packet-sip.c

   1 /* packet-sip.c
   2  * Routines for the Session Initiation Protocol (SIP) dissection.
   3  * RFC 2543
   4  *
   5  * TODO: Pay attention to Content-Type: It might not always be SDP.
   6  *       hf_ display filters for headers of SIP extension RFCs:
   7  *              Done for RCF 3265, RFC 3262
   8  *              Use hash table for list of headers
   9  *       Add sip msg body dissection based on Content-Type for:
  10  *                SDP, MIME, and other types
  11  *       Align SIP methods with recent Internet Drafts or RFC
  12  *               (SIP INFO, rfc2976 - done)
  13  *               (SIP SUBSCRIBE-NOTIFY - done)
  14  *               (SIP REFER - done)
  15  *               check for other
  16  *
  17  * Copyright 2000, Heikki Vatiainen <hessu@cs.tut.fi>
  18  * Copyright 2001, Jean-Francois Mule <jfm@cablelabs.com>
  19  *
  20  * $Id: packet-sip.c,v 1.35 2003/03/11 01:48:55 gerald Exp $
  21  *
  22  * Ethereal - Network traffic analyzer
  23  * By Gerald Combs <gerald@ethereal.com>
  24  * Copyright 1998 Gerald Combs
  25  *
  26  * Copied from packet-cops.c
  27  *
  28  * This program is free software; you can redistribute it and/or
  29  * modify it under the terms of the GNU General Public License
  30  * as published by the Free Software Foundation; either version 2
  31  * of the License, or (at your option) any later version.
  32  *
  33  * This program is distributed in the hope that it will be useful,
  34  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  35  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  36  * GNU General Public License for more details.
  37  *
  38  * You should have received a copy of the GNU General Public License
  39  * along with this program; if not, write to the Free Software
  40  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  41  */
  42
  43 #ifdef HAVE_CONFIG_H
  44 # include "config.h"
  45 #endif
  46
  47 #include <stdio.h>
  48 #include <stdlib.h>
  49 #include <string.h>
  50
  51 #include <glib.h>
  52 #include <epan/packet.h>
  53
  54 #define TCP_PORT_SIP 5060
  55 #define UDP_PORT_SIP 5060
  56
  57 /* Initialize the protocol and registered fields */
  58 static gint proto_sip = -1;
  59 static gint hf_msg_hdr = -1;
  60 static gint hf_Method = -1;
  61 static gint hf_Status_Code = -1;
  62
  63 /* Initialize the subtree pointers */
  64 static gint ett_sip = -1;
  65 static gint ett_sip_hdr = -1;
  66
  67 static const char *sip_methods[] = {
  68         "<Invalid method>",      /* Pad so that the real methods start at index 1 */
  69         "ACK",
  70         "BYE",
  71         "CANCEL",
  72         "DO",
  73         "INFO",
  74         "INVITE",
  75         "MESSAGE",
  76         "NOTIFY",
  77         "OPTIONS",
  78         "PRACK",
  79         "QAUTH",
  80         "REFER",
  81         "REGISTER",
  82         "SPRACK",
  83         "SUBSCRIBE"
  84 };
  85
  86 /* from RFC 3261 */
  87 static const char *sip_headers[] = {
  88                 "Unknown-header", /* Pad so that the real headers start at index 1 */
  89                 "Accept",
  90                 "Accept-Encoding",
  91                 "Accept-Language",
  92                 "Alert-Info",
  93                 "Allow",
  94                 "Allow-Events",
  95                 "Authentication-Info",
  96                 "Authorization",
  97                 "Call-ID",
  98                 "Call-Info",
  99                 "Contact",
 100                 "Content-Disposition",
 101                 "Content-Encoding",
 102                 "Content-Language",
 103                 "Content-Length",
 104                 "Content-Type",
 105                 "CSeq",
 106                 "Date",
 107                 "Error-Info",
 108                 "Event",
 109                 "Expires",
 110                 "From",
 111                 "In-Reply-To",
 112                 "Max-Forwards",
 113                 "MIME-Version",
 114                 "Min-Expires",
 115                 "Organization",
 116                 "Priority",
 117                 "Proxy-Authenticate",
 118                 "Proxy-Authorization",
 119                 "Proxy-Require",
 120                 "RAck",
 121                 "RSeq",
 122                 "Record-Route",
 123                 "Reply-To",
 124                 "Require",
 125                 "Retry-After",
 126                 "Route",
 127                 "Server",
 128                 "Subject",
 129                 "Subscription-State",
 130                 "Supported",
 131                 "Timestamp",
 132                 "To",
 133                 "Unsupported",
 134                 "User-Agent",
 135                 "Via",
 136                 "Warning",
 137                 "WWW-Authenticate"
 138 };
 139
 140
 141 #define POS_ACCEPT              1
 142 #define POS_ACCEPT_ENCODING     2
 143 #define POS_ACCEPT_LANGUAGE     3
 144 #define POS_ALERT_INFO          4
 145 #define POS_ALLOW               5
 146 #define POS_ALLOW_EVENTS        6
 147 #define POS_AUTHENTICATION_INFO 7
