packet-rtsp.c

   1 /* packet-rtsp.c
   2  * Routines for RTSP packet disassembly (RFC 2326)
   3  *
   4  * Jason Lango <jal@netapp.com>
   5  * Liberally copied from packet-http.c, by Guy Harris <guy@alum.mit.edu>
   6  *
   7  * $Id: packet-rtsp.c,v 1.67 2004/07/09 23:37:40 guy Exp $
   8  *
   9  * Ethereal - Network traffic analyzer
  10  * By Gerald Combs <gerald@ethereal.com>
  11  * Copyright 1998 Gerald Combs
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  *
  27  * References:
  28  * RTSP is defined in RFC 2326, http://www.ietf.org/rfc/rfc2326.txt?number=2326
  29  * http://www.iana.org/assignments/rsvp-parameters
  30  */
  31
  32 #include "config.h"
  33
  34 #include <string.h>
  35 #include <ctype.h>
  36 #include <stdlib.h>
  37
  38 #include "prefs.h"
  39
  40 #include <glib.h>
  41 #include <epan/packet.h>
  42 #include "req_resp_hdrs.h"
  43 #include "packet-rtp.h"
  44 #include "packet-rtcp.h"
  45 #include <epan/conversation.h>
  46 #include <epan/strutil.h>
  47 #include "packet-e164.h"
  48
  49 static int proto_rtsp           = -1;
  50
  51 static gint ett_rtsp            = -1;
  52 static gint ett_rtspframe       = -1;
  53 static gint ett_rtsp_method     = -1;
  54
  55 static int hf_rtsp_method       = -1;
  56 static int hf_rtsp_url          = -1;
  57 static int hf_rtsp_status       = -1;
  58 static int hf_rtsp_session      = -1;
  59 static int hf_rtsp_X_Vig_Msisdn = -1;
  60
  61 static dissector_handle_t sdp_handle;
  62 static dissector_handle_t rtp_handle;
  63 static dissector_handle_t rtcp_handle;
  64
  65 void proto_reg_handoff_rtsp(void);
  66
  67 static GMemChunk *rtsp_vals = NULL;
  68 #define rtsp_hash_init_count 20
  69
  70 /*
  71  * desegmentation of RTSP headers
  72  * (when we are over TCP or another protocol providing the desegmentation API)
  73  */
  74 static gboolean rtsp_desegment_headers = FALSE;
  75
  76 /*
  77  * desegmentation of RTSP bodies
  78  * (when we are over TCP or another protocol providing the desegmentation API)
  79  * TODO let the user filter on content-type the bodies he wants desegmented
  80  */
  81 static gboolean rtsp_desegment_body = FALSE;
  82
  83 /* http://www.iana.org/assignments/port-numberslists two rtsp ports */
  84 #define TCP_PORT_RTSP                   554
  85 #define TCP_ALTERNATE_PORT_RTSP         8554
  86 static guint global_rtsp_tcp_port = TCP_PORT_RTSP;
  87 static guint global_rtsp_tcp_alternate_port = TCP_ALTERNATE_PORT_RTSP;
  88 /*
  89 * Variables to allow for proper deletion of dissector registration when
  90 * the user changes port from the gui.
  91 */
  92 static guint tcp_port = 0;
  93 static guint tcp_alternate_port = 0;
  94
  95 /*
  96  * Takes an array of bytes, assumed to contain a null-terminated
  97  * string, as an argument, and returns the length of the string -
  98  * i.e., the size of the array, minus 1 for the null terminator.
  99  */
 100 #define STRLEN_CONST(str)       (sizeof (str) - 1)
 101
 102 #define RTSP_FRAMEHDR   ('$')
 103
 104 typedef struct {
 105         dissector_handle_t              dissector;
 106 } rtsp_interleaved_t;
 107
 108 #define RTSP_MAX_INTERLEAVED            (8)
 109
 110 /*
 111  * Careful about dynamically allocating memory in this structure (say
 112  * for dynamically increasing the size of the 'interleaved' array) -
 113  * the containing structure is garbage collected and contained
 114  * pointers will not be freed.
 115  */
 116 typedef struct {
 117         rtsp_interleaved_t              interleaved[RTSP_MAX_INTERLEAVED];
 118 } rtsp_conversation_data_t;
 119
 120 static int
 121 dissect_rtspinterleaved(tvbuff_t *tvb, int offset, packet_info *pinfo,
 122         proto_tree *tree)
 123 {
 124         guint           length_remaining;
 125         proto_item      *ti;
 126         proto_tree      *rtspframe_tree = NULL;
 127         int             orig_offset;
 128         guint8          rf_start;               /* always RTSP_FRAMEHDR */
 129         guint8          rf_chan;        /* interleaved channel id */
 130         guint16         rf_len;         /* packet length */
 131         tvbuff_t        *next_tvb;
 132         conversation_t  *conv;
 133         rtsp_conversation_data_t        *data;
 134         dissector_handle_t              dissector;
 135
 136         /*
 137          * This will throw an exception if we don't have any data left.
 138          * That's what we want.  (See "tcp_dissect_pdus()", which is
 139          * similar.)
 140          */
 141         length_remaining = tvb_ensure_length_remaining(tvb, offset);
 142
 143         /*
 144          * Can we do reassembly?
 145          */
 146         if (rtsp_desegment_headers && pinfo->can_desegment) {
 147                 /*
 148                  * Yes - would an RTSP multiplexed header starting at
 149                  * this offset be split across segment boundaries?
 150                  */
 151                 if (length_remaining < 4) {
 152                         /*
 153                          * Yes.  Tell the TCP dissector where the data
 154                          * for this message starts in the data it handed
 155                          * us, and how many more bytes we need, and return.
