packet-rtp.c

   1 /* packet-rtp.c
   2  *
   3  * Routines for RTP dissection
   4  * RTP = Real time Transport Protocol
   5  *
   6  * Copyright 2000, Philips Electronics N.V.
   7  * Written by Andreas Sikkema <andreas.sikkema@philips.com>
   8  *
   9  * Ethereal - Network traffic analyzer
  10  * By Gerald Combs <gerald@zing.org>
  11  * Copyright 1998 Gerald Combs
  12  *
  13  *
  14  * This program is free software; you can redistribute it and/or
  15  * modify it under the terms of the GNU General Public License
  16  * as published by the Free Software Foundation; either version 2
  17  * of the License, or (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, write to the Free Software
  26  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  27  */
  28
  29 /*
  30  * This dissector tries to dissect the RTP protocol according to Annex A
  31  * of ITU-T Recommendation H.225.0 (02/98) or RFC 1889
  32  *
  33  * RTP traffic is handled by an even UDP portnumber. This can be any
  34  * port number, but there is a registered port available, port 5004
  35  * See Annex B of ITU-T Recommendation H.225.0, section B.7
  36  */
  37
  38
  39 #ifdef HAVE_CONFIG_H
  40 # include "config.h"
  41 #endif
  42
  43 #include <glib.h>
  44 #include "packet.h"
  45
  46 #ifdef HAVE_SYS_TYPES_H
  47 #  include <sys/types.h>
  48 #endif
  49
  50 #ifdef HAVE_NETINET_IN_H
  51 #  include <netinet/in.h>
  52 #endif
  53
  54 #include <stdio.h>
  55 #include <string.h>
  56
  57 #include "packet-rtp.h"
  58 #include "packet-h261.h"
  59 #include "conversation.h"
  60
  61 /* RTP header fields             */
  62 static int proto_rtp           = -1;
  63 static int hf_rtp_version      = -1;
  64 static int hf_rtp_padding      = -1;
  65 static int hf_rtp_extension    = -1;
  66 static int hf_rtp_csrc_count   = -1;
  67 static int hf_rtp_marker       = -1;
  68 static int hf_rtp_payload_type = -1;
  69 static int hf_rtp_seq_nr       = -1;
  70 static int hf_rtp_timestamp    = -1;
  71 static int hf_rtp_ssrc         = -1;
  72 static int hf_rtp_csrc_item    = -1;
  73 static int hf_rtp_data         = -1;
  74 static int hf_rtp_padding_data = -1;
  75 static int hf_rtp_padding_count= -1;
  76
  77 /* RTP header extension fields   */
  78 static int hf_rtp_prof_define  = -1;
  79 static int hf_rtp_length       = -1;
  80 static int hf_rtp_hdr_ext      = -1;
  81
  82 /* RTP fields defining a sub tree */
  83 static gint ett_rtp       = -1;
  84 static gint ett_csrc_list = -1;
  85 static gint ett_hdr_ext   = -1;
  86
  87 /*
  88  * Fields in the first octet of the RTP header.
  89  */
  90
  91 /* Version is the first 2 bits of the first octet*/
  92 #define RTP_VERSION(octet)      ((octet) >> 6)
  93
  94 /* Padding is the third bit; No need to shift, because true is any value
  95    other than 0! */
  96 #define RTP_PADDING(octet)      ((octet) & 0x20)
  97
  98 /* Extension bit is the fourth bit */
  99 #define RTP_EXTENSION(octet)    ((octet) & 0x10)
 100
 101 /* CSRC count is the last four bits */
 102 #define RTP_CSRC_COUNT(octet)   ((octet) & 0xF)
 103
 104 static const value_string rtp_version_vals[] =
 105 {
 106         { 0, "Old VAT Version" },
 107         { 1, "First Draft Version" },
 108         { 2, "RFC 1889 Version" },
 109         { 0, NULL },
 110 };
 111
 112 /*
 113  * Fields in the second octet of the RTP header.