 148 #define POS_AUTHORIZATION       8
 149 #define POS_CALL_ID             9
 150 #define POS_CALL_INFO           10
 151 #define POS_CONTACT             11
 152 #define POS_CONTENT_DISPOSITION 12
 153 #define POS_CONTENT_ENCODING    13
 154 #define POS_CONTENT_LANGUAGE    14
 155 #define POS_CONTENT_LENGTH      15
 156 #define POS_CONTENT_TYPE        16
 157 #define POS_CSEQ                17
 158 #define POS_DATE                18
 159 #define POS_ERROR_INFO          19
 160 #define POS_EVENT               20
 161 #define POS_EXPIRES             21
 162 #define POS_FROM                22
 163 #define POS_IN_REPLY_TO         23
 164 #define POS_MAX_FORWARDS        24
 165 #define POS_MIME_VERSION        25
 166 #define POS_MIN_EXPIRES         26
 167 #define POS_ORGANIZATION        27
 168 #define POS_PRIORITY            28
 169 #define POS_PROXY_AUTHENTICATE  29
 170 #define POS_PROXY_AUTHORIZATION 30
 171 #define POS_PROXY_REQUIRE       31
 172 #define POS_RACK                32
 173 #define POS_RSEQ                33
 174 #define POS_RECORD_ROUTE        34
 175 #define POS_REPLY_TO            35
 176 #define POS_REQUIRE             36
 177 #define POS_RETRY_AFTER         37
 178 #define POS_ROUTE               38
 179 #define POS_SERVER              39
 180 #define POS_SUBJECT             40
 181 #define POS_SUBSCRIPTION_STATE  41
 182 #define POS_SUPPORTED           42
 183 #define POS_TIMESTAMP           43
 184 #define POS_TO                  44
 185 #define POS_UNSUPPORTED         45
 186 #define POS_USER_AGENT          46
 187 #define POS_VIA                 47
 188 #define POS_WARNING             48
 189 #define POS_WWW_AUTHENTICATE    49
 190
 191 static gint hf_header_array[] = {
 192                 -1, /* "Unknown-header" - Pad so that the real headers start at index 1 */
 193                 -1, /* "Accept" */
 194                 -1, /* "Accept-Encoding" */
 195                 -1, /* "Accept-Language" */
 196                 -1, /* "Alert-Info" */
 197                 -1, /* "Allow" */
 198                 -1, /* "Allow-Events" - RFC 3265 */
 199                 -1, /* "Authentication-Info" */
 200                 -1, /* "Authorization" */
 201                 -1, /* "Call-ID" */
 202                 -1, /* "Call-Info" */
 203                 -1, /* "Contact" */
 204                 -1, /* "Content-Disposition" */
 205                 -1, /* "Content-Encoding" */
 206                 -1, /* "Content-Language" */
 207                 -1, /* "Content-Length" */
 208                 -1, /* "Content-Type" */
 209                 -1, /* "CSeq" */
 210                 -1, /* "Date" */
 211                 -1, /* "Error-Info" */
 212                 -1, /* "Expires" */
 213                 -1, /* "Event" - RFC 3265 */
 214                 -1, /* "From" */
 215                 -1, /* "In-Reply-To" */
 216                 -1, /* "Max-Forwards" */
 217                 -1, /* "MIME-Version" */
 218                 -1, /* "Min-Expires" */
 219                 -1, /* "Organization" */
 220                 -1, /* "Priority" */
 221                 -1, /* "Proxy-Authenticate" */
 222                 -1, /* "Proxy-Authorization" */
 223                 -1, /* "Proxy-Require" */
 224                 -1, /* "RAck" - RFC 3262 */
 225                 -1, /* "RSeq" - RFC 3261 */
 226                 -1, /* "Record-Route" */
 227                 -1, /* "Reply-To" */
 228                 -1, /* "Require" */
 229                 -1, /* "Retry-After" */
 230                 -1, /* "Route" */
 231                 -1, /* "Server" */
 232                 -1, /* "Subject" */
 233                 -1, /* "Subscription-State" - RFC 3265 */
 234                 -1, /* "Supported" */
 235                 -1, /* "Timestamp" */
 236                 -1, /* "To" */
 237                 -1, /* "Unsupported" */
 238                 -1, /* "User-Agent" */
 239                 -1, /* "Via" */
 240                 -1, /* "Warning" */
 241                 -1  /* "WWW-Authenticate" */
 242 };
 243
 244
 245 static gboolean sip_is_request(tvbuff_t *tvb, gint eol);
 246 static gboolean sip_is_known_request(tvbuff_t *tvb, guint32 offset);
 247 static gint sip_get_msg_offset(tvbuff_t *tvb, guint32 offset);
 248 static gint sip_is_known_sip_header(tvbuff_t *tvb, guint32 offset, guint8* header_len);
 249 void dfilter_sip_message_line(gboolean is_request, tvbuff_t *tvb, proto_tree *tree);
 250
 251 static dissector_handle_t sdp_handle;
 252 static dissector_handle_t data_handle;
 253
 254 #define SIP2_HDR "SIP/2.0"
 255 #define SIP2_HDR_LEN (strlen (SIP2_HDR))
 256
 257 /* Code to actually dissect the packets */
 258 static void dissect_sip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 259 {
 260         guint32 offset;
 261         gint eol, next_offset, msg_offset;
 262         tvbuff_t *next_tvb;
 263         gboolean is_request, is_known_request;
 264         char *req_descr;
 265
 266         /*
 267          * Note that "tvb_strneql()" doesn't throw exceptions, so
 268          * "sip_is_request()" won't throw an exception.
