/* packet-sip.c * Routines for the Session Initiation Protocol (SIP) dissection. * RFCs 3261-3264 * * TODO: * hf_ display filters for headers of SIP extension RFCs (ongoing) * * Copyright 2000, Heikki Vatiainen * Copyright 2001, Jean-Francois Mule * Copyright 2004, Anders Broman * Copyright 2011, Anders Broman , Johan Wahl * Copyright 2018, Anders Broman * Copyright 2020, Atul Sharma * * Wireshark - Network traffic analyzer * By Gerald Combs * Copyright 1998 Gerald Combs * * SPDX-License-Identifier: GPL-2.0-or-later * */ #include "config.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "packet-tls.h" #include "packet-isup.h" #include "packet-e164.h" #include "packet-e212.h" #include "packet-sip.h" #include "packet-media-type.h" #include "packet-acdr.h" #include "packet-sdp.h" /* SDP needs a transport layer to determine request/response */ /* un-comment the following as well as this line in conversation.c, to enable debug printing */ /* #define DEBUG_CONVERSATION */ #include "conversation_debug.h" #define TLS_PORT_SIP 5061 #define DEFAULT_SIP_PORT_RANGE "5060" void proto_register_sip(void); static int sip_tap = -1; static int sip_follow_tap = -1; static int exported_pdu_tap = -1; static dissector_handle_t sip_handle; static dissector_handle_t sip_tcp_handle; static dissector_handle_t sigcomp_handle; static dissector_handle_t sip_diag_handle; static dissector_handle_t sip_uri_userinfo_handle; static dissector_handle_t sip_via_branch_handle; static dissector_handle_t sip_via_be_route_handle; /* Dissector to dissect the text part of an reason code */ static dissector_handle_t sip_reason_code_handle; /* Initialize the protocol and registered fields */ static int proto_sip; static int proto_raw_sip; static int hf_sip_raw_line; static int hf_sip_msg_hdr; static int hf_sip_Method; static int hf_Request_Line; static int hf_sip_ruri_display; static int hf_sip_ruri; static int hf_sip_ruri_user; static int hf_sip_ruri_host; static int hf_sip_ruri_port; static int hf_sip_ruri_param; static int hf_sip_Status_Code; static int hf_sip_Status_Line; static int hf_sip_display; static int hf_sip_to_display; static int hf_sip_to_addr; static int hf_sip_to_user; static int hf_sip_to_host; static int hf_sip_to_port; static int hf_sip_to_param; static int hf_sip_to_tag; static int hf_sip_from_display; static int hf_sip_from_addr; static int hf_sip_from_user; static int hf_sip_from_host; static int hf_sip_from_port; static int hf_sip_from_param; static int hf_sip_from_tag; static int hf_sip_tag; static int hf_sip_pai_display; static int hf_sip_pai_addr; static int hf_sip_pai_user; static int hf_sip_pai_host; static int hf_sip_pai_port; static int hf_sip_pai_param; static int hf_sip_pmiss_display; static int hf_sip_pmiss_addr; static int hf_sip_pmiss_user; static int hf_sip_pmiss_host; static int hf_sip_pmiss_port; static int hf_sip_pmiss_param; static int hf_sip_ppi_display; static int hf_sip_ppi_addr; static int hf_sip_ppi_user; static int hf_sip_ppi_host; static int hf_sip_ppi_port; static int hf_sip_ppi_param; static int hf_sip_tc_display; static int hf_sip_tc_addr; static int hf_sip_tc_user; static int hf_sip_tc_host; static int hf_sip_tc_port; static int hf_sip_tc_param; static int hf_sip_tc_turi; static int hf_sip_contact_param; static int hf_sip_resend; static int hf_sip_original_frame; static int hf_sip_matching_request_frame; static int hf_sip_response_time; static int hf_sip_release_time; static int hf_sip_curi_display; static int hf_sip_curi; static int hf_sip_curi_user; static int hf_sip_curi_host; static int hf_sip_curi_port; static int hf_sip_curi_param; static int hf_sip_route_display; static int hf_sip_route; static int hf_sip_route_user; static int hf_sip_route_host; static int hf_sip_route_port; static int hf_sip_route_param; static int hf_sip_record_route_display; static int hf_sip_record_route; static int hf_sip_record_route_user; static int hf_sip_record_route_host; static int hf_sip_record_route_port; static int hf_sip_record_route_param; static int hf_sip_service_route_display; static int hf_sip_service_route; static int hf_sip_service_route_user; static int hf_sip_service_route_host; static int hf_sip_service_route_port; static int hf_sip_service_route_param; static int hf_sip_path_display; static int hf_sip_path; static int hf_sip_path_user; static int hf_sip_path_host; static int hf_sip_path_port; static int hf_sip_path_param; static int hf_sip_auth; static int hf_sip_auth_scheme; static int hf_sip_auth_digest_response; static int hf_sip_auth_nc; static int hf_sip_auth_username; static int hf_sip_auth_realm; static int hf_sip_auth_nonce; static int hf_sip_auth_algorithm; static int hf_sip_auth_opaque; static int hf_sip_auth_qop; static int hf_sip_auth_cnonce; static int hf_sip_auth_uri; static int hf_sip_auth_domain; static int hf_sip_auth_stale; static int hf_sip_auth_auts; static int hf_sip_auth_rspauth; static int hf_sip_auth_nextnonce; static int hf_sip_auth_ik; static int hf_sip_auth_ck; static int hf_sip_cseq_seq_no; static int hf_sip_cseq_method; static int hf_sip_via_transport; static int hf_sip_via_sent_by_address; static int hf_sip_via_sent_by_port; static int hf_sip_via_branch; static int hf_sip_via_maddr; static int hf_sip_via_rport; static int hf_sip_via_received; static int hf_sip_via_ttl; static int hf_sip_via_comp; static int hf_sip_via_sigcomp_id; static int hf_sip_via_oc; static int hf_sip_via_oc_val; static int hf_sip_via_oc_algo; static int hf_sip_via_oc_validity; static int hf_sip_via_oc_seq; static int hf_sip_oc_seq_timestamp; static int hf_sip_via_be_route; static int hf_sip_rack_rseq_no; static int hf_sip_rack_cseq_no; static int hf_sip_rack_cseq_method; static int hf_sip_reason_protocols; static int hf_sip_reason_cause_q850; static int hf_sip_reason_cause_sip; static int hf_sip_reason_cause_other; static int hf_sip_reason_text; static int hf_sip_msg_body; static int hf_sip_sec_mechanism; static int hf_sip_sec_mechanism_alg; static int hf_sip_sec_mechanism_ealg; static int hf_sip_sec_mechanism_prot; static int hf_sip_sec_mechanism_spi_c; static int hf_sip_sec_mechanism_spi_s; static int hf_sip_sec_mechanism_port1; static int hf_sip_sec_mechanism_port_c; static int hf_sip_sec_mechanism_port2; static int hf_sip_sec_mechanism_port_s; static int hf_sip_session_id_sess_id; static int hf_sip_session_id_param; static int hf_sip_session_id_local_uuid; static int hf_sip_session_id_remote_uuid; static int hf_sip_session_id_logme; static int hf_sip_continuation; static int hf_sip_feature_cap; static int hf_sip_p_acc_net_i_acc_type; static int hf_sip_p_acc_net_i_ucid_3gpp; static int hf_sip_service_priority; static int hf_sip_icid_value; static int hf_sip_icid_gen_addr; static int hf_sip_call_id_gen; /* Initialize the subtree pointers */ static int ett_sip; static int ett_sip_reqresp; static int ett_sip_hdr; static int ett_sip_ext_hdr; static int ett_raw_text; static int ett_sip_element; static int ett_sip_hist; static int ett_sip_uri; static int ett_sip_contact_item; static int ett_sip_message_body; static int ett_sip_cseq; static int ett_sip_via; static int ett_sip_reason; static int ett_sip_security_client; static int ett_sip_security_server; static int ett_sip_security_verify; static int ett_sip_rack; static int ett_sip_route; static int ett_sip_record_route; static int ett_sip_service_route; static int ett_sip_path; static int ett_sip_ruri; static int ett_sip_to_uri; static int ett_sip_curi; static int ett_sip_from_uri; static int ett_sip_pai_uri; static int ett_sip_pmiss_uri; static int ett_sip_ppi_uri; static int ett_sip_tc_uri; static int ett_sip_session_id; static int ett_sip_p_access_net_info; static int ett_sip_p_charging_vector; static int ett_sip_feature_caps; static int ett_sip_via_be_route; static expert_field ei_sip_unrecognized_header; static expert_field ei_sip_header_no_colon; static expert_field ei_sip_header_not_terminated; #if 0 static expert_field ei_sip_odd_register_response; #endif static expert_field ei_sip_call_id_invalid; static expert_field ei_sip_sipsec_malformed; static expert_field ei_sip_via_sent_by_port; static expert_field ei_sip_content_length_invalid; static expert_field ei_sip_retry_after_invalid; static expert_field ei_sip_Status_Code_invalid; static expert_field ei_sip_authorization_invalid; static expert_field ei_sip_session_id_sess_id; /* patterns used for tvb_ws_mempbrk_pattern_uint8 */ static ws_mempbrk_pattern pbrk_comma_semi; static ws_mempbrk_pattern pbrk_whitespace; static ws_mempbrk_pattern pbrk_param_end; static ws_mempbrk_pattern pbrk_param_end_colon_brackets; static ws_mempbrk_pattern pbrk_header_end_dquote; static ws_mempbrk_pattern pbrk_tab_sp_fslash; static ws_mempbrk_pattern pbrk_addr_end; static ws_mempbrk_pattern pbrk_via_param_end; /* PUBLISH method added as per https://tools.ietf.org/html/draft-ietf-sip-publish-01 */ static const char *sip_methods[] = { #define SIP_METHOD_INVALID 0 "", /* Pad so that the real methods start at index 1 */ #define SIP_METHOD_ACK 1 "ACK", #define SIP_METHOD_BYE 2 "BYE", #define SIP_METHOD_CANCEL 3 "CANCEL", #define SIP_METHOD_DO 4 "DO", #define SIP_METHOD_INFO 5 "INFO", #define SIP_METHOD_INVITE 6 "INVITE", #define SIP_METHOD_MESSAGE 7 "MESSAGE", #define SIP_METHOD_NOTIFY 8 "NOTIFY", #define SIP_METHOD_OPTIONS 9 "OPTIONS", #define SIP_METHOD_PRACK 10 "PRACK", #define SIP_METHOD_QAUTH 11 "QAUTH", #define SIP_METHOD_REFER 12 "REFER", #define SIP_METHOD_REGISTER 13 "REGISTER", #define SIP_METHOD_SPRACK 14 "SPRACK", #define SIP_METHOD_SUBSCRIBE 15 "SUBSCRIBE", #define SIP_METHOD_UPDATE 16 "UPDATE", #define SIP_METHOD_PUBLISH 17 "PUBLISH" }; /* from RFC 3261 * Updated with info from https://www.iana.org/assignments/sip-parameters * (last updated 2009-11-11) * Updated with: https://tools.ietf.org/html/draft-ietf-sip-resource-priority-05 */ typedef struct { const char *name; const char *compact_name; } sip_header_t; static const sip_header_t sip_headers[] = { { "Unknown-header", NULL }, /* 0 Pad so that the real headers start at index 1 */ { "Accept", NULL }, /* */ #define POS_ACCEPT 1 { "Accept-Contact", "a" }, /* RFC3841 */ #define POS_ACCEPT_CONTACT 2 { "Accept-Encoding", NULL }, /* */ #define POS_ACCEPT_ENCODING 3 { "Accept-Language", NULL }, /* */ #define POS_ACCEPT_LANGUAGE 4 { "Accept-Resource-Priority", NULL }, /* RFC4412 */ #define POS_ACCEPT_RESOURCE_PRIORITY 5 { "Additional-Identity", NULL }, /* 3GPP TS 24.229 v16.7.0 */ #define POS_ADDITIONAL_IDENTITY 6 { "Alert-Info", NULL }, #define POS_ALERT_INFO 7 { "Allow", NULL }, #define POS_ALLOW 8 { "Allow-Events", "u" }, /* RFC3265 */ #define POS_ALLOW_EVENTS 9 { "Answer-Mode", NULL }, /* RFC5373 */ #define POS_ANSWER_MODE 10 { "Attestation-Info", NULL }, /* [3GPP TS 24.229 v15.11.0] */ #define POS_ATTESTATION_INFO 11 { "Authentication-Info", NULL }, #define POS_AUTHENTICATION_INFO 12 { "Authorization", NULL }, /* */ #define POS_AUTHORIZATION 13 { "Call-ID", "i" }, #define POS_CALL_ID 14 { "Call-Info", NULL }, #define POS_CALL_INFO 15 { "Cellular-Network-Info", NULL }, /* [3GPP TS 24.229 v13.9.0] */ #define POS_CELLULAR_NETWORK_INFO 16 { "Contact", "m" }, #define POS_CONTACT 17 { "Content-Disposition", NULL }, #define POS_CONTENT_DISPOSITION 18 { "Content-Encoding", "e" }, /* */ #define POS_CONTENT_ENCODING 19 { "Content-Language", NULL }, #define POS_CONTENT_LANGUAGE 20 { "Content-Length", "l" }, #define POS_CONTENT_LENGTH 21 { "Content-Type", "c" }, #define POS_CONTENT_TYPE 22 { "CSeq", NULL }, #define POS_CSEQ 23 { "Date", NULL }, /* */ #define POS_DATE 24 /* Encryption (Deprecated) [RFC3261] */ { "Error-Info", NULL }, /* */ #define POS_ERROR_INFO 25 { "Event", "o" }, /* */ #define POS_EVENT 26 { "Expires", NULL }, /* */ #define POS_EXPIRES 27 { "Feature-Caps", NULL }, /* RFC6809 */ #define POS_FEATURE_CAPS 28 { "Flow-Timer", NULL }, /* RFC5626 */ #define POS_FLOW_TIMER 29 { "From", "f" }, /* */ #define POS_FROM 30 { "Geolocation", NULL }, /* */ #define POS_GEOLOCATION 31 { "Geolocation-Error", NULL }, /* */ #define POS_GEOLOCATION_ERROR 32 { "Geolocation-Routing", NULL }, /* */ #define POS_GEOLOCATION_ROUTING 33 /* Hide RFC3261 (deprecated)*/ { "History-Info", NULL }, /* RFC4244 */ #define POS_HISTORY_INFO 34 { "Identity", "y" }, /* RFC4474 */ #define POS_IDENTITY 35 { "Identity-Info", "n" }, /* RFC4474 */ #define POS_IDENTITY_INFO 36 { "Info-Package", NULL }, /* RFC-ietf-sipcore-info-events-10.txt */ #define POS_INFO_PKG 37 { "In-Reply-To", NULL }, /* RFC3261 */ #define POS_IN_REPLY_TO 38 { "Join", NULL }, /* RFC3911 */ #define POS_JOIN 39 { "Max-Breadth", NULL }, /* RFC5393*/ #define POS_MAX_BREADTH 40 { "Max-Forwards", NULL }, /* */ #define POS_MAX_FORWARDS 41 { "MIME-Version", NULL }, /* */ #define POS_MIME_VERSION 42 { "Min-Expires", NULL }, /* */ #define POS_MIN_EXPIRES 43 { "Min-SE", NULL }, /* RFC4028 */ #define POS_MIN_SE 44 { "Organization", NULL }, /* RFC3261 */ #define POS_ORGANIZATION 45 { "Origination-Id", NULL }, /* [3GPP TS 24.229 v15.11.0] */ #define POS_ORIGINATION_ID 46 { "P-Access-Network-Info", NULL }, /* RFC3455 */ #define POS_P_ACCESS_NETWORK_INFO 47 { "P-Answer-State", NULL }, /* RFC4964 */ #define POS_P_ANSWER_STATE 48 { "P-Asserted-Identity", NULL }, /* RFC3325 */ #define POS_P_ASSERTED_IDENTITY 49 { "P-Asserted-Service", NULL }, /* RFC6050 */ #define POS_P_ASSERTED_SERV 50 { "P-Associated-URI", NULL }, /* RFC3455 */ #define POS_P_ASSOCIATED_URI 51 { "P-Called-Party-ID", NULL }, /* RFC3455 */ #define POS_P_CALLED_PARTY_ID 52 { "P-Charge-Info", NULL }, /* RFC8496 */ #define POS_P_CHARGE_INFO 53 { "P-Charging-Function-Addresses", NULL }, /* RFC3455 */ #define POS_P_CHARGING_FUNC_ADDRESSES 54 { "P-Charging-Vector", NULL }, /* RFC3455 */ #define POS_P_CHARGING_VECTOR 55 { "P-DCS-Trace-Party-ID", NULL }, /* RFC5503 */ #define POS_P_DCS_TRACE_PARTY_ID 56 { "P-DCS-OSPS", NULL }, /* RFC5503 */ #define POS_P_DCS_OSPS 57 { "P-DCS-Billing-Info", NULL }, /* RFC5503 */ #define POS_P_DCS_BILLING_INFO 58 { "P-DCS-LAES", NULL }, /* RFC5503 */ #define POS_P_DCS_LAES 59 { "P-DCS-Redirect", NULL }, /* RFC5503 */ #define POS_P_DCS_REDIRECT 60 { "P-Early-Media", NULL }, /* RFC5009 */ #define POS_P_EARLY_MEDIA 61 { "P-Media-Authorization", NULL }, /* RFC3313 */ #define POS_P_MEDIA_AUTHORIZATION 62 { "P-Preferred-Identity", NULL }, /* RFC3325 */ #define POS_P_PREFERRED_IDENTITY 63 { "P-Preferred-Service", NULL }, /* RFC6050 */ #define POS_P_PREFERRED_SERV 64 { "P-Profile-Key", NULL }, /* RFC5002 */ #define POS_P_PROFILE_KEY 65 { "P-Refused-URI-List", NULL }, /* RFC5318 */ #define POS_P_REFUSED_URI_LST 66 { "P-Served-User", NULL }, /* RFC5502 */ #define POS_P_SERVED_USER 67 { "P-User-Database", NULL }, /* RFC4457 */ #define POS_P_USER_DATABASE 68 { "P-Visited-Network-ID", NULL }, /* RFC3455 */ #define POS_P_VISITED_NETWORK_ID 69 { "Path", NULL }, /* RFC3327 */ #define POS_PATH 70 { "Permission-Missing", NULL }, /* RFC5360 */ #define POS_PERMISSION_MISSING 71 { "Policy-Contact", NULL }, /* RFC3261 */ #define POS_POLICY_CONTACT 72 { "Policy-ID", NULL }, /* RFC3261 */ #define POS_POLICY_ID 73 { "Priority", NULL }, /* RFC3261 */ #define POS_PRIORITY 74 { "Priority-Share", NULL }, /* [3GPP TS 24.229 v13.16.0] */ #define POS_PRIORITY_SHARE 75 { "Priv-Answer-Mode", NULL }, /* RFC5373 */ #define POS_PRIV_ANSWER_MODE 76 { "Privacy", NULL }, /* RFC3323 */ #define POS_PRIVACY 77 { "Proxy-Authenticate", NULL }, /* */ #define POS_PROXY_AUTHENTICATE 78 { "Proxy-Authorization", NULL }, /* */ #define POS_PROXY_AUTHORIZATION 79 { "Proxy-Require", NULL }, /* */ #define POS_PROXY_REQUIRE 80 { "RAck", NULL }, /* RFC3262 */ #define POS_RACK 81 { "Reason", NULL }, /* RFC3326 */ #define POS_REASON 82 { "Reason-Phrase", NULL }, /* RFC3326 */ #define POS_REASON_PHRASE 83 { "Record-Route", NULL }, /* */ #define POS_RECORD_ROUTE 84 { "Recv-Info", NULL }, /* RFC6086 */ #define POS_RECV_INFO 85 { "Refer-Sub", NULL }, /* RFC4488 */ #define POS_REFER_SUB 86 { "Refer-To", "r" }, /* RFC3515 */ #define POS_REFER_TO 87 { "Referred-By", "b" }, /* RFC3892 */ #define POS_REFERRED_BY 88 { "Reject-Contact", "j" }, /* RFC3841 */ #define POS_REJECT_CONTACT 89 { "Relayed-Charge", NULL }, /* [3GPP TS 24.229 v12.14.0] */ #define POS_RELAYED_CHARGE 90 { "Replaces", NULL }, /* RFC3891 */ #define POS_REPLACES 91 { "Reply-To", NULL }, /* RFC3261 */ #define POS_REPLY_TO 92 { "Request-Disposition", "d" }, /* RFC3841 */ #define POS_REQUEST_DISPOSITION 93 { "Require", NULL }, /* RFC3261 */ #define POS_REQUIRE 94 { "Resource-Priority", NULL }, /* RFC4412 */ #define POS_RESOURCE_PRIORITY 95 { "Resource-Share", NULL }, /* [3GPP TS 24.229 v13.7.0] */ #define POS_RESOURCE_SHARE 96 /*{ "Response-Key (Deprecated) [RFC3261]*/ { "Response-Source", NULL }, /* [3GPP TS 24.229 v15.11.0] */ #define POS_RESPONSE_SOURCE 97 { "Restoration-Info", NULL }, /* [3GPP TS 24.229 v12.14.0] */ #define POS_RESTORATION_INFO 98 { "Retry-After", NULL }, /* RFC3261 */ #define POS_RETRY_AFTER 99 { "Route", NULL }, /* RFC3261 */ #define POS_ROUTE 100 { "RSeq", NULL }, /* RFC3262 */ #define POS_RSEQ 101 { "Security-Client", NULL }, /* RFC3329 */ #define POS_SECURITY_CLIENT 102 { "Security-Server", NULL }, /* RFC3329 */ #define POS_SECURITY_SERVER 103 { "Security-Verify", NULL }, /* RFC3329 */ #define POS_SECURITY_VERIFY 104 { "Server", NULL }, /* RFC3261 */ #define POS_SERVER 105 { "Service-Interact-Info", NULL }, /* [3GPP TS 24.229 v13.18.0] */ #define POS_SERVICE_INTERACT_INFO 106 { "Service-Route", NULL }, /* RFC3608 */ #define POS_SERVICE_ROUTE 107 { "Session-Expires", "x" }, /* RFC4028 */ #define POS_SESSION_EXPIRES 108 { "Session-ID", NULL }, /* RFC7329 */ #define POS_SESSION_ID 109 { "SIP-ETag", NULL }, /* RFC3903 */ #define POS_SIP_ETAG 110 { "SIP-If-Match", NULL }, /* RFC3903 */ #define POS_SIP_IF_MATCH 111 { "Subject", "s" }, /* RFC3261 */ #define POS_SUBJECT 112 { "Subscription-State", NULL }, /* RFC3265 */ #define POS_SUBSCRIPTION_STATE 113 { "Supported", "k" }, /* RFC3261 */ #define POS_SUPPORTED 114 { "Suppress-If-Match", NULL }, /* RFC5839 */ #define POS_SUPPRESS_IF_MATCH 115 { "Target-Dialog", NULL }, /* RFC4538 */ #define POS_TARGET_DIALOG 116 { "Timestamp", NULL }, /* RFC3261 */ #define POS_TIMESTAMP 117 { "To", "t" }, /* RFC3261 */ #define POS_TO 118 { "Trigger-Consent", NULL }, /* RFC5360 */ #define POS_TRIGGER_CONSENT 119 { "Unsupported", NULL }, /* RFC3261 */ #define POS_UNSUPPORTED 120 { "User-Agent", NULL }, /* RFC3261 */ #define POS_USER_AGENT 121 { "Via", "v" }, /* RFC3261 */ #define POS_VIA 122 { "Warning", NULL }, /* RFC3261 */ #define POS_WARNING 123 { "WWW-Authenticate", NULL }, /* RFC3261 */ #define POS_WWW_AUTHENTICATE 124 { "Diversion", NULL }, /* RFC5806 */ #define POS_DIVERSION 125 { "User-to-User", NULL }, /* RFC7433 */ #define POS_USER_TO_USER 126 }; static int hf_header_array[array_length(sip_headers)]; /* Track associations between parameter name and hf item */ typedef struct { const char *param_name; const int *hf_item; } header_parameter_t; static header_parameter_t auth_parameters_hf_array[] = { {"response", &hf_sip_auth_digest_response}, {"nc", &hf_sip_auth_nc}, {"username", &hf_sip_auth_username}, {"realm", &hf_sip_auth_realm}, {"nonce", &hf_sip_auth_nonce}, {"algorithm", &hf_sip_auth_algorithm}, {"opaque", &hf_sip_auth_opaque}, {"qop", &hf_sip_auth_qop}, {"cnonce", &hf_sip_auth_cnonce}, {"uri", &hf_sip_auth_uri}, {"domain", &hf_sip_auth_domain}, {"stale", &hf_sip_auth_stale}, {"auts", &hf_sip_auth_auts}, {"rspauth", &hf_sip_auth_rspauth}, {"nextnonce", &hf_sip_auth_nextnonce}, {"ik", &hf_sip_auth_ik}, {"ck", &hf_sip_auth_ck} }; static header_parameter_t via_parameters_hf_array[] = { {"branch", &hf_sip_via_branch}, {"maddr", &hf_sip_via_maddr}, {"rport", &hf_sip_via_rport}, {"received", &hf_sip_via_received}, {"ttl", &hf_sip_via_ttl}, {"comp", &hf_sip_via_comp}, {"sigcomp-id", &hf_sip_via_sigcomp_id}, {"oc", &hf_sip_via_oc}, {"oc-validity", &hf_sip_via_oc_validity }, {"oc-seq", &hf_sip_via_oc_seq}, {"oc-algo", &hf_sip_via_oc_algo}, {"be-route", &hf_sip_via_be_route} }; typedef enum { MECH_PARA_STRING = 0, MECH_PARA_UINT = 1, } mech_parameter_type_t; /* Track associations between parameter name and hf item for security mechanism*/ typedef struct { const char *param_name; const int para_type; const int *hf_item; } mech_parameter_t; static mech_parameter_t sec_mechanism_parameters_hf_array[] = { {"alg", MECH_PARA_STRING, &hf_sip_sec_mechanism_alg}, {"ealg", MECH_PARA_STRING, &hf_sip_sec_mechanism_ealg}, {"prot", MECH_PARA_STRING, &hf_sip_sec_mechanism_prot}, {"spi-c", MECH_PARA_UINT, &hf_sip_sec_mechanism_spi_c}, {"spi-s", MECH_PARA_UINT, &hf_sip_sec_mechanism_spi_s}, {"port1", MECH_PARA_UINT, &hf_sip_sec_mechanism_port1}, {"port-c", MECH_PARA_UINT, &hf_sip_sec_mechanism_port_c}, {"port2", MECH_PARA_UINT, &hf_sip_sec_mechanism_port2}, {"port-s", MECH_PARA_UINT, &hf_sip_sec_mechanism_port_s}, {NULL, 0, 0} }; typedef struct { int *hf_sip_display; int *hf_sip_addr; int *hf_sip_user; int *hf_sip_host; int *hf_sip_port; int *hf_sip_param; int *ett_uri; } hf_sip_uri_t; static hf_sip_uri_t sip_pai_uri = { &hf_sip_pai_display, &hf_sip_pai_addr, &hf_sip_pai_user, &hf_sip_pai_host, &hf_sip_pai_port, &hf_sip_pai_param, &ett_sip_pai_uri }; static hf_sip_uri_t sip_ppi_uri = { &hf_sip_ppi_display, &hf_sip_ppi_addr, &hf_sip_ppi_user, &hf_sip_ppi_host, &hf_sip_ppi_port, &hf_sip_ppi_param, &ett_sip_ppi_uri }; static hf_sip_uri_t sip_pmiss_uri = { &hf_sip_pmiss_display, &hf_sip_pmiss_addr, &hf_sip_pmiss_user, &hf_sip_pmiss_host, &hf_sip_pmiss_port, &hf_sip_pmiss_param, &ett_sip_pmiss_uri }; static hf_sip_uri_t sip_tc_uri = { &hf_sip_tc_display, &hf_sip_tc_addr, &hf_sip_tc_user, &hf_sip_tc_host, &hf_sip_tc_port, &hf_sip_tc_param, &ett_sip_tc_uri }; static hf_sip_uri_t sip_to_uri = { &hf_sip_to_display, &hf_sip_to_addr, &hf_sip_to_user, &hf_sip_to_host, &hf_sip_to_port, &hf_sip_to_param, &ett_sip_to_uri }; static hf_sip_uri_t sip_from_uri = { &hf_sip_from_display, &hf_sip_from_addr, &hf_sip_from_user, &hf_sip_from_host, &hf_sip_from_port, &hf_sip_from_param, &ett_sip_from_uri }; static hf_sip_uri_t sip_req_uri = { &hf_sip_ruri_display, &hf_sip_ruri, &hf_sip_ruri_user, &hf_sip_ruri_host, &hf_sip_ruri_port, &hf_sip_ruri_param, &ett_sip_ruri }; static hf_sip_uri_t sip_contact_uri = { &hf_sip_curi_display, &hf_sip_curi, &hf_sip_curi_user, &hf_sip_curi_host, &hf_sip_curi_port, &hf_sip_curi_param, &ett_sip_curi }; static hf_sip_uri_t sip_route_uri = { &hf_sip_route_display, &hf_sip_route, &hf_sip_route_user, &hf_sip_route_host, &hf_sip_route_port, &hf_sip_route_param, &ett_sip_route }; static hf_sip_uri_t sip_record_route_uri = { &hf_sip_record_route_display, &hf_sip_record_route, &hf_sip_record_route_user, &hf_sip_record_route_host, &hf_sip_record_route_port, &hf_sip_record_route_param, &ett_sip_record_route }; static hf_sip_uri_t sip_service_route_uri = { &hf_sip_service_route_display, &hf_sip_service_route, &hf_sip_service_route_user, &hf_sip_service_route_host, &hf_sip_service_route_port, &hf_sip_service_route_param, &ett_sip_service_route }; static hf_sip_uri_t sip_path_uri = { &hf_sip_path_display, &hf_sip_path, &hf_sip_path_user, &hf_sip_path_host, &hf_sip_path_port, &hf_sip_path_param, &ett_sip_path }; /* * Type of line. It's either a SIP Request-Line, a SIP Status-Line, or * another type of line. */ typedef enum { REQUEST_LINE, STATUS_LINE, OTHER_LINE } line_type_t; /* Preferences */ static unsigned sip_tls_port = TLS_PORT_SIP; /* global_sip_raw_text determines whether we are going to display */ /* the raw text of the SIP message, much like the MEGACO dissector does. */ static bool global_sip_raw_text; /* global_sip_raw_text_without_crlf determines whether we are going to display */ /* the raw text of the SIP message with or without the '\r\n'. */ static bool global_sip_raw_text_without_crlf; /* global_sip_raw_text_body_default_encoding determines what charset we are going to display the body */ static int global_sip_raw_text_body_default_encoding = IANA_CS_UTF_8; /* strict_sip_version determines whether the SIP dissector enforces * the SIP version to be "SIP/2.0". */ static bool strict_sip_version = true; /* * desegmentation of SIP headers * (when we are over TCP or another protocol providing the desegmentation API) */ static bool sip_desegment_headers = true; /* * desegmentation of SIP bodies * (when we are over TCP or another protocol providing the desegmentation API) */ static bool sip_desegment_body = true; /* * same source port for retransmissions */ static bool sip_retrans_the_same_sport = true; /* whether we hold off tracking RTP conversations until an SDP answer is received */ static bool sip_delay_sdp_changes; /* Hide the generated Call IDs or not */ static bool sip_hide_generatd_call_ids; /* Extension header subdissectors */ static dissector_table_t ext_hdr_subdissector_table; /* Custom SIP headers */ typedef struct _header_field_t { char* header_name; char* header_desc; } header_field_t; static header_field_t* sip_custom_header_fields; static unsigned sip_custom_num_header_fields; static GHashTable *sip_custom_header_fields_hash; static hf_register_info *dynamic_hf; static unsigned dynamic_hf_size; static bool header_fields_update_cb(void *r, char **err) { header_field_t *rec = (header_field_t *)r; char c; if (rec->header_name == NULL) { *err = g_strdup("Header name can't be empty"); return false; } g_strstrip(rec->header_name); if (rec->header_name[0] == 0) { *err = g_strdup("Header name can't be empty"); return false; } /* Check for invalid characters (to avoid asserting out when * registering the field). */ c = proto_check_field_name(rec->header_name); if (c) { *err = ws_strdup_printf("Header name can't contain '%c'", c); return false; } *err = NULL; return true; } static void * header_fields_copy_cb(void* n, const void* o, size_t siz _U_) { header_field_t* new_rec = (header_field_t*)n; const header_field_t* old_rec = (const header_field_t*)o; new_rec->header_name = g_strdup(old_rec->header_name); new_rec->header_desc = g_strdup(old_rec->header_desc); return new_rec; } static void header_fields_free_cb(void*r) { header_field_t* rec = (header_field_t*)r; g_free(rec->header_name); g_free(rec->header_desc); } static void deregister_header_fields(void) { if (dynamic_hf) { /* Deregister all fields */ for (unsigned i = 0; i < dynamic_hf_size; i++) { proto_deregister_field(proto_sip, *(dynamic_hf[i].p_id)); g_free(dynamic_hf[i].p_id); } proto_add_deregistered_data(dynamic_hf); dynamic_hf = NULL; dynamic_hf_size = 0; } if (sip_custom_header_fields_hash) { g_hash_table_destroy(sip_custom_header_fields_hash); sip_custom_header_fields_hash = NULL; } } static void header_fields_post_update_cb(void) { int* hf_id; char* header_name; char* header_name_key; deregister_header_fields(); if (sip_custom_num_header_fields) { sip_custom_header_fields_hash = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL); dynamic_hf = g_new0(hf_register_info, sip_custom_num_header_fields); dynamic_hf_size = sip_custom_num_header_fields; for (unsigned i = 0; i < dynamic_hf_size; i++) { hf_id = g_new(int, 1); *hf_id = -1; header_name = g_strdup(sip_custom_header_fields[i].header_name); header_name_key = g_ascii_strdown(header_name, -1); dynamic_hf[i].p_id = hf_id; dynamic_hf[i].hfinfo.name = header_name; dynamic_hf[i].hfinfo.abbrev = ws_strdup_printf("sip.%s", header_name); dynamic_hf[i].hfinfo.type = FT_STRING; dynamic_hf[i].hfinfo.display = BASE_NONE; dynamic_hf[i].hfinfo.strings = NULL; dynamic_hf[i].hfinfo.bitmask = 0; dynamic_hf[i].hfinfo.blurb = g_strdup(sip_custom_header_fields[i].header_desc); HFILL_INIT(dynamic_hf[i]); g_hash_table_insert(sip_custom_header_fields_hash, header_name_key, hf_id); } proto_register_field_array(proto_sip, dynamic_hf, dynamic_hf_size); } } static void header_fields_reset_cb(void) { deregister_header_fields(); } UAT_CSTRING_CB_DEF(sip_custom_header_fields, header_name, header_field_t) UAT_CSTRING_CB_DEF(sip_custom_header_fields, header_desc, header_field_t) /* SIP authorization parameters */ static bool global_sip_validate_authorization; typedef struct _authorization_user_t { char* username; char* realm; char* password; } authorization_user_t; static authorization_user_t* sip_authorization_users; static unsigned sip_authorization_num_users; static bool authorization_users_update_cb(void *r, char **err) { authorization_user_t *rec = (authorization_user_t *)r; char c; if (rec->username == NULL) { *err = g_strdup("Username can't be empty"); return false; } g_strstrip(rec->username); if (rec->username[0] == 0) { *err = g_strdup("Username can't be empty"); return false; } /* Check for invalid characters (to avoid asserting out when * registering the field). */ c = proto_check_field_name(rec->username); if (c) { *err = ws_strdup_printf("Username can't contain '%c'", c); return false; } *err = NULL; return true; } static void * authorization_users_copy_cb(void* n, const void* o, size_t siz _U_) { authorization_user_t* new_rec = (authorization_user_t*)n; const authorization_user_t* old_rec = (const authorization_user_t*)o; new_rec->username = g_strdup(old_rec->username); new_rec->realm = g_strdup(old_rec->realm); new_rec->password = g_strdup(old_rec->password); return new_rec; } static void authorization_users_free_cb(void*r) { authorization_user_t* rec = (authorization_user_t*)r; g_free(rec->username); g_free(rec->realm); g_free(rec->password); } UAT_CSTRING_CB_DEF(sip_authorization_users, username, authorization_user_t) UAT_CSTRING_CB_DEF(sip_authorization_users, realm, authorization_user_t) UAT_CSTRING_CB_DEF(sip_authorization_users, password, authorization_user_t) /* Forward declaration we need below */ void proto_reg_handoff_sip(void); static int dissect_sip_common(tvbuff_t *tvb, int offset, int remaining_length, packet_info *pinfo, proto_tree *tree, bool is_heur, bool use_reassembly); static line_type_t sip_parse_line(tvbuff_t *tvb, int offset, int linelen, unsigned *token_1_len); static bool sip_is_known_request(tvbuff_t *tvb, int meth_offset, unsigned meth_len, unsigned *meth_idx); static int sip_is_known_sip_header(char *header_name, unsigned header_len); static void dfilter_sip_request_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int offset, unsigned meth_len, int linelen); static void dfilter_sip_status_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int line_end, int offset); static void tvb_raw_text_add(tvbuff_t *tvb, int offset, int length, int body_offset, packet_info* pinfo, proto_tree *tree); static unsigned sip_is_packet_resend(packet_info *pinfo, const char *cseq_method, char* call_id, unsigned char cseq_number_set, uint32_t cseq_number, line_type_t line_type); static unsigned sip_find_request(packet_info *pinfo, const char *cseq_method, char* call_id, unsigned char cseq_number_set, uint32_t cseq_number, uint32_t *response_time); static unsigned sip_find_invite(packet_info *pinfo, const char *cseq_method, char* call_id, unsigned char cseq_number_set, uint32_t cseq_number, uint32_t *response_time); typedef struct { char * username; char * realm; char * uri; char * nonce; char * cnonce; char * nonce_count; char * response; char * qop; char * algorithm; char * method; } sip_authorization_t; static authorization_user_t * sip_get_authorization(sip_authorization_t *authorization_info); static bool sip_validate_authorization(sip_authorization_t *authorization_info, char *password); static authorization_user_t * sip_get_authorization(sip_authorization_t *authorization_info) { unsigned i; for (i = 0; i < sip_authorization_num_users; i++) { if ((!strcmp(sip_authorization_users[i].username, authorization_info->username)) && (!strcmp(sip_authorization_users[i].realm, authorization_info->realm))) { return &sip_authorization_users[i]; } } return NULL; } /* SIP content type and internet media type used by other dissectors * are the same. List of media types from IANA at: * http://www.iana.org/assignments/media-types/index.html */ static dissector_table_t media_type_dissector_table; static heur_dissector_list_t heur_subdissector_list; #define SIP2_HDR "SIP/2.0" #define SIP2_HDR_LEN 7 /* Store the info needed by the SIP tap for one packet */ static sip_info_value_t *stat_info; /* The buffer size for the cseq_method name */ #define MAX_CSEQ_METHOD_SIZE 16 /**************************************************************************** * Conversation-type definitions * * For each call, keep track of the current cseq number and state of * transaction, in order to be able to detect retransmissions. * * Don't use the conversation mechanism, but instead: * - store with each dissected packet original frame (if any) * - maintain a global hash table of * (call_id, source_addr, dest_addr) -> (cseq, transaction_state, frame) * * N.B. This is broken for a couple of reasons: * - it won't cope properly with overlapping transactions within the * same dialog * - request response mapping won't work where the response uses a different * address pair from the request * * TODO: proper transaction matching uses RFC fields (use Max-forwards or * maybe Via count as extra key to limit view to one hop) ****************************************************************************/ static GHashTable *sip_hash; /* Hash table */ static GHashTable *sip_headers_hash; /* Hash table */ /* Types for hash table keys and values */ #define MAX_CALL_ID_SIZE 128 #define MAGIC_SOURCE_PORT 0 /* Conversation-type key */ typedef struct { char call_id[MAX_CALL_ID_SIZE]; address source_address; uint32_t source_port; address dest_address; uint32_t dest_port; port_type ptype; } sip_hash_key; typedef enum { nothing_seen, request_seen, provisional_response_seen, final_response_seen } transaction_state_t; /* Current conversation-type value */ typedef struct { uint32_t cseq; transaction_state_t transaction_state; const char *method; nstime_t request_time; uint32_t response_code; int frame_number; } sip_hash_value; /* Result to be stored in per-packet info */ typedef struct { int original_frame_num; int response_request_frame_num; int response_time; } sip_frame_result_value; /************************/ /* Hash table functions */ /* Equal keys */ static int sip_equal(const void *v, const void *v2) { const sip_hash_key* val1 = (const sip_hash_key*)v; const sip_hash_key* val2 = (const sip_hash_key*)v2; /* Call id must match */ if (strcmp(val1->call_id, val2->call_id) != 0) { return 0; } /* Addresses must match */ return (addresses_equal(&(val1->source_address), &(val2->source_address))) && (val1->source_port == val2->source_port) && (addresses_equal(&(val1->dest_address), &(val2->dest_address))) && (val1->dest_port == val2->dest_port) && (val1->ptype == val2->ptype); } /* Initializes the hash table each time a new * file is loaded or re-loaded in wireshark */ static void sip_init_protocol(void) { unsigned i; char *value_copy; sip_hash = g_hash_table_new(g_str_hash , sip_equal); /* Hash table for quick lookup of SIP headers names to hf entry (POS_x) */ sip_headers_hash = g_hash_table_new(g_str_hash , g_str_equal); for (i = 1; i < array_length(sip_headers); i++){ value_copy = wmem_strdup(wmem_file_scope(), sip_headers[i].name); ascii_strdown_inplace(value_copy); g_hash_table_insert(sip_headers_hash, (void *)value_copy, GINT_TO_POINTER(i)); } } static void sip_cleanup_protocol(void) { g_hash_table_destroy(sip_hash); g_hash_table_destroy(sip_headers_hash); } /* Call the export PDU tap with relevant data */ static void export_sip_pdu(packet_info *pinfo, tvbuff_t *tvb) { exp_pdu_data_t *exp_pdu_data = export_pdu_create_common_tags(pinfo, "sip", EXP_PDU_TAG_DISSECTOR_NAME); exp_pdu_data->tvb_captured_length = tvb_captured_length(tvb); exp_pdu_data->tvb_reported_length = tvb_reported_length(tvb); exp_pdu_data->pdu_tvb = tvb; tap_queue_packet(exported_pdu_tap, pinfo, exp_pdu_data); } typedef enum { SIP_URI_TYPE_ABSOLUTE_URI, SIP_URI_TYPE_SIP, SIP_URI_TYPE_TEL } sip_uri_type_enum_t; /* Structure to collect info about a sip uri */ typedef struct _uri_offset_info { sip_uri_type_enum_t uri_type; int display_name_start; int display_name_end; int uri_start; int uri_end; int uri_parameters_start; int uri_parameters_end; int name_addr_start; int name_addr_end; int uri_user_start; int uri_user_end; int uri_host_start; int uri_host_end; int uri_host_port_start; int uri_host_port_end; } uri_offset_info; static void sip_uri_offset_init(uri_offset_info *uri_offsets){ /* Initialize the uri_offsets */ uri_offsets->uri_type = SIP_URI_TYPE_ABSOLUTE_URI; uri_offsets->display_name_start = -1; uri_offsets->display_name_end = -1; uri_offsets->uri_start = -1; uri_offsets->uri_end = -1; uri_offsets->uri_parameters_start = -1; uri_offsets->uri_parameters_end = -1; uri_offsets->name_addr_start = -1; uri_offsets->name_addr_end = -1; uri_offsets->uri_user_start = -1; uri_offsets->uri_user_end = -1; uri_offsets->uri_host_start = -1; uri_offsets->uri_host_end = -1; uri_offsets->uri_host_port_start = -1; uri_offsets->uri_host_port_end = -1; } /* Code to parse a sip uri. * Returns Offset end off parsing or -1 for unsuccessful parsing * - sip_uri_offset_init() must have been called first. */ static int dissect_sip_uri(tvbuff_t *tvb, packet_info *pinfo _U_, int start_offset, int line_end_offset, uri_offset_info *uri_offsets) { unsigned char c = '\0'; int current_offset; int queried_offset; int parameter_end_offset; bool in_ipv6 = false; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if(current_offset >= line_end_offset) { /* Nothing to parse */ return -1; } /* Set uri start offset in case this was called directly */ uri_offsets->uri_start = current_offset; /* Check if it's really a sip uri ( it might be a tel uri, parse that?) */ if (tvb_strneql(tvb, current_offset, "sip", 3) != 0){ if (uri_offsets->uri_end != -1) { /* We know where the URI ends, set the offsets*/ return uri_offsets->name_addr_end; } return -1; } uri_offsets->uri_type = SIP_URI_TYPE_SIP; if(uri_offsets->uri_end == -1) { /* name-addr form was NOT used e.g no closing ">" */ /* look for the first ',' or ';' which will mark the end of this URI * In this case a semicolon indicates a header field parameter, and not an uri parameter. */ int end_offset; end_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_comma_semi, NULL); if (end_offset != -1) { uri_offsets->uri_end = end_offset - 1; } else { /* We don't have a semicolon or a comma. * In that case, we assume that the end of the URI is at the line end */ uri_offsets->uri_end = line_end_offset - 3; /* remove '\r\n' */ } uri_offsets->name_addr_end = uri_offsets->uri_end; } /* Look for URI address parts (user, host, host-port) */ /* Look for '@' within URI */ queried_offset = tvb_find_uint8(tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start, '@'); if(queried_offset == -1) { /* no '@' = no user part */ uri_offsets->uri_host_start = tvb_find_uint8(tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start, ':')+1; } else { /* with '@' = with user part */ uri_offsets->uri_user_start = tvb_find_uint8(tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start, ':')+1; uri_offsets->uri_user_end = tvb_find_uint8(tvb, uri_offsets->uri_user_start, uri_offsets->uri_end - uri_offsets->uri_start, '@')-1; uri_offsets->uri_host_start = uri_offsets->uri_user_end + 2; } /* find URI-Host end*/ parameter_end_offset = uri_offsets->uri_host_start; in_ipv6 = (tvb_get_uint8(tvb, parameter_end_offset) == '['); while (parameter_end_offset < line_end_offset) { parameter_end_offset++; parameter_end_offset = tvb_ws_mempbrk_pattern_uint8(tvb, parameter_end_offset, line_end_offset - parameter_end_offset, &pbrk_param_end_colon_brackets, &c); if (parameter_end_offset == -1) { parameter_end_offset = line_end_offset; break; } /* after adding character to this switch() , update also pbrk_param_end_colon_brackets */ switch (c) { case '>': case ',': goto uri_host_end_found; case ';': uri_offsets->uri_parameters_start = parameter_end_offset + 1; goto uri_host_end_found; case '?': case ' ': case '\r': goto uri_host_end_found; case ':': if (!in_ipv6) goto uri_host_end_found; break; case '[': in_ipv6 = true; break; case ']': in_ipv6 = false; break; default : DISSECTOR_ASSERT_NOT_REACHED(); break; } } uri_host_end_found: uri_offsets->uri_host_end = parameter_end_offset - 1; if (c == ':') { uri_offsets->uri_host_port_start = parameter_end_offset + 1; parameter_end_offset = uri_offsets->uri_host_port_start; while (parameter_end_offset < line_end_offset) { parameter_end_offset++; parameter_end_offset = tvb_ws_mempbrk_pattern_uint8(tvb, parameter_end_offset, line_end_offset - parameter_end_offset, &pbrk_param_end, &c); if (parameter_end_offset == -1) { parameter_end_offset = line_end_offset; break; } /* after adding character to this switch(), update also pbrk_param_end */ switch (c) { case '>': case ',': goto uri_host_port_end_found; case ';': uri_offsets->uri_parameters_start = parameter_end_offset + 1; goto uri_host_port_end_found; case '?': case ' ': case '\r': goto uri_host_port_end_found; default : DISSECTOR_ASSERT_NOT_REACHED(); break; } } uri_host_port_end_found: uri_offsets->uri_host_port_end = parameter_end_offset -1; } return uri_offsets->name_addr_end; } void dfilter_store_sip_from_addr(tvbuff_t *tvb,proto_tree *tree,unsigned parameter_offset, unsigned parameter_len) { proto_item *pi; pi = proto_tree_add_item(tree, hf_sip_from_addr, tvb, parameter_offset, parameter_len, ENC_UTF_8); proto_item_set_generated(pi); } static proto_item * sip_proto_tree_add_uint(proto_tree *tree, int hfindex, tvbuff_t *tvb, int start, int length, int value_offset, int value_len) { const char *str; unsigned long val; /* don't fetch string when field is not referenced */ if (!proto_field_is_referenced(tree, hfindex)) return tree; str = tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, value_len, ENC_UTF_8|ENC_NA); val = strtoul(str, NULL, 10); return proto_tree_add_uint(tree, hfindex, tvb, start, length, (uint32_t) val); } static proto_item * sip_proto_tree_add_string(proto_tree *tree, int hfindex, tvbuff_t *tvb, int start, int length, int value_offset, int value_len) { const char *str; /* don't fetch string when field is not referenced */ if (!proto_field_is_referenced(tree, hfindex)) return tree; str = tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, value_len, ENC_UTF_8|ENC_NA); return proto_tree_add_string(tree, hfindex, tvb, start, length, str); } static void sip_proto_set_format_text(const proto_tree *tree, proto_item *item, tvbuff_t *tvb, int offset, int length) { if (tree != item && item && PTREE_DATA(item)->visible) proto_item_set_text(item, "%s", tvb_format_text(wmem_packet_scope(), tvb, offset, length)); } /* * XXXX If/when more parameters are added consider doing something similar to what's done in * packet-magaco.c for find_megaco_localParam_names() possibly adding the hf to the array and have a generic * dissection function here. */ static void dissect_sip_generic_parameters(tvbuff_t *tvb, proto_tree* tree, packet_info *pinfo _U_, int current_offset, int line_end_offset) { int semi_colon_offset, par_name_end_offset, equals_offset, length; /* Loop over the generic parameter(s)*/ while (current_offset < line_end_offset) { char *param_name = NULL; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); if (semi_colon_offset == -1) { semi_colon_offset = line_end_offset; } length = semi_colon_offset - current_offset; /* Parse parameter and value */ equals_offset = tvb_find_uint8(tvb, current_offset + 1, length, '='); if (equals_offset != -1) { /* Has value part */ par_name_end_offset = equals_offset; /* Extract the parameter name */ param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, par_name_end_offset - current_offset, ENC_UTF_8 | ENC_NA); /* Access-Info fields */ if ((param_name != NULL) && (g_ascii_strcasecmp(param_name, "service-priority") == 0)) { proto_tree_add_item(tree, hf_sip_service_priority, tvb, equals_offset + 1, semi_colon_offset - equals_offset - 1, ENC_UTF_8 | ENC_NA); } else { proto_tree_add_format_text(tree, tvb, current_offset, length); } } else { proto_tree_add_format_text(tree, tvb, current_offset, length); } current_offset = semi_colon_offset + 1; } } /* * History-Info = "History-Info" HCOLON * hi-entry *(COMMA hi-entry) * * hi-entry = hi-targeted-to-uri *( SEMI hi-param ) * hi-targeted-to-uri= name-addr * * * hi-param = hi-index / hi-extension * * hi-index = "index" EQUAL 1*DIGIT *(DOT 1*DIGIT) * * hi-extension = generic-param */ static int dissect_sip_history_info(tvbuff_t *tvb, proto_tree* tree, packet_info *pinfo _U_, int current_offset, int line_end_offset) { int comma_offset; bool first_time = true; /* split the line at the commas */ while (line_end_offset > current_offset){ comma_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ','); if(comma_offset == -1){ if(first_time == true){ /* It was only on parameter no need to split it up */ return line_end_offset; } /* Last parameter */ comma_offset = line_end_offset; } first_time = false; proto_tree_add_format_text(tree, tvb, current_offset, comma_offset-current_offset); current_offset = comma_offset+1; } return line_end_offset; } /* * The syntax for the P-Charging-Function-Addresses header is described * as follows: * * P-Charging-Addr = "P-Charging-Function-Addresses" HCOLON * charge-addr-params * *(SEMI charge-addr-params) * charge-addr-params = ccf / ecf / generic-param * ccf = "ccf" EQUAL gen-value * ecf = "ecf" EQUAL gen-value * generic-param = token [ EQUAL gen-value ] * gen-value = token / host / quoted-string * */ static int dissect_sip_p_charging_func_addresses(tvbuff_t *tvb, proto_tree* tree, packet_info *pinfo _U_, int current_offset, int line_end_offset) { int semi_offset, start_quote_offset, end_quote_offset; bool first_time = true; while (line_end_offset > current_offset){ /* Do we have a quoted string ? */ start_quote_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '"'); if(start_quote_offset>0){ /* Find end of quoted string */ end_quote_offset = tvb_find_uint8(tvb, start_quote_offset+1, line_end_offset - (start_quote_offset+1), '"'); /* Find parameter end */ if (end_quote_offset>0) semi_offset = tvb_find_uint8(tvb, end_quote_offset+1, line_end_offset - (end_quote_offset+1), ';'); else { /* XXX expert info about unterminated string */ semi_offset = tvb_find_uint8(tvb, start_quote_offset+1, line_end_offset - (start_quote_offset+1), ';'); } }else{ /* Find parameter end */ semi_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); } if(semi_offset == -1){ if(first_time == true){ /* It was only one parameter no need to split it up */ return line_end_offset; } /* Last parameter */ semi_offset = line_end_offset; } first_time = false; proto_tree_add_format_text(tree, tvb, current_offset, semi_offset-current_offset); current_offset = semi_offset+1; } return current_offset; } /* * token = 1*(alphanum / "-" / "." / "!" / "%" / "*" * / "_" / "+" / "`" / "'" / "~" ) * LWS = [*WSP CRLF] 1*WSP ; linear whitespace * name-addr = [ display-name ] LAQUOT addr-spec RAQUOT * addr-spec = SIP-URI / SIPS-URI / absoluteURI * display-name = *(token LWS)/ quoted-string * absoluteURI = scheme ":" ( hier-part / opaque-part ) */ static int dissect_sip_name_addr_or_addr_spec(tvbuff_t *tvb, packet_info *pinfo _U_, int start_offset, int line_end_offset, uri_offset_info *uri_offsets) { char c; int i; int current_offset; int queried_offset; int colon_offset; bool uri_without_angle_quotes = false; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if(current_offset >= line_end_offset) { /* Nothing to parse */ return -1; } uri_offsets->name_addr_start = current_offset; /* First look, if we have a display name */ c=tvb_get_uint8(tvb, current_offset); switch(c) { case '"': /* We have a display name, look for the next unescaped '"' */ uri_offsets->display_name_start = current_offset; do { queried_offset = tvb_find_uint8(tvb, current_offset + 1, line_end_offset - (current_offset + 1), '"'); if(queried_offset == -1) { /* malformed URI */ return -1; } current_offset = queried_offset; /* Is it escaped? */ /* count back slashes before '"' */ for(i=1;tvb_get_uint8(tvb, queried_offset - i) == '\\';i++); i--; if(i % 2 == 0) { /* not escaped */ break; } } while (current_offset < line_end_offset); if(current_offset >= line_end_offset) { /* malformed URI */ return -1; } uri_offsets->display_name_end = current_offset; /* find start of the URI */ queried_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '<'); if(queried_offset == -1) { /* malformed Uri */ return -1; } current_offset = queried_offset + 1; break; case '<': /* We don't have a display name */ current_offset++; break; default: /* We have either an URI without angles or a display name with a limited character set */ /* Look for the right angle quote or colon */ queried_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '<'); colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ':'); if(queried_offset != -1 && colon_offset != -1) { if(queried_offset < colon_offset) { /* we have an URI with angle quotes */ uri_offsets->display_name_start = current_offset; uri_offsets->display_name_end = queried_offset - 1; current_offset = queried_offset + 1; } else { /* we have an URI without angle quotes */ uri_without_angle_quotes = true; } } else { if(queried_offset != -1) { /* we have an URI with angle quotes */ uri_offsets->display_name_start = current_offset; uri_offsets->display_name_end = queried_offset - 1; current_offset = queried_offset + 1; break; } if(colon_offset != -1) { /* we have an URI without angle quotes */ uri_without_angle_quotes = true; break; } /* If this point is reached, we can't parse the URI */ return -1; } break; } /* Start of URI */ uri_offsets->uri_start = current_offset; if(uri_without_angle_quotes==false){ /* name-addr form was used */ /* look for closing angle quote */ queried_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '>'); if(queried_offset == -1) { /* malformed Uri */ return -1; } uri_offsets->name_addr_end = queried_offset; uri_offsets->uri_end = queried_offset - 1; } return dissect_sip_uri(tvb, pinfo, current_offset, line_end_offset, uri_offsets); } /* * Code to add dissected SIP URI Information to proto tree */ static proto_tree * display_sip_uri (tvbuff_t *tvb, proto_tree *sip_element_tree, packet_info *pinfo, uri_offset_info* uri_offsets, hf_sip_uri_t* uri) { proto_item *ti; proto_tree *uri_item_tree = NULL; tvbuff_t *next_tvb; if(uri_offsets->display_name_end != uri_offsets->display_name_start) { proto_tree_add_item(sip_element_tree, *(uri->hf_sip_display), tvb, uri_offsets->display_name_start, uri_offsets->display_name_end - uri_offsets->display_name_start + 1, ENC_UTF_8|ENC_NA); ti = proto_tree_add_item(sip_element_tree, hf_sip_display, tvb, uri_offsets->display_name_start, uri_offsets->display_name_end - uri_offsets->display_name_start + 1, ENC_UTF_8); proto_item_set_hidden(ti); } ti = proto_tree_add_item(sip_element_tree, *(uri->hf_sip_addr), tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start + 1, ENC_UTF_8|ENC_NA); uri_item_tree = proto_item_add_subtree(ti, *(uri->ett_uri)); if (uri_offsets->uri_type != SIP_URI_TYPE_SIP) { return ti; } if(uri_offsets->uri_user_end > uri_offsets->uri_user_start) { proto_tree_add_item(uri_item_tree, *(uri->hf_sip_user), tvb, uri_offsets->uri_user_start, uri_offsets->uri_user_end - uri_offsets->uri_user_start + 1, ENC_UTF_8|ENC_NA); if (tvb_get_uint8(tvb, uri_offsets->uri_user_start) == '+') { dissect_e164_msisdn(tvb, uri_item_tree, uri_offsets->uri_user_start + 1, uri_offsets->uri_user_end - uri_offsets->uri_user_start, E164_ENC_UTF8); } /* If we have a SIP diagnostics sub dissector call it */ if (sip_uri_userinfo_handle) { next_tvb = tvb_new_subset_length(tvb, uri_offsets->uri_user_start, uri_offsets->uri_user_end - uri_offsets->uri_user_start + 1); call_dissector(sip_uri_userinfo_handle, next_tvb, pinfo, uri_item_tree); } } proto_tree_add_item(uri_item_tree, *(uri->hf_sip_host), tvb, uri_offsets->uri_host_start, uri_offsets->uri_host_end - uri_offsets->uri_host_start + 1, ENC_UTF_8|ENC_NA); if(uri_offsets->uri_host_port_end > uri_offsets->uri_host_port_start) { proto_tree_add_item(uri_item_tree, *(uri->hf_sip_port), tvb, uri_offsets->uri_host_port_start, uri_offsets->uri_host_port_end - uri_offsets->uri_host_port_start + 1, ENC_UTF_8|ENC_NA); } if (uri_offsets->uri_parameters_start != -1) { /* Move current offset to the start of the first param */ int current_offset = uri_offsets->uri_parameters_start; int uri_params_start_offset = current_offset; int queried_offset; int uri_param_end_offset = -1; char c; /* Put the contact parameters in the tree */ while (current_offset < uri_offsets->name_addr_end) { queried_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, uri_offsets->name_addr_end - current_offset, &pbrk_comma_semi, &c); if (queried_offset == -1) { /* Reached line end */ /* Check if the line ends with a ">", if so decrement end offset. */ c = tvb_get_uint8(tvb, uri_offsets->name_addr_end); if (c == '>') { uri_param_end_offset = uri_offsets->name_addr_end - 1; } else { uri_param_end_offset = uri_offsets->name_addr_end; } current_offset = uri_offsets->name_addr_end; } else if (c==',') { uri_param_end_offset = queried_offset; current_offset = queried_offset+1; /* must move forward */ } else if (c==';') { /* More parameters */ uri_param_end_offset = queried_offset-1; current_offset = tvb_skip_wsp(tvb, queried_offset+1, uri_offsets->name_addr_end - queried_offset + 1); } proto_tree_add_item(uri_item_tree, *(uri->hf_sip_param), tvb, uri_params_start_offset , uri_param_end_offset - uri_params_start_offset +1, ENC_UTF_8|ENC_NA); /* In case there are more parameters, point to the start of it */ uri_params_start_offset = current_offset; } } return uri_item_tree; } /* Code to parse a contact header item * Returns Offset end off parsing or -1 for unsuccessful parsing * * contact-param = (name-addr / addr-spec) *(SEMI contact-params) */ static int dissect_sip_contact_item(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int start_offset, int line_end_offset, unsigned char* contacts_expires_0, unsigned char* contacts_expires_unknown) { char c; int current_offset; int queried_offset; int contact_params_start_offset = -1; /*int contact_param_end_offset = -1;*/ uri_offset_info uri_offsets; bool end_of_hdr = false; bool has_expires_param = false; /* skip Spaces and Tabs */ start_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if(start_offset >= line_end_offset) { /* Nothing to parse */ return -1; } /* Initialize the uri_offsets */ sip_uri_offset_init(&uri_offsets); /* contact-param = (name-addr / addr-spec) *(SEMI contact-params) */ current_offset = dissect_sip_name_addr_or_addr_spec(tvb, pinfo, start_offset, line_end_offset, &uri_offsets); if(current_offset == -1) { /* Parsing failed */ return -1; } display_sip_uri(tvb, tree, pinfo, &uri_offsets, &sip_contact_uri); /* check if there's a comma before a ';', in which case we stop parsing this item at the comma */ queried_offset = tvb_find_uint8(tvb, uri_offsets.uri_end, line_end_offset - uri_offsets.uri_end, ','); /* Check if we have contact parameters, the uri should be followed by a ';' */ contact_params_start_offset = tvb_find_uint8(tvb, uri_offsets.uri_end, line_end_offset - uri_offsets.uri_end, ';'); if (queried_offset != -1 && (queried_offset < contact_params_start_offset || contact_params_start_offset == -1)) { /* no expires param */ (*contacts_expires_unknown)++; return queried_offset; } /* check if contact-params is present */ if(contact_params_start_offset == -1) { /* no expires param */ (*contacts_expires_unknown)++; return line_end_offset; } /* Move current offset to the start of the first param */ contact_params_start_offset++; current_offset = contact_params_start_offset; /* Put the contact parameters in the tree */ queried_offset = current_offset; while(current_offset< line_end_offset){ c = '\0'; queried_offset++; queried_offset = (queried_offset < line_end_offset) ? tvb_ws_mempbrk_pattern_uint8(tvb, queried_offset, line_end_offset - queried_offset, &pbrk_header_end_dquote, &c) : -1; if (queried_offset != -1) { switch (c) { /* prevent tree from displaying the '\r\n' as part of the param */ case '\r': case '\n': end_of_hdr = true; /* fall through */ case ',': case ';': case '"': break; default : DISSECTOR_ASSERT_NOT_REACHED(); break; } } if (queried_offset == -1) { /* Last parameter, line end */ current_offset = line_end_offset; }else if(c=='"'){ /* Do we have a quoted string ? */ queried_offset = tvb_find_uint8(tvb, queried_offset+1, line_end_offset - queried_offset, '"'); if(queried_offset==-1){ /* We have an opening quote but no closing quote. */ current_offset = line_end_offset; } else { current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, queried_offset+1, line_end_offset - queried_offset, &pbrk_comma_semi, &c); if(current_offset==-1){ /* Last parameter, line end */ current_offset = line_end_offset; } } }else{ current_offset = queried_offset; } proto_tree_add_item(tree, hf_sip_contact_param, tvb, contact_params_start_offset , current_offset - contact_params_start_offset, ENC_UTF_8); /* need to check for an 'expires' parameter * TODO: this should be done in a common way for all headers, * but To/From/etc do their own right now so doing the same here */ /* also, this is a bad way of checking param names, but it's what To/From * etc, do. But legally "exPiRes = value" is also legit. */ if (tvb_strncaseeql(tvb, contact_params_start_offset, "expires=", 8) == 0) { int32_t expire; /* if the expires param value is 0, then it's de-registering * this assumes the message is a REGISTER request/response, but these * contacts_expires_0/contacts_expires_unknown variables only get used then, * so that's ok */ if (!ws_strtoi32(tvb_get_string_enc(wmem_packet_scope(), tvb, contact_params_start_offset+8, current_offset - (contact_params_start_offset+8), ENC_UTF_8|ENC_NA), NULL, &expire)) return contact_params_start_offset+8; has_expires_param = true; if (expire == 0) { (*contacts_expires_0)++; /* RFC 3261 10.3 "Processing REGISTER requests": * "The registrar returns a 200 (OK) response. The response * MUST contain Contact header field values enumerating all * current bindings." * This implies it is invalid for the response to contain the * deregistered, no longer current, Contacts with expires=0. * However, this warning was removed due to 3GPP usage. * Cf. 3GPP TS 24.229 "5.4.1.4 User-initiated deregistration": * "send a 200 (OK) response to a REGISTER request that * contains a list of Contact header fields enumerating all * contacts and flows that are currently registered, and all * contacts that have been deregistered." * https://gitlab.com/wireshark/wireshark/-/issues/10364 */ #if 0 if (stat_info && stat_info->response_code > 199 && stat_info->response_code < 300) { proto_tree_add_expert_format(tree, pinfo, &ei_sip_odd_register_response, tvb, contact_params_start_offset, current_offset - contact_params_start_offset, "SIP REGISTER %d response contains Contact with expires=0", stat_info->response_code); } #endif } } /* In case there are more parameters, point to the start of it */ contact_params_start_offset = current_offset+1; queried_offset = contact_params_start_offset; if (end_of_hdr) { /* '\r' or '\n' found, stop parsing and also set current offset to end * so the return value indicates we reached line end */ current_offset = line_end_offset; } if (c == ',') { /* comma separator found, stop parsing of current contact-param here */ break; } } if (!has_expires_param) { (*contacts_expires_unknown)++; } return current_offset; } /* Code to parse an authorization header item * Returns offset at end of parsing, or -1 for unsuccessful parsing */ static int dissect_sip_authorization_item(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset, sip_authorization_t *authorization_info) { int current_offset, par_name_end_offset, queried_offset, value_offset, value_search_offset; int equals_offset = 0; char *name; header_parameter_t *auth_parameter; unsigned i = 0; /* skip Spaces and Tabs */ start_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if (start_offset >= line_end_offset) { /* Nothing to parse */ return -1; } current_offset = start_offset; equals_offset = tvb_find_uint8(tvb, current_offset + 1, line_end_offset - (current_offset + 1), '='); if(equals_offset == -1){ /* malformed parameter */ return -1; } par_name_end_offset = equals_offset - 1; par_name_end_offset = tvb_skip_wsp_return(tvb,par_name_end_offset); /* Extract the parameter name */ name = tvb_get_string_enc(wmem_packet_scope(), tvb, start_offset, par_name_end_offset-start_offset, ENC_UTF_8|ENC_NA); value_offset = tvb_skip_wsp(tvb, equals_offset + 1, line_end_offset - (equals_offset + 1)); if (tvb_get_uint8(tvb, value_offset) == '\"') { /* quoted value */ value_search_offset = value_offset; do { value_search_offset++; queried_offset = tvb_find_uint8 (tvb, value_search_offset, line_end_offset - value_search_offset, '\"'); } while ((queried_offset != -1) && (tvb_get_uint8(tvb, queried_offset - 1) == '\\')); if (queried_offset == -1) { /* Closing quote not found, return line end */ current_offset = line_end_offset; } else { /* Include closing quotes */ current_offset = queried_offset + 1; } } else { /* unquoted value */ queried_offset = tvb_find_uint8 (tvb, value_offset, line_end_offset - value_offset, ','); if (queried_offset == -1) { /* Last parameter, line end */ current_offset = line_end_offset; } else { current_offset = queried_offset; } } /* Try to add parameter as a filterable item */ for (auth_parameter = &auth_parameters_hf_array[i]; i < array_length(auth_parameters_hf_array); i++, auth_parameter++) { if (g_ascii_strcasecmp(name, auth_parameter->param_name) == 0) { proto_tree_add_item(tree, *(auth_parameter->hf_item), tvb, value_offset, current_offset - value_offset, ENC_UTF_8|ENC_NA); if (global_sip_validate_authorization) { int real_value_offset = value_offset; int real_value_length = current_offset - value_offset; if ((tvb_get_uint8(tvb, value_offset) == '\"') && (tvb_get_uint8(tvb, current_offset - 1) == '\"') && (real_value_length > 1)) { real_value_offset++; real_value_length -= 2; } if (g_ascii_strcasecmp(name, "response") == 0) { authorization_info->response = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "nc") == 0) { authorization_info->nonce_count = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "username") == 0) { authorization_info->username = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "realm") == 0) { authorization_info->realm = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "algorithm") == 0) { authorization_info->algorithm = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "nonce") == 0) { authorization_info->nonce = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "qop") == 0) { authorization_info->qop = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "cnonce") == 0) { authorization_info->cnonce = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } else if (g_ascii_strcasecmp(name, "uri") == 0) { authorization_info->uri = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII); } } break; } } /* If not matched, just add as text... */ if (i == array_length(auth_parameters_hf_array)) { proto_tree_add_format_text(tree, tvb, start_offset, current_offset-start_offset); } /* Find comma/end of line */ queried_offset = tvb_find_uint8 (tvb, current_offset, line_end_offset - current_offset, ','); if (queried_offset == -1) { current_offset = line_end_offset; } else { current_offset = queried_offset; } return current_offset; } /* Dissect the details of a Reason header * Reason = "Reason" HCOLON reason-value *(COMMA reason-value) * reason-value = protocol *(SEMI reason-params) * protocol = "SIP" / "Q.850" / token * reason-params = protocol-cause / reason-text / reason-extension * protocol-cause = "cause" EQUAL cause * cause = 1*DIGIT * reason-text = "text" EQUAL quoted-string * reason-extension = generic-param */ static void dissect_sip_reason_header(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int start_offset, int line_end_offset){ int current_offset, semi_colon_offset, length, end_quote_offset; const uint8_t *param_name = NULL; unsigned cause_value; sip_reason_code_info_t sip_reason_code_info; /* skip Spaces and Tabs */ start_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if (start_offset >= line_end_offset) { /* Nothing to parse */ return; } current_offset = start_offset; semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset-current_offset, ';'); if(semi_colon_offset == -1) return; length = semi_colon_offset - current_offset; proto_tree_add_item_ret_string(tree, hf_sip_reason_protocols, tvb, start_offset, length, ENC_UTF_8|ENC_NA, wmem_packet_scope(), ¶m_name); current_offset = tvb_find_uint8(tvb, semi_colon_offset, line_end_offset - semi_colon_offset, '=') + 1; /* Do we have a text parameter too? */ semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); if (semi_colon_offset == -1){ length = line_end_offset - current_offset; } else { /* Text parmeter exist, set length accordingly */ length = semi_colon_offset - current_offset; } /* Get cause value */ cause_value = (unsigned)strtoul(tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, length, ENC_UTF_8 | ENC_NA), NULL, 10); if (g_ascii_strcasecmp(param_name, "Q.850") == 0){ proto_tree_add_uint(tree, hf_sip_reason_cause_q850, tvb, current_offset, length, cause_value); sip_reason_code_info.protocol_type_num = SIP_PROTO_Q850; } else if (g_ascii_strcasecmp(param_name, "SIP") == 0) { proto_tree_add_uint(tree, hf_sip_reason_cause_sip, tvb, current_offset, length, cause_value); sip_reason_code_info.protocol_type_num = SIP_PROTO_SIP; } else { proto_tree_add_uint(tree, hf_sip_reason_cause_other, tvb, current_offset, length, cause_value); sip_reason_code_info.protocol_type_num = SIP_PROTO_OTHER; } if (semi_colon_offset == -1) /* Nothing to parse */ return; /* reason-text = "text" EQUAL quoted-string */ current_offset = tvb_find_uint8(tvb, semi_colon_offset, line_end_offset - semi_colon_offset, '"') + 1; if (current_offset == -1) /* Nothing to parse */ return; end_quote_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '"'); if (end_quote_offset == -1) /* Nothing to parse */ return; length = end_quote_offset - current_offset; proto_tree_add_item(tree, hf_sip_reason_text, tvb, current_offset, length, ENC_UTF_8 | ENC_NA); if (sip_reason_code_handle) { tvbuff_t *next_tvb; sip_reason_code_info.cause_value = cause_value; next_tvb = tvb_new_subset_length(tvb, current_offset, length); call_dissector_with_data(sip_reason_code_handle, next_tvb, pinfo, tree, &sip_reason_code_info); } } /* Dissect the details of a security client header * sec-mechanism = mechanism-name *(SEMI mech-parameters) * mech-parameters = ( preference / digest-algorithm / * digest-qop / digest-verify / extension ) * preference = "q" EQUAL qvalue * qvalue = ( "0" [ "." 0*3DIGIT ] ) * / ( "1" [ "." 