packet-rtp.c

   1 /* packet-rtp.c
   2  *
   3  * Routines for RTP dissection
   4  * RTP = Real time Transport Protocol
   5  *
   6  * Copyright 2000, Philips Electronics N.V.
   7  * Written by Andreas Sikkema <andreas.sikkema@philips.com>
   8  *
   9  * Ethereal - Network traffic analyzer
  10  * By Gerald Combs <gerald@zing.org>
  11  * Copyright 1998 Gerald Combs
  12  *
  13  *
  14  * This program is free software; you can redistribute it and/or
  15  * modify it under the terms of the GNU General Public License
  16  * as published by the Free Software Foundation; either version 2
  17  * of the License, or (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, write to the Free Software
  26  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  27  */
  28
  29 /*
  30  * This dissector tries to dissect the RTP protocol according to Annex A
  31  * of ITU-T Recommendation H.225.0 (02/98) or RFC 1889
  32  *
  33  * RTP traffic is handled by an even UDP portnumber. This can be any
  34  * port number, but there is a registered port available, port 5004
  35  * See Annex B of ITU-T Recommendation H.225.0, section B.7
  36  */
  37
  38
  39 #ifdef HAVE_CONFIG_H
  40 # include "config.h"
  41 #endif
  42
  43 #include <glib.h>
  44 #include "packet.h"
  45
  46 #ifdef HAVE_SYS_TYPES_H
  47 #  include <sys/types.h>
  48 #endif
  49
  50 #ifdef HAVE_NETINET_IN_H
  51 #  include <netinet/in.h>
  52 #endif
  53
  54 #include <stdio.h>
  55 #include <string.h>
  56
  57 #include "packet-rtp.h"
  58 #include "packet-h261.h"
  59 #include "conversation.h"
  60
  61 /* RTP header fields             */
  62 static int proto_rtp           = -1;
  63 static int hf_rtp_version      = -1;
  64 static int hf_rtp_padding      = -1;
  65 static int hf_rtp_extension    = -1;
  66 static int hf_rtp_csrc_count   = -1;
  67 static int hf_rtp_marker       = -1;
  68 static int hf_rtp_payload_type = -1;
  69 static int hf_rtp_seq_nr       = -1;
  70 static int hf_rtp_timestamp    = -1;
  71 static int hf_rtp_ssrc         = -1;
  72 static int hf_rtp_csrc_item    = -1;
  73 static int hf_rtp_data         = -1;
  74 static int hf_rtp_padding_data = -1;
  75 static int hf_rtp_padding_count= -1;
  76
  77 /* RTP header extension fields   */
  78 static int hf_rtp_prof_define  = -1;
  79 static int hf_rtp_length       = -1;
  80 static int hf_rtp_hdr_ext      = -1;
  81
  82 /* RTP fields defining a sub tree */
  83 static gint ett_rtp       = -1;
  84 static gint ett_csrc_list = -1;
  85 static gint ett_hdr_ext   = -1;
  86
  87 /*
  88  * Fields in the first octet of the RTP header.
  89  */
  90
  91 /* Version is the first 2 bits of the first octet*/
  92 #define RTP_VERSION(octet)      ((octet) >> 6)
  93
  94 /* Padding is the third bit; No need to shift, because true is any value
  95    other than 0! */
  96 #define RTP_PADDING(octet)      ((octet) & 0x20)
  97
  98 /* Extension bit is the fourth bit */
  99 #define RTP_EXTENSION(octet)    ((octet) & 0x10)
 100
 101 /* CSRC count is the last four bits */
 102 #define RTP_CSRC_COUNT(octet)   ((octet) & 0xF)
 103
 104 static const value_string rtp_version_vals[] =
 105 {
 106         { 0, "Old VAT Version" },
 107         { 1, "First Draft Version" },
 108         { 2, "RFC 1889 Version" },
 109         { 0, NULL },
 110 };
 111
 112 /*
 113  * Fields in the second octet of the RTP header.