 114  */
 115
 116 /* Marker is the first bit of the second octet */
 117 #define RTP_MARKER(octet)       ((octet) & 0x80)
 118
 119 /* Payload type is the last 7 bits */
 120 #define RTP_PAYLOAD_TYPE(octet) ((octet) & 0x7F)
 121
 122 /*
 123  * RTP Payload types
 124  * Table B.2 / H.225.0
 125  */
 126 #define PT_PCMU 0
 127 #define PT_PCMA 8
 128 #define PT_G722 9
 129 #define PT_G723 4
 130 #define PT_G728 15
 131 #define PT_G729 18
 132 #define PT_H261 31
 133 #define PT_H263 34
 134
 135 static const value_string rtp_payload_type_vals[] =
 136 {
 137         { PT_PCMU, "ITU-T G.711 PCMU" },
 138         { PT_PCMA, "ITU-T G.711 PCMA" },
 139         { PT_G722, "ITU-T G.722" },
 140         { PT_G723, "ITU-T G.723" },
 141         { PT_G728, "ITU-T G.728" },
 142         { PT_G729, "ITU-T G.729" },
 143         { PT_H261, "ITU-T H.261" },
 144         { PT_H263, "ITU-T H.263" },
 145         { 0, NULL },
 146 };
 147
 148 static address fake_addr;
 149 static int heur_init = FALSE;
 150
 151 static const char rtp_proto[] = "RTP";
 152
 153 void rtp_add_address( const unsigned char* ip_addr, int prt )
 154 {
 155         address src_addr;
 156         conversation_t* pconv = ( conversation_t* ) NULL;
 157
 158         src_addr.type = AT_IPv4;
 159         src_addr.len = 4;
 160         src_addr.data = ip_addr;
 161
 162         /*
 163          * The first time the function is called let the tcp dissector
 164          * know that we're interested in traffic
 165          */
 166         if ( ! heur_init ) {
 167                 heur_dissector_add( "udp", dissect_rtp_heur );
 168                 heur_init = TRUE;
 169         }
 170
 171         /*
 172          * Check if the ip address an dport combination is not
 173          * already registered
 174          */
 175         pconv = find_conversation( &src_addr, &fake_addr, PT_UDP, prt, 0, 0 );
 176
 177         /*
 178          * If not, add
 179          */
 180         if ( ! pconv ) {
 181                 conversation_new( &src_addr, &fake_addr, PT_UDP, (guint32) prt,
 182                     (guint32) 0, ( void * ) rtp_proto, 0 );
 183         }
 184
 185 }
 186
 187 #if 0
 188 static void rtp_init( void )
 189 {
 190         unsigned char* tmp_data;
 191         int i;
 192
 193         /* Create a fake adddress... */
 194         fake_addr.type = AT_IPv4;
 195         fake_addr.len = 4;
 196
 197         tmp_data = malloc( fake_addr.len );
 198         for ( i = 0; i < fake_addr.len; i++) {
 199                 tmp_data[i] = 0;
 200         }
 201         fake_addr.data = tmp_data;
 202 }
 203 #endif
 204
 205 gboolean
 206 dissect_rtp_heur( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
 207 {
 208         conversation_t* pconv;
 209
 210         if (!proto_is_protocol_enabled(proto_rtp))
 211                 return FALSE;   /* RTP has been disabled */
 212
 213         /* This is a heuristic dissector, which means we get all the TCP
 214          * traffic not sent to a known dissector and not claimed by
 215          * a heuristic dissector called before us!
 216          * So we first check if the frame is really meant for us.
 217          */
 218         if ( ( pconv = find_conversation( &pi.src, &fake_addr, pi.ptype,
 219             pi.srcport, 0, 0 ) ) == NULL ) {
 220                 /*
 221                  * The source ip:port combination was not what we were
 222                  * looking for, check the destination
 223                  */
 224                 if ( ( pconv = find_conversation( &pi.dst, &fake_addr,
 225                     pi.ptype, pi.destport, 0, 0 ) ) == NULL ) {
 226                         return FALSE;
 227                 }
 228         }
 229
 230         /*
 231          * An RTP conversation always contains data
 232          */
 233         if ( pconv->data == NULL )
 234                 return FALSE;
 235
 236         /*
 237          * An RTP conversation data always contains "RTP"
 238          */
 239         if ( strcmp( pconv->data, rtp_proto ) != 0 )
 240                 return FALSE;
 241
 242         dissect_rtp( tvb, pinfo, tree );
 243
 244         return TRUE;
 245 }
 246
 247 void
 248 dissect_rtp_data( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *rtp_tree, int offset, unsigned int data_len, unsigned int payload_type )
 249 {
 250         tvbuff_t *newtvb;
 251
 252         switch( payload_type ) {
 253                 case PT_H261:
 254                         /*
 255                          * What does reported length DO?