0*3("0") ] ) * digest-algorithm = "d-alg" EQUAL token * digest-qop = "d-qop" EQUAL token * digest-verify = "d-ver" EQUAL LDQUOT 32LHEX RDQUOT * extension = generic-param * * */ static void dissect_sip_sec_mechanism(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, int start_offset, int line_end_offset){ int current_offset, semi_colon_offset, length, par_name_end_offset, equals_offset; /* skip Spaces and Tabs */ start_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if (start_offset >= line_end_offset) { /* Nothing to parse */ return; } current_offset = start_offset; semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset-current_offset, ';'); if(semi_colon_offset == -1){ semi_colon_offset = line_end_offset; } length = semi_colon_offset-current_offset; proto_tree_add_item(tree, hf_sip_sec_mechanism, tvb, start_offset, length, ENC_UTF_8); current_offset = current_offset + length + 1; while(current_offset < line_end_offset){ char *param_name = NULL, *value = NULL; uint8_t hf_index = 0; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset-current_offset, ';'); if(semi_colon_offset == -1){ semi_colon_offset = line_end_offset; } length = semi_colon_offset - current_offset; /* Parse parameter and value */ equals_offset = tvb_find_uint8(tvb, current_offset + 1, length, '='); if(equals_offset != -1){ /* Has value part */ par_name_end_offset = equals_offset; /* Extract the parameter name */ param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, par_name_end_offset-current_offset, ENC_UTF_8|ENC_NA); /* Extract the value */ value = tvb_get_string_enc(wmem_packet_scope(), tvb, equals_offset+1, semi_colon_offset-equals_offset+1, ENC_UTF_8|ENC_NA); } else { return; } while (sec_mechanism_parameters_hf_array[hf_index].param_name) { /* Protection algorithm to be used */ if (g_ascii_strcasecmp(param_name, sec_mechanism_parameters_hf_array[hf_index].param_name) == 0) { switch (sec_mechanism_parameters_hf_array[hf_index].para_type) { case MECH_PARA_STRING: proto_tree_add_item(tree, *sec_mechanism_parameters_hf_array[hf_index].hf_item, tvb, equals_offset+1, semi_colon_offset-equals_offset-1, ENC_UTF_8); break; case MECH_PARA_UINT: if (!value) { proto_tree_add_expert(tree, pinfo, &ei_sip_sipsec_malformed, tvb, current_offset, -1); } else { uint32_t semi_para; semi_para = (uint32_t)strtoul(value, NULL, 10); proto_tree_add_uint(tree, *sec_mechanism_parameters_hf_array[hf_index].hf_item, tvb, equals_offset+1, semi_colon_offset-equals_offset-1, semi_para); } break; default: break; } break; } hf_index++; } if (!sec_mechanism_parameters_hf_array[hf_index].param_name) { proto_tree_add_format_text(tree, tvb, current_offset, length); } current_offset = semi_colon_offset+1; } } /* Dissect the details of a Route (and Record-Route) header */ static void dissect_sip_route_header(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, hf_sip_uri_t *sip_route_uri_p, int start_offset, int line_end_offset) { int current_offset; uri_offset_info uri_offsets; current_offset = start_offset; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); if (current_offset >= line_end_offset) { return; } while (current_offset < line_end_offset) { current_offset = tvb_find_uint8(tvb, current_offset, (line_end_offset - 1) - current_offset, ','); if (current_offset != -1) { /* found any ',' ? */ sip_uri_offset_init(&uri_offsets); current_offset = dissect_sip_name_addr_or_addr_spec(tvb, pinfo, start_offset, current_offset, &uri_offsets); if(current_offset == -1) return; display_sip_uri(tvb, tree, pinfo, &uri_offsets, sip_route_uri_p); current_offset++; start_offset = current_offset + 1; } else { /* current_offset = (line_end_offset - 1); */ sip_uri_offset_init(&uri_offsets); current_offset = dissect_sip_name_addr_or_addr_spec(tvb, pinfo, start_offset, line_end_offset, &uri_offsets); if(current_offset == -1) return; display_sip_uri(tvb, tree, pinfo, &uri_offsets, sip_route_uri_p); return; } current_offset++; } return; } /* Dissect the details of a Via header * * Via = ( "Via" / "v" ) HCOLON via-parm *(COMMA via-parm) * via-parm = sent-protocol LWS sent-by *( SEMI via-params ) * via-params = via-ttl / via-maddr * / via-received / via-branch * / via-extension * via-ttl = "ttl" EQUAL ttl * via-maddr = "maddr" EQUAL host * via-received = "received" EQUAL (IPv4address / IPv6address) * via-branch = "branch" EQUAL token * via-extension = generic-param * sent-protocol = protocol-name SLASH protocol-version * SLASH transport * protocol-name = "SIP" / token * protocol-version = token * transport = "UDP" / "TCP" / "TLS" / "SCTP" * / other-transport * sent-by = host [ COLON port ] * ttl = 1*3DIGIT ; 0 to 255 * */ static void dissect_sip_via_header(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset, packet_info *pinfo) { int current_offset; int address_start_offset; int semicolon_offset; bool colon_seen; bool ipv6_reference; bool ipv6_address; unsigned char c; char *param_name = NULL; current_offset = start_offset; while (1) { /* Reset flags and counters */ semicolon_offset = 0; ipv6_reference = false; ipv6_address = false; colon_seen = false; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); if (current_offset >= line_end_offset) { /* Nothing more to parse */ return; } /* Now look for the end of the SIP/2.0/transport parameter. * There may be spaces between the slashes * sent-protocol = protocol-name SLASH protocol-version * SLASH transport */ current_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '/'); if (current_offset != -1) { current_offset++; current_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '/'); } if (current_offset != -1) { current_offset++; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); } else current_offset = line_end_offset; /* We should now be at the start of the first transport name (or at the end of the line) */ /* * transport = "UDP" / "TCP" / "TLS" / "SCTP" * / other-transport */ while (current_offset < line_end_offset) { int transport_start_offset = current_offset; current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_tab_sp_fslash, &c); if (current_offset != -1){ proto_tree_add_item(tree, hf_sip_via_transport, tvb, transport_start_offset, current_offset - transport_start_offset, ENC_UTF_8); /* Check if we have more transport parameters */ if(c=='/'){ current_offset++; continue; } current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); c = tvb_get_uint8(tvb, current_offset); if(c=='/'){ current_offset++; continue; } break; }else{ current_offset = line_end_offset; } } /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); /* Now read the address part */ address_start_offset = current_offset; while (current_offset < line_end_offset) { current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_addr_end, &c); if (current_offset == -1) { current_offset = line_end_offset; break; } if (c == '[') { ipv6_reference = true; ipv6_address = true; } else if (c == ']') { ipv6_reference = false; } if (colon_seen || (c == ' ') || (c == '\t') || ((c == ':') && (ipv6_reference == false)) || (c == ';')) { break; } current_offset++; } /* Add address to tree */ if (ipv6_address == true) { proto_tree_add_item(tree, hf_sip_via_sent_by_address, tvb, address_start_offset + 1, current_offset - address_start_offset - 2, ENC_UTF_8); } else { proto_tree_add_item(tree, hf_sip_via_sent_by_address, tvb, address_start_offset, current_offset - address_start_offset, ENC_UTF_8); } /* Transport port number may follow ([space] : [space])*/ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); c = tvb_get_uint8(tvb, current_offset); if (c == ':') { /* Port number will follow any space after : */ int port_offset; current_offset++; /* Skip optional space after colon */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); port_offset = current_offset; /* Find digits of port number */ while (current_offset < line_end_offset) { c = tvb_get_uint8(tvb, current_offset); if (!g_ascii_isdigit(c)) { if (current_offset > port_offset) { /* Add address port number to tree */ uint16_t port; bool port_valid; proto_item* pi; port_valid = ws_strtou16(tvb_get_string_enc(wmem_packet_scope(), tvb, port_offset, current_offset - port_offset, ENC_UTF_8|ENC_NA), NULL, &port); pi = proto_tree_add_uint(tree, hf_sip_via_sent_by_port, tvb, port_offset, current_offset - port_offset, port); if (!port_valid) expert_add_info(pinfo, pi, &ei_sip_via_sent_by_port); } else { /* Shouldn't see a colon without a port number given */ return; } break; } current_offset++; } } /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); /* Dissect any parameters found */ while (current_offset < line_end_offset) { bool equals_found = false; bool found_end_of_parameters = false; int parameter_name_end = 0; header_parameter_t *via_parameter; unsigned i = 0; /* Look for the semicolon that signals the start of a parameter */ while (current_offset < line_end_offset) { c = tvb_get_uint8(tvb, current_offset); if (c == ';') { semicolon_offset = current_offset; current_offset++; break; } else if ((c != ' ') && (c != '\t')) { found_end_of_parameters = true; break; } current_offset++; } if (found_end_of_parameters) { break; } if (current_offset == line_end_offset) { return; } /* Look for end of parameter name */ while (current_offset < line_end_offset) { c = tvb_get_uint8(tvb, current_offset); if (!g_ascii_isalpha(c) && (c != '-')) { break; } current_offset++; } /* Not all params have an = */ if (c == '=') { equals_found = true; } parameter_name_end = current_offset; /* Read until end of parameter value */ current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_via_param_end, NULL); if (current_offset == -1) current_offset = line_end_offset; /* Note parameter name */ param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, semicolon_offset+1, parameter_name_end - semicolon_offset - 1, ENC_UTF_8|ENC_NA); /* Try to add parameter as a filterable item */ for (via_parameter = &via_parameters_hf_array[i]; i < array_length(via_parameters_hf_array); i++, via_parameter++) { if (g_ascii_strcasecmp(param_name, via_parameter->param_name) == 0) { if (equals_found) { proto_item* via_parameter_item; via_parameter_item = proto_tree_add_item(tree, *(via_parameter->hf_item), tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1, ENC_UTF_8 | ENC_NA); if (sip_via_branch_handle && g_ascii_strcasecmp(param_name, "branch") == 0) { tvbuff_t *next_tvb; next_tvb = tvb_new_subset_length(tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1); call_dissector(sip_via_branch_handle, next_tvb, pinfo, tree); } else if (g_ascii_strcasecmp(param_name, "oc") == 0) { proto_item *ti; char *value = tvb_get_string_enc(wmem_packet_scope(), tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1, ENC_UTF_8 | ENC_NA); ti = proto_tree_add_uint(tree, hf_sip_via_oc_val, tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1, (uint32_t)strtoul(value, NULL, 10)); proto_item_set_generated(ti); } else if (g_ascii_strcasecmp(param_name, "oc-seq") == 0) { proto_item *ti; nstime_t ts; int dec_p_off = tvb_find_uint8(tvb, parameter_name_end + 1, - 1, '.'); char *value; if(dec_p_off > 0){ value = tvb_get_string_enc(wmem_packet_scope(), tvb, parameter_name_end + 1, dec_p_off - parameter_name_end, ENC_UTF_8 | ENC_NA); ts.secs = (time_t)strtoul(value, NULL, 10); value = tvb_get_string_enc(wmem_packet_scope(), tvb, dec_p_off + 1, current_offset - parameter_name_end - 1, ENC_UTF_8 | ENC_NA); ts.nsecs = (uint32_t)strtoul(value, NULL, 10) * 1000; ti = proto_tree_add_time(tree, hf_sip_oc_seq_timestamp, tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1, &ts); proto_item_set_generated(ti); } } else if (g_ascii_strcasecmp(param_name, "be-route") == 0) { tvbuff_t* next_tvb; next_tvb = tvb_new_subset_length(tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1); call_dissector(sip_via_be_route_handle, next_tvb, pinfo, proto_item_add_subtree(via_parameter_item, ett_sip_via_be_route)); } } else { proto_tree_add_item(tree, *(via_parameter->hf_item), tvb, semicolon_offset+1, current_offset-semicolon_offset-1, ENC_UTF_8|ENC_NA); } break; } } /* If not matched, just add as text... */ if (i == array_length(via_parameters_hf_array)) { proto_tree_add_format_text(tree, tvb, semicolon_offset+1, current_offset-semicolon_offset-1); } /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); /* There may be a comma, followed by more Via entries... */ if (current_offset < line_end_offset) { c = tvb_get_uint8(tvb, current_offset); if (c == ',') { /* Skip it and get out of parameter loop */ current_offset++; break; } } } } } /* Dissect the details of a Session-ID header * * Session-ID = "Session-ID" HCOLON sess-id * *( SEMI generic-param ) * sess-id = 32(DIGIT / %x61-66) ; 32 chars of [0-9a-f] */ static void dissect_sip_session_id_header(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset, packet_info *pinfo) { int current_offset, semi_colon_offset, equals_offset, length, logme_end_offset; GByteArray *bytes; proto_item *pi; current_offset = start_offset; semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset-current_offset, ';'); if(semi_colon_offset == -1){ semi_colon_offset = line_end_offset; } length = semi_colon_offset-current_offset; bytes = g_byte_array_sized_new(16); if (length != 0) { pi = proto_tree_add_bytes_item(tree, hf_sip_session_id_sess_id, tvb, start_offset, length, ENC_UTF_8|ENC_STR_HEX|ENC_SEP_NONE, bytes, NULL, NULL); } else { pi = proto_tree_add_item(tree, hf_sip_session_id_sess_id, tvb, start_offset, length, ENC_UTF_8 | ENC_STR_HEX | ENC_SEP_NONE); expert_add_info(pinfo, pi, &ei_sip_session_id_sess_id); } current_offset = current_offset + length + 1; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); if (current_offset < line_end_offset) { /* Parse parameter and value */ equals_offset = tvb_find_uint8(tvb, current_offset + 1, length, '='); if (equals_offset != -1) { /* Extract the parameter name */ GByteArray *uuid = g_byte_array_sized_new(16); uint8_t *param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, tvb_skip_wsp_return(tvb, equals_offset - 1) - current_offset, ENC_UTF_8|ENC_NA); if ((bytes->len == 16) && (g_ascii_strcasecmp(param_name, "remote") == 0) && tvb_get_string_bytes(tvb, equals_offset + 1, line_end_offset - equals_offset - 1, ENC_UTF_8|ENC_STR_HEX|ENC_SEP_NONE, uuid, NULL) && (uuid->len == 16)) { /* Decode header as draft-ietf-insipid-session-id * * session-id = "Session-ID" HCOLON session-id-value * session-id-value = local-uuid *(SEMI sess-id-param) * local-uuid = sess-uuid / null * remote-uuid = sess-uuid / null * sess-uuid = 32(DIGIT / %x61-66) ;32 chars of [0-9a-f] * sess-id-param = remote-param / generic-param * remote-param = "remote" EQUAL remote-uuid * null = 32("0") */ e_guid_t guid; proto_item_set_hidden(pi); guid.data1 = (bytes->data[0] << 24) | (bytes->data[1] << 16) | (bytes->data[2] << 8) | bytes->data[3]; guid.data2 = (bytes->data[4] << 8) | bytes->data[5]; guid.data3 = (bytes->data[6] << 8) | bytes->data[7]; memcpy(guid.data4, &bytes->data[8], 8); proto_tree_add_guid(tree, hf_sip_session_id_local_uuid, tvb, start_offset, semi_colon_offset - start_offset, &guid); guid.data1 = (uuid->data[0] << 24) | (uuid->data[1] << 16) | (uuid->data[2] << 8) | uuid->data[3]; guid.data2 = (uuid->data[4] << 8) | uuid->data[5]; guid.data3 = (uuid->data[6] << 8) | uuid->data[7]; memcpy(guid.data4, &uuid->data[8], 8); proto_tree_add_guid(tree, hf_sip_session_id_remote_uuid, tvb, equals_offset + 1, line_end_offset - equals_offset - 1, &guid); /* Decode logme parameter as per https://tools.ietf.org/html/rfc8497 * * sess-id-param =/ logme-param * logme-param = "logme" */ semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); while(semi_colon_offset != -1){ current_offset = semi_colon_offset + 1; if(current_offset != line_end_offset){ logme_end_offset = current_offset + 5; current_offset = tvb_skip_wsp_return(tvb,semi_colon_offset); /* Extract logme parameter name */ char *name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset,logme_end_offset - current_offset, ENC_UTF_8|ENC_NA); if(g_ascii_strcasecmp(name, "logme") == 0){ proto_tree_add_boolean(tree, hf_sip_session_id_logme, tvb, current_offset, logme_end_offset - current_offset, 1); } else if(current_offset != line_end_offset){ proto_tree_add_item(tree, hf_sip_session_id_param, tvb, current_offset,line_end_offset - current_offset, ENC_UTF_8); } } semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); } } else { /* Display generic parameter */ proto_tree_add_item(tree, hf_sip_session_id_param, tvb, current_offset, line_end_offset - current_offset, ENC_UTF_8); } g_byte_array_free(uuid, true); } else { /* Display generic parameter */ proto_tree_add_item(tree, hf_sip_session_id_param, tvb, current_offset, line_end_offset - current_offset, ENC_UTF_8); } } g_byte_array_free(bytes, true); } /* Dissect the headers for P-Access-Network-Info Headers * * Spec found in 3GPP 24.229 7.2A.4 * P-Access-Network-Info = "P-Access-Network-Info" HCOLON * access-net-spec *(COMMA access-net-spec) * access-net-spec = (access-type / access-class) *(SEMI access-info) * access-type = "IEEE-802.11" / "IEEE-802.11a" / "IEEE-802.11b" / "IEEE-802.11g" / "IEEE-802.11n" / "3GPP-GERAN" / * "3GPP-UTRAN-FDD" / "3GPP-UTRAN-TDD" / "3GPP-E-UTRAN-FDD" / "3GPP-E-UTRAN-TDD" / "ADSL" / "ADSL2" / * "ADSL2+" / "RADSL" / "SDSL" / "HDSL" / "HDSL2" / "G.SHDSL" / "VDSL" / "IDSL" / "3GPP2-1X" / * "3GPP2-1X-Femto" / "3GPP2-1X-HRPD" / "3GPP2-UMB" / "DOCSIS" / "IEEE-802.3" / "IEEE-802.3a" / * "IEEE-802.3e" / "IEEE-802.3i" / "IEEE-802.3j" / "IEEE-802.3u" / "IEEE-802.3ab"/ "IEEE-802.3ae" / * "IEEE-802.3ak" / "IEEE-802.3aq" / "IEEE-802.3an" / "IEEE-802.3y" / "IEEE-802.3z" / "GPON" / "XGPON1" / "GSTN"/ token * access-class = "3GPP-GERAN" / "3GPP-UTRAN" / "3GPP-E-UTRAN" / "3GPP-WLAN" / "3GPP-GAN" / "3GPP-HSPA" / token * np = "network-provided" * access-info = cgi-3gpp / utran-cell-id-3gpp / dsl-location / i-wlan-node-id / ci-3gpp2 / ci-3gpp2-femto / eth-location / fiber-location / np / gstn-location / extension-access-info * extension-access-info = gen-value * cgi-3gpp = "cgi-3gpp" EQUAL (token / quoted-string) * utran-cell-id-3gpp = "utran-cell-id-3gpp" EQUAL (token / quoted-string) * i-wlan-node-id = "i-wlan-node-id" EQUAL (token / quoted-string) * dsl-location = "dsl-location" EQUAL (token / quoted-string) * eth-location = "eth-location" EQUAL (token / quoted-string) * fiber-location = "fiber-location" EQUAL (token / quoted-string) * ci-3gpp2 = "ci-3gpp2" EQUAL (token / quoted-string) * ci-3gpp2-femto = "ci-3gpp2-femto" EQUAL (token / quoted-string) * gstn-location = "gstn-location" EQUAL (token / quoted-string) * */ void dissect_sip_p_access_network_info_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int start_offset, int line_end_offset) { int current_offset, semi_colon_offset, length, par_name_end_offset, equals_offset; /* skip Spaces and Tabs */ start_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if (start_offset >= line_end_offset) { /* Nothing to parse */ return; } /* Get the Access Type / Access Class*/ current_offset = start_offset; semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); if (semi_colon_offset == -1) return; length = semi_colon_offset - current_offset; proto_tree_add_item(tree, hf_sip_p_acc_net_i_acc_type, tvb, start_offset, length, ENC_UTF_8 | ENC_NA); current_offset = current_offset + length + 1; while (current_offset < line_end_offset){ char *param_name = NULL; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); if (semi_colon_offset == -1){ semi_colon_offset = line_end_offset; } length = semi_colon_offset - current_offset; /* Parse parameter and value */ equals_offset = tvb_find_uint8(tvb, current_offset + 1, length, '='); if (equals_offset != -1){ /* Has value part */ par_name_end_offset = equals_offset; /* Extract the parameter name */ param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, par_name_end_offset - current_offset, ENC_UTF_8 | ENC_NA); /* Access-Info fields */ if ((param_name != NULL)&&(g_ascii_strcasecmp(param_name, "utran-cell-id-3gpp") == 0)) { proto_tree_add_item(tree, hf_sip_p_acc_net_i_ucid_3gpp, tvb, equals_offset + 1, semi_colon_offset - equals_offset - 1, ENC_UTF_8 | ENC_NA); /* check if value is quoted */ if (tvb_get_uint8(tvb, equals_offset + 1) == '"') { dissect_e212_mcc_mnc_in_utf8_address(tvb, pinfo, tree, equals_offset + 2); } else { dissect_e212_mcc_mnc_in_utf8_address(tvb, pinfo, tree, equals_offset + 1); } } else { proto_tree_add_format_text(tree, tvb, current_offset, length); } } else { proto_tree_add_format_text(tree, tvb, current_offset, length); } current_offset = semi_colon_offset + 1; } } /* The syntax for the P-Charging-Vector header field is described as follows: P-Charging-Vector = "P-Charging-Vector" HCOLON icid-value *(SEMI charge-params) charge-params = icid-gen-addr / orig-ioi / term-ioi / transit-ioi / related-icid / related-icid-gen-addr / generic-param icid-value = "icid-value" EQUAL gen-value icid-gen-addr = "icid-generated-at" EQUAL host orig-ioi = "orig-ioi" EQUAL gen-value term-ioi = "term-ioi" EQUAL gen-value transit-ioi = "transit-ioi" EQUAL transit-ioi-list transit-ioi-list = DQUOTE transit-ioi-param *(COMMA transit-ioi-param) DQUOTE transit-ioi-param = transit-ioi-indexed-value / transit-ioi-void-value transit-ioi-indexed-value = transit-ioi-name "." transit-ioi-index transit-ioi-name = ALPHA *(ALPHA / DIGIT) transit-ioi-index = 1*DIGIT transit-ioi-void-value = "void" related-icid = "related-icid" EQUAL gen-value related-icid-gen-addr = "related-icid-generated-at" EQUAL host */ static void dissect_sip_p_charging_vector_header(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset) { int current_offset, semi_colon_offset, length, equals_offset; /* skip Spaces and Tabs */ start_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if (start_offset >= line_end_offset) { /* Nothing to parse */ return; } /* icid-value = "icid-value" EQUAL gen-value */ current_offset = start_offset; semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); if (semi_colon_offset == -1) { /* No parameters, is that allowed?