 156                          */
 157                         pinfo->desegment_offset = offset;
 158                         pinfo->desegment_len = 4 - length_remaining;
 159                         return -1;
 160                 }
 161         }
 162
 163         /*
 164          * Get the "$", channel, and length from the header.
 165          */
 166         orig_offset = offset;
 167         rf_start = tvb_get_guint8(tvb, offset);
 168         rf_chan = tvb_get_guint8(tvb, offset+1);
 169         rf_len = tvb_get_ntohs(tvb, offset+2);
 170
 171         /*
 172          * Can we do reassembly?
 173          */
 174         if (rtsp_desegment_body && pinfo->can_desegment) {
 175                 /*
 176                  * Yes - is the header + encapsulated packet split
 177                  * across segment boundaries?
 178                  */
 179                 if (length_remaining < 4U + rf_len) {
 180                         /*
 181                          * Yes.  Tell the TCP dissector where the data
 182                          * for this message starts in the data it handed
 183                          * us, and how many more bytes we need, and return.
 184                          */
 185                         pinfo->desegment_offset = offset;
 186                         pinfo->desegment_len = 4U + rf_len - length_remaining;
 187                         return -1;
 188                 }
 189         }
 190
 191         if (check_col(pinfo->cinfo, COL_INFO))
 192                 col_add_fstr(pinfo->cinfo, COL_INFO,
 193                         "Interleaved channel 0x%02x, %u bytes",
 194                         rf_chan, rf_len);
 195
 196         if (tree != NULL) {
 197                 ti = proto_tree_add_protocol_format(tree, proto_rtsp, tvb,
 198                     offset, 4,
 199                     "RTSP Interleaved Frame, Channel: 0x%02x, %u bytes",
 200                     rf_chan, rf_len);
 201                 rtspframe_tree = proto_item_add_subtree(ti, ett_rtspframe);
 202
 203                 proto_tree_add_text(rtspframe_tree, tvb, offset, 1,
 204                     "Magic: 0x%02x",
 205                     rf_start);
 206         }
 207         offset += 1;
 208
 209         if (tree != NULL) {
 210                 proto_tree_add_text(rtspframe_tree, tvb, offset, 1,
 211                     "Channel: 0x%02x",
 212                     rf_chan);
 213         }
 214         offset += 1;
 215
 216         if (tree != NULL) {
 217                 proto_tree_add_text(rtspframe_tree, tvb, offset, 2,
 218                     "Length: %u bytes",
 219                     rf_len);
 220         }
 221         offset += 2;
 222
 223         /*
 224          * We set the actual length of the tvbuff for the interleaved
 225          * stuff to the minimum of what's left in the tvbuff and the
 226          * length in the header.
 227          *
 228          * XXX - what if there's nothing left in the tvbuff?
 229          * We'd want a BoundsError exception to be thrown, so
 230          * that a Short Frame would be reported.
 231          */
 232         if (length_remaining > rf_len)
 233                 length_remaining = rf_len;
 234         next_tvb = tvb_new_subset(tvb, offset, length_remaining, rf_len);
 235
 236         conv = find_conversation(&pinfo->src, &pinfo->dst, pinfo->ptype,
 237                 pinfo->srcport, pinfo->destport, 0);
 238
 239         if (conv &&
 240             (data = conversation_get_proto_data(conv, proto_rtsp)) &&
 241             rf_chan < RTSP_MAX_INTERLEAVED &&
 242             (dissector = data->interleaved[rf_chan].dissector)) {
 243                 call_dissector(dissector, next_tvb, pinfo, tree);
 244         } else {
 245                 proto_tree_add_text(rtspframe_tree, tvb, offset, rf_len,
 246                         "Data (%u bytes)", rf_len);
 247         }
 248
 249         offset += rf_len;
 250
 251         return offset - orig_offset;
 252 }
 253
 254 static void process_rtsp_request(tvbuff_t *tvb, int offset, const guchar *data,
 255         size_t linelen, proto_tree *tree);
 256
 257 static void process_rtsp_reply(tvbuff_t *tvb, int offset, const guchar *data,
 258         size_t linelen, proto_tree *tree);
 259
 260 typedef enum {
 261         RTSP_REQUEST,
 262         RTSP_REPLY,
 263         NOT_RTSP
 264 } rtsp_type_t;
 265
 266 static const char *rtsp_methods[] = {
 267         "DESCRIBE",
 268         "ANNOUNCE",
 269         "GET_PARAMETER",
 270         "OPTIONS",
 271         "PAUSE",
 272         "PLAY",
 273         "RECORD",
 274         "REDIRECT",
 275         "SETUP",
 276         "SET_PARAMETER",
 277         "TEARDOWN"
 278 };
 279
 280 #define RTSP_NMETHODS   (sizeof rtsp_methods / sizeof rtsp_methods[0])
 281
 282 static gboolean
 283 is_rtsp_request_or_reply(const guchar *line, size_t linelen, rtsp_type_t *type)
 284 {
 285         unsigned        ii;
 286
 287         /* Is this an RTSP reply? */
 288         if (linelen >= 5 && strncasecmp("RTSP/", line, 5) == 0) {
 289                 /*
 290                  * Yes.
 291                  */
 292                 *type = RTSP_REPLY;
 293                 return TRUE;
 294         }
 295
 296         /*
 297          * Is this an RTSP request?
 298          * Check whether the line begins with one of the RTSP request
 299          * methods.