 114  */
 115
 116 /* Marker is the first bit of the second octet */
 117 #define RTP_MARKER(octet)       ((octet) & 0x80)
 118
 119 /* Payload type is the last 7 bits */
 120 #define RTP_PAYLOAD_TYPE(octet) ((octet) & 0x7F)
 121
 122 /*
 123  * RTP Payload types
 124  * Table B.2 / H.225.0
 125  * Also RFC 1890
 126  */
 127 #define PT_PCMU         0
 128 #define PT_1016         1
 129 #define PT_G721         2
 130 #define PT_GSM          3
 131 #define PT_G723         4
 132 #define PT_DVI4_8000    5
 133 #define PT_DVI4_16000   6
 134 #define PT_LPC          7
 135 #define PT_PCMA         8
 136 #define PT_G722         9
 137 #define PT_L16_STEREO   10
 138 #define PT_L16_MONO     11
 139 #define PT_MPA          14
 140 #define PT_G728         15
 141 #define PT_G729         18
 142 #define PT_CELB         25
 143 #define PT_JPEG         26
 144 #define PT_NV           28
 145 #define PT_H261         31
 146 #define PT_MPV          32
 147 #define PT_MP2T         33
 148 #define PT_H263         34
 149
 150 static const value_string rtp_payload_type_vals[] =
 151 {
 152         { PT_PCMU,      "ITU-T G.711 PCMU" },
 153         { PT_1016,      "USA Federal Standard FS-1016" },
 154         { PT_G721,      "ITU-T G.721" },
 155         { PT_GSM,       "GSM 06.10" },
 156         { PT_G723,      "ITU-T G.723" },
 157         { PT_DVI4_8000, "DVI4 8000 samples/s" },
 158         { PT_DVI4_16000, "DVI4 16000 samples/s" },
 159         { PT_LPC,       "LPC" },
 160         { PT_PCMA,      "ITU-T G.711 PCMA" },
 161         { PT_G722,      "ITU-T G.722" },
 162         { PT_L16_STEREO, "16-bit uncompressed audio, stereo" },
 163         { PT_L16_MONO,  "16-bit uncompressed audio, monaural" },
 164         { PT_MPA,       "MPEG-I/II Audeo"},
 165         { PT_G728,      "ITU-T G.728" },
 166         { PT_G729,      "ITU-T G.729" },
 167         { PT_CELB,      "Sun CELL-B" },
 168         { PT_JPEG,      "JPEG" },
 169         { PT_NV,        "'nv' program" },
 170         { PT_H261,      "ITU-T H.261" },
 171         { PT_MPV,       "MPEG-I/II Video"},
 172         { PT_MP2T,      "MPEG-II transport streams"},
 173         { PT_H263,      "ITU-T H.263" },
 174         { 0,            NULL },
 175 };
 176
 177 static address fake_addr;
 178 static int heur_init = FALSE;
 179
 180 static const char rtp_proto[] = "RTP";
 181
 182 void rtp_add_address( const unsigned char* ip_addr, int prt )
 183 {
 184         address src_addr;
 185         conversation_t* pconv = ( conversation_t* ) NULL;
 186
 187         src_addr.type = AT_IPv4;
 188         src_addr.len = 4;
 189         src_addr.data = ip_addr;
 190
 191         /*
 192          * The first time the function is called let the tcp dissector
 193          * know that we're interested in traffic
 194          */
 195         if ( ! heur_init ) {
 196                 heur_dissector_add( "udp", dissect_rtp_heur, proto_rtp );
 197                 heur_init = TRUE;
 198         }
 199
 200         /*
 201          * Check if the ip address an dport combination is not
 202          * already registered
 203          */
 204         pconv = find_conversation( &src_addr, &fake_addr, PT_UDP, prt, 0, 0 );
 205
 206         /*
 207          * If not, add
 208          */
 209         if ( ! pconv ) {
 210                 conversation_new( &src_addr, &fake_addr, PT_UDP, (guint32) prt,
 211                     (guint32) 0, ( void * ) rtp_proto, 0 );
 212         }
 213
 214 }
 215
 216 #if 0
 217 static void rtp_init( void )
 218 {
 219         unsigned char* tmp_data;
 220         int i;
 221
 222         /* Create a fake adddress... */
 223         fake_addr.type = AT_IPv4;
 224         fake_addr.len = 4;
 225
 226         tmp_data = malloc( fake_addr.len );
 227         for ( i = 0; i < fake_addr.len; i++) {
 228                 tmp_data[i] = 0;
 229         }
 230         fake_addr.data = tmp_data;
 231 }
 232 #endif
 233
 234 gboolean
 235 dissect_rtp_heur( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
 236 {
 237         conversation_t* pconv;
 238
 239         if (!proto_is_protocol_enabled(proto_rtp))
 240                 return FALSE;   /* RTP has been disabled */
 241
 242         /* This is a heuristic dissector, which means we get all the TCP
 243          * traffic not sent to a known dissector and not claimed by
 244          * a heuristic dissector called before us!