 269          *
 270          * Note that "tvb_find_line_end()" will return a value that
 271          * is not longer than what's in the buffer, so the
 272          * "tvb_get_ptr()" call s below won't throw exceptions.
 273          */
 274         offset = 0;
 275         eol = tvb_find_line_end(tvb, 0, -1, &next_offset, FALSE);
 276         /* XXX - Check for a valid status message as well. */
 277         is_request = sip_is_request(tvb, eol);
 278         is_known_request = sip_is_known_request(tvb, 0);
 279         /* XXX - Is this case-sensitive?  RFC 2543 didn't explicitly say. */
 280         if (tvb_strneql(tvb, 0, SIP2_HDR, SIP2_HDR_LEN) != 0 && ! is_request)
 281                 goto bad;
 282
 283         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 284                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "SIP");
 285
 286         req_descr = is_known_request ? "Request" : "Unknown request";
 287         if (check_col(pinfo->cinfo, COL_INFO))
 288                 col_add_fstr(pinfo->cinfo, COL_INFO, "%s: %s",
 289                              is_request ? req_descr : "Status",
 290                              is_request ?
 291                              tvb_format_text(tvb, 0, eol - SIP2_HDR_LEN - 1) :
 292                              tvb_format_text(tvb, SIP2_HDR_LEN + 1, eol - SIP2_HDR_LEN - 1));
 293         msg_offset = sip_get_msg_offset(tvb, offset);
 294         if (msg_offset < 0) {
 295                 /*
 296                  * XXX - this may just mean that the entire SIP message
 297                  * didn't fit in this TCP segment.
 298                  */
 299                 goto bad;
 300         }
 301
 302         if (tree) {
 303                 proto_item *ti, *th;
 304                 proto_tree *sip_tree, *hdr_tree;
 305
 306                 ti = proto_tree_add_item(tree, proto_sip, tvb, 0, -1, FALSE);
 307                 sip_tree = proto_item_add_subtree(ti, ett_sip);
 308
 309                 proto_tree_add_text(sip_tree, tvb, 0, next_offset, "%s line: %s",
 310                                     is_request ? req_descr : "Status",
 311                                     tvb_format_text(tvb, 0, eol));
 312
 313                 dfilter_sip_message_line(is_request , tvb, sip_tree);
 314
 315                 offset = next_offset;
 316                 th = proto_tree_add_item(sip_tree, hf_msg_hdr, tvb, offset, msg_offset - offset, FALSE);
 317                 hdr_tree = proto_item_add_subtree(th, ett_sip_hdr);
 318
 319                 /* - 2 since we have a CRLF separating the message-body */
 320                 while (msg_offset - 2 > (int) offset) {
 321                         gint hf_index;
 322                         guint8 header_len;
 323
 324                         eol = tvb_find_line_end(tvb, offset, -1, &next_offset,
 325                             FALSE);
 326                         hf_index = sip_is_known_sip_header(tvb, offset, &header_len);
 327
 328                         if (hf_index == -1) {
 329                          proto_tree_add_text(hdr_tree, tvb, offset , next_offset - offset, "%s",
 330                                             tvb_format_text(tvb, offset, eol));
 331                         }
 332                         else    {
 333                          proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset ,
 334                                              tvb_format_text(tvb, offset + header_len + 2, eol - header_len - 2));
 335                         }
 336
 337                         offset = next_offset;
 338                 }
 339                 offset += 2;  /* Skip the CRLF mentioned above */
 340        }
 341
 342         if (tvb_offset_exists(tvb, msg_offset)) {
 343                 next_tvb = tvb_new_subset(tvb, msg_offset, -1, -1);
 344                 call_dissector(sdp_handle, next_tvb, pinfo, tree);