*/ semi_colon_offset = line_end_offset; } length = semi_colon_offset - current_offset; /* Parse parameter and value */ equals_offset = tvb_find_uint8(tvb, current_offset + 1, length, '='); if (equals_offset == -1) { /* Does not conform to ABNF */ return; } /* Get the icid-value */ proto_tree_add_item(tree, hf_sip_icid_value, tvb, equals_offset + 1, semi_colon_offset - equals_offset - 1, ENC_UTF_8 | ENC_NA); current_offset = semi_colon_offset + 1; /* Add the rest of the parameters to the tree */ while (current_offset < line_end_offset) { char *param_name = NULL; int par_name_end_offset; /* skip Spaces and Tabs */ current_offset = tvb_skip_wsp(tvb, current_offset, line_end_offset - current_offset); semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';'); if (semi_colon_offset == -1) { semi_colon_offset = line_end_offset; } length = semi_colon_offset - current_offset; /* Parse parameter and value */ equals_offset = tvb_find_uint8(tvb, current_offset + 1, length, '='); if (equals_offset != -1) { /* Has value part */ par_name_end_offset = equals_offset; /* Extract the parameter name */ param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, par_name_end_offset - current_offset, ENC_UTF_8 | ENC_NA); /* charge-params */ if ((param_name != NULL) && (g_ascii_strcasecmp(param_name, "icid-gen-addr") == 0)) { proto_tree_add_item(tree, hf_sip_icid_gen_addr, tvb, equals_offset + 1, semi_colon_offset - equals_offset - 1, ENC_UTF_8 | ENC_NA); } else { proto_tree_add_format_text(tree, tvb, current_offset, length); } } else { proto_tree_add_format_text(tree, tvb, current_offset, length); } current_offset = semi_colon_offset + 1; } } /* https://tools.ietf.org/html/rfc6809 The ABNF for the Feature-Caps header fields is: Feature-Caps = "Feature-Caps" HCOLON fc-value *(COMMA fc-value) fc-value = "*" *(SEMI feature-cap) The ABNF for the feature-capability indicator is: feature-cap = "+" fcap-name [EQUAL LDQUOT (fcap-value-list / fcap-string-value ) RDQUOT] fcap-name = ftag-name fcap-value-list = tag-value-list fcap-string-value = string-value ;; ftag-name, tag-value-list, string-value defined in RFC 3840 NOTE: In comparison with media feature tags, the "+" sign in front of the feature-capability indicator name is mandatory. */ static void dissect_sip_p_feature_caps(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset) { int current_offset, next_offset, length; uint16_t semi_plus = 0x3b2b; /* skip Spaces and Tabs */ next_offset = tvb_skip_wsp(tvb, start_offset, line_end_offset - start_offset); if (next_offset >= line_end_offset) { /* Nothing to parse */ return; } while (next_offset < line_end_offset) { /* Find the end of feature cap or start of feature cap parameter, ";+" should indicate the start of a new feature-cap */ current_offset = next_offset; next_offset = tvb_find_uint16(tvb, current_offset, line_end_offset - current_offset, semi_plus); if (next_offset == -1) { length = line_end_offset - current_offset; next_offset = line_end_offset; } else { length = next_offset - current_offset; next_offset += 2; } proto_tree_add_item(tree, hf_sip_feature_cap, tvb, current_offset, length, ENC_UTF_8 | ENC_NA); } } /* Code to actually dissect the packets */ static int dissect_sip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) { uint8_t octet; int len; int remaining_length; octet = tvb_get_uint8(tvb,0); if ((octet & 0xf8) == 0xf8){ call_dissector(sigcomp_handle, tvb, pinfo, tree); return tvb_reported_length(tvb); } remaining_length = tvb_reported_length(tvb); len = dissect_sip_common(tvb, 0, remaining_length, pinfo, tree, false, false); if (len < 0) return 0; /* not SIP */ else return len; } static int dissect_sip_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) { uint8_t octet; int offset = 0, linelen; int len; int remaining_length; octet = tvb_get_uint8(tvb,0); if ((octet & 0xf8) == 0xf8){ call_dissector(sigcomp_handle, tvb, pinfo, tree); return tvb_reported_length(tvb); } remaining_length = tvb_reported_length(tvb); /* If we have exactly one non printable byte of payload, this is * probably just a keep alive at the beginning of a capture. Better * to treat it as such than to mark it and everything up to the next * line end as Continuation Data. */ if (remaining_length == 1 && !g_ascii_isprint(octet)) { return 0; } /* Check if we have enough data or if we need another segment, as a safety measure set a length limit*/ if (remaining_length < 1500){ linelen = tvb_find_line_end(tvb, offset, remaining_length, NULL, true); if (linelen == -1){ pinfo->desegment_offset = offset; pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT; return -1; } } len = dissect_sip_common(tvb, offset, remaining_length, pinfo, tree, true, true); if (len <= 0) return len; offset += len; remaining_length = remaining_length - len; /* * This is a bit of a cludge as the TCP dissector does not call the dissectors again if not all * the data in the segment was dissected and we do not know if we need another segment or not. * so DESEGMENT_ONE_MORE_SEGMENT can't be used in all cases. * */ while (remaining_length > 0) { /* Check if we have enough data or if we need another segment, as a safety measure set a length limit*/ if (remaining_length < 1500){ linelen = tvb_find_line_end(tvb, offset, remaining_length, NULL, true); if (linelen == -1){ pinfo->desegment_offset = offset; pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT; return -1; } } len = dissect_sip_common(tvb, offset, remaining_length, pinfo, tree, true, true); if (len <= 0) return len; offset += len; remaining_length = remaining_length - len; } return offset; } static bool dissect_sip_tcp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) { int offset = 0; int len; bool first = true; int remaining_length; remaining_length = tvb_captured_length(tvb); while (remaining_length > 0) { len = dissect_sip_common(tvb, offset, remaining_length, pinfo, tree, !first, true); if (len == -2) { if (first) { /* * If the first packet doesn't start with * a valid SIP request or response, don't * treat this as SIP. */ return false; } break; } if (len == -1) break; /* need more data */ offset += len; remaining_length = remaining_length - len; first = false; } return true; } static bool dissect_sip_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_) { int remaining_length = tvb_captured_length(tvb); return dissect_sip_common(tvb, 0, remaining_length, pinfo, tree, false, false) > 0; } static int dissect_sip_common(tvbuff_t *tvb, int offset, int remaining_length, packet_info *pinfo, proto_tree *tree, bool dissect_other_as_continuation, bool use_reassembly) { int orig_offset, body_offset; int next_offset, linelen; int content_length, datalen, reported_datalen; line_type_t line_type; tvbuff_t *next_tvb; bool is_known_request; int found_match = 0; const char *descr; unsigned token_1_len = 0; unsigned current_method_idx = SIP_METHOD_INVALID; proto_item *ts, *ti_a = NULL, *th = NULL; proto_tree *sip_tree, *reqresp_tree = NULL, *hdr_tree = NULL, *message_body_tree = NULL, *cseq_tree = NULL, *via_tree = NULL, *reason_tree = NULL, *rack_tree = NULL, *route_tree = NULL, *security_client_tree = NULL, *session_id_tree = NULL, *p_access_net_info_tree = NULL; unsigned char contacts = 0, contact_is_star = 0, expires_is_0 = 0, contacts_expires_0 = 0, contacts_expires_unknown = 0; uint32_t cseq_number = 0; unsigned char cseq_number_set = 0; const char *cseq_method = ""; char *call_id = NULL; char *media_type_str_lower_case = NULL; media_content_info_t content_info = { MEDIA_CONTAINER_SIP_DATA, NULL, NULL, NULL }; char *content_encoding_parameter_str = NULL; unsigned resend_for_packet = 0; unsigned request_for_response = 0; uint32_t response_time = 0; int strlen_to_copy; heur_dtbl_entry_t *hdtbl_entry; /* * If this should be a request of response, do this quick check to see if * it begins with a string... * Otherwise, SIP heuristics are expensive... * */ if (!dissect_other_as_continuation && ((remaining_length < 1) || !g_ascii_isprint(tvb_get_uint8(tvb, offset)))) { return -2; } /* * Note that "tvb_find_line_end()" will return a value that * is not longer than what's in the buffer, so the * "tvb_get_ptr()" calls below won't throw exceptions. * * Note that "tvb_strneql()" doesn't throw exceptions, so * "sip_parse_line()" won't throw an exception. */ orig_offset = offset; linelen = tvb_find_line_end(tvb, offset, remaining_length, &next_offset, false); if(linelen==0){ return -2; } if (tvb_strnlen(tvb, offset, linelen) > -1) { /* * There's a NULL in the line, * this may be SIP within another protocol. * This heuristic still needs to improve. */ return -2; } line_type = sip_parse_line(tvb, offset, linelen, &token_1_len); if (line_type == OTHER_LINE) { /* * This is neither a SIP request nor response. */ if (!dissect_other_as_continuation) { /* * We were asked to reject this. */ return -2; } /* * Just dissect it as a continuation. */ } else if ((use_reassembly)&&( pinfo->ptype == PT_TCP)) { /* * Yes, it's a request or response. * Do header desegmentation if we've been told to, * and do body desegmentation if we've been told to and * we find a Content-Length header. * * RFC 6594, Section 20.14. requires Content-Length for TCP. */ if (!req_resp_hdrs_do_reassembly(tvb, offset, pinfo, sip_desegment_headers, sip_desegment_body, false, NULL, NULL, NULL)) { /* * More data needed for desegmentation. */ return -1; } } /* Initialise stat info for passing to tap * Note: this isn't _only_ for taps - internal code here uses it too * also store stat info in proto_data for subdissectors */ stat_info = wmem_new0(pinfo->pool, sip_info_value_t); p_add_proto_data(pinfo->pool, pinfo, proto_sip, pinfo->curr_layer_num, stat_info); col_set_str(pinfo->cinfo, COL_PROTOCOL, "SIP"); if (!pinfo->flags.in_error_pkt && have_tap_listener(exported_pdu_tap)) { wmem_list_frame_t *cur; unsigned proto_id; const char *proto_name; void *tmp; /* For SIP messages with other sip messages embeded in the body, don't export those individually. * E.g. if we are called from the mime_multipart dissector don't export the message. */ cur = wmem_list_frame_prev(wmem_list_tail(pinfo->layers)); tmp = wmem_list_frame_data(cur); proto_id = GPOINTER_TO_UINT(tmp); proto_name = proto_get_protocol_filter_name(proto_id); if (strcmp(proto_name, "mime_multipart") != 0) { export_sip_pdu(pinfo, tvb); } } DPRINT2(("------------------------------ dissect_sip_common ------------------------------")); switch (line_type) { case REQUEST_LINE: is_known_request = sip_is_known_request(tvb, offset, token_1_len, ¤t_method_idx); descr = is_known_request ? "Request" : "Unknown request"; col_add_lstr(pinfo->cinfo, COL_INFO, descr, ": ", tvb_format_text(pinfo->pool, tvb, offset, linelen - SIP2_HDR_LEN - 1), COL_ADD_LSTR_TERMINATOR); DPRINT(("got %s: %s", descr, tvb_format_text(pinfo->pool, tvb, offset, linelen - SIP2_HDR_LEN - 1))); break; case STATUS_LINE: descr = "Status"; col_add_lstr(pinfo->cinfo, COL_INFO, "Status: ", tvb_format_text(pinfo->pool, tvb, offset + SIP2_HDR_LEN + 1, linelen - SIP2_HDR_LEN - 1), COL_ADD_LSTR_TERMINATOR); stat_info->reason_phrase = tvb_get_string_enc(wmem_packet_scope(), tvb, offset + SIP2_HDR_LEN + 5, linelen - (SIP2_HDR_LEN + 5),ENC_UTF_8|ENC_NA); DPRINT(("got Response: %s", tvb_format_text(pinfo->pool, tvb, offset + SIP2_HDR_LEN + 1, linelen - SIP2_HDR_LEN - 1))); break; case OTHER_LINE: default: /* Squelch compiler complaints */ descr = "Continuation"; col_set_str(pinfo->cinfo, COL_INFO, "Continuation"); DPRINT(("got continuation")); break; } ts = proto_tree_add_item(tree, proto_sip, tvb, offset, -1, ENC_NA); sip_tree = proto_item_add_subtree(ts, ett_sip); switch (line_type) { case REQUEST_LINE: if (sip_tree) { ti_a = proto_tree_add_item(sip_tree, hf_Request_Line, tvb, offset, linelen, ENC_UTF_8); reqresp_tree = proto_item_add_subtree(ti_a, ett_sip_reqresp); } dfilter_sip_request_line(tvb, reqresp_tree, pinfo, offset, token_1_len, linelen); break; case STATUS_LINE: if (sip_tree) { ti_a = proto_tree_add_item(sip_tree, hf_sip_Status_Line, tvb, offset, linelen, ENC_UTF_8); reqresp_tree = proto_item_add_subtree(ti_a, ett_sip_reqresp); } dfilter_sip_status_line(tvb, reqresp_tree, pinfo, linelen, offset); break; case OTHER_LINE: if (sip_tree) { reqresp_tree = proto_tree_add_subtree_format(sip_tree, tvb, offset, next_offset, ett_sip_reqresp, NULL, "%s line: %s", descr, tvb_format_text(pinfo->pool, tvb, offset, linelen)); /* XXX: Is adding to 'reqresp_tree as intended ? Changed from original 'sip_tree' */ proto_tree_add_item(reqresp_tree, hf_sip_continuation, tvb, offset, -1, ENC_NA); } return remaining_length; } remaining_length = remaining_length - (next_offset - offset); offset = next_offset; body_offset = offset; /* * Find the blank line separating the headers from the message body. * Do this now so we can add the msg_hdr FT_STRING item with the correct * length. */ content_length = -1; while (remaining_length > 0) { int line_end_offset; unsigned char c; linelen = tvb_find_line_end(tvb, body_offset, -1, &next_offset, false); if (linelen == 0) { /* * This is a blank line separating the * message header from the message body. */ body_offset = next_offset; break; } line_end_offset = body_offset + linelen; if(tvb_reported_length_remaining(tvb, next_offset) > 0){ while (tvb_offset_exists(tvb, next_offset) && ((c = tvb_get_uint8(tvb, next_offset)) == ' ' || c == '\t')) { /* * This line end is not a header seperator. * It just extends the header with another line. * Look for next line end: */ linelen += (next_offset - line_end_offset); linelen += tvb_find_line_end(tvb, next_offset, -1, &next_offset, false); line_end_offset = body_offset + linelen; } } remaining_length = remaining_length - (next_offset - body_offset); body_offset = next_offset; }/* End while */ remaining_length += (body_offset - offset); th = proto_tree_add_item(sip_tree, hf_sip_msg_hdr, tvb, offset, body_offset - offset, ENC_UTF_8); hdr_tree = proto_item_add_subtree(th, ett_sip_hdr); if (have_tap_listener(sip_follow_tap)) tap_queue_packet(sip_follow_tap, pinfo, tvb); /* * Process the headers - if we're not building a protocol tree, * we just do this to find the blank line separating the * headers from the message body. */ content_length = -1; while (remaining_length > 0) { int line_end_offset; int colon_offset; int semi_colon_offset; int parameter_offset; int parameter_end_offset; int parameter_len; int content_type_len, content_type_parameter_str_len; int header_len; char *header_name; dissector_handle_t ext_hdr_handle; int hf_index; int value_offset; int sub_value_offset; int comma_offset; unsigned char c; int value_len; bool is_no_header_termination = false; proto_tree *tc_uri_item_tree = NULL; uri_offset_info uri_offsets; linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, false); if (linelen == 0) { /* * This is a blank line separating the * message header from the message body. */ offset = next_offset; break; } line_end_offset = offset + linelen; if(tvb_reported_length_remaining(tvb, next_offset) <= 0){ is_no_header_termination = true; }else{ while (tvb_offset_exists(tvb, next_offset) && ((c = tvb_get_uint8(tvb, next_offset)) == ' ' || c == '\t')) { /* * This line end is not a header seperator. * It just extends the header with another line. * Look for next line end: */ linelen += (next_offset - line_end_offset); linelen += tvb_find_line_end(tvb, next_offset, -1, &next_offset, false); line_end_offset = offset + linelen; } } colon_offset = tvb_find_uint8(tvb, offset, linelen, ':'); if (colon_offset == -1) { /* * Malformed header - no colon after the name. */ expert_add_info(pinfo, th, &ei_sip_header_no_colon); } else { header_len = colon_offset - offset; header_name = (char*)tvb_get_string_enc(wmem_packet_scope(), tvb, offset, header_len, ENC_UTF_8|ENC_NA); ascii_strdown_inplace(header_name); hf_index = sip_is_known_sip_header(header_name, header_len); /* * Skip whitespace after the colon. */ value_offset = tvb_skip_wsp(tvb, colon_offset + 1, line_end_offset - (colon_offset + 1)); value_len = (int) (line_end_offset - value_offset); if (hf_index == -1) { int *hf_ptr = NULL; if (sip_custom_header_fields_hash) { hf_ptr = (int*)g_hash_table_lookup(sip_custom_header_fields_hash, header_name); } if (hf_ptr) { sip_proto_tree_add_string(hdr_tree, *hf_ptr, tvb, offset, next_offset - offset, value_offset, value_len); } else { proto_item *ti_c; proto_tree *ti_tree = proto_tree_add_subtree(hdr_tree, tvb, offset, next_offset - offset, ett_sip_ext_hdr, &ti_c, tvb_format_text(pinfo->pool, tvb, offset, linelen)); ext_hdr_handle = dissector_get_string_handle(ext_hdr_subdissector_table, header_name); if (ext_hdr_handle != NULL) { tvbuff_t *next_tvb2; next_tvb2 = tvb_new_subset_length(tvb, value_offset, value_len); dissector_try_string(ext_hdr_subdissector_table, header_name, next_tvb2, pinfo, ti_tree, NULL); } else { expert_add_info_format(pinfo, ti_c, &ei_sip_unrecognized_header, "Unrecognised SIP header (%s)", header_name); } } } else { proto_item *sip_element_item; proto_tree *sip_element_tree; /* * Add it to the protocol tree, * but display the line as is. */ switch ( hf_index ) { case POS_TO : /*if(hdr_tree)*/ { proto_item *item; sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* To = ( "To" / "t" ) HCOLON ( name-addr * / addr-spec ) *( SEMI to-param ) */ sip_uri_offset_init(&uri_offsets); if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1){ display_sip_uri(tvb, sip_element_tree, pinfo, &uri_offsets, &sip_to_uri); if((uri_offsets.name_addr_start != -1) && (uri_offsets.name_addr_end != -1)){ stat_info->tap_to_addr=tvb_get_string_enc(wmem_packet_scope(), tvb, uri_offsets.name_addr_start, uri_offsets.name_addr_end - uri_offsets.name_addr_start + 1, ENC_UTF_8|ENC_NA); } offset = uri_offsets.name_addr_end +1; } /* Find parameter tag if present. * TODO make this generic to find any interesting parameter * use the same method as for SIP headers ? */ parameter_offset = offset; while (parameter_offset < line_end_offset && (tvb_strneql(tvb, parameter_offset, "tag=", 4) != 0)) parameter_offset++; if ( parameter_offset < line_end_offset ){ /* Tag found */ parameter_offset = parameter_offset + 4; parameter_end_offset = tvb_find_uint8(tvb, parameter_offset, (line_end_offset - parameter_offset), ';'); if ( parameter_end_offset == -1) parameter_end_offset = line_end_offset; parameter_len = parameter_end_offset - parameter_offset; proto_tree_add_item(sip_element_tree, hf_sip_to_tag, tvb, parameter_offset, parameter_len, ENC_UTF_8); item = proto_tree_add_item(sip_element_tree, hf_sip_tag, tvb, parameter_offset, parameter_len, ENC_UTF_8); proto_item_set_hidden(item); /* Tag indicates in-dialog messages, in case we have a INVITE, SUBSCRIBE or REFER, mark it */ switch (current_method_idx) { case SIP_METHOD_INVITE: case SIP_METHOD_SUBSCRIBE: case SIP_METHOD_REFER: col_append_str(pinfo->cinfo, COL_INFO, ", in-dialog"); break; } } } /* if hdr_tree */ break; case POS_FROM : /*if(hdr_tree)*/ { proto_item *item; sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* * From = ( "From" / "f" ) HCOLON from-spec * from-spec = ( name-addr / addr-spec ) * *( SEMI from-param ) */ sip_uri_offset_init(&uri_offsets); if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1){ display_sip_uri(tvb, sip_element_tree, pinfo, &uri_offsets, &sip_from_uri); if((uri_offsets.name_addr_start != -1) && (uri_offsets.name_addr_end != -1)){ stat_info->tap_from_addr=tvb_get_string_enc(wmem_packet_scope(), tvb, uri_offsets.name_addr_start, uri_offsets.name_addr_end - uri_offsets.name_addr_start + 1, ENC_UTF_8|ENC_NA); } offset = uri_offsets.name_addr_end +1; } /* Find parameter tag if present. * TODO make this generic to find any interesting parameter * use the same method as for SIP headers ? */ parameter_offset = offset; while (parameter_offset < line_end_offset && (tvb_strneql(tvb, parameter_offset, "tag=", 4) != 0)) parameter_offset++; if ( parameter_offset < line_end_offset ){ /* Tag found */ parameter_offset = parameter_offset + 4; parameter_end_offset = tvb_find_uint8(tvb, parameter_offset, (line_end_offset - parameter_offset), ';'); if ( parameter_end_offset == -1) parameter_end_offset = line_end_offset; parameter_len = parameter_end_offset - parameter_offset; proto_tree_add_item(sip_element_tree, hf_sip_from_tag, tvb, parameter_offset, parameter_len, ENC_UTF_8); item = proto_tree_add_item(sip_element_tree, hf_sip_tag, tvb, parameter_offset, parameter_len, ENC_UTF_8); proto_item_set_hidden(item); } }/* hdr_tree */ break; case POS_P_ASSERTED_IDENTITY : if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* * PAssertedID = "P-Asserted-Identity" HCOLON PAssertedID-value * *(COMMA PAssertedID-value) * PAssertedID-value = name-addr / addr-spec * * Initialize the uri_offsets */ sip_uri_offset_init(&uri_offsets); if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1) display_sip_uri(tvb, sip_element_tree, pinfo, &uri_offsets, &sip_pai_uri); } break; case POS_P_ASSOCIATED_URI: if (hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); /* * P-Associated-URI = "P-Associated-URI" HCOLON * [p-aso-uri-spec] * *(COMMA p-aso-uri-spec) * p-aso-uri-spec = name-addr *(SEMI ai-param) * ai-param = generic-param */ /* Skip to the end of the URI directly */ semi_colon_offset = tvb_find_uint8(tvb, value_offset, line_end_offset - value_offset, '>'); if (semi_colon_offset != -1) { semi_colon_offset = tvb_find_uint8(tvb, semi_colon_offset, line_end_offset - semi_colon_offset, ';'); if (semi_colon_offset != -1) { sip_element_tree = proto_item_add_subtree(sip_element_item, ett_sip_element); /* We have generic parameters */ dissect_sip_generic_parameters(tvb, sip_element_tree, pinfo, semi_colon_offset + 1, line_end_offset); } } } break; case POS_HISTORY_INFO: if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_hist); dissect_sip_history_info(tvb, sip_element_tree, pinfo, value_offset, line_end_offset); } break; case POS_P_CHARGING_FUNC_ADDRESSES: if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); dissect_sip_p_charging_func_addresses(tvb, sip_element_tree, pinfo, value_offset, line_end_offset); } break; case POS_P_PREFERRED_IDENTITY : if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* * PPreferredID = "P-Preferred-Identity" HCOLON PPreferredID-value * *(COMMA PPreferredID-value) * PPreferredID-value = name-addr / addr-spec * * Initialize the uri_offsets */ sip_uri_offset_init(&uri_offsets); if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1) display_sip_uri(tvb, sip_element_tree, pinfo, &uri_offsets, &sip_ppi_uri); } break; case POS_PERMISSION_MISSING : if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* * Permission-Missing = "Permission-Missing" HCOLON per-miss-spec * *( COMMA per-miss-spec ) * per-miss-spec = ( name-addr / addr-spec ) * *( SEMI generic-param ) * Initialize the uri_offsets */ sip_uri_offset_init(&uri_offsets); if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1) display_sip_uri(tvb, sip_element_tree, pinfo, &uri_offsets, &sip_pmiss_uri); } break; case POS_TRIGGER_CONSENT : if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* * Trigger-Consent = "Trigger-Consent" HCOLON trigger-cons-spec * *( COMMA trigger-cons-spec ) * trigger-cons-spec = ( SIP-URI / SIPS-URI ) * *( SEMI trigger-param ) * trigger-param = target-uri / generic-param * target-uri = "target-uri" EQUAL * LDQUOT *( qdtext / quoted-pair ) RDQUOT * Initialize the uri_offsets */ sip_uri_offset_init(&uri_offsets); if((dissect_sip_uri(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1) { tc_uri_item_tree = display_sip_uri(tvb, sip_element_tree, pinfo, &uri_offsets, &sip_tc_uri); if (line_end_offset > uri_offsets.uri_end) { int hparam_offset = uri_offsets.uri_end + 1; /* Is there a header parameter */ if (tvb_find_uint8(tvb, hparam_offset, 1,';')) { while ((hparam_offset != -1 && hparam_offset < line_end_offset) ) { /* Is this a target-uri ? */ hparam_offset = hparam_offset + 1; if (tvb_strncaseeql(tvb, hparam_offset, "target-uri=\"", 12) == 0) { int turi_start_offset = hparam_offset + 12; int turi_end_offset = tvb_find_uint8(tvb, turi_start_offset, -1,'\"'); if (turi_end_offset != -1) proto_tree_add_item(tc_uri_item_tree, hf_sip_tc_turi, tvb, turi_start_offset,(turi_end_offset - turi_start_offset),ENC_UTF_8); else break; /* malformed */ } hparam_offset = tvb_find_uint8(tvb, hparam_offset, -1,';'); } } } } }/* hdr_tree */ break; case POS_RETRY_AFTER: { /* Store the retry number */ char *value = tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, value_len, ENC_UTF_8 | ENC_NA); uint32_t retry; bool retry_valid = ws_strtou32(value, NULL, &retry); sip_element_item = proto_tree_add_uint(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, retry); if (!retry_valid) { expert_add_info(pinfo, sip_element_item, &ei_sip_retry_after_invalid); } } break; case POS_CSEQ : { /* Store the sequence number */ char *value = tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, value_len, ENC_UTF_8|ENC_NA); cseq_number = (uint32_t)strtoul(value, NULL, 10); cseq_number_set = 1; stat_info->tap_cseq_number=cseq_number; /* Add CSeq tree */ if (hdr_tree) { sip_element_item = proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); cseq_tree = proto_item_add_subtree(sip_element_item, ett_sip_cseq); } /* Walk past number and spaces characters to get to start of method name */ for (sub_value_offset=0; sub_value_offset < value_len; sub_value_offset++) { if (!g_ascii_isdigit(value[sub_value_offset])) { proto_tree_add_uint(cseq_tree, hf_sip_cseq_seq_no, tvb, value_offset, sub_value_offset, cseq_number); break; } } for (; sub_value_offset < value_len; sub_value_offset++) { if (g_ascii_isalpha(value[sub_value_offset])) { /* Have reached start of method name */ break; } } if (sub_value_offset == value_len) { /* Didn't find method name */ return offset - orig_offset; } /* Extract method name from value */ strlen_to_copy = (int)value_len-sub_value_offset; if (strlen_to_copy > MAX_CSEQ_METHOD_SIZE) { /* Note the error in the protocol tree */ proto_tree_add_string_format(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value+sub_value_offset, "%s String too big: %d bytes", sip_headers[POS_CSEQ].name, strlen_to_copy); return offset - orig_offset; } else { /* Add CSeq method to the tree */ proto_tree_add_item_ret_string(cseq_tree, hf_sip_cseq_method, tvb, value_offset + sub_value_offset, strlen_to_copy, ENC_UTF_8, pinfo->pool, (const uint8_t **)&cseq_method); } } break; case POS_RACK : { char *value = tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, value_len, ENC_UTF_8|ENC_NA); int cseq_no_offset; /*int cseq_method_offset;*/ /* Add RAck tree */ if (hdr_tree) { sip_element_item = proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); rack_tree = proto_item_add_subtree(sip_element_item, ett_sip_rack); } /* RSeq number */ for (sub_value_offset=0; sub_value_offset < value_len; sub_value_offset++) { if (!g_ascii_isdigit(value[sub_value_offset])) { proto_tree_add_uint(rack_tree, hf_sip_rack_rseq_no, tvb, value_offset, sub_value_offset, (uint32_t)strtoul(value, NULL, 10)); break; } } /* Get to start of CSeq number */ for ( ; sub_value_offset < value_len; sub_value_offset++) { if (value[sub_value_offset] != ' ' && value[sub_value_offset] != '\t') { break; } } cseq_no_offset = sub_value_offset; /* CSeq number */ for ( ; sub_value_offset < value_len; sub_value_offset++) { if (!g_ascii_isdigit(value[sub_value_offset])) { proto_tree_add_uint(rack_tree, hf_sip_rack_cseq_no, tvb, value_offset+cseq_no_offset, sub_value_offset-cseq_no_offset, (uint32_t)strtoul(value+cseq_no_offset, NULL, 10)); break; } } /* Get to start of CSeq method name */ for ( ; sub_value_offset < value_len; sub_value_offset++) { if (g_ascii_isalpha(value[sub_value_offset])) { /* Have reached start of method name */ break; } } /*cseq_method_offset = sub_value_offset;*/ if (sub_value_offset == linelen) { /* Didn't find method name */ return offset - orig_offset; } /* Add CSeq method to the tree */ if (cseq_tree) { proto_tree_add_item(rack_tree, hf_sip_rack_cseq_method, tvb, value_offset + sub_value_offset, (int)value_len-sub_value_offset, ENC_UTF_8); } break; } case POS_CALL_ID : { call_id = tvb_get_string_enc(pinfo->pool, tvb, value_offset, value_len, ENC_UTF_8|ENC_NA); proto_item *gen_item; /* Store the Call-id */ stat_info->tap_call_id = call_id; /* Add 'Call-id' string item to tree */ sip_element_item = proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, call_id); gen_item = proto_tree_add_string(hdr_tree, hf_sip_call_id_gen, tvb, offset, next_offset - offset, call_id); proto_item_set_generated(gen_item); if (sip_hide_generatd_call_ids) { proto_item_set_hidden(gen_item); } sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); } break; case POS_EXPIRES : if (tvb_strneql(tvb, value_offset, "0", value_len) == 0) { expires_is_0 = 1; } /* Add 'Expires' string item to tree */ sip_proto_tree_add_uint(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); break; /* * Content-Type is the same as Internet * media type used by other dissectors, * appropriate dissector found by * lookup in "media_type" dissector table. */ case POS_CONTENT_TYPE : sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); content_type_len = value_len; semi_colon_offset = tvb_find_uint8(tvb, value_offset, value_len, ';'); /* Content-Type = ( "Content-Type" / "c" ) HCOLON media-type * media-type = m-type SLASH m-subtype *(SEMI m-parameter) * SEMI = SWS ";" SWS ; semicolon * LWS = [*WSP CRLF] 1*WSP ; linear whitespace * SWS = [LWS] ; sep whitespace */ if ( semi_colon_offset != -1) { int content_type_end; /* * Skip whitespace after the semicolon. */ parameter_offset = tvb_skip_wsp(tvb, semi_colon_offset +1, value_offset + value_len - (semi_colon_offset +1)); content_type_end = tvb_skip_wsp_return(tvb, semi_colon_offset-1); content_type_len = content_type_end - value_offset; content_type_parameter_str_len = value_offset + value_len - parameter_offset; content_info.media_str = tvb_get_string_enc(wmem_packet_scope(), tvb, parameter_offset, content_type_parameter_str_len, ENC_UTF_8|ENC_NA); } media_type_str_lower_case = ascii_strdown_inplace( (char *)tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, content_type_len, ENC_UTF_8|ENC_NA)); /* Debug code proto_tree_add_debug_text(hdr_tree, tvb, value_offset,content_type_len, "media_type_str(lower cased)=%s",media_type_str_lower_case); */ break; case POS_CONTENT_LENGTH : { char *value = tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, value_len, ENC_UTF_8|ENC_NA); bool content_length_valid = ws_strtou32(value, NULL, &content_length); sip_element_item = proto_tree_add_uint(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, content_length); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); if (!content_length_valid) expert_add_info(pinfo, sip_element_item, &ei_sip_content_length_invalid); break; } case POS_MAX_BREADTH : case POS_MAX_FORWARDS : case POS_RSEQ : sip_proto_tree_add_uint(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); break; case POS_CONTACT : /* * Contact = ("Contact" / "m" ) HCOLON * ( STAR / (contact-param *(COMMA contact-param))) * contact-param = (name-addr / addr-spec) *(SEMI contact-params) */ sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* value_offset points to the first non SWS character after ':' */ c = tvb_get_uint8(tvb, value_offset); if (c =='*'){ contact_is_star = 1; break; } /*if(hdr_tree)*/ { comma_offset = value_offset; while((comma_offset = dissect_sip_contact_item(tvb, pinfo, sip_element_tree, comma_offset, next_offset, &contacts_expires_0, &contacts_expires_unknown)) != -1) { contacts++; if(comma_offset == next_offset) { /* Line End reached: Stop Parsing */ break; } if(tvb_get_uint8(tvb, comma_offset) != ',') { /* Undefined value reached: Stop Parsing */ break; } comma_offset++; /* skip comma */ } } break; case POS_AUTHORIZATION: /* Authorization = "Authorization" HCOLON credentials * credentials = ("Digest" LWS digest-response) * / other-response * digest-response = dig-resp *(COMMA dig-resp) * other-response = auth-scheme LWS auth-param * *(COMMA auth-param) */ case POS_WWW_AUTHENTICATE: /* Proxy-Authenticate = "Proxy-Authenticate" HCOLON challenge * challenge = ("Digest" LWS digest-cln *(COMMA digest-cln)) * / other-challenge * other-challenge = auth-scheme LWS auth-param * *(COMMA auth-param) * auth-scheme = token */ case POS_PROXY_AUTHENTICATE: /* Proxy-Authenticate = "Proxy-Authenticate" HCOLON challenge */ case POS_PROXY_AUTHORIZATION: /* Proxy-Authorization = "Proxy-Authorization" HCOLON credentials */ case POS_AUTHENTICATION_INFO: /* Authentication-Info = "Authentication-Info" HCOLON ainfo * *(COMMA ainfo) * ainfo = nextnonce / message-qop * / response-auth / cnonce * / nonce-count */ /* Add tree using whole text of line */ if (hdr_tree) { proto_item *ti_c; sip_authorization_t authorization_info = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; authorization_user_t * authorization_user = NULL; /* Add whole line as header tree */ sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); sip_element_tree = proto_item_add_subtree( sip_element_item, ett_sip_element); /* Set sip.auth as a hidden field/filter */ ti_c = proto_tree_add_item(hdr_tree, hf_sip_auth, tvb, offset, next_offset-offset, ENC_UTF_8); proto_item_set_hidden(ti_c); /* Check if we have any parameters */ if ((line_end_offset - value_offset) != 0) { /* Authentication-Info does not begin with the scheme name */ if (hf_index != POS_AUTHENTICATION_INFO) { /* The first time comma_offset is "start of parameters" */ comma_offset = tvb_ws_mempbrk_pattern_uint8(tvb, value_offset, line_end_offset - value_offset, &pbrk_whitespace, NULL); proto_tree_add_item(sip_element_tree, hf_sip_auth_scheme, tvb, value_offset, comma_offset - value_offset, ENC_UTF_8 | ENC_NA); } else { /* The first time comma_offset is "start of parameters" */ comma_offset = value_offset; } /* Parse each individual parameter in the line */ while ((comma_offset = dissect_sip_authorization_item(tvb, sip_element_tree, comma_offset, line_end_offset, &authorization_info)) != -1) { if (comma_offset == line_end_offset) { /* Line End reached: Stop Parsing */ break; } if (tvb_get_uint8(tvb, comma_offset) != ',') { /* Undefined value reached: Stop Parsing */ break; } comma_offset++; /* skip comma */ } if ((authorization_info.response != NULL) && (global_sip_validate_authorization) && (authorization_info.username != NULL) && (authorization_info.realm != NULL)) { /* If there is a response, check for valid credentials */ authorization_user = sip_get_authorization(&authorization_info); if (authorization_user) { authorization_info.method = wmem_strdup(wmem_packet_scope(), stat_info->request_method); if (!sip_validate_authorization(&authorization_info, authorization_user->password)) { proto_tree_add_expert_format(tree, pinfo, &ei_sip_authorization_invalid, tvb, offset, line_end_offset - offset, "SIP digest does not match known password %s", authorization_user->password); } } } } /* Check if we have any parameters */ }/*hdr_tree*/ break; case POS_ROUTE: /* Add Route subtree */ if (hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); route_tree = proto_item_add_subtree(sip_element_item, ett_sip_route); dissect_sip_route_header(tvb, route_tree, pinfo, &sip_route_uri, value_offset, line_end_offset); } break; case POS_RECORD_ROUTE: /* Add Record-Route subtree */ if (hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); route_tree = proto_item_add_subtree(sip_element_item, ett_sip_route); dissect_sip_route_header(tvb, route_tree, pinfo, &sip_record_route_uri, value_offset, line_end_offset); } break; case POS_SERVICE_ROUTE: /* Add Service-Route subtree */ if (hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); route_tree = proto_item_add_subtree(sip_element_item, ett_sip_route); dissect_sip_route_header(tvb, route_tree, pinfo, &sip_service_route_uri, value_offset, line_end_offset); } break; case POS_PATH: /* Add Path subtree */ if (hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); route_tree = proto_item_add_subtree(sip_element_item, ett_sip_route); dissect_sip_route_header(tvb, route_tree, pinfo, &sip_path_uri, value_offset, line_end_offset); } break; case POS_VIA: /* Add Via subtree */ if (hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); via_tree = proto_item_add_subtree(sip_element_item, ett_sip_via); dissect_sip_via_header(tvb, via_tree, value_offset, line_end_offset, pinfo); } break; case POS_REASON: if(hdr_tree) { sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); reason_tree = proto_item_add_subtree(sip_element_item, ett_sip_reason); dissect_sip_reason_header(tvb, reason_tree, pinfo, value_offset, line_end_offset); } break; case POS_CONTENT_ENCODING: /* Content-Encoding = ( "Content-Encoding" / "e" ) HCOLON * content-coding *(COMMA content-coding) */ sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); content_encoding_parameter_str = ascii_strdown_inplace(tvb_get_string_enc(wmem_packet_scope(), tvb, value_offset, (line_end_offset-value_offset), ENC_UTF_8|ENC_NA)); break; case POS_SECURITY_CLIENT: /* security-client = "Security-Client" HCOLON * sec-mechanism *(COMMA sec-mechanism) */ sip_element_item = sip_proto_tree_add_string(hdr_tree, hf_header_array[hf_index], tvb, offset, next_offset - offset, value_offset, value_len); sip_proto_set_format_text(hdr_tree, sip_element_item, tvb, offset, linelen); comma_offset = tvb_find_uint8(tvb, value_offset, line_end_offset - value_offset, ','); while(comma_offset content_length) datalen = content_length; if (reported_datalen > content_length) reported_datalen = content_length; } if (!call_id) { call_id = wmem_strdup(pinfo->pool, ""); expert_add_info(pinfo, hdr_tree, &ei_sip_call_id_invalid); /* XXX: The hash table lookups below (setup time, request/response, * resend) are less reliable when the mandatory Call-Id header field * is missing. */ } /* Add to info column interesting things learned from header fields. */ /* for either REGISTER requests or responses, any contacts without expires * parameter use the Expires header's value */ if (expires_is_0) { /* this may add nothing, but that's ok */ contacts_expires_0 += contacts_expires_unknown; } /* Registration requests */ if (current_method_idx == SIP_METHOD_REGISTER) { /* TODO: what if there's a *-contact but also non-*-contacts? * we should create expert info for that someday I guess */ if (contact_is_star && expires_is_0) { col_append_str(pinfo->cinfo, COL_INFO, " (remove all bindings)"); } else if (contacts_expires_0 > 0) { col_append_fstr(pinfo->cinfo, COL_INFO, " (remove %d binding%s)", contacts_expires_0, contacts_expires_0 == 1 ? "":"s"); if (contacts > contacts_expires_0) { col_append_fstr(pinfo->cinfo, COL_INFO, " (add %d binding%s)", contacts - contacts_expires_0, (contacts - contacts_expires_0 == 1) ? "":"s"); } } else if (!contacts) { col_append_str(pinfo->cinfo, COL_INFO, " (fetch bindings)"); } else { col_append_fstr(pinfo->cinfo, COL_INFO, " (%d binding%s)", contacts, contacts == 1 ? "":"s"); } } /* Registration responses - this info only makes sense in 2xx responses */ if (line_type == STATUS_LINE && stat_info) { if (stat_info->response_code == 200) { col_append_fstr(pinfo->cinfo, COL_INFO, " (%s)", cseq_method); } if ((strcmp(cseq_method, "REGISTER") == 0) && stat_info->response_code > 199 && stat_info->response_code < 300) { if (contacts_expires_0 > 0) { col_append_fstr(pinfo->cinfo, COL_INFO, " (removed %d binding%s)", contacts_expires_0, contacts_expires_0 == 1 ? "":"s"); if (contacts > contacts_expires_0) { col_append_fstr(pinfo->cinfo, COL_INFO, " (%d binding%s kept)", contacts - contacts_expires_0, (contacts - contacts_expires_0 == 1) ? "":"s"); } } else { col_append_fstr(pinfo->cinfo, COL_INFO, " (%d binding%s)", contacts, contacts == 1 ? "":"s"); } } } /* We've finished writing to the info col for this SIP message * Set fence in case there is more than one (SIP)message in the frame */ /* XXX: this produces ugly output, since usually there's only one SIP * message in a frame yet this '|' gets added at the end. Need a better * way to do this. */ col_append_str(pinfo->cinfo, COL_INFO, " | "); col_set_fence(pinfo->cinfo, COL_INFO); /* Find the total setup time, Must be done before checking for resend * As that will overwrite the "Request packet no". */ if ((line_type == REQUEST_LINE)&&(strcmp(cseq_method, "ACK") == 0)) { request_for_response = sip_find_invite(pinfo, cseq_method, call_id, cseq_number_set, cseq_number, &response_time); stat_info->setup_time = response_time; } /* For responses, try to link back to request frame */ if (line_type == STATUS_LINE) { request_for_response = sip_find_request(pinfo, cseq_method, call_id, cseq_number_set, cseq_number, &response_time); } /* Check if this packet is a resend. */ resend_for_packet = sip_is_packet_resend(pinfo, cseq_method, call_id, cseq_number_set, cseq_number, line_type); /* Mark whether this is a resend for the tap */ stat_info->resend = (resend_for_packet > 0); /* Report this packet to the tap */ if (!pinfo->flags.in_error_pkt) { tap_queue_packet(sip_tap, pinfo, stat_info); } if (datalen > 0) { /* * There's a message body starting at "offset". * Set the length of the header item. */ sdp_setup_info_t setup_info = { .hf_id = hf_sip_call_id_gen, .add_hidden = sip_hide_generatd_call_ids, .hf_type = SDP_TRACE_ID_HF_TYPE_STR, .trace_id.str = wmem_strdup(wmem_file_scope(), call_id), }; content_info.data = &setup_info; if(content_encoding_parameter_str != NULL && (!strncmp(content_encoding_parameter_str, "gzip", 4) || !strncmp(content_encoding_parameter_str,"deflate",7))){ /* The body is gzip:ed */ next_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, datalen); if (next_tvb) { add_new_data_source(pinfo, next_tvb, "gunzipped data"); if(sip_tree) { ti_a = proto_tree_add_item(sip_tree, hf_sip_msg_body, next_tvb, 0, -1, ENC_NA); message_body_tree = proto_item_add_subtree(ti_a, ett_sip_message_body); } } else { next_tvb = tvb_new_subset_length_caplen(tvb, offset, datalen, reported_datalen); if(sip_tree) { ti_a = proto_tree_add_item(sip_tree, hf_sip_msg_body, next_tvb, 0, -1, ENC_NA); message_body_tree = proto_item_add_subtree(ti_a, ett_sip_message_body); } } }else{ next_tvb = tvb_new_subset_length_caplen(tvb, offset, datalen, reported_datalen); if(sip_tree) { ti_a = proto_tree_add_item(sip_tree, hf_sip_msg_body, next_tvb, 0, -1, ENC_NA); message_body_tree = proto_item_add_subtree(ti_a, ett_sip_message_body); } } /* give the content type parameters to sub dissectors */ if ( media_type_str_lower_case != NULL ) { /* SDP needs a transport layer to determine request/response */ if (!strcmp(media_type_str_lower_case, "application/sdp")) { /* Resends don't count */ if (resend_for_packet == 0) { if (line_type == REQUEST_LINE) { DPRINT(("calling setup_sdp_transport() SDP_EXCHANGE_OFFER frame=%d", pinfo->num)); DINDENT(); setup_sdp_transport(next_tvb, pinfo, SDP_EXCHANGE_OFFER, pinfo->num, sip_delay_sdp_changes, &setup_info); DENDENT(); } else if (line_type == STATUS_LINE) { if (stat_info->response_code >= 400) { DPRINT(("calling setup_sdp_transport() SDP_EXCHANGE_ANSWER_REJECT " "request_frame=%d, this=%d", request_for_response, pinfo->num)); DINDENT(); /* SIP client request failed, so SDP offer should fail */ setup_sdp_transport(next_tvb, pinfo, SDP_EXCHANGE_ANSWER_REJECT, request_for_response, sip_delay_sdp_changes, &setup_info); DENDENT(); } else if ((stat_info->response_code >= 200) && (stat_info->response_code <= 299)) { DPRINT(("calling setup_sdp_transport() SDP_EXCHANGE_ANSWER_ACCEPT " "request_frame=%d, this=%d", request_for_response, pinfo->num)); DINDENT(); /* SIP success request, so SDP offer should be accepted */ setup_sdp_transport(next_tvb, pinfo, SDP_EXCHANGE_ANSWER_ACCEPT, request_for_response, sip_delay_sdp_changes, &setup_info); DENDENT(); } } } else { DPRINT(("calling setup_sdp_transport() resend_for_packet " "request_frame=%d, this=%d", request_for_response, pinfo->num)); DINDENT(); setup_sdp_transport_resend(pinfo->num, resend_for_packet); DENDENT(); } } /* XXX: why is this called even if setup_sdp_transport() was called before? That will parse the SDP a second time, for 'application/sdp' media MIME bodies */ DPRINT(("calling dissector_try_string()")); DINDENT(); found_match = dissector_try_string(media_type_dissector_table, media_type_str_lower_case, next_tvb, pinfo, message_body_tree, &content_info); DENDENT(); DPRINT(("done calling dissector_try_string() with found_match=%u", found_match)); if (!found_match && !strncmp(media_type_str_lower_case, "multipart/", sizeof("multipart/")-1)) { DPRINT(("calling dissector_try_string() for multipart")); DINDENT(); /* Try to decode the unknown multipart subtype anyway */ found_match = dissector_try_string(media_type_dissector_table, "multipart/", next_tvb, pinfo, message_body_tree, &content_info); DENDENT(); DPRINT(("done calling dissector_try_string() with found_match=%u", found_match)); } /* If no match dump as text */ } if ( found_match == 0 ) { DPRINT(("calling dissector_try_heuristic() with found_match=0")); DINDENT(); if (!(dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, message_body_tree, &hdtbl_entry, NULL))) { int tmp_offset = 0; while (tvb_offset_exists(next_tvb, tmp_offset)) { tvb_find_line_end(next_tvb, tmp_offset, -1, &next_offset, false); linelen = next_offset - tmp_offset; proto_tree_add_format_text(message_body_tree, next_tvb, tmp_offset, linelen); tmp_offset = next_offset; }/* end while */ } DENDENT(); } offset += datalen; } /* And add the filterable field to the request/response line */ if (reqresp_tree) { proto_item *item; item = proto_tree_add_boolean(reqresp_tree, hf_sip_resend, tvb, orig_offset, 0, resend_for_packet > 0); proto_item_set_generated(item); if (resend_for_packet > 0) { item = proto_tree_add_uint(reqresp_tree, hf_sip_original_frame, tvb, orig_offset, 0, resend_for_packet); proto_item_set_generated(item); } if (request_for_response > 0) { item = proto_tree_add_uint(reqresp_tree, hf_sip_matching_request_frame, tvb, orig_offset, 0, request_for_response); proto_item_set_generated(item); item = proto_tree_add_uint(reqresp_tree, hf_sip_response_time, tvb, orig_offset, 0, response_time); proto_item_set_generated(item); if ((line_type == STATUS_LINE)&&(strcmp(cseq_method, "BYE") == 0)){ item = proto_tree_add_uint(reqresp_tree, hf_sip_release_time, tvb, orig_offset, 0, response_time); proto_item_set_generated(item); } } } if (ts != NULL) proto_item_set_len(ts, offset - orig_offset); if (global_sip_raw_text) tvb_raw_text_add(tvb, orig_offset, offset - orig_offset, body_offset, pinfo, tree); /* Append a brief summary to the SIP root item */ if (stat_info->request_method) { proto_item_append_text(ts, " (%s)", stat_info->request_method); } else { proto_item_append_text(ts, " (%u)", stat_info->response_code); } return offset - orig_offset; } /* Display filter for SIP Request-Line */ static void dfilter_sip_request_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int offset, unsigned meth_len, int linelen) { const uint8_t *value; unsigned parameter_len = meth_len; uri_offset_info uri_offsets; /* * We know we have the entire method; otherwise, "sip_parse_line()" * would have returned OTHER_LINE. * Request-Line = Method SP Request-URI SP SIP-Version CRLF * SP = single space * Request-URI = SIP-URI / SIPS-URI / absoluteURI */ /* get method string*/ proto_tree_add_item_ret_string(tree, hf_sip_Method, tvb, offset, parameter_len, ENC_ASCII | ENC_NA, wmem_packet_scope(), &value); /* Copy request method for telling tap */ stat_info->request_method = value; if (tree) { /* build Request-URI tree*/ offset=offset + parameter_len+1; sip_uri_offset_init(&uri_offsets); /* calc R-URI len*/ uri_offsets.uri_end = tvb_find_uint8(tvb, offset, linelen, ' ')-1; dissect_sip_uri(tvb, pinfo, offset, offset + linelen, &uri_offsets); display_sip_uri(tvb, tree, pinfo, &uri_offsets, &sip_req_uri); } } /* Display filter for SIP Status-Line */ static void dfilter_sip_status_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int line_end, int offset) { int response_code = 0; bool response_code_valid; proto_item* pi; int diag_len; tvbuff_t *next_tvb; /* * We know we have the entire status code; otherwise, * "sip_parse_line()" would have returned OTHER_LINE. * We also know that we have a version string followed by a * space at the beginning of the line, for the same reason. */ offset = offset + SIP2_HDR_LEN + 1; response_code_valid = ws_strtoi32(tvb_get_string_enc(wmem_packet_scope(), tvb, offset, 3, ENC_UTF_8|ENC_NA), NULL, &response_code); /* Add numerical response code to tree */ pi = proto_tree_add_uint(tree, hf_sip_Status_Code, tvb, offset, 3, response_code); if (!response_code_valid) expert_add_info(pinfo, pi, &ei_sip_Status_Code_invalid); /* Add response code for sending to tap */ stat_info->response_code = response_code; /* Skip past the response code and possible trailing space */ offset = offset + 3 + 1; /* Check for diagnostics */ diag_len = line_end - (SIP2_HDR_LEN + 1 + 3 + 1); if((diag_len) <= 0) return; /* If we have a SIP diagnostics sub dissector call it */ if(sip_diag_handle){ next_tvb = tvb_new_subset_length(tvb, offset, diag_len); call_dissector_only(sip_diag_handle, next_tvb, pinfo, tree, NULL); } } /* From section 4.1 of RFC 2543: * * Request-Line = Method SP Request-URI SP SIP-Version CRLF * * From section 5.1 of RFC 2543: * * Status-Line = SIP-version SP Status-Code SP Reason-Phrase CRLF * * From section 7.1 of RFC 3261: * * Unlike HTTP, SIP treats the version number as a literal string. * In practice, this should make no difference. */ static line_type_t sip_parse_line(tvbuff_t *tvb, int offset, int linelen, unsigned *token_1_lenp) { int space_offset; int token_1_start; unsigned token_1_len; int token_2_start; unsigned token_2_len; int token_3_start; unsigned token_3_len; int colon_pos; token_1_start = offset; space_offset = tvb_find_uint8(tvb, token_1_start, -1, ' '); if ((space_offset == -1) || (space_offset == token_1_start)) { /* * Either there's no space in the line (which means * the line is empty or doesn't have a token followed * by a space; neither is valid for a request or status), or * the first character in the line is a space (meaning * the method is empty, which isn't valid for a request, * or the SIP version is empty, which isn't valid for a * status). */ return OTHER_LINE; } token_1_len = space_offset - token_1_start; token_2_start = space_offset + 1; space_offset = tvb_find_uint8(tvb, token_2_start, -1, ' '); if (space_offset == -1) { /* * There's no space after the second token, so we don't * have a third token. */ return OTHER_LINE; } token_2_len = space_offset - token_2_start; token_3_start = space_offset + 1; token_3_len = token_1_start + linelen - token_3_start; *token_1_lenp = token_1_len; /* * Is the first token a version string? */ if ( (strict_sip_version && ( token_1_len == SIP2_HDR_LEN && tvb_strneql(tvb, token_1_start, SIP2_HDR, SIP2_HDR_LEN) == 0) ) || (! strict_sip_version && ( tvb_strncaseeql(tvb, token_1_start, "SIP/", 4) == 0) )) { /* * Yes, so this is either a Status-Line or something * else other than a Request-Line. To be a Status-Line, * the second token must be a 3-digit number. */ if (token_2_len != 3) { /* * We don't have 3-character status code. */ return OTHER_LINE; } if (!g_ascii_isdigit(tvb_get_uint8(tvb, token_2_start)) || !g_ascii_isdigit(tvb_get_uint8(tvb, token_2_start + 1)) || !g_ascii_isdigit(tvb_get_uint8(tvb, token_2_start + 2))) { /* * 3 characters yes, 3 digits no. */ return OTHER_LINE; } return STATUS_LINE; } else { /* * No, so this is either a Request-Line or something * other than a Status-Line. To be a Request-Line, the * second token must be a URI and the third token must * be a version string. */ if (token_2_len < 3) { /* * We don't have a URI consisting of at least 3 * characters. */ return OTHER_LINE; } colon_pos = tvb_find_uint8(tvb, token_2_start + 1, -1, ':'); if (colon_pos == -1) { /* * There is no colon after the method, so the URI * doesn't have a colon in it, so it's not valid. */ return OTHER_LINE; } if (colon_pos >= token_3_start) { /* * The colon is in the version string, not the URI. */ return OTHER_LINE; } /* XXX - Check for a proper URI prefix? */ if ( (strict_sip_version && ( token_3_len != SIP2_HDR_LEN || tvb_strneql(tvb, token_3_start, SIP2_HDR, SIP2_HDR_LEN) == -1) ) || (! strict_sip_version && ( tvb_strncaseeql(tvb, token_3_start, "SIP/", 4) == -1) )) { /* * The version string isn't an SIP version 2.0 version * string. */ return OTHER_LINE; } return REQUEST_LINE; } } static bool sip_is_known_request(tvbuff_t *tvb, int meth_offset, unsigned meth_len, unsigned *meth_idx) { unsigned i; char *meth_name; meth_name = tvb_get_string_enc(wmem_packet_scope(), tvb, meth_offset, meth_len, ENC_UTF_8|ENC_NA); for (i = 1; i < array_length(sip_methods); i++) { if (meth_len == strlen(sip_methods[i]) && strncmp(meth_name, sip_methods[i], meth_len) == 0) { *meth_idx = i; return true; } } return false; } /* * Returns index of method in sip_headers * Header namne should be in lower case */ static int sip_is_known_sip_header(char *header_name, unsigned header_len) { unsigned pos; /* Compact name is one character long */ if(header_len>1){ pos = GPOINTER_TO_UINT(g_hash_table_lookup(sip_headers_hash, header_name)); if (pos!=0) return pos; } /* Look for compact name match */ for (pos = 1; pos < array_length(sip_headers); pos++) { if (sip_headers[pos].compact_name != NULL && header_len == strlen(sip_headers[pos].compact_name) && g_ascii_strncasecmp(header_name, sip_headers[pos].compact_name, header_len) == 0) return pos; } return -1; } /* * Display the entire message as raw text. */ static void tvb_raw_text_add(tvbuff_t *tvb, int offset, int length, int body_offset, packet_info* pinfo, proto_tree *tree) { proto_tree *raw_tree; proto_item *ti; int next_offset, linelen, end_offset; char *str; tvbuff_t* body_tvb = NULL; ti = proto_tree_add_item(tree, proto_raw_sip, tvb, offset, length, ENC_NA); raw_tree = proto_item_add_subtree(ti, ett_raw_text); end_offset = offset + length; if (body_offset < end_offset && global_sip_raw_text_body_default_encoding != IANA_CS_UTF_8 /* UTF-8 compatible with ASCII */ && global_sip_raw_text_body_default_encoding != IANA_CS_US_ASCII) { /* Create body tvb with new character encoding */ uint32_t iana_charset_id = global_sip_raw_text_body_default_encoding; unsigned ws_encoding_id = mibenum_charset_to_encoding((unsigned)iana_charset_id); if (ws_encoding_id != (ENC_NA | ENC_ASCII) && ws_encoding_id != (ENC_NA | ENC_UTF_8)) { /* Encoding body with the new encoding */ char* encoding_name = val_to_str_ext_wmem(pinfo->pool, iana_charset_id, &mibenum_vals_character_sets_ext, "UNKNOWN"); const uint8_t* data_str = tvb_get_string_enc(wmem_packet_scope(), tvb, body_offset, end_offset - body_offset, ws_encoding_id); size_t l = strlen(data_str); body_tvb = tvb_new_child_real_data(tvb, data_str, (unsigned)l, (int)l); add_new_data_source(pinfo, body_tvb, wmem_strdup_printf(pinfo->pool, "Decoded %s text", encoding_name)); } } /* Display the headers of SIP message as raw text */ while (offset < body_offset) { tvb_find_line_end(tvb, offset, -1, &next_offset, false); linelen = next_offset - offset; if (raw_tree) { if (global_sip_raw_text_without_crlf) str = tvb_format_text_wsp(wmem_packet_scope(), tvb, offset, linelen); else str = tvb_format_text(wmem_packet_scope(), tvb, offset, linelen); proto_tree_add_string_format(raw_tree, hf_sip_raw_line, tvb, offset, linelen, str, "%s", str); } offset = next_offset; } DISSECTOR_ASSERT_HINT(offset == body_offset, "The offset must be equal to body_offset before dissect body as raw text."); if (body_offset < end_offset) { /* Dissect the body of SIP message as raw text */ if (body_tvb) { offset = 0; end_offset = tvb_captured_length_remaining(body_tvb, 0); } else { body_tvb = tvb; /* reuse old offset and end_offset */ } while (offset < end_offset) { tvb_find_line_end(body_tvb, offset, -1, &next_offset, false); linelen = next_offset - offset; if (raw_tree) { if (global_sip_raw_text_without_crlf) str = tvb_format_text_wsp(wmem_packet_scope(), body_tvb, offset, linelen); else str = tvb_format_text(wmem_packet_scope(), body_tvb, offset, linelen); proto_tree_add_string_format(raw_tree, hf_sip_raw_line, body_tvb, offset, linelen, str, "%s", str); } offset = next_offset; } } } /* Check to see if this packet is a resent request. Return value is the frame number of the original frame this packet seems to be resending (0 = no resend). */ unsigned sip_is_packet_resend(packet_info *pinfo, const char *cseq_method, char *call_id, unsigned char cseq_number_set, uint32_t cseq_number, line_type_t line_type) { uint32_t cseq_to_compare = 0; sip_hash_key key; sip_hash_key *p_key = 0; sip_hash_value *p_val = 0; sip_frame_result_value *sip_frame_result = NULL; unsigned result = 0; /* Don't consider packets that appear to be resent only because they are e.g. returned in ICMP unreachable messages. */ if (pinfo->flags.in_error_pkt) { return 0; } /* A broken packet may have no cseq number set. Don't consider it as a resend */ if (!cseq_number_set) { return 0; } /* Return any answer stored from previous dissection */ if (pinfo->fd->visited) { sip_frame_result = (sip_frame_result_value*)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num); if (sip_frame_result != NULL) { return sip_frame_result->original_frame_num; } else { return 0; } } /* No packet entry found, consult global hash table */ /* Prepare the key */ (void) g_strlcpy(key.call_id, call_id, MAX_CALL_ID_SIZE); /* We're only using these addresses locally (for the hash lookup) so * there is no need to make a (g_malloc'd) copy of them. */ set_address(&key.dest_address, pinfo->net_dst.type, pinfo->net_dst.len, pinfo->net_dst.data); set_address(&key.source_address, pinfo->net_src.type, pinfo->net_src.len, pinfo->net_src.data); key.dest_port = pinfo->destport; if (sip_retrans_the_same_sport) { key.source_port = pinfo->srcport; } else { key.source_port = MAGIC_SOURCE_PORT; } key.ptype = pinfo->ptype; /* Do the lookup */ p_val = (sip_hash_value*)g_hash_table_lookup(sip_hash, &key); if (p_val) { /* Table entry found, we'll use its value for comparison */ cseq_to_compare = p_val->cseq; /* First time through, must update value with current details if cseq number has changed */ if (cseq_number != p_val->cseq) { p_val->cseq = cseq_number; p_val->method = wmem_strdup(wmem_file_scope(), cseq_method); p_val->transaction_state = nothing_seen; p_val->frame_number = 0; if (line_type == REQUEST_LINE) { p_val->request_time = pinfo->abs_ts; } } } else { /* Need to create a new table entry */ /* Allocate a new key and value */ p_key = wmem_new(wmem_file_scope(), sip_hash_key); p_val = wmem_new0(wmem_file_scope(), sip_hash_value); /* Fill in key and value details */ snprintf(p_key->call_id, MAX_CALL_ID_SIZE, "%s", call_id); copy_address_wmem(wmem_file_scope(), &(p_key->dest_address), &pinfo->net_dst); copy_address_wmem(wmem_file_scope(), &(p_key->source_address), &pinfo->net_src); p_key->dest_port = pinfo->destport; if (sip_retrans_the_same_sport) { p_key->source_port = pinfo->srcport; } else { p_key->source_port = MAGIC_SOURCE_PORT; } p_key->ptype = pinfo->ptype; p_val->cseq = cseq_number; p_val->method = wmem_strdup(wmem_file_scope(), cseq_method); p_val->transaction_state = nothing_seen; if (line_type == REQUEST_LINE) { p_val->request_time = pinfo->abs_ts; } /* Add entry */ g_hash_table_insert(sip_hash, p_key, p_val); /* Assume have seen no cseq yet */ cseq_to_compare = 0; } /******************************************/ /* Is it a resend??? */ /* Does this look like a resent request (discount ACK, CANCEL, or a different method from the original one) ? */ if ((line_type == REQUEST_LINE) && (cseq_number == cseq_to_compare) && (p_val->transaction_state == request_seen) && (strcmp(cseq_method, p_val->method) == 0) && (strcmp(cseq_method, "ACK") != 0) && (strcmp(cseq_method, "CANCEL") != 0)) { result = p_val->frame_number; } /* Does this look like a resent final response ? */ if ((line_type == STATUS_LINE) && (cseq_number == cseq_to_compare) && (p_val->transaction_state == final_response_seen) && (strcmp(cseq_method, p_val->method) == 0) && (stat_info->response_code >= 200) && (stat_info->response_code == p_val->response_code)) { result = p_val->frame_number; } /* Update state for this entry */ p_val->cseq = cseq_number; switch (line_type) { case REQUEST_LINE: p_val->transaction_state = request_seen; if (!result) { /* This frame is the original request */ p_val->frame_number = pinfo->num; p_val->request_time = pinfo->abs_ts; } break; case STATUS_LINE: if (stat_info->response_code >= 200) { p_val->response_code = stat_info->response_code; p_val->transaction_state = final_response_seen; if (!result) { /* This frame is the original response */ p_val->frame_number = pinfo->num; } } else { p_val->transaction_state = provisional_response_seen; } break; default: break; } sip_frame_result = (sip_frame_result_value *)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num); if (sip_frame_result == NULL) { sip_frame_result = wmem_new0(wmem_file_scope(), sip_frame_result_value); p_add_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num, sip_frame_result); } /* Store return value with this packet */ sip_frame_result->original_frame_num = result; return result; } /* Check to see if this packet is a resent request. Return value is the frame number of the original frame this packet seems to be resending (0 = no resend). */ unsigned sip_find_request(packet_info *pinfo, const char *cseq_method, char *call_id, unsigned char cseq_number_set, uint32_t cseq_number, uint32_t *response_time) { uint32_t cseq_to_compare = 0; sip_hash_key key; sip_hash_value *p_val = 0; sip_frame_result_value *sip_frame_result = NULL; unsigned result = 0; int seconds_between_packets; int nseconds_between_packets; /* Ignore error (usually ICMP) frames */ if (pinfo->flags.in_error_pkt) { return 0; } /* A broken packet may have no cseq number set. Ignore. */ if (!cseq_number_set) { return 0; } /* Return any answer stored from previous dissection */ if (pinfo->fd->visited) { sip_frame_result = (sip_frame_result_value*)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num); if (sip_frame_result != NULL) { *response_time = sip_frame_result->response_time; return sip_frame_result->response_request_frame_num; } else { return 0; } } /* No packet entry found, consult global hash table */ /* Prepare the key */ (void) g_strlcpy(key.call_id, call_id, MAX_CALL_ID_SIZE); /* Looking for matching request, so reverse addresses for this lookup */ set_address(&key.dest_address, pinfo->net_src.type, pinfo->net_src.len, pinfo->net_src.data); set_address(&key.source_address, pinfo->net_dst.type, pinfo->net_dst.len, pinfo->net_dst.data); key.dest_port = pinfo->srcport; key.source_port = pinfo->destport; key.ptype = pinfo->ptype; /* Do the lookup */ p_val = (sip_hash_value*)g_hash_table_lookup(sip_hash, &key); if (p_val) { /* Table entry found, we'll use its value for comparison */ cseq_to_compare = p_val->cseq; } else { /* We don't have the request */ return 0; } /**************************************************/ /* Is it a response to a request that we've seen? */ if ((cseq_number == cseq_to_compare) && (p_val->transaction_state == request_seen) && (strcmp(cseq_method, p_val->method) == 0)) { result = p_val->frame_number; } /* Store return value with this packet */ sip_frame_result = (sip_frame_result_value *)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num); if (sip_frame_result == NULL) { /* Allocate and set all values to zero */ sip_frame_result = wmem_new0(wmem_file_scope(), sip_frame_result_value); p_add_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num, sip_frame_result); } sip_frame_result->response_request_frame_num = result; /* Work out response time */ seconds_between_packets = (int) (pinfo->abs_ts.secs - p_val->request_time.secs); nseconds_between_packets = pinfo->abs_ts.nsecs - p_val->request_time.nsecs; sip_frame_result->response_time = (seconds_between_packets*1000) + (nseconds_between_packets / 1000000); *response_time = sip_frame_result->response_time; return result; } /* * Find the initial INVITE to calculate the total setup time */ unsigned sip_find_invite(packet_info *pinfo, const char *cseq_method _U_, char *call_id, unsigned char cseq_number_set, uint32_t cseq_number _U_, uint32_t *response_time) { #if 0 uint32_t cseq_to_compare = 0; #endif sip_hash_key key; sip_hash_value *p_val = 0; sip_frame_result_value *sip_frame_result = NULL; unsigned result = 0; int seconds_between_packets; int nseconds_between_packets; /* Ignore error (usually ICMP) frames */ if (pinfo->flags.in_error_pkt) { return 0; } /* A broken packet may have no cseq number set. Ignore. */ if (!cseq_number_set) { return 0; } /* Return any answer stored from previous dissection */ if (pinfo->fd->visited) { sip_frame_result = (sip_frame_result_value*)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num); if (sip_frame_result != NULL) { *response_time = sip_frame_result->response_time; return sip_frame_result->response_request_frame_num; } else { return 0; } } /* No packet entry found, consult global hash table */ /* Prepare the key */ (void) g_strlcpy(key.call_id, call_id, MAX_CALL_ID_SIZE); /* Looking for matching INVITE */ set_address(&key.dest_address, pinfo->net_dst.type, pinfo->net_dst.len, pinfo->net_dst.data); set_address(&key.source_address, pinfo->net_src.type, pinfo->net_src.len, pinfo->net_src.data); key.dest_port = pinfo->destport; key.source_port = pinfo->srcport; key.ptype = pinfo->ptype; /* Do the lookup */ p_val = (sip_hash_value*)g_hash_table_lookup(sip_hash, &key); if (p_val) { #if 0 /* Table entry found, we'll use its value for comparison */ cseq_to_compare = p_val->cseq; #endif } else { /* We don't have the request */ return 0; } /**************************************************/ /* Is it a response to a request that we've seen? */ #if 0 if ((cseq_number == cseq_to_compare) && (p_val->transaction_state == request_seen) && (strcmp(cseq_method, p_val->method) == 0)) { result = p_val->frame_number; } #endif result = p_val->frame_number; /* Store return value with this packet */ sip_frame_result = (sip_frame_result_value *)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num); if (sip_frame_result == NULL) { /* Allocate and set all values to zero */ sip_frame_result = wmem_new0(wmem_file_scope(), sip_frame_result_value); p_add_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num, sip_frame_result); } sip_frame_result->response_request_frame_num = result; /* Work out response time */ seconds_between_packets = (int) (pinfo->abs_ts.secs - p_val->request_time.secs); nseconds_between_packets = pinfo->abs_ts.nsecs - p_val->request_time.nsecs; sip_frame_result->response_time = (seconds_between_packets*1000) + (nseconds_between_packets / 1000000); *response_time = sip_frame_result->response_time; return result; } static bool sip_validate_authorization(sip_authorization_t *authorization_info, char *password) { char ha1[33] = {0}; char ha2[33] = {0}; char response[33] = {0}; gcry_md_hd_t md5_handle; if ( (authorization_info->qop == NULL) || (authorization_info->username == NULL) || (authorization_info->realm == NULL) || (authorization_info->method == NULL) || (authorization_info->uri == NULL) || (authorization_info->nonce == NULL) ) { return true; /* If no qop, discard */ } if (strcmp(authorization_info->qop, "auth") || (authorization_info->nonce_count == NULL) || (authorization_info->cnonce == NULL) || (authorization_info->response == NULL) || (password == NULL)) { return true; /* Obsolete or not enough information, discard */ } if (gcry_md_open(&md5_handle, GCRY_MD_MD5, 0)) { return false; } gcry_md_write(md5_handle, authorization_info->username, strlen(authorization_info->username)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, authorization_info->realm, strlen(authorization_info->realm)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, password, strlen(password)); /* Array is zeroed out so there is always a \0 at index 32 for string termination */ bytes_to_hexstr(ha1, gcry_md_read(md5_handle, 0), HASH_MD5_LENGTH); gcry_md_reset(md5_handle); gcry_md_write(md5_handle, authorization_info->method, strlen(authorization_info->method)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, authorization_info->uri, strlen(authorization_info->uri)); /* Array is zeroed out so there is always a \0 at index 