 300          */
 301         for (ii = 0; ii < RTSP_NMETHODS; ii++) {
 302                 size_t len = strlen(rtsp_methods[ii]);
 303                 if (linelen >= len &&
 304                     strncasecmp(rtsp_methods[ii], line, len) == 0 &&
 305                     (len == linelen || isspace(line[len]))) {
 306                         *type = RTSP_REQUEST;
 307                         return TRUE;
 308                 }
 309         }
 310         *type = NOT_RTSP;
 311         return FALSE;
 312 }
 313
 314 static const char rtsp_content_type[] = "Content-Type:";
 315
 316 static int
 317 is_content_sdp(const guchar *line, size_t linelen)
 318 {
 319         static const char type[] = "application/sdp";
 320         size_t          typelen = STRLEN_CONST(type);
 321
 322         line += STRLEN_CONST(rtsp_content_type);
 323         linelen -= STRLEN_CONST(rtsp_content_type);
 324         while (linelen > 0 && (*line == ' ' || *line == '\t')) {
 325                 line++;
 326                 linelen--;
 327         }
 328
 329         if (linelen < typelen || strncasecmp(type, line, typelen))
 330                 return FALSE;
 331
 332         line += typelen;
 333         linelen -= typelen;
 334         if (linelen > 0 && !isspace(*line))
 335                 return FALSE;
 336
 337         return TRUE;
 338 }
 339
 340 static const char rtsp_transport[] = "Transport:";
 341 static const char rtsp_sps[] = "server_port=";
 342 static const char rtsp_cps[] = "client_port=";
 343 static const char rtsp_rtp[] = "rtp/";
 344 static const char rtsp_inter[] = "interleaved=";
 345
 346 static void
 347 rtsp_create_conversation(packet_info *pinfo, const guchar *line_begin,
 348         size_t line_len)
 349 {
 350         conversation_t  *conv;
 351         guchar          buf[256];
 352         guchar          *tmp;
 353         guint           c_data_port, c_mon_port;
 354         guint           s_data_port, s_mon_port;
 355         address         null_addr;
 356
 357         if (line_len > sizeof(buf) - 1) {
 358                 /*
 359                  * Don't overflow the buffer.
 360                  */
 361                 line_len = sizeof(buf) - 1;
 362         }
 363         memcpy(buf, line_begin, line_len);
 364         buf[line_len] = '\0';
 365
 366         tmp = buf + STRLEN_CONST(rtsp_transport);
 367         while (*tmp && isspace(*tmp))
 368                 tmp++;
 369         if (strncasecmp(tmp, rtsp_rtp, strlen(rtsp_rtp)) != 0) {
 370                 g_warning("Frame %u: rtsp: unknown transport", pinfo->fd->num);
 371                 return;
 372         }
 373
 374         c_data_port = c_mon_port = 0;
 375         s_data_port = s_mon_port = 0;
 376         if ((tmp = strstr(buf, rtsp_sps))) {
 377                 tmp += strlen(rtsp_sps);
 378                 if (sscanf(tmp, "%u-%u", &s_data_port, &s_mon_port) < 1) {
 379                         g_warning("Frame %u: rtsp: bad server_port",
 380                                 pinfo->fd->num);
 381                         return;
 382                 }
 383         }
 384         if ((tmp = strstr(buf, rtsp_cps))) {
 385                 tmp += strlen(rtsp_cps);
 386                 if (sscanf(tmp, "%u-%u", &c_data_port, &c_mon_port) < 1) {
 387                         g_warning("Frame %u: rtsp: bad client_port",
 388                                 pinfo->fd->num);
 389                         return;
 390                 }
 391         }
 392         if (!c_data_port) {
 393                 rtsp_conversation_data_t        *data;
 394                 guint                           s_data_chan, s_mon_chan;
 395                 int                             i;
 396
 397                 /*
 398                  * Deal with RTSP TCP-interleaved conversations.
 399                  */
 400                 if ((tmp = strstr(buf, rtsp_inter)) == NULL) {
 401                         /*
 402                          * No interleaved or server_port - probably a
 403                          * SETUP request, rather than reply.
 404                          */
 405                         return;
 406                 }
 407                 tmp += strlen(rtsp_inter);
 408                 i = sscanf(tmp, "%u-%u", &s_data_chan, &s_mon_chan);
 409                 if (i < 1) {
 410                         g_warning("Frame %u: rtsp: bad interleaved",
 411                                 pinfo->fd->num);
 412                         return;
 413                 }
 414                 conv = find_conversation(&pinfo->src, &pinfo->dst, pinfo->ptype,
 415                         pinfo->srcport, pinfo->destport, 0);
 416                 if (!conv) {
 417                         conv = conversation_new(&pinfo->src, &pinfo->dst,
 418                                 pinfo->ptype, pinfo->srcport, pinfo->destport,
 419                                 0);
 420                 }
 421                 data = conversation_get_proto_data(conv, proto_rtsp);
 422                 if (!data) {
 423                         data = g_mem_chunk_alloc(rtsp_vals);
 424                         conversation_add_proto_data(conv, proto_rtsp, data);
 425                 }
 426                 if (s_data_chan < RTSP_MAX_INTERLEAVED) {
 427                         data->interleaved[s_data_chan].dissector =
 428                                 rtp_handle;
 429                 }
 430                 if (i > 1 && s_mon_chan < RTSP_MAX_INTERLEAVED) {
 431                         data->interleaved[s_mon_chan].dissector =
 432                                 rtcp_handle;
 433                 }
 434                 return;
 435         }
 436
 437         /*
 438          * We only want to match on the destination address, not the
 439          * source address, because the server might send back a packet
 440          * from an address other than the address to which its client
 441          * sent the packet, so we construct a conversation with no
 442          * second address.