 256                          */
 257                         newtvb = tvb_new_subset( tvb, offset, data_len, -1 );
 258                         dissect_h261(newtvb, pinfo, tree);
 259                         break;
 260                 default:
 261                         proto_tree_add_bytes( rtp_tree, hf_rtp_data, tvb, offset, data_len, tvb_get_ptr( tvb, offset, data_len ) );
 262                         break;
 263         }
 264 }
 265
 266 void
 267 dissect_rtp( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
 268 {
 269         proto_item *ti            = NULL;
 270         proto_tree *rtp_tree      = NULL;
 271         proto_tree *rtp_csrc_tree = NULL;
 272         guint8      octet;
 273         unsigned int version;
 274         gboolean    padding_set;
 275         gboolean    extension_set;
 276         unsigned int csrc_count;
 277         gboolean    marker_set;
 278         unsigned int payload_type;
 279         unsigned int i            = 0;
 280         unsigned int hdr_extension= 0;
 281         unsigned int padding_count= 0;
 282         unsigned int offset = 0;
 283         guint16     seq_num;
 284         guint32     timestamp;
 285         guint32     sync_src;
 286         guint32     csrc_item;
 287
 288         CHECK_DISPLAY_AS_DATA(proto_rtp, tvb, pinfo, tree);
 289
 290         pinfo->current_proto = "RTP";
 291
 292         /* Get the fields in the first octet */
 293         octet = tvb_get_guint8( tvb, offset );
 294         version = RTP_VERSION( octet );
 295         padding_set = RTP_PADDING( octet );
 296         extension_set = RTP_EXTENSION( octet );
 297         csrc_count = RTP_CSRC_COUNT( octet );
 298
 299         /* Get the fields in the second octet */
 300         octet = tvb_get_guint8( tvb, offset + 1 );
 301         marker_set = RTP_MARKER( octet );
 302         payload_type = RTP_PAYLOAD_TYPE( octet );
 303
 304         /* Get the subsequent fields */
 305         seq_num = tvb_get_ntohs( tvb, offset + 2 );
 306         timestamp = tvb_get_ntohl( tvb, offset + 4 );
 307         sync_src = tvb_get_ntohl( tvb, offset + 8 );
 308
 309         if ( check_col( pinfo->fd, COL_PROTOCOL ) )   {
 310                 col_set_str( pinfo->fd, COL_PROTOCOL, "RTP" );
 311         }
 312
 313         if ( check_col( pinfo->fd, COL_INFO) ) {
 314                 col_add_fstr( pinfo->fd, COL_INFO,
 315                     "Payload type=%s, SSRC=%u, Seq=%u, Time=%u%s",
 316                     val_to_str( payload_type, rtp_payload_type_vals,
 317                         "Unknown (%u)" ),
 318                     sync_src,
 319                     seq_num,
 320                     timestamp,
 321                     marker_set ? ", Mark" : "");
 322         }
 323
 324         if ( tree ) {
 325                 ti = proto_tree_add_item( tree, proto_rtp, tvb, offset, tvb_length_remaining( tvb, offset ), FALSE );
 326                 rtp_tree = proto_item_add_subtree( ti, ett_rtp );
 327
 328                 proto_tree_add_uint( rtp_tree, hf_rtp_version, tvb,
 329                     offset, 1, version );
 330                 proto_tree_add_boolean( rtp_tree, hf_rtp_padding, tvb,
 331                     offset, 1, padding_set );
 332                 proto_tree_add_boolean( rtp_tree, hf_rtp_extension, tvb,
 333                     offset, 1, extension_set );
 334                 proto_tree_add_uint( rtp_tree, hf_rtp_csrc_count, tvb,
 335                     offset, 1, csrc_count );
 336                 offset++;
 337
 338                 proto_tree_add_boolean( rtp_tree, hf_rtp_marker, tvb, offset,
 339                     1, marker_set );
 340                 proto_tree_add_uint( rtp_tree, hf_rtp_payload_type, tvb,
 341                     offset, 1, payload_type );
 342                 offset++;
 343
 344                 /* Sequence number 16 bits (2 octets) */
 345                 proto_tree_add_uint( rtp_tree, hf_rtp_seq_nr, tvb, offset, 2, seq_num );
 346                 offset += 2;
 347
 348                 /* Timestamp 32 bits (4 octets) */
 349                 proto_tree_add_uint( rtp_tree, hf_rtp_timestamp, tvb, offset, 4, timestamp );
 350                 offset += 4;
 351
 352                 /* Synchronization source identifier 32 bits (4 octets) */
 353                 proto_tree_add_uint( rtp_tree, hf_rtp_ssrc, tvb, offset, 4, sync_src );
 354                 offset += 4;
 355
 356                 /* CSRC list*/
 357                 if ( csrc_count > 0 ) {
 358                         ti = proto_tree_add_text(rtp_tree, tvb, offset, csrc_count * 4, "Contributing Source identifiers");
 359                         rtp_csrc_tree = proto_item_add_subtree( ti, ett_csrc_list );
 360                         for (i = 0; i < csrc_count; i++ ) {
 361                                 csrc_item = tvb_get_ntohl( tvb, offset );
 362                                 proto_tree_add_uint_format( rtp_csrc_tree,
 363                                     hf_rtp_csrc_item, tvb, offset, 4,
 364                                     csrc_item,
 365                                     "CSRC item %d: %u",
 366                                     i, csrc_item );
 367                                 offset += 4;
 368                         }
 369                 }
 370
 371                 /* Optional RTP header extension */
 372                 if ( extension_set ) {
 373                         /* Defined by profile field is 16 bits (2 octets) */