 345         }
 346
 347         return;
 348
 349   bad:
 350         next_tvb = tvb_new_subset(tvb, offset, -1, -1);
 351         call_dissector(data_handle,next_tvb, pinfo, tree);
 352
 353         return;
 354 }
 355
 356 /* Display filter for SIP-message line */
 357 void dfilter_sip_message_line(gboolean is_request, tvbuff_t *tvb, proto_tree *tree)
 358 {
 359         char    *string;
 360         gint    code_len;
 361
 362         if (is_request) {
 363             code_len = tvb_find_guint8(tvb, 0, -1, ' ');
 364         }
 365         else    {
 366             code_len = tvb_find_guint8(tvb, SIP2_HDR_LEN + 1, -1, ' ');
 367         }
 368
 369         string = g_malloc(code_len + 1);
 370
 371         CLEANUP_PUSH(g_free, string);
 372
 373         if (is_request) {
 374             tvb_memcpy(tvb, (guint8 *)string, 0, code_len);
 375             string[code_len] = '\0';
 376             proto_tree_add_string(tree, hf_Method, tvb, 0,
 377                     code_len, string);
 378         }
 379         else    {
 380             tvb_memcpy(tvb, (guint8 *)string, SIP2_HDR_LEN + 1, code_len - SIP2_HDR_LEN);
 381             string[code_len - SIP2_HDR_LEN - 1] = '\0';
 382             proto_tree_add_string(tree, hf_Status_Code,
 383                     tvb, SIP2_HDR_LEN + 1, code_len - SIP2_HDR_LEN - 1, string);
 384         }
 385
 386         CLEANUP_CALL_AND_POP;
 387 }
 388
 389 static gboolean
 390 dissect_sip_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 391 {
 392         gint eol, next_offset;
 393
 394         /*
 395          * This is a heuristic dissector, which means we get all the
 396          * UDP and TCP traffic not sent to a known dissector and not
 397          * claimed by a heuristic dissector called before us!
 398          * So we first check if the frame is really meant for us.
 399          */
 400
 401         /*
 402          * Check for a response.
 403          * First, make sure we have enough data to do the check.
 404          */
 405         if (!tvb_bytes_exist(tvb, 0, SIP2_HDR_LEN)) {
 406                 /*
 407                  * We don't.
 408                  */
 409                 return FALSE;
 410         }
 411
 412         /*
 413          * Now see if we have a response header; they begin with
 414          * "SIP/2.0".
 415          */
 416         if (tvb_strneql(tvb, 0, SIP2_HDR, SIP2_HDR_LEN) != 0)  {
 417                 /*
 418                  * We don't, so this isn't a response; check for a request.
 419                  * They *end* with "SIP/2.0".
 420                  */
 421                 eol = tvb_find_line_end(tvb, 0, -1, &next_offset, FALSE);
 422                 if (eol <= (gint)SIP2_HDR_LEN) {
 423                         /*
 424                          * The line isn't long enough to end with "SIP/2.0".
 425                          */
 426                         return FALSE;
 427                 }
 428                 if (!tvb_bytes_exist(tvb, eol - SIP2_HDR_LEN, SIP2_HDR_LEN)) {
 429                         /*
 430                          * We don't have enough of the data in the line
 431                          * to check.
 432                          */
 433                         return FALSE;
 434                 }
 435
 436                 if (tvb_strneql(tvb, eol - SIP2_HDR_LEN, SIP2_HDR, SIP2_HDR_LEN - 1) != 0) {
 437                         /*
 438                          * Not a request, either.
 439                          */
 440                         return FALSE;
 441                 }
 442         }
 443
 444         /*
 445          * The message seems to be a valid SIP message!
 446          */
 447         dissect_sip(tvb, pinfo, tree);
 448
 449         return TRUE;
 450 }
 451
 452 /* Returns the offset to the start of the optional message-body, or
 453  * -1 if not found.