 443          */
 444         SET_ADDRESS(&null_addr, pinfo->src.type, 0, NULL);
 445
 446         rtp_add_address(pinfo, (char *)pinfo->dst.data, c_data_port, s_data_port,
 447                     "RTSP", pinfo->fd->num);
 448
 449         if (!c_mon_port)
 450                 return;
 451
 452         rtcp_add_address(pinfo, (char *)pinfo->dst.data, c_mon_port, s_mon_port,
 453                      "RTSP", pinfo->fd->num);
 454 }
 455
 456 static const char rtsp_content_length[] = "Content-Length:";
 457
 458 static int
 459 rtsp_get_content_length(const guchar *line_begin, size_t line_len)
 460 {
 461         guchar          buf[256];
 462         guchar          *tmp;
 463         long            content_length;
 464         char            *p;
 465         guchar          *up;
 466
 467         if (line_len > sizeof(buf) - 1) {
 468                 /*
 469                  * Don't overflow the buffer.
 470                  */
 471                 line_len = sizeof(buf) - 1;
 472         }
 473         memcpy(buf, line_begin, line_len);
 474         buf[line_len] = '\0';
 475
 476         tmp = buf + STRLEN_CONST(rtsp_content_length);
 477         while (*tmp && isspace(*tmp))
 478                 tmp++;
 479         content_length = strtol(tmp, &p, 10);
 480         up = p;
 481         if (up == tmp || (*up != '\0' && !isspace(*up)))
 482                 return -1;      /* not a valid number */
 483         return content_length;
 484 }
 485
 486 static const char rtsp_Session[] = "Session:";
 487 static const char rtsp_X_Vig_Msisdn[] = "X-Vig-Msisdn";
 488
 489 static int
 490 dissect_rtspmessage(tvbuff_t *tvb, int offset, packet_info *pinfo,
 491         proto_tree *tree)
 492 {
 493         proto_tree              *rtsp_tree = NULL;
 494         proto_tree              *sub_tree = NULL;
 495         proto_item              *ti = NULL;
 496         const guchar            *line;
 497         gint                    next_offset;
 498         const guchar            *linep, *lineend;
 499         int                     orig_offset;
 500         int                     first_linelen, linelen;
 501         int                     line_end_offset;
 502         int                     colon_offset;
 503         gboolean                is_request_or_reply;
 504         gboolean                body_requires_content_len;
 505         gboolean                saw_req_resp_or_header;
 506         guchar                  c;
 507         rtsp_type_t             rtsp_type;
 508         gboolean                is_header;
 509         int                     is_sdp = FALSE;
 510         int                     datalen;
 511         int                     content_length;
 512         int                     reported_datalen;
 513         int                     value_offset;
 514         int                     value_len;
 515         e164_info_t             e164_info;
 516         /*
 517          * Is this a request or response?
 518          *
 519          * Note that "tvb_find_line_end()" will return a value that
 520          * is not longer than what's in the buffer, so the
 521          * "tvb_get_ptr()" call won't throw an exception.
 522          */
 523         first_linelen = tvb_find_line_end(tvb, offset,
 524             tvb_ensure_length_remaining(tvb, offset), &next_offset,
 525             FALSE);
 526         /*
 527          * Is the first line a request or response?
 528          */
 529         line = tvb_get_ptr(tvb, offset, first_linelen);
 530         is_request_or_reply = is_rtsp_request_or_reply(line, first_linelen,
 531             &rtsp_type);
 532         if (is_request_or_reply) {
 533                 /*
 534                  * Yes, it's a request or response.
 535                  * Do header desegmentation if we've been told to,
 536                  * and do body desegmentation if we've been told to and
 537                  * we find a Content-Length header.
 538                  */
 539                 if (!req_resp_hdrs_do_reassembly(tvb, pinfo,
 540                     rtsp_desegment_headers, rtsp_desegment_body)) {
 541                         /*
 542                          * More data needed for desegmentation.
 543                          */
 544                         return -1;
 545                 }
 546         }
 547
 548         /*
 549          * RFC 2326 says that a content length must be specified
 550          * in requests that have a body, although section 4.4 speaks
 551          * of a server closing the connection indicating the end of
 552          * a reply body.
 553          *
 554          * We assume that an absent content length in a request means
 555          * that we don't have a body, and that an absent content length
 556          * in a reply means that the reply body runs to the end of
 557          * the connection.  If the first line is neither, we assume
 558          * that whatever follows a blank line should be treated as a
 559          * body; there's not much else we can do, as we're jumping
 560          * into the message in the middle.
 561          *
 562          * XXX - if there was no Content-Length entity header, we should
 563          * accumulate all data until the end of the connection.
 564          * That'd require that the TCP dissector call subdissectors
 565          * for all frames with FIN, even if they contain no data,
 566          * which would require subdissectors to deal intelligently
 567          * with empty segments.
 568          */
 569         if (rtsp_type == RTSP_REQUEST)
 570                 body_requires_content_len = TRUE;
 571         else
 572                 body_requires_content_len = FALSE;
 573
 574         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 575                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "RTSP");
 576         if (check_col(pinfo->cinfo, COL_INFO)) {
 577                 /*
 578                  * Put the first line from the buffer into the summary
 579                  * if it's an RTSP request or reply (but leave out the
 580                  * line terminator).
 581                  * Otherwise, just call it a continuation.
 582                  *
 583                  * Note that "tvb_find_line_end()" will return a value that
 584                  * is not longer than what's in the buffer, so the
 585                  * "tvb_get_ptr()" call won't throw an exception.
 586                  */
 587                 line = tvb_get_ptr(tvb, offset, first_linelen);
 588                 if (is_request_or_reply)
 589                         if ( rtsp_type == RTSP_REPLY ) {
 590                                 col_add_str(pinfo->cinfo, COL_INFO, "Reply: ");
 591                                 col_append_str(pinfo->cinfo, COL_INFO,
 592                                         format_text(line, first_linelen));
 593                         }
 594                         else
 595                                 col_add_str(pinfo->cinfo, COL_INFO,
 596                                         format_text(line, first_linelen));
 597
 598                 else
 599                         col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
 600
 601         }
 602
 603         orig_offset = offset;
 604         if (tree) {
 605                 ti = proto_tree_add_item(tree, proto_rtsp, tvb, offset, -1,
 606                     FALSE);
 607                 rtsp_tree = proto_item_add_subtree(ti, ett_rtsp);
 608         }
 609
 610         /*
 611          * We haven't yet seen a Content-Length header.