 374                         proto_tree_add_uint( rtp_tree, hf_rtp_prof_define, tvb, offset, 2, tvb_get_ntohs( tvb, offset ) );
 375                         offset += 2;
 376
 377                         hdr_extension = tvb_get_ntohs( tvb, offset );
 378                         proto_tree_add_uint( rtp_tree, hf_rtp_length, tvb,
 379                             offset, 2, hdr_extension);
 380                         if ( hdr_extension > 0 ) {
 381                                 ti = proto_tree_add_text(rtp_tree, tvb, offset, csrc_count * 4, "Header extensions");
 382                                 /* I'm re-using the old tree variable here
 383                                    from the CSRC list!*/
 384                                 rtp_csrc_tree = proto_item_add_subtree( ti,
 385                                     ett_hdr_ext );
 386                                 for (i = 0; i < hdr_extension; i++ ) {
 387                                         proto_tree_add_uint( rtp_csrc_tree, hf_rtp_hdr_ext, tvb, offset, 4, tvb_get_ntohl( tvb, offset ) );
 388                                         offset += 4;
 389                                 }
 390                         }
 391                 }
 392                 /* Find the padding
 393                  * The padding count is found in the LAST octet of the packet
 394                  * This contains the number of octets that can be ignored at
 395                  * the end of the packet
 396                  */
 397                 if ( padding_set ) {
 398                         padding_count = tvb_get_guint8( tvb, tvb_length( tvb ) - 1 );
 399                         if ( padding_count > 0 ) {
 400                                 dissect_rtp_data( tvb, pinfo, tree, rtp_tree, offset, tvb_length( tvb ) - padding_count, payload_type );
 401                                 offset = tvb_length( tvb ) - padding_count;
 402                                 proto_tree_add_item( rtp_tree, hf_rtp_padding_data, tvb, offset, padding_count - 1, FALSE );
 403                                 offset += padding_count - 1;
 404                                 proto_tree_add_item( rtp_tree, hf_rtp_padding_count, tvb, offset, 1, FALSE );
 405                         }
 406                         else {
 407                                 proto_tree_add_item( rtp_tree, hf_rtp_padding_count, tvb, tvb_length( tvb ) - 1, 1, FALSE );
 408                         }
 409                 }
 410                 else {
 411                         dissect_rtp_data( tvb, pinfo, tree, rtp_tree, offset, tvb_length_remaining( tvb, offset ) - padding_count, payload_type );
 412                 }
 413         }
 414 }
 415
 416 void
 417 proto_register_rtp(void)
 418 {
 419         static hf_register_info hf[] =
 420         {
 421                 {
 422                         &hf_rtp_version,
 423                         {
 424                                 "Version",
 425                                 "rtp.version",
 426                                 FT_UINT8,
 427                                 BASE_DEC,
 428                                 VALS(rtp_version_vals),
 429                                 0x0,
 430                                 ""
 431                         }
 432                 },
 433                 {
 434                         &hf_rtp_padding,
 435                         {
 436                                 "Padding",
 437                                 "rtp.padding",
 438                                 FT_BOOLEAN,
 439                                 BASE_NONE,
 440                                 NULL,
 441                                 0x0,
 442                                 ""
 443                         }
 444                 },
 445                 {
 446                         &hf_rtp_extension,
 447                         {
 448                                 "Extension",
 449                                 "rtp.ext",
 450                                 FT_BOOLEAN,
 451                                 BASE_NONE,
 452                                 NULL,
 453                                 0x0,
 454                                 ""
 455                         }
 456                 },
 457                 {
 458                         &hf_rtp_csrc_count,
 459                         {
 460                                 "Contributing source identifiers count",
 461                                 "rtp.cc",
 462                                 FT_UINT8,
 463                                 BASE_DEC,
 464                                 NULL,
 465                                 0x0,
 466                                 ""
 467                         }
 468                 },
 469                 {
 470                         &hf_rtp_marker,
 471                         {
 472                                 "Marker",
 473                                 "rtp.marker",
 474                                 FT_BOOLEAN,
 475                                 BASE_NONE,
 476                                 NULL,
 477                                 0x0,
 478                                 ""
 479                         }
 480                 },
 481                 {
 482                         &hf_rtp_payload_type,
 483                         {
 484                                 "Payload type",
 485                                 "rtp.p_type",
 486                                 FT_UINT8,
 487                                 BASE_DEC,
 488                                 VALS(rtp_payload_type_vals),