32 for string termination */ bytes_to_hexstr(ha2, gcry_md_read(md5_handle, 0), HASH_MD5_LENGTH); gcry_md_reset(md5_handle); gcry_md_write(md5_handle, ha1, strlen(ha1)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, authorization_info->nonce, strlen(authorization_info->nonce)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, authorization_info->nonce_count, strlen(authorization_info->nonce_count)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, authorization_info->cnonce, strlen(authorization_info->cnonce)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, authorization_info->qop, strlen(authorization_info->qop)); gcry_md_putc(md5_handle, ':'); gcry_md_write(md5_handle, ha2, strlen(ha2)); /* Array is zeroed out so there is always a \0 at index 32 for string termination */ bytes_to_hexstr(response, gcry_md_read(md5_handle, 0), HASH_MD5_LENGTH); gcry_md_close(md5_handle); if (!strncmp(response, authorization_info->response, 32)) { return true; } return false; } /* TAP STAT INFO */ /* * Much of this is from ui/gtk/sip_stat.c: * sip_stat 2004 Martin Mathieson */ /* TODO: extra codes to be added from SIP extensions? * https://www.iana.org/assignments/sip-parameters/sip-parameters.xhtml#sip-parameters-6 */ const value_string sip_response_code_vals[] = { { 999, "Unknown response"}, /* Must be first */ { 100, "Trying"}, { 180, "Ringing"}, { 181, "Call Is Being Forwarded"}, { 182, "Queued"}, { 183, "Session Progress"}, { 199, "Informational - Others" }, { 200, "OK"}, { 202, "Accepted"}, { 204, "No Notification"}, { 299, "Success - Others"}, /* used to keep track of other Success packets */ { 300, "Multiple Choices"}, { 301, "Moved Permanently"}, { 302, "Moved Temporarily"}, { 305, "Use Proxy"}, { 380, "Alternative Service"}, { 399, "Redirection - Others"}, { 400, "Bad Request"}, { 401, "Unauthorized"}, { 402, "Payment Required"}, { 403, "Forbidden"}, { 404, "Not Found"}, { 405, "Method Not Allowed"}, { 406, "Not Acceptable"}, { 407, "Proxy Authentication Required"}, { 408, "Request Timeout"}, { 410, "Gone"}, { 412, "Conditional Request Failed"}, { 413, "Request Entity Too Large"}, { 414, "Request-URI Too Long"}, { 415, "Unsupported Media Type"}, { 416, "Unsupported URI Scheme"}, { 420, "Bad Extension"}, { 421, "Extension Required"}, { 422, "Session Timer Too Small"}, { 423, "Interval Too Brief"}, { 428, "Use Identity Header"}, { 429, "Provide Referrer Identity"}, { 430, "Flow Failed"}, { 433, "Anonymity Disallowed"}, { 436, "Bad Identity-Info"}, { 437, "Unsupported Certificate"}, { 438, "Invalid Identity Header"}, { 439, "First Hop Lacks Outbound Support"}, { 440, "Max-Breadth Exceeded"}, { 470, "Consent Needed"}, { 480, "Temporarily Unavailable"}, { 481, "Call/Transaction Does Not Exist"}, { 482, "Loop Detected"}, { 483, "Too Many Hops"}, { 484, "Address Incomplete"}, { 485, "Ambiguous"}, { 486, "Busy Here"}, { 487, "Request Terminated"}, { 488, "Not Acceptable Here"}, { 489, "Bad Event"}, { 491, "Request Pending"}, { 493, "Undecipherable"}, { 494, "Security Agreement Required"}, { 499, "Client Error - Others"}, { 500, "Server Internal Error"}, { 501, "Not Implemented"}, { 502, "Bad Gateway"}, { 503, "Service Unavailable"}, { 504, "Server Time-out"}, { 505, "Version Not Supported"}, { 513, "Message Too Large"}, { 599, "Server Error - Others"}, { 600, "Busy Everywhere"}, { 603, "Decline"}, { 604, "Does Not Exist Anywhere"}, { 606, "Not Acceptable"}, { 607, "Unwanted"}, { 608, "Rejected"}, { 699, "Global Failure - Others"}, { 0, NULL} }; #define RESPONSE_CODE_MIN 100 #define RESPONSE_CODE_MAX 699 typedef enum { REQ_RESP_METHOD_COLUMN, COUNT_COLUMN, RESENT_COLUMN, MIN_SETUP_COLUMN, AVG_SETUP_COLUMN, MAX_SETUP_COLUMN } sip_stat_columns; static stat_tap_table_item sip_stat_fields[] = { {TABLE_ITEM_STRING, TAP_ALIGN_LEFT, "Request Method / Response Code", "%-25s"}, {TABLE_ITEM_UINT, TAP_ALIGN_RIGHT, "Count", "%d"}, {TABLE_ITEM_UINT, TAP_ALIGN_RIGHT, "Resent", "%d"}, {TABLE_ITEM_FLOAT, TAP_ALIGN_RIGHT, "Min Setup (s)", "%8.2f"}, {TABLE_ITEM_FLOAT, TAP_ALIGN_RIGHT, "Avg Setup (s)", "%8.2f"}, {TABLE_ITEM_FLOAT, TAP_ALIGN_RIGHT, "Max Setup (s)", "%8.2f"}, }; static const char *req_table_name = "SIP Requests"; static const char *resp_table_name = "SIP Responses"; static void sip_stat_init(stat_tap_table_ui* new_stat) { /* XXX Should we have a single request + response table instead? */ int num_fields = array_length(sip_stat_fields); stat_tap_table *req_table; stat_tap_table *resp_table; stat_tap_table_item_type items[array_length(sip_stat_fields)]; unsigned i; // These values are fixed for all entries. items[REQ_RESP_METHOD_COLUMN].type = TABLE_ITEM_STRING; items[COUNT_COLUMN].type = TABLE_ITEM_UINT; items[COUNT_COLUMN].user_data.uint_value = 0; items[COUNT_COLUMN].value.uint_value = 0; items[RESENT_COLUMN].type = TABLE_ITEM_UINT; items[RESENT_COLUMN].value.uint_value = 0; items[MIN_SETUP_COLUMN].type = TABLE_ITEM_FLOAT; items[MIN_SETUP_COLUMN].user_data.uint_value = 0; items[MIN_SETUP_COLUMN].value.float_value = 0.0f; items[AVG_SETUP_COLUMN].type = TABLE_ITEM_FLOAT; items[AVG_SETUP_COLUMN].user_data.float_value = 0.0f; items[AVG_SETUP_COLUMN].value.float_value = 0.0f; items[MAX_SETUP_COLUMN].type = TABLE_ITEM_FLOAT; items[MAX_SETUP_COLUMN].value.float_value = 0.0f; req_table = stat_tap_find_table(new_stat, req_table_name); if (req_table) { if (new_stat->stat_tap_reset_table_cb) new_stat->stat_tap_reset_table_cb(req_table); } else { req_table = stat_tap_init_table(req_table_name, num_fields, 0, NULL); stat_tap_add_table(new_stat, req_table); // For req_table, first column value is method. for (i = 1; i < array_length(sip_methods); i++) { items[REQ_RESP_METHOD_COLUMN].value.string_value = g_strdup(sip_methods[i]); stat_tap_init_table_row(req_table, i-1, num_fields, items); } } resp_table = stat_tap_find_table(new_stat, resp_table_name); if (resp_table) { if (new_stat->stat_tap_reset_table_cb) new_stat->stat_tap_reset_table_cb(resp_table); } else { resp_table = stat_tap_init_table(resp_table_name, num_fields, 0, NULL); stat_tap_add_table(new_stat, resp_table); // For responses entries, first column gets code and description. for (i = 1; sip_response_code_vals[i].strptr; i++) { unsigned response_code = sip_response_code_vals[i].value; items[REQ_RESP_METHOD_COLUMN].value.string_value = ws_strdup_printf("%u %s", response_code, sip_response_code_vals[i].strptr); items[REQ_RESP_METHOD_COLUMN].user_data.uint_value = response_code; stat_tap_init_table_row(resp_table, i-1, num_fields, items); } } } static tap_packet_status sip_stat_packet(void *tapdata, packet_info *pinfo _U_, epan_dissect_t *edt _U_, const void *siv_ptr, tap_flags_t flags _U_) { stat_data_t* stat_data = (stat_data_t*) tapdata; const sip_info_value_t *info_value = (const sip_info_value_t *) siv_ptr; stat_tap_table *cur_table = NULL; unsigned cur_row = 0; /* 0 = Unknown for both tables */ if (info_value->request_method && info_value->response_code < 1) { /* Request table */ stat_tap_table *req_table = stat_tap_find_table(stat_data->stat_tap_data, req_table_name); stat_tap_table_item_type *item_data; unsigned element; cur_table = req_table; for (element = 0; element < req_table->num_elements; element++) { item_data = stat_tap_get_field_data(req_table, element, REQ_RESP_METHOD_COLUMN); if (g_ascii_strcasecmp(info_value->request_method, item_data->value.string_value) == 0) { cur_row = element; break; } } } else if (info_value->response_code > 0) { /* Response table */ stat_tap_table *resp_table = stat_tap_find_table(stat_data->stat_tap_data, resp_table_name); unsigned response_code = info_value->response_code; stat_tap_table_item_type *item_data; unsigned element; cur_table = resp_table; if (response_code < RESPONSE_CODE_MIN || response_code > RESPONSE_CODE_MAX) { response_code = 999; } else if (!try_val_to_str(response_code, sip_response_code_vals)) { response_code = ((response_code / 100) * 100) + 99; } for (element = 0; element < resp_table->num_elements; element++) { item_data = stat_tap_get_field_data(resp_table, element, REQ_RESP_METHOD_COLUMN); if (item_data->user_data.uint_value == response_code) { cur_row = element; break; } } } else { return TAP_PACKET_DONT_REDRAW; } if (cur_table) { stat_tap_table_item_type *item_data; item_data = stat_tap_get_field_data(cur_table, cur_row, COUNT_COLUMN); item_data->value.uint_value++; stat_tap_set_field_data(cur_table, cur_row, COUNT_COLUMN, item_data); if (info_value->resend) { item_data = stat_tap_get_field_data(cur_table, cur_row, RESENT_COLUMN); item_data->value.uint_value++; stat_tap_set_field_data(cur_table, cur_row, RESENT_COLUMN, item_data); } if (info_value->setup_time > 0) { stat_tap_table_item_type *min_item_data = stat_tap_get_field_data(cur_table, cur_row, MIN_SETUP_COLUMN); stat_tap_table_item_type *avg_item_data = stat_tap_get_field_data(cur_table, cur_row, AVG_SETUP_COLUMN); stat_tap_table_item_type *max_item_data = stat_tap_get_field_data(cur_table, cur_row, MAX_SETUP_COLUMN); double setup_time = (double) info_value->setup_time / 1000; unsigned count; min_item_data->user_data.uint_value++; /* We store the setup count in MIN_SETUP_COLUMN */ count = min_item_data->user_data.uint_value; avg_item_data->user_data.float_value += setup_time; /* We store the total setup time in AVG_SETUP_COLUMN */ if (count <= 1) { min_item_data->value.float_value = setup_time; avg_item_data->value.float_value = setup_time; max_item_data->value.float_value = setup_time; } else { if (setup_time < min_item_data->value.float_value) { min_item_data->value.float_value = setup_time; } avg_item_data->value.float_value = avg_item_data->user_data.float_value / count; if (setup_time > max_item_data->value.float_value) { max_item_data->value.float_value = setup_time; } } stat_tap_set_field_data(cur_table, cur_row, MIN_SETUP_COLUMN, min_item_data); stat_tap_set_field_data(cur_table, cur_row, AVG_SETUP_COLUMN, avg_item_data); stat_tap_set_field_data(cur_table, cur_row, MAX_SETUP_COLUMN, max_item_data); } } return TAP_PACKET_REDRAW; } static void sip_stat_reset(stat_tap_table* table) { unsigned element; stat_tap_table_item_type* item_data; for (element = 0; element < table->num_elements; element++) { item_data = stat_tap_get_field_data(table, element, COUNT_COLUMN); item_data->user_data.uint_value = 0; item_data->value.uint_value = 0; stat_tap_set_field_data(table, element, COUNT_COLUMN, item_data); item_data = stat_tap_get_field_data(table, element, RESENT_COLUMN); item_data->value.uint_value = 0; stat_tap_set_field_data(table, element, RESENT_COLUMN, item_data); item_data = stat_tap_get_field_data(table, element, MIN_SETUP_COLUMN); item_data->user_data.uint_value = 0; item_data->value.float_value = 0.0f; stat_tap_set_field_data(table, element, MIN_SETUP_COLUMN, item_data); item_data = stat_tap_get_field_data(table, element, AVG_SETUP_COLUMN); item_data->user_data.float_value = 0.0f; item_data->value.float_value = 0.0f; stat_tap_set_field_data(table, element, AVG_SETUP_COLUMN, item_data); item_data = stat_tap_get_field_data(table, element, MAX_SETUP_COLUMN); item_data->value.float_value = 0.0f; stat_tap_set_field_data(table, element, MAX_SETUP_COLUMN, item_data); } } static void sip_stat_free_table_item(stat_tap_table* table _U_, unsigned row _U_, unsigned column, stat_tap_table_item_type* field_data) { if (column != REQ_RESP_METHOD_COLUMN) return; g_free((char*)field_data->value.string_value); field_data->value.string_value = NULL; } static char *sip_follow_conv_filter(epan_dissect_t *edt, packet_info *pinfo _U_, unsigned *stream _U_, unsigned *sub_stream _U_) { char *filter = NULL; /* Extract si.Call-ID from decoded tree in edt */ if (edt != NULL) { int hfid = proto_registrar_get_id_byname("sip.Call-ID"); GPtrArray *gp = proto_find_first_finfo(edt->tree, hfid); if (gp != NULL && gp->len != 0) { filter = ws_strdup_printf("sip.Call-ID == \"%s\"", fvalue_get_string(((field_info *)gp->pdata[0])->value)); } g_ptr_array_free(gp, true); } else { filter = ws_strdup_printf("sip.Call-ID"); } return filter; } static char *sip_follow_index_filter(unsigned stream _U_, unsigned sub_stream _U_) { return NULL; } static char *sip_follow_address_filter(address *src_addr _U_, address *dst_addr _U_, int src_port _U_, int dst_port _U_) { return NULL; } /* Register the protocol with Wireshark */ void proto_register_sip(void) { /* Setup list of header fields */ static hf_register_info hf[] = { { &hf_sip_msg_hdr, { "Message Header", "sip.msg_hdr", FT_STRING, BASE_NONE|BASE_NO_DISPLAY_VALUE, NULL, 0, "Message Header in SIP message", HFILL } }, { &hf_sip_Method, { "Method", "sip.Method", FT_STRING, BASE_NONE,NULL,0x0, "SIP Method", HFILL } }, { &hf_Request_Line, { "Request-Line", "sip.Request-Line", FT_STRING, BASE_NONE,NULL,0x0, "SIP Request-Line", HFILL } }, { &hf_sip_ruri_display, { "Request-URI display info", "sip.r-uri.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP R-URI Display Info", HFILL } }, { &hf_sip_ruri, { "Request-URI", "sip.r-uri", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP R-URI", HFILL } }, { &hf_sip_ruri_user, { "Request-URI User Part", "sip.r-uri.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP R-URI User", HFILL } }, { &hf_sip_ruri_host, { "Request-URI Host Part", "sip.r-uri.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP R-URI Host", HFILL } }, { &hf_sip_ruri_port, { "Request-URI Host Port", "sip.r-uri.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP R-URI Port", HFILL } }, { &hf_sip_ruri_param, { "Request URI parameter", "sip.r-uri.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_Status_Code, { "Status-Code", "sip.Status-Code", FT_UINT32, BASE_DEC,NULL,0x0, "SIP Status Code", HFILL } }, { &hf_sip_Status_Line, { "Status-Line", "sip.Status-Line", FT_STRING, BASE_NONE,NULL,0x0, "SIP Status-Line", HFILL } }, { &hf_sip_display, { "SIP Display info", "sip.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Display info", HFILL } }, { &hf_sip_to_display, { "SIP to display info", "sip.to.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: To Display info", HFILL } }, { &hf_sip_to_addr, { "SIP to address", "sip.to.addr", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: To Address", HFILL } }, { &hf_sip_to_user, { "SIP to address User Part", "sip.to.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: To Address User", HFILL } }, { &hf_sip_to_host, { "SIP to address Host Part", "sip.to.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: To Address Host", HFILL } }, { &hf_sip_to_port, { "SIP to address Host Port", "sip.to.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: To Address Port", HFILL } }, { &hf_sip_to_param, { "SIP To URI parameter", "sip.to.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_to_tag, { "SIP to tag", "sip.to.tag", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: to tag", HFILL } }, { &hf_sip_from_display, { "SIP from display info", "sip.from.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: From Display info", HFILL } }, { &hf_sip_from_addr, { "SIP from address", "sip.from.addr", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: From Address", HFILL } }, { &hf_sip_from_user, { "SIP from address User Part", "sip.from.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: From Address User", HFILL } }, { &hf_sip_from_host, { "SIP from address Host Part", "sip.from.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: From Address Host", HFILL } }, { &hf_sip_from_port, { "SIP from address Host Port", "sip.from.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: From Address Port", HFILL } }, { &hf_sip_from_param, { "SIP From URI parameter", "sip.from.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_from_tag, { "SIP from tag", "sip.from.tag", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: from tag", HFILL } }, { &hf_sip_curi_display, { "SIP C-URI display info", "sip.contact.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP C-URI Display info", HFILL } }, { &hf_sip_curi, { "Contact URI", "sip.contact.uri", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP C-URI", HFILL } }, { &hf_sip_curi_user, { "Contact URI User Part", "sip.contact.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP C-URI User", HFILL } }, { &hf_sip_curi_host, { "Contact URI Host Part", "sip.contact.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP C-URI Host", HFILL } }, { &hf_sip_curi_port, { "Contact URI Host Port", "sip.contact.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: SIP C-URI Port", HFILL } }, { &hf_sip_curi_param, { "Contact URI parameter", "sip.contact.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_route_display, { "Route display info", "sip.Route.display.info", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_route, { "Route URI", "sip.Route.uri", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_route_user, { "Route Userinfo", "sip.Route.user", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_route_host, { "Route Host Part", "sip.Route.host", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_route_port, { "Route Host Port", "sip.Route.port", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_route_param, { "Route URI parameter", "sip.Route.param", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_record_route_display, { "Record-Route display info", "sip.Record-Route.display.info", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_record_route, { "Record-Route URI", "sip.Record-Route.uri", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_record_route_user, { "Record-Route Userinfo", "sip.Record-Route.user", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_record_route_host, { "Record-Route Host Part", "sip.Record-Route.host", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_record_route_port, { "Record-Route Host Port", "sip.Record-Route.port", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_record_route_param, { "Record-Route URI parameter", "sip.Record-Route.param", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_service_route_display, { "Service-Route display info", "sip.Service-Route.display.info", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_service_route, { "Service-Route URI", "sip.Service-Route.uri", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_service_route_user, { "Service-Route Userinfo", "sip.Service-Route.user", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_service_route_host, { "Service-Route Host Part", "sip.Service-Route.host", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_service_route_port, { "Service-Route Host Port", "sip.Service-Route.port", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_service_route_param, { "Service-Route URI parameter", "sip.Service-Route.param", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_path_display, { "Path URI", "sip.Path.display.info", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_path, { "Path URI", "sip.Path.uri", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_path_user, { "Path Userinfo", "sip.Path.user", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_path_host, { "Path Host Part", "sip.Path.host", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_path_port, { "Path Host Port", "sip.Path.port", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_path_param, { "Path URI parameter", "sip.Path.param", FT_STRING, BASE_NONE,NULL,0x0,NULL,HFILL } }, { &hf_sip_contact_param, { "Contact parameter", "sip.contact.parameter", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: one contact parameter", HFILL } }, { &hf_sip_tag, { "SIP tag", "sip.tag", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: tag", HFILL } }, { &hf_sip_pai_display, { "SIP PAI display info", "sip.pai.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Asserted-Identity Display info", HFILL } }, { &hf_sip_pai_addr, { "SIP PAI Address", "sip.pai.addr", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Asserted-Identity Address", HFILL } }, { &hf_sip_pai_user, { "SIP PAI User Part", "sip.pai.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Asserted-Identity User", HFILL } }, { &hf_sip_pai_host, { "SIP PAI Host Part", "sip.pai.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Asserted-Identity Host", HFILL } }, { &hf_sip_pai_port, { "SIP PAI Host Port", "sip.pai.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Asserted-Identity Port", HFILL } }, { &hf_sip_pai_param, { "SIP PAI URI parameter", "sip.pai.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_pmiss_display, { "SIP PMISS display info", "sip.pmiss.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Permission Missing Display info", HFILL } }, { &hf_sip_pmiss_addr, { "SIP PMISS Address", "sip.pmiss.addr", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Permission Missing Address", HFILL } }, { &hf_sip_pmiss_user, { "SIP PMISS User Part", "sip.pmiss.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Permission Missing User", HFILL } }, { &hf_sip_pmiss_host, { "SIP PMISS Host Part", "sip.pmiss.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Permission Missing Host", HFILL } }, { &hf_sip_pmiss_port, { "SIP PMISS Host Port", "sip.pmiss.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Permission Missing Port", HFILL } }, { &hf_sip_pmiss_param, { "SIP PMISS URI parameter", "sip.pmiss.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_ppi_display, { "SIP PPI display info", "sip.ppi.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Preferred-Identity Display info", HFILL } }, { &hf_sip_ppi_addr, { "SIP PPI Address", "sip.ppi.addr", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Preferred-Identity Address", HFILL } }, { &hf_sip_ppi_user, { "SIP PPI User Part", "sip.ppi.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Preferred-Identity User", HFILL } }, { &hf_sip_ppi_host, { "SIP PPI Host Part", "sip.ppi.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Preferred-Identity Host", HFILL } }, { &hf_sip_ppi_port, { "SIP PPI Host Port", "sip.ppi.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Preferred-Identity Port", HFILL } }, { &hf_sip_ppi_param, { "SIP PPI URI parameter", "sip.ppi.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_tc_display, { "SIP TC display info", "sip.tc.display.info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Trigger Consent Display info", HFILL } }, { &hf_sip_tc_addr, { "SIP TC Address", "sip.tc.addr", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Trigger Consent Address", HFILL } }, { &hf_