 612          */
 613         content_length = -1;
 614
 615         /*
 616          * Process the packet data, a line at a time.
 617          */
 618         saw_req_resp_or_header = FALSE; /* haven't seen anything yet */
 619         while (tvb_reported_length_remaining(tvb, offset) != 0) {
 620                 /*
 621                  * We haven't yet concluded that this is a header.
 622                  */
 623                 is_header = FALSE;
 624
 625                 /*
 626                  * Find the end of the line.
 627                  */
 628                 linelen = tvb_find_line_end(tvb, offset,
 629                     tvb_ensure_length_remaining(tvb, offset), &next_offset,
 630                     FALSE);
 631                 if (linelen < 0)
 632                         return -1;
 633                 line_end_offset = offset + linelen;
 634                 /*
 635                  * colon_offset may be -1
 636                  */
 637                 colon_offset = tvb_find_guint8(tvb, offset, linelen, ':');
 638
 639
 640                 /*
 641                  * Get a buffer that refers to the line.
 642                  */
 643                 line = tvb_get_ptr(tvb, offset, linelen);
 644                 lineend = line + linelen;
 645
 646                 /*
 647                  * OK, does it look like an RTSP request or response?
 648                  */
 649                 is_request_or_reply = is_rtsp_request_or_reply(line, linelen,
 650                     &rtsp_type);
 651                 if (is_request_or_reply)
 652                         goto is_rtsp;
 653
 654                 /*
 655                  * No.  Does it look like a blank line (as would appear
 656                  * at the end of an RTSP request)?
 657                  */
 658                 if (linelen == 0)
 659                         goto is_rtsp;   /* Yes. */
 660
 661                 /*
 662                  * No.  Does it look like a header?
 663                  */
 664                 linep = line;
 665                 while (linep < lineend) {
 666                         c = *linep++;
 667
 668                         /*
 669                          * This must be a CHAR to be part of a token; that
 670                          * means it must be ASCII.
 671                          */
 672                         if (!isascii(c))
 673                                 break;  /* not ASCII, thus not a CHAR */
 674
 675                         /*
 676                          * This mustn't be a CTL to be part of a token.
 677                          *
 678                          * XXX - what about leading LWS on continuation
 679                          * lines of a header?
 680                          */
 681                         if (iscntrl(c))
 682                                 break;  /* CTL, not part of a header */
 683
 684                         switch (c) {
 685
 686                         case '(':
 687                         case ')':
 688                         case '<':
 689                         case '>':
 690                         case '@':
 691                         case ',':
 692                         case ';':
 693                         case '\\':
 694                         case '"':
 695                         case '/':
 696                         case '[':
 697                         case ']':
 698                         case '?':
 699                         case '=':
 700                         case '{':
 701                         case '}':
 702                                 /*
 703                                  * It's a tspecial, so it's not
 704                                  * part of a token, so it's not
 705                                  * a field name for the beginning
 706                                  * of a header.
 707                                  */
 708                                 goto not_rtsp;
 709
 710                         case ':':
 711                                 /*
 712                                  * This ends the token; we consider
 713                                  * this to be a header.
 714                                  */
 715                                 is_header = TRUE;
 716                                 goto is_rtsp;
 717
 718                         case ' ':
 719                         case '\t':
 720                                 /*
 721                                  * LWS (RFC-2616, 4.2); continue the previous
 722                                  * header.
 723                                  */
 724                                 goto is_rtsp;
 725                         }
 726                 }
 727
 728                 /*
 729                  * We haven't seen the colon, but everything else looks
 730                  * OK for a header line.
 731                  *
 732                  * If we've already seen an RTSP request or response
 733                  * line, or a header line, and we're at the end of
 734                  * the tvbuff, we assume this is an incomplete header
 735                  * line.  (We quit this loop after seeing a blank line,
 736                  * so if we've seen a request or response line, or a
 737                  * header line, this is probably more of the request
 738                  * or response we're presumably seeing.  There is some
 739                  * risk of false positives, but the same applies for
 740                  * full request or response lines or header lines,
 741                  * although that's less likely.)
 742                  *
 743                  * We throw an exception in that case, by checking for
 744                  * the existence of the next byte after the last one
 745                  * in the line.  If it exists, "tvb_ensure_bytes_exist()"
 746                  * throws no exception, and we fall through to the
 747                  * "not RTSP" case.  If it doesn't exist,
 748                  * "tvb_ensure_bytes_exist()" will throw the appropriate
 749                  * exception.
 750                  */
 751                 if (saw_req_resp_or_header)
 752                         tvb_ensure_bytes_exist(tvb, offset, linelen + 1);
 753
 754         not_rtsp:
 755                 /*
 756                  * We don't consider this part of an RTSP request or
 757                  * reply, so we don't display it.
 758                  */
 759                 break;
 760
 761         is_rtsp:
 762                 /*
 763                  * Process this line.
 764                  */
 765                 if (linelen == 0) {
 766                         /*
 767                          * This is a blank line, which means that
 768                          * whatever follows it isn't part of this
 769                          * request or reply.
 770                          */
 771                         proto_tree_add_text(rtsp_tree, tvb, offset,
 772                             next_offset - offset, "%s",
 773                             tvb_format_text(tvb, offset, next_offset - offset));
 774                         offset = next_offset;
 775                         break;
 776                 }
 777
 778                 /*
 779                  * Not a blank line - either a request, a reply, or a header
 780                  * line.