 454  */
 455 static gint sip_get_msg_offset(tvbuff_t *tvb, guint32 offset)
 456 {
 457         gint eol;
 458
 459         while ((eol = tvb_find_guint8(tvb, offset, -1, '\r')) > 0
 460             && tvb_bytes_exist(tvb, eol, 4)) {
 461                 if (tvb_get_guint8(tvb, eol + 1) == '\n' &&
 462                     tvb_get_guint8(tvb, eol + 2) == '\r' &&
 463                     tvb_get_guint8(tvb, eol + 3) == '\n')
 464                         return eol + 4;
 465                 offset = eol + 2;
 466         }
 467
 468         return -1;
 469 }
 470
 471 /* From section 4.1 of RFC 2543:
 472  *
 473  * Request-Line  =  Method SP Request-URI SP SIP-Version CRLF
 474  */
 475
 476 static gboolean sip_is_request(tvbuff_t *tvb, gint eol)
 477 {
 478         gint meth_len, req_len, req_colon_pos;
 479         guint8 req_start, ver_start, ver_len;
 480
 481         meth_len = tvb_find_guint8(tvb, 0, -1, ' ');
 482         req_start = meth_len + 1;
 483         req_len = tvb_find_guint8(tvb, req_start, -1, ' ') - meth_len - 1;
 484         req_colon_pos = tvb_find_guint8(tvb, req_start + 1, -1, ':');
 485         ver_start = meth_len + req_len + 2;
 486         ver_len = eol - req_len - meth_len - 2; /*CRLF, plus two spaces */
 487
 488         /* Do we have:
 489          *   A method of at least one character?
 490          *   A URI consisting of at least three characters?
 491          *   A version string length matching that of SIP2_HDR?
 492          */
 493         if (meth_len <= 0 || req_len <= 3 || ver_len != SIP2_HDR_LEN)
 494                 return FALSE;
 495
 496         /* Does our method have a colon character? */
 497         if (req_colon_pos < 0 || req_colon_pos > ver_start)
 498                 return FALSE;
 499         /* XXX - Check for a proper URI prefix? */
 500
 501         /* Do we have a proper version string? */
 502         if (tvb_strneql(tvb, ver_start, SIP2_HDR, SIP2_HDR_LEN))
 503                 return TRUE;
 504
 505         return TRUE;
 506 }
 507
 508 static gboolean sip_is_known_request(tvbuff_t *tvb, guint32 offset)
 509 {
 510         guint8 i, meth_len;
 511
 512         meth_len = tvb_find_guint8(tvb, 0, -1, ' ');
 513
 514         for (i = 1; i < array_length(sip_methods); i++) {
 515                 if ((meth_len == strlen(sip_methods[i])) && tvb_strneql(tvb, offset, sip_methods[i], strlen(sip_methods[i])) == 0)
 516                         return TRUE;
 517         }
 518
 519         return FALSE;
 520 }
 521
 522 /* Returns index of method in sip_headers */
 523 static gint sip_is_known_sip_header(tvbuff_t *tvb, guint32 offset, guint8* header_len)
 524 {
 525         guint8 i;
 526
 527         *header_len = tvb_find_guint8(tvb, offset, -1, ':') - offset;
 528
 529         for (i = 1; i < array_length(sip_headers); i++) {
 530                 if ((*header_len == strlen(sip_headers[i])) && tvb_strneql(tvb, offset, sip_headers[i], strlen(sip_headers[i])) == 0)
 531                         return i;
 532         }
 533
 534         return -1;
 535 }
 536
 537 /* Register the protocol with Ethereal */
 538 void proto_register_sip(void)
 539 {
 540
 541         /* Setup list of header fields */
 542         static hf_register_info hf[] = {
 543
 544                 { &hf_msg_hdr,
 545                         { "Message Header",           "sip.msg_hdr",
 546                         FT_NONE, 0, NULL, 0,
 547                         "Message Header in SIP message", HFILL }
 548                 },
 549                 { &hf_Method,
 550                        { "Method",              "sip.Method",
 551                        FT_STRING, BASE_NONE,NULL,0x0,
 552                         "SIP Method", HFILL }
 553                 },
 554                 { &hf_Status_Code,
 555                        { "Status-Code",                 "sip.Status-Code",
 556                        FT_STRING, BASE_NONE,NULL,0x0,
 557                         "SIP Status Code", HFILL }
 558                 },
 559                 { &hf_header_array[POS_ACCEPT],
 560                        { "Accept",              "sip.Accept",
 561                        FT_STRING, BASE_NONE,NULL,0x0,
 562                         "RFC 3261: Accept Header", HFILL }
 563                 },
 564                 { &hf_header_array[POS_ACCEPT_ENCODING],
 565                        { "Accept-Encoding",             "sip.Accept-Encoding",
 566                        FT_STRING, BASE_NONE,NULL,0x0,
 567                         "RFC 3261: Accept-Encoding Header", HFILL }
 568                 },
 569                 { &hf_header_array[POS_ACCEPT_LANGUAGE],
 570                        { "Accept-Language",             "sip.Accept-Language",
 571                        FT_STRING, BASE_NONE,NULL,0x0,
