099         rtp_handle = find_dissector("rtp");
1100         dissector_add_handle("udp.port", rtp_handle);
1101
1102         heur_dissector_add( "udp", dissect_rtp_heur, proto_rtp);
1103 }