 781                  */
 782                 saw_req_resp_or_header = TRUE;
 783                 if (rtsp_tree) {
 784                         ti = proto_tree_add_text(rtsp_tree, tvb, offset,
 785                                 next_offset - offset, "%s",
 786                                 tvb_format_text(tvb, offset, next_offset - offset));
 787
 788                         sub_tree = proto_item_add_subtree(ti, ett_rtsp_method);
 789
 790                         switch (rtsp_type) {
 791
 792                         case RTSP_REQUEST:
 793                                 process_rtsp_request(tvb, offset, line, linelen,
 794                                     sub_tree);
 795                                 break;
 796
 797                         case RTSP_REPLY:
 798                                 process_rtsp_reply(tvb, offset, line, linelen,
 799                                     sub_tree);
 800                                 break;
 801
 802                         case NOT_RTSP:
 803                                 break;
 804                         }
 805                 }
 806                 if (is_header) {
 807                         /*
 808                          * Process some headers specially.
 809                          */
 810 #define HDR_MATCHES(header) \
 811         (linelen > STRLEN_CONST(header) && \
 812          strncasecmp(line, (header), STRLEN_CONST(header)) == 0)
 813
 814                         if (HDR_MATCHES(rtsp_transport)) {
 815                                 /*
 816                                  * Based on the port numbers specified
 817                                  * in the Transport: header, set up
 818                                  * a conversation that will be dissected
 819                                  * with the appropriate dissector.
 820                                  */
 821                                 rtsp_create_conversation(pinfo, line, linelen);
 822                         } else if (HDR_MATCHES(rtsp_content_type)) {
 823                                 /*
 824                                  * If the Content-Type: header says this
 825                                  * is SDP, dissect the payload as SDP.
 826                                  *
 827                                  * XXX - we should just do the same
 828                                  * sort of header processing
 829                                  * that HTTP does, and use the
 830                                  * "media_type" dissector table on
 831                                  * the content type.
 832                                  *
 833                                  * We should use those for Transport:
 834                                  * and Content-Length: as well (and
 835                                  * should process Content-Length: in
 836                                  * HTTP).
 837                                  */
 838                                 if (is_content_sdp(line, linelen))
 839                                         is_sdp = TRUE;
 840                         } else if (HDR_MATCHES(rtsp_content_length)) {
 841                                 /*
 842                                  * Only the amount specified by the
 843                                  * Content-Length: header should be treated
 844                                  * as payload.
 845                                  */
 846                                 content_length = rtsp_get_content_length(line,
 847                                     linelen);
 848
 849                         } else if (HDR_MATCHES(rtsp_Session)) {
 850                                 /*
 851                                  * Extract the session string
 852
 853                                  */
 854
 855                                 if ( colon_offset != -1 ){
 856                                         /*
 857                                         * Skip whitespace after the colon.
 858                                         * (Code from SIP dissector )
 859                                         */
 860                                         value_offset = colon_offset + 1;
 861                                         while (value_offset < line_end_offset
 862                                                 && ((c = tvb_get_guint8(tvb,
 863                                                         value_offset)) == ' '
 864                                                 || c == '\t'))
 865                                                 value_offset++;
 866                                         /*
 867                                          * Put the value into the protocol tree
 868                                         */
 869                                         value_len = line_end_offset - value_offset;
 870                                         proto_tree_add_string(sub_tree, hf_rtsp_session,tvb,
 871                                                 value_offset, value_len ,
 872                                                 tvb_format_text(tvb, value_offset, value_len));
 873                                 }
 874
 875                         } else if (HDR_MATCHES(rtsp_X_Vig_Msisdn)) {
 876                                 /*
 877                                  * Extract the X_Vig_Msisdn string
 878                                  */
 879                                 if ( colon_offset != -1 ){
 880                                         /*
 881                                          * Skip whitespace after the colon.
 882                                          * (Code from SIP dissector )
 883                                          */
 884                                         value_offset = colon_offset + 1;
 885                                         while (value_offset < line_end_offset
 886                                                 && ((c = tvb_get_guint8(tvb,
 887                                                     value_offset)) == ' '
 888                                                   || c == '\t'))
 889                                                 value_offset++;
 890                                         /*
 891                                          * Put the value into the protocol tree
 892                                          */
 893                                         value_len = line_end_offset - value_offset;
 894                                         proto_tree_add_string(sub_tree, hf_rtsp_X_Vig_Msisdn,tvb,
 895                                                 value_offset, value_len ,
 896                                                 tvb_format_text(tvb, value_offset, value_len));
 897
 898                                         e164_info.e164_number_type = CALLING_PARTY_NUMBER;
 899                                         e164_info.nature_of_address = 0;
 900
 901                                         e164_info.E164_number_str = tvb_get_string(tvb, value_offset,
 902                                                 value_len);
 903                                         e164_info.E164_number_length = value_len;
 904                                         dissect_e164_number(tvb, sub_tree, value_offset,
 905                                                 value_len, e164_info);
 906                                         g_free(e164_info.E164_number_str);
 907
 908
 909                                 }
 910                         }
 911
 912                 }
 913                 offset = next_offset;
 914         }
 915
 916         /*
 917          * If a content length was supplied, the amount of data to be
 918          * processed as RTSP payload is the minimum of the content
 919          * length and the amount of data remaining in the frame.
 920          *
 921          * If no content length was supplied (or if a bad content length
 922          * was supplied), the amount of data to be processed is the amount
 923          * of data remaining in the frame.
 924          */
 925         datalen = tvb_length_remaining(tvb, offset);
 926         reported_datalen = tvb_reported_length_remaining(tvb, offset);
 927         if (content_length != -1) {
 928                 /*
 929                  * Content length specified; display only that amount
 930                  * as payload.