 245          * So we first check if the frame is really meant for us.
 246          */
 247         if ( ( pconv = find_conversation( &pi.src, &fake_addr, pi.ptype,
 248             pi.srcport, 0, 0 ) ) == NULL ) {
 249                 /*
 250                  * The source ip:port combination was not what we were
 251                  * looking for, check the destination
 252                  */
 253                 if ( ( pconv = find_conversation( &pi.dst, &fake_addr,
 254                     pi.ptype, pi.destport, 0, 0 ) ) == NULL ) {
 255                         return FALSE;
 256                 }
 257         }
 258
 259         /*
 260          * An RTP conversation always contains data
 261          */
 262         if ( pconv->data == NULL )
 263                 return FALSE;
 264
 265         /*
 266          * An RTP conversation data always contains "RTP"
 267          */
 268         if ( strcmp( pconv->data, rtp_proto ) != 0 )
 269                 return FALSE;
 270
 271         dissect_rtp( tvb, pinfo, tree );
 272
 273         return TRUE;
 274 }
 275
 276 void
 277 dissect_rtp_data( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_tree *rtp_tree, int offset, unsigned int data_len, unsigned int payload_type )
 278 {
 279         tvbuff_t *newtvb;
 280
 281         switch( payload_type ) {
 282                 case PT_H261:
 283                         /*
 284                          * What does reported length DO?
 285                          */
 286                         newtvb = tvb_new_subset( tvb, offset, data_len, -1 );
 287                         dissect_h261(newtvb, pinfo, tree);
 288                         break;
 289                 default:
 290                         proto_tree_add_bytes( rtp_tree, hf_rtp_data, tvb, offset, data_len, tvb_get_ptr( tvb, offset, data_len ) );
 291                         break;
 292         }
 293 }
 294
 295 void
 296 dissect_rtp( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree )
 297 {
 298         proto_item *ti            = NULL;
 299         proto_tree *rtp_tree      = NULL;
 300         proto_tree *rtp_csrc_tree = NULL;
 301         guint8      octet;
 302         unsigned int version;
 303         gboolean    padding_set;
 304         gboolean    extension_set;
 305         unsigned int csrc_count;
 306         gboolean    marker_set;
 307         unsigned int payload_type;
 308         unsigned int i            = 0;
 309         unsigned int hdr_extension= 0;
 310         unsigned int padding_count= 0;
 311         unsigned int offset = 0;
 312         guint16     seq_num;
 313         guint32     timestamp;
 314         guint32     sync_src;
 315         guint32     csrc_item;
 316
 317         CHECK_DISPLAY_AS_DATA(proto_rtp, tvb, pinfo, tree);
 318
 319         pinfo->current_proto = "RTP";
 320
 321         /* Get the fields in the first octet */
 322         octet = tvb_get_guint8( tvb, offset );
 323         version = RTP_VERSION( octet );
 324         padding_set = RTP_PADDING( octet );
 325         extension_set = RTP_EXTENSION( octet );
 326         csrc_count = RTP_CSRC_COUNT( octet );
 327
 328         /* Get the fields in the second octet */
 329         octet = tvb_get_guint8( tvb, offset + 1 );
 330         marker_set = RTP_MARKER( octet );
 331         payload_type = RTP_PAYLOAD_TYPE( octet );
 332
 333         /* Get the subsequent fields */
 334         seq_num = tvb_get_ntohs( tvb, offset + 2 );
 335         timestamp = tvb_get_ntohl( tvb, offset + 4 );
 336         sync_src = tvb_get_ntohl( tvb, offset + 8 );
 337
 338         if ( check_col( pinfo->fd, COL_PROTOCOL ) )   {
 339                 col_set_str( pinfo->fd, COL_PROTOCOL, "RTP" );
 340         }
 341
 342         if ( check_col( pinfo->fd, COL_INFO) ) {
 343                 col_add_fstr( pinfo->fd, COL_INFO,
 344                     "Payload type=%s, SSRC=%u, Seq=%u, Time=%u%s",
 345                     val_to_str( payload_type, rtp_payload_type_vals,
 346                         "Unknown (%u)" ),
 347                     sync_src,
 348                     seq_num,
 349                     timestamp,
 350                     marker_set ? ", Mark" : "");
 351         }
 352
 353         if ( tree ) {
 354                 ti = proto_tree_add_item( tree, proto_rtp, tvb, offset, tvb_length_remaining( tvb, offset ), FALSE );
 355                 rtp_tree = proto_item_add_subtree( ti, ett_rtp );
 356
 357                 proto_tree_add_uint( rtp_tree, hf_rtp_version, tvb,
 358                     offset, 1, version );