 489                                 0x0,
 490                                 ""
 491                         }
 492                 },
 493                 {
 494                         &hf_rtp_seq_nr,
 495                         {
 496                                 "Sequence number",
 497                                 "rtp.seq",
 498                                 FT_UINT16,
 499                                 BASE_DEC,
 500                                 NULL,
 501                                 0x0,
 502                                 ""
 503                         }
 504                 },
 505                 {
 506                         &hf_rtp_timestamp,
 507                         {
 508                                 "Timestamp",
 509                                 "rtp.timestamp",
 510                                 FT_UINT32,
 511                                 BASE_DEC,
 512                                 NULL,
 513                                 0x0,
 514                                 ""
 515                         }
 516                 },
 517                 {
 518                         &hf_rtp_ssrc,
 519                         {
 520                                 "Synchronization Source identifier",
 521                                 "rtp.ssrc",
 522                                 FT_UINT32,
 523                                 BASE_DEC,
 524                                 NULL,
 525                                 0x0,
 526                                 ""
 527                         }
 528                 },
 529                 {
 530                         &hf_rtp_prof_define,
 531                         {
 532                                 "Defined by profile",
 533                                 "rtp.ext.profile",
 534                                 FT_UINT16,
 535                                 BASE_DEC,
 536                                 NULL,
 537                                 0x0,
 538                                 ""
 539                         }
 540                 },
 541                 {
 542                         &hf_rtp_length,
 543                         {
 544                                 "Extension length",
 545                                 "rtp.ext.len",
 546                                 FT_UINT16,
 547                                 BASE_DEC,
 548                                 NULL,
 549                                 0x0,
 550                                 ""
 551                         }
 552                 },
 553                 {
 554                         &hf_rtp_csrc_item,
 555                         {
 556                                 "CSRC item",
 557                                 "rtp.csrc.item",
 558                                 FT_UINT32,
 559                                 BASE_DEC,
 560                                 NULL,
 561                                 0x0,
 562                                 ""
 563                         }
 564                 },
 565                 {
 566                         &hf_rtp_hdr_ext,
 567                         {
 568                                 "Header extension",
 569                                 "rtp.hdr_ext",
 570                                 FT_UINT32,
 571                                 BASE_DEC,
 572                                 NULL,
 573                                 0x0,
 574                                 ""
 575                         }
 576                 },
 577                 {
 578                         &hf_rtp_data,
 579                         {
 580                                 "Payload",
 581                                 "rtp.payload",
 582                                 FT_BYTES,
 583                                 BASE_HEX,
 584                                 NULL,
 585                                 0x0,
 586                                 ""
 587                         }
 588                 },
 589                 {
 590                         &hf_rtp_padding_data,
 591                         {
 592                                 "Padding data",
 593                                 "rtp.padding.data",
 594                                 FT_BYTES,
 595                                 BASE_HEX,
 596                                 NULL,
 597                                 0x0,
 598                                 ""
 599                         }
 600                 },
 601                 {
 602                         &hf_rtp_padding_count,
 603                         {
 604                                 "Padding count",
 605                                 "rtp.padding.count",
 606                                 FT_UINT8,
 607                                 BASE_DEC,
 608                                 NULL,
 609                                 0x0,
 610                                 ""
 611                         }
 612                 },
 613 };
 614
 615         static gint *ett[] =
 616         {
 617                 &ett_rtp,
 618                 &ett_csrc_list,
 619                 &ett_hdr_ext,
 620         };
 621
 622
 623         proto_rtp = proto_register_protocol("Real-Time Transport Protocol", "rtp");
 624         proto_register_field_array(proto_rtp, hf, array_length(hf));
 625         proto_register_subtree_array(ett, array_length(ett));
 626
 627 #if 0
 628         register_init_routine( &rtp_init );
 629 #endif
 630 }