 931                  */
 932                 if (datalen > content_length)
 933                         datalen = content_length;
 934
 935                 /*
 936                  * XXX - limit the reported length in the tvbuff we'll
 937                  * hand to a subdissector to be no greater than the
 938                  * content length.
 939                  *
 940                  * We really need both unreassembled and "how long it'd
 941                  * be if it were reassembled" lengths for tvbuffs, so
 942                  * that we throw the appropriate exceptions for
 943                  * "not enough data captured" (running past the length),
 944                  * "packet needed reassembly" (within the length but
 945                  * running past the unreassembled length), and
 946                  * "packet is malformed" (running past the reassembled
 947                  * length).
 948                  */
 949                 if (reported_datalen > content_length)
 950                         reported_datalen = content_length;
 951         } else {
 952                 /*
 953                  * No content length specified; if this message doesn't
 954                  * have a body if no content length is specified, process
 955                  * nothing as payload.
 956                  */
 957                 if (body_requires_content_len)
 958                         datalen = 0;
 959         }
 960
 961         if (datalen > 0) {
 962                 /*
 963                  * There's stuff left over; process it.
 964                  */
 965                 if (is_sdp) {
 966                         tvbuff_t *new_tvb;
 967
 968                         /*
 969                          * Fix up the top-level item so that it doesn't
 970                          * include the SDP stuff.
 971                          */
 972                         if (ti != NULL)
 973                                 proto_item_set_len(ti, offset);
 974
 975                         /*
 976                          * Now create a tvbuff for the SDP stuff and
 977                          * dissect it.
 978                          *
 979                          * The amount of data to be processed that's
 980                          * available in the tvbuff is "datalen", which
 981                          * is the minimum of the amount of data left in
 982                          * the tvbuff and any specified content length.
 983                          *
 984                          * The amount of data to be processed that's in
 985                          * this frame, regardless of whether it was
 986                          * captured or not, is "reported_datalen",
 987                          * which, if no content length was specified,
 988                          * is -1, i.e. "to the end of the frame.
 989                          */
 990                         new_tvb = tvb_new_subset(tvb, offset, datalen,
 991                             reported_datalen);
 992                         call_dissector(sdp_handle, new_tvb, pinfo, tree);
 993                 } else {
 994                         if (tvb_get_guint8(tvb, offset) == RTSP_FRAMEHDR) {
 995                                 /*
 996                                  * This is interleaved stuff; don't
 997                                  * treat it as raw data - set "datalen"
 998                                  * to 0, so we won't skip the offset
 999                                  * past it, which will cause our
1000                                  * caller to process that stuff itself.
1001                                  */
1002                                 datalen = 0;
1003                         } else {
1004                                 proto_tree_add_text(rtsp_tree, tvb, offset,
1005                                     datalen, "Data (%d bytes)",
1006                                     reported_datalen);
1007                         }
1008                 }
1009
1010                 /*
1011                  * We've processed "datalen" bytes worth of data
1012                  * (which may be no data at all); advance the
1013                  * offset past whatever data we've processed.
1014                  */
1015                 offset += datalen;
1016         }
1017         return offset - orig_offset;
1018 }
1019
1020 static void
1021 process_rtsp_request(tvbuff_t *tvb, int offset, const guchar *data,
1022         size_t linelen, proto_tree *tree)
1023 {
1024         const guchar    *lineend = data + linelen;
1025         unsigned                ii;
1026         const guchar    *url;
1027         const guchar    *url_start;
1028         guchar                  *tmp_url;
1029
1030         /* Request Methods */
1031         for (ii = 0; ii < RTSP_NMETHODS; ii++) {
1032                 size_t len = strlen(rtsp_methods[ii]);
1033                 if (linelen >= len &&
1034                     strncasecmp(rtsp_methods[ii], data, len) == 0 &&
1035                     (len == linelen || isspace(data[len])))
1036                         break;
1037         }
1038         if (ii == RTSP_NMETHODS) {
1039                 /*
1040                  * We got here because "is_rtsp_request_or_reply()" returned
1041                  * RTSP_REQUEST, so we know one of the request methods
1042                  * matched, so we "can't get here".
1043                  */
1044                 g_assert_not_reached();
1045         }
1046
1047         /* Method name */
1048         proto_tree_add_string(tree, hf_rtsp_method, tvb, offset,
1049                 strlen(rtsp_methods[ii]), rtsp_methods[ii]);
1050
1051
1052         /* URL */
1053         url = data;
1054         while (url < lineend && !isspace(*url))
1055                 url++;
1056         while (url < lineend && isspace(*url))
1057                 url++;
1058         url_start = url;
1059         while (url < lineend && !isspace(*url))
1060                 url++;
1061         tmp_url = g_malloc(url - url_start + 1);
1062         memcpy(tmp_url, url_start, url - url_start);
1063         tmp_url[url - url_start] = 0;
1064         proto_tree_add_string(tree, hf_rtsp_url, tvb,
1065                 offset + (url_start - data), url - url_start, tmp_url);
1066         g_free(tmp_url);
1067 }
1068
1069 static void
1070 process_rtsp_reply(tvbuff_t *tvb, int offset, const guchar *data,
1071         size_t linelen, proto_tree *tree)
1072 {
1073         const guchar    *lineend = data + linelen;
1074         const guchar    *status = data;
1075         const guchar    *status_start;
1076         unsigned int    status_i;
1077
1078         /* status code */
1079         while (status < lineend && !isspace(*status))
1080                 status++;
1081         while (status < lineend && isspace(*status))
1082                 status++;
1083         status_start = status;
1084         status_i = 0;
1085         while (status < lineend && isdigit(*status))
1086                 status_i = status_i * 10 + *status++ - '0';
1087         proto_tree_add_uint(tree, hf_rtsp_status, tvb,
1088                 offset + (status_start - data),
1089                 status - status_start, status_i);
1090 }
1091
1092 static void
1093 dissect_rtsp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1094 {
1095         int             offset = 0;
1096         int             len;
1097
1098         while (tvb_reported_length_remaining(tvb, offset) != 0) {
1099                 len = (tvb_get_guint8(tvb, offset) == RTSP_FRAMEHDR)
1100                         ? dissect_rtspinterleaved(tvb, offset, pinfo, tree)
1101                         : dissect_rtspmessage(tvb, offset, pinfo, tree);
1102                 if (len == -1)
1103                         break;
1104                 offset += len;
1105
1106                 /*
1107                  * OK, we've set the Protocol and Info columns for the
1108                  * first RTSP message; make the columns non-writable,
1109                  * so that we don't change it for subsequent RTSP messages.