 359                 proto_tree_add_boolean( rtp_tree, hf_rtp_padding, tvb,
 360                     offset, 1, padding_set );
 361                 proto_tree_add_boolean( rtp_tree, hf_rtp_extension, tvb,
 362                     offset, 1, extension_set );
 363                 proto_tree_add_uint( rtp_tree, hf_rtp_csrc_count, tvb,
 364                     offset, 1, csrc_count );
 365                 offset++;
 366
 367                 proto_tree_add_boolean( rtp_tree, hf_rtp_marker, tvb, offset,
 368                     1, marker_set );
 369                 proto_tree_add_uint( rtp_tree, hf_rtp_payload_type, tvb,
 370                     offset, 1, payload_type );
 371                 offset++;
 372
 373                 /* Sequence number 16 bits (2 octets) */
 374                 proto_tree_add_uint( rtp_tree, hf_rtp_seq_nr, tvb, offset, 2, seq_num );
 375                 offset += 2;
 376
 377                 /* Timestamp 32 bits (4 octets) */
 378                 proto_tree_add_uint( rtp_tree, hf_rtp_timestamp, tvb, offset, 4, timestamp );
 379                 offset += 4;
 380
 381                 /* Synchronization source identifier 32 bits (4 octets) */
 382                 proto_tree_add_uint( rtp_tree, hf_rtp_ssrc, tvb, offset, 4, sync_src );
 383                 offset += 4;
 384
 385                 /* CSRC list*/
 386                 if ( csrc_count > 0 ) {
 387                         ti = proto_tree_add_text(rtp_tree, tvb, offset, csrc_count * 4, "Contributing Source identifiers");
 388                         rtp_csrc_tree = proto_item_add_subtree( ti, ett_csrc_list );
 389                         for (i = 0; i < csrc_count; i++ ) {
 390                                 csrc_item = tvb_get_ntohl( tvb, offset );
 391                                 proto_tree_add_uint_format( rtp_csrc_tree,
 392                                     hf_rtp_csrc_item, tvb, offset, 4,
 393                                     csrc_item,
 394                                     "CSRC item %d: %u",
 395                                     i, csrc_item );
 396                                 offset += 4;
 397                         }
 398                 }
 399
 400                 /* Optional RTP header extension */
 401                 if ( extension_set ) {
 402                         /* Defined by profile field is 16 bits (2 octets) */
 403                         proto_tree_add_uint( rtp_tree, hf_rtp_prof_define, tvb, offset, 2, tvb_get_ntohs( tvb, offset ) );
 404                         offset += 2;
 405
 406                         hdr_extension = tvb_get_ntohs( tvb, offset );
 407                         proto_tree_add_uint( rtp_tree, hf_rtp_length, tvb,
 408                             offset, 2, hdr_extension);
 409                         if ( hdr_extension > 0 ) {
 410                                 ti = proto_tree_add_text(rtp_tree, tvb, offset, csrc_count * 4, "Header extensions");
 411                                 /* I'm re-using the old tree variable here
 412                                    from the CSRC list!*/
 413                                 rtp_csrc_tree = proto_item_add_subtree( ti,
 414                                     ett_hdr_ext );
 415                                 for (i = 0; i < hdr_extension; i++ ) {
 416                                         proto_tree_add_uint( rtp_csrc_tree, hf_rtp_hdr_ext, tvb, offset, 4, tvb_get_ntohl( tvb, offset ) );
 417                                         offset += 4;
 418                                 }
 419                         }
 420                 }
 421                 /* Find the padding
 422                  * The padding count is found in the LAST octet of the packet
 423                  * This contains the number of octets that can be ignored at
 424                  * the end of the packet
 425                  */
 426                 if ( padding_set ) {
 427                         padding_count = tvb_get_guint8( tvb, tvb_length( tvb ) - 1 );
 428                         if ( padding_count > 0 ) {
 429                                 dissect_rtp_data( tvb, pinfo, tree, rtp_tree, offset, tvb_length( tvb ) - padding_count, payload_type );
 430                                 offset = tvb_length( tvb ) - padding_count;
 431                                 proto_tree_add_item( rtp_tree, hf_rtp_padding_data, tvb, offset, padding_count - 1, FALSE );
 432                                 offset += padding_count - 1;
 433                                 proto_tree_add_item( rtp_tree, hf_rtp_padding_count, tvb, offset, 1, FALSE );