 572                         "RFC 3261: Accept-Language Header", HFILL }
 573                 },
 574                 { &hf_header_array[POS_ALERT_INFO],
 575                        { "Alert-Info",          "sip.Alert-Info",
 576                        FT_STRING, BASE_NONE,NULL,0x0,
 577                         "RFC 3261: Alert-Info Header", HFILL }
 578                 },
 579                 { &hf_header_array[POS_ALLOW],
 580                        { "Allow",               "sip.Allow",
 581                        FT_STRING, BASE_NONE,NULL,0x0,
 582                         "RFC 3261: Allow Header", HFILL }
 583                 },
 584                 { &hf_header_array[POS_ALLOW_EVENTS],
 585                        { "Allow-Events",                "sip.Allow-Events",
 586                        FT_STRING, BASE_NONE,NULL,0x0,
 587                         "RFC 3265: Allow-Events Header", HFILL }
 588                 },
 589                 { &hf_header_array[POS_AUTHENTICATION_INFO],
 590                        { "Authentication-Info",                 "sip.Authentication-Info",
 591                        FT_STRING, BASE_NONE,NULL,0x0,
 592                         "RFC 3261: Authentication-Info Header", HFILL }
 593                 },
 594                 { &hf_header_array[POS_AUTHORIZATION],
 595                        { "Authorization",               "sip.Authorization",
 596                        FT_STRING, BASE_NONE,NULL,0x0,
 597                         "RFC 3261: Authorization Header", HFILL }
 598                 },
 599                 { &hf_header_array[POS_CALL_ID],
 600                        { "Call-ID",             "sip.Call-ID",
 601                        FT_STRING, BASE_NONE,NULL,0x0,
 602                         "RFC 3261: Call-ID Header", HFILL }
 603                 },
 604                 { &hf_header_array[POS_CALL_INFO],
 605                        { "Call-Info",           "sip.Call-Info",
 606                        FT_STRING, BASE_NONE,NULL,0x0,
 607                         "RFC 3261: Call-Info Header", HFILL }
 608                 },
 609                 { &hf_header_array[POS_CONTACT],
 610                        { "Contact",             "sip.Contact",
 611                        FT_STRING, BASE_NONE,NULL,0x0,
 612                         "RFC 3261: Contact Header", HFILL }
 613                 },
 614                 { &hf_header_array[POS_CONTENT_DISPOSITION],
 615                        { "Content-Disposition",                 "sip.Content-Disposition",
 616                        FT_STRING, BASE_NONE,NULL,0x0,
 617                         "RFC 3261: Content-Disposition Header", HFILL }
 618                 },
 619                 { &hf_header_array[POS_CONTENT_ENCODING],
 620                        { "Content-Encoding",            "sip.Content-Encoding",
 621                        FT_STRING, BASE_NONE,NULL,0x0,
 622                         "RFC 3261: Content-Encoding Header", HFILL }
 623                 },
 624                 { &hf_header_array[POS_CONTENT_LANGUAGE],
 625                        { "Content-Language",            "sip.Content-Language",
 626                        FT_STRING, BASE_NONE,NULL,0x0,
 627                         "RFC 3261: Content-Language Header", HFILL }
 628                 },
 629                 { &hf_header_array[POS_CONTENT_LENGTH],
 630                        { "Content-Length",              "sip.Content-Length",
 631                        FT_STRING, BASE_NONE,NULL,0x0,
 632                         "RFC 3261: Content-Length Header", HFILL }
 633                 },
 634                 { &hf_header_array[POS_CONTENT_TYPE],
 635                        { "Content-Type",                "sip.Content-Type",
 636                        FT_STRING, BASE_NONE,NULL,0x0,
 637                         "RFC 3261: Content-Type Header", HFILL }
 638                 },
 639                 { &hf_header_array[POS_CSEQ],
 640                        { "CSeq",                "sip.CSeq",
 641                        FT_STRING, BASE_NONE,NULL,0x0,
 642                         "RFC 3261: CSeq Header", HFILL }
 643                 },
 644                 { &hf_header_array[POS_DATE],
 645                        { "Date",                "sip.Date",
 646                        FT_STRING, BASE_NONE,NULL,0x0,
 647                         "RFC 3261: Date Header", HFILL }
 648                 },
 649                 { &hf_header_array[POS_ERROR_INFO],
 650                        { "Error-Info",          "sip.Error-Info",
 651                        FT_STRING, BASE_NONE,NULL,0x0,
 652                         "RFC 3261: Error-Info Header", HFILL }
 653                 },
 654                 { &hf_header_array[POS_EVENT],
 655                        { "Event",               "sip.Event",