1110                  */
1111                 col_set_writable(pinfo->cinfo, FALSE);
1112         }
1113 }
1114
1115 static void
1116 rtsp_init(void)
1117 {
1118 /* Routine to initialize rtsp protocol before each capture or filter pass. */
1119 /* Release any memory if needed.  Then setup the memory chunks.         */
1120
1121         if (rtsp_vals)
1122                 g_mem_chunk_destroy(rtsp_vals);
1123
1124         rtsp_vals = g_mem_chunk_new("rtsp_vals",
1125                 sizeof(rtsp_conversation_data_t),
1126                 rtsp_hash_init_count * sizeof(rtsp_conversation_data_t),
1127                 G_ALLOC_AND_FREE);
1128 }
1129
1130 void
1131 proto_register_rtsp(void)
1132 {
1133         static gint *ett[] = {
1134                 &ett_rtspframe,
1135                 &ett_rtsp,
1136                 &ett_rtsp_method,
1137         };
1138         static hf_register_info hf[] = {
1139                 { &hf_rtsp_method,
1140                         { "Method", "rtsp.method", FT_STRING, BASE_NONE, NULL, 0,
1141                         "", HFILL }},
1142                 { &hf_rtsp_url,
1143                         { "URL", "rtsp.url", FT_STRING, BASE_NONE, NULL, 0,
1144                         "", HFILL }},
1145                 { &hf_rtsp_status,
1146                         { "Status", "rtsp.status", FT_UINT32, BASE_DEC, NULL, 0,
1147                         "", HFILL }},
1148                 { &hf_rtsp_session,
1149                         { "Session", "rtsp.session", FT_STRING, BASE_NONE, NULL, 0,
1150                         "", HFILL }},
1151                 { &hf_rtsp_X_Vig_Msisdn,
1152                         { "X-Vig-Msisdn", "X_Vig_Msisdn", FT_STRING, BASE_NONE, NULL, 0,
1153                         "", HFILL }},
1154
1155
1156         };
1157         module_t *rtsp_module;
1158
1159         proto_rtsp = proto_register_protocol("Real Time Streaming Protocol",
1160                 "RTSP", "rtsp");
1161         proto_register_field_array(proto_rtsp, hf, array_length(hf));
1162         proto_register_subtree_array(ett, array_length(ett));
1163
1164         /* Register our configuration options, particularly our ports */
1165
1166         rtsp_module = prefs_register_protocol(proto_rtsp, proto_reg_handoff_rtsp);
1167         prefs_register_uint_preference(rtsp_module, "tcp.port",
1168                 "RTSP TCP Port",
1169                 "Set the TCP port for RTSP messages",
1170                 10, &global_rtsp_tcp_port);
1171         prefs_register_uint_preference(rtsp_module, "tcp.alternate_port",
1172                 "Alternate RTSP TCP Port",
1173                 "Set the alternate TCP port for RTSP messages",
1174                 10, &global_rtsp_tcp_alternate_port);
1175         prefs_register_bool_preference(rtsp_module, "desegment_headers",
1176             "Desegment all RTSP headers\nspanning multiple TCP segments",
1177             "Whether the RTSP dissector should desegment all headers "
1178             "of a request spanning multiple TCP segments",
1179             &rtsp_desegment_headers);
1180         prefs_register_bool_preference(rtsp_module, "desegment_body",
1181             "Trust the \"Content-length:\" header and\ndesegment RTSP "
1182             "bodies\nspanning multiple TCP segments",
1183             "Whether the RTSP dissector should use the "
1184             "\"Content-length:\" value to desegment the body "
1185             "of a request spanning multiple TCP segments",
1186             &rtsp_desegment_body);
1187
1188         register_init_routine(rtsp_init);       /* register re-init routine */
1189 }
1190
1191 void
1192 proto_reg_handoff_rtsp(void)
1193 {
1194         dissector_handle_t rtsp_handle;
1195         static int rtsp_prefs_initialized = FALSE;
1196
1197         rtsp_handle = create_dissector_handle(dissect_rtsp, proto_rtsp);
1198
1199         if (!rtsp_prefs_initialized) {
1200                 rtsp_prefs_initialized = TRUE;
1201         }
1202         else {
1203                 dissector_delete("tcp.port", tcp_port, rtsp_handle);
1204                 dissector_delete("tcp.port", tcp_alternate_port, rtsp_handle);
1205         }
1206         /* Set our port number for future use */
1207
1208         tcp_port = global_rtsp_tcp_port;
1209         tcp_alternate_port = global_rtsp_tcp_alternate_port;
1210
1211         dissector_add("tcp.port", tcp_port, rtsp_handle);
1212         dissector_add("tcp.port", tcp_alternate_port, rtsp_handle);
1213
1214         sdp_handle = find_dissector("sdp");
1215         rtp_handle = find_dissector("rtp");
1216         rtcp_handle = find_dissector("rtcp");
1217 }