 434                         }
 435                         else {
 436                                 proto_tree_add_item( rtp_tree, hf_rtp_padding_count, tvb, tvb_length( tvb ) - 1, 1, FALSE );
 437                         }
 438                 }
 439                 else {
 440                         dissect_rtp_data( tvb, pinfo, tree, rtp_tree, offset, tvb_length_remaining( tvb, offset ) - padding_count, payload_type );
 441                 }
 442         }
 443 }
 444
 445 void
 446 proto_register_rtp(void)
 447 {
 448         static hf_register_info hf[] =
 449         {
 450                 {
 451                         &hf_rtp_version,
 452                         {
 453                                 "Version",
 454                                 "rtp.version",
 455                                 FT_UINT8,
 456                                 BASE_DEC,
 457                                 VALS(rtp_version_vals),
 458                                 0x0,
 459                                 ""
 460                         }
 461                 },
 462                 {
 463                         &hf_rtp_padding,
 464                         {
 465                                 "Padding",
 466                                 "rtp.padding",
 467                                 FT_BOOLEAN,
 468                                 BASE_NONE,
 469                                 NULL,
 470                                 0x0,
 471                                 ""
 472                         }
 473                 },
 474                 {
 475                         &hf_rtp_extension,
 476                         {
 477                                 "Extension",
 478                                 "rtp.ext",
 479                                 FT_BOOLEAN,
 480                                 BASE_NONE,
 481                                 NULL,
 482                                 0x0,
 483                                 ""
 484                         }
 485                 },
 486                 {
 487                         &hf_rtp_csrc_count,
 488                         {
 489                                 "Contributing source identifiers count",
 490                                 "rtp.cc",
 491                                 FT_UINT8,
 492                                 BASE_DEC,
 493                                 NULL,
 494                                 0x0,
 495                                 ""
 496                         }
 497                 },
 498                 {
 499                         &hf_rtp_marker,
 500                         {
 501                                 "Marker",
 502                                 "rtp.marker",
 503                                 FT_BOOLEAN,
 504                                 BASE_NONE,
 505                                 NULL,
 506                                 0x0,
 507                                 ""
 508                         }
 509                 },
 510                 {
 511                         &hf_rtp_payload_type,
 512                         {
 513                                 "Payload type",
 514                                 "rtp.p_type",
 515                                 FT_UINT8,
 516                                 BASE_DEC,
 517                                 VALS(rtp_payload_type_vals),
 518                                 0x0,
 519                                 ""
 520                         }
 521                 },
 522                 {
 523                         &hf_rtp_seq_nr,
 524                         {
 525                                 "Sequence number",
 526                                 "rtp.seq",
 527                                 FT_UINT16,
 528                                 BASE_DEC,
 529                                 NULL,
 530                                 0x0,
 531                                 ""
 532                         }
 533                 },
 534                 {
 535                         &hf_rtp_timestamp,
 536                         {
 537                                 "Timestamp",
 538                                 "rtp.timestamp",
 539                                 FT_UINT32,
 540                                 BASE_DEC,
 541                                 NULL,
 542                                 0x0,
 543                                 ""
 544                         }
 545                 },
 546                 {
 547                         &hf_rtp_ssrc,
 548                         {