 656                        FT_STRING, BASE_NONE,NULL,0x0,
 657                         "RFC 3265: Event Header", HFILL }
 658                 },
 659                 { &hf_header_array[POS_EXPIRES],
 660                        { "Expires",             "sip.Expires",
 661                        FT_STRING, BASE_NONE,NULL,0x0,
 662                         "RFC 3261: Expires Header", HFILL }
 663                 },
 664                 { &hf_header_array[POS_FROM],
 665                        { "From",                "sip.From",
 666                        FT_STRING, BASE_NONE,NULL,0x0,
 667                         "RFC 3261: From Header", HFILL }
 668                 },
 669                 { &hf_header_array[POS_IN_REPLY_TO],
 670                        { "In-Reply-To",                 "sip.In-Reply-To",
 671                        FT_STRING, BASE_NONE,NULL,0x0,
 672                         "RFC 3261: In-Reply-To Header", HFILL }
 673                 },
 674                 { &hf_header_array[POS_MAX_FORWARDS],
 675                        { "Max-Forwards",                "sip.Max-Forwards",
 676                        FT_STRING, BASE_NONE,NULL,0x0,
 677                         "RFC 3261: Max-Forwards Header", HFILL }
 678                 },
 679                 { &hf_header_array[POS_MIME_VERSION],
 680                        { "MIME-Version",                "sip.MIME-Version",
 681                        FT_STRING, BASE_NONE,NULL,0x0,
 682                         "RFC 3261: MIME-Version Header", HFILL }
 683                 },
 684                 { &hf_header_array[POS_MIN_EXPIRES],
 685                        { "Min-Expires",                 "sip.Min-Expires",
 686                        FT_STRING, BASE_NONE,NULL,0x0,
 687                         "RFC 3261: Min-Expires Header", HFILL }
 688                 },
 689                 { &hf_header_array[POS_ORGANIZATION],
 690                        { "Organization",                "sip.Organization",
 691                        FT_STRING, BASE_NONE,NULL,0x0,
 692                         "RFC 3261: Organization Header", HFILL }
 693                 },
 694                 { &hf_header_array[POS_PRIORITY],
 695                        { "Priority",            "sip.Priority",
 696                        FT_STRING, BASE_NONE,NULL,0x0,
 697                         "RFC 3261: Priority Header", HFILL }
 698                 },
 699                 { &hf_header_array[POS_PROXY_AUTHENTICATE],
 700                        { "Proxy-Authenticate",          "sip.Proxy-Authenticate",
 701                        FT_STRING, BASE_NONE,NULL,0x0,
 702                         "RFC 3261: Proxy-Authenticate Header", HFILL }
 703                 },
 704                 { &hf_header_array[POS_PROXY_AUTHORIZATION],
 705                        { "Proxy-Authorization",                 "sip.Proxy-Authorization",
 706                        FT_STRING, BASE_NONE,NULL,0x0,
 707                         "RFC 3261: Proxy-Authorization Header", HFILL }
 708                 },
 709                 { &hf_header_array[POS_RACK],
 710                        { "RAck",                "sip.RAck",
 711                        FT_STRING, BASE_NONE,NULL,0x0,
 712                         "RFC 3262: RAck Header", HFILL }
 713                 },
 714                 { &hf_header_array[POS_RSEQ],
 715                        { "RSeq",                "sip.RSeq",
 716                        FT_STRING, BASE_NONE,NULL,0x0,
 717                         "RFC 3262: RSeq Header", HFILL }
 718                 },
 719                 { &hf_header_array[POS_PROXY_REQUIRE],
 720                        { "Proxy-Require",               "sip.Proxy-Require",
 721                        FT_STRING, BASE_NONE,NULL,0x0,
 722                         "RFC 3261: Proxy-Require Header", HFILL }
 723                 },
 724                 { &hf_header_array[POS_RECORD_ROUTE],
 725                        { "Record-Route",                "sip.Record-Route",
 726                        FT_STRING, BASE_NONE,NULL,0x0,
 727                         "RFC 3261: Record-Route Header", HFILL }
 728                 },
 729                 { &hf_header_array[POS_REPLY_TO],
 730                        { "Reply-To",            "sip.Reply-To",
 731                        FT_STRING, BASE_NONE,NULL,0x0,
 732                         "RFC 3261: Reply-To Header", HFILL }
 733                 },
 734                 { &hf_header_array[POS_REQUIRE],
 735                        { "Require",             "sip.Require",
 736                        FT_STRING, BASE_NONE,NULL,0x0,
 737                         "RFC 3261: Require Header", HFILL }
 738                 },
 739                 { &hf_header_array[POS_RETRY_AFTER],