 549                                 "Synchronization Source identifier",
 550                                 "rtp.ssrc",
 551                                 FT_UINT32,
 552                                 BASE_DEC,
 553                                 NULL,
 554                                 0x0,
 555                                 ""
 556                         }
 557                 },
 558                 {
 559                         &hf_rtp_prof_define,
 560                         {
 561                                 "Defined by profile",
 562                                 "rtp.ext.profile",
 563                                 FT_UINT16,
 564                                 BASE_DEC,
 565                                 NULL,
 566                                 0x0,
 567                                 ""
 568                         }
 569                 },
 570                 {
 571                         &hf_rtp_length,
 572                         {
 573                                 "Extension length",
 574                                 "rtp.ext.len",
 575                                 FT_UINT16,
 576                                 BASE_DEC,
 577                                 NULL,
 578                                 0x0,
 579                                 ""
 580                         }
 581                 },
 582                 {
 583                         &hf_rtp_csrc_item,
 584                         {
 585                                 "CSRC item",
 586                                 "rtp.csrc.item",
 587                                 FT_UINT32,
 588                                 BASE_DEC,
 589                                 NULL,
 590                                 0x0,
 591                                 ""
 592                         }
 593                 },
 594                 {
 595                         &hf_rtp_hdr_ext,
 596                         {
 597                                 "Header extension",
 598                                 "rtp.hdr_ext",
 599                                 FT_UINT32,
 600                                 BASE_DEC,
 601                                 NULL,
 602                                 0x0,
 603                                 ""
 604                         }
 605                 },
 606                 {
 607                         &hf_rtp_data,
 608                         {
 609                                 "Payload",
 610                                 "rtp.payload",
 611                                 FT_BYTES,
 612                                 BASE_HEX,
 613                                 NULL,
 614                                 0x0,
 615                                 ""
 616                         }
 617                 },
 618                 {
 619                         &hf_rtp_padding_data,
 620                         {
 621                                 "Padding data",
 622                                 "rtp.padding.data",
 623                                 FT_BYTES,
 624                                 BASE_HEX,
 625                                 NULL,
 626                                 0x0,
 627                                 ""
 628                         }
 629                 },
 630                 {
 631                         &hf_rtp_padding_count,
 632                         {
 633                                 "Padding count",
 634                                 "rtp.padding.count",
 635                                 FT_UINT8,
 636                                 BASE_DEC,
 637                                 NULL,
 638                                 0x0,
 639                                 ""
 640                         }
 641                 },
 642 };
 643
 644         static gint *ett[] =
 645         {
 646                 &ett_rtp,
 647                 &ett_csrc_list,
 648                 &ett_hdr_ext,
 649         };
 650
 651
 652         proto_rtp = proto_register_protocol("Real-Time Transport Protocol",
 653             "RTP", "rtp");
 654         proto_register_field_array(proto_rtp, hf, array_length(hf));
 655         proto_register_subtree_array(ett, array_length(ett));
 656
 657 #if 0
 658         register_init_routine( &rtp_init );
 659 #endif
 660 }
 661
 662 void
 663 proto_reg_handoff_rtp(void)
 664 {
 665         /*
 666          * Register this dissector as one that can be assigned to a
 667          * UDP conversation.
 668          */
 669         conv_dissector_add("udp", dissect_rtp, proto_rtp);
 670 }