 740                        { "Retry-After",                 "sip.Retry-After",
 741                        FT_STRING, BASE_NONE,NULL,0x0,
 742                         "RFC 3261: Retry-After Header", HFILL }
 743                 },
 744                 { &hf_header_array[POS_ROUTE],
 745                        { "Route",               "sip.Route",
 746                        FT_STRING, BASE_NONE,NULL,0x0,
 747                         "RFC 3261: Route Header", HFILL }
 748                 },
 749                 { &hf_header_array[POS_SERVER],
 750                        { "Server",              "sip.Server",
 751                        FT_STRING, BASE_NONE,NULL,0x0,
 752                         "RFC 3261: Server Header", HFILL }
 753                 },
 754                 { &hf_header_array[POS_SUBJECT],
 755                        { "Subject",             "sip.Subject",
 756                        FT_STRING, BASE_NONE,NULL,0x0,
 757                         "RFC 3261: Subject Header", HFILL }
 758                 },
 759                 { &hf_header_array[POS_SUBSCRIPTION_STATE],
 760                        { "Subscription-State",          "sip.Subscription-State",
 761                        FT_STRING, BASE_NONE,NULL,0x0,
 762                         "RFC 3265: Subscription-State Header", HFILL }
 763                 },
 764                 { &hf_header_array[POS_SUPPORTED],
 765                        { "Supported",           "sip.Supported",
 766                        FT_STRING, BASE_NONE,NULL,0x0,
 767                         "RFC 3261: Supported Header", HFILL }
 768                 },
 769                 { &hf_header_array[POS_TIMESTAMP],
 770                        { "Timestamp",           "sip.Timestamp",
 771                        FT_STRING, BASE_NONE,NULL,0x0,
 772                         "RFC 3261: Timestamp Header", HFILL }
 773                 },
 774                 { &hf_header_array[POS_TO],
 775                        { "To",          "sip.To",
 776                        FT_STRING, BASE_NONE,NULL,0x0,
 777                         "RFC 3261: To Header", HFILL }
 778                 },
 779                 { &hf_header_array[POS_UNSUPPORTED],
 780                        { "Unsupported",                 "sip.Unsupported",
 781                        FT_STRING, BASE_NONE,NULL,0x0,
 782                         "RFC 3261: Unsupported Header", HFILL }
 783                 },
 784                 { &hf_header_array[POS_USER_AGENT],
 785                        { "User-Agent",          "sip.User-Agent",
 786                        FT_STRING, BASE_NONE,NULL,0x0,
 787                         "RFC 3261: User-Agent Header", HFILL }
 788                 },
 789                 { &hf_header_array[POS_VIA],
 790                        { "Via",                 "sip.Via",
 791                        FT_STRING, BASE_NONE,NULL,0x0,
 792                         "RFC 3261: Via Header", HFILL }
 793                 },
 794                 { &hf_header_array[POS_WARNING],
 795                        { "Warning",             "sip.Warning",
 796                        FT_STRING, BASE_NONE,NULL,0x0,
 797                         "RFC 3261: Warning Header", HFILL }
 798                 },
 799                 { &hf_header_array[POS_WWW_AUTHENTICATE],
 800                        { "WWW-Authenticate",            "sip.WWW-Authenticate",
 801                        FT_STRING, BASE_NONE,NULL,0x0,
 802                         "RFC 3261: WWW-Authenticate Header", HFILL }
 803                 },
 804
 805         };
 806
 807         /* Setup protocol subtree array */
 808         static gint *ett[] = {
 809                 &ett_sip,
 810                 &ett_sip_hdr,
 811         };
 812
 813         /* Register the protocol name and description */
 814         proto_sip = proto_register_protocol("Session Initiation Protocol",
 815             "SIP", "sip");
 816
 817         /* Required function calls to register the header fields and subtrees used */
 818         proto_register_field_array(proto_sip, hf, array_length(hf));
 819         proto_register_subtree_array(ett, array_length(ett));
 820 }
 821
 822 void
 823 proto_reg_handoff_sip(void)
 824 {
 825         dissector_handle_t sip_handle;
 826
 827         sip_handle = create_dissector_handle(dissect_sip, proto_sip);
 828         dissector_add("tcp.port", TCP_PORT_SIP, sip_handle);
 829         dissector_add("udp.port", UDP_PORT_SIP, sip_handle);
 830
 831         heur_dissector_add( "udp", dissect_sip_heur, proto_sip );
 832         heur_dissector_add( "tcp", dissect_sip_heur, proto_sip );
 833
 834         /*
 835          * Get a handle for the SDP dissector.
 836          */
 837         sdp_handle = find_dissector("sdp");
 838         data_handle = find_dissector("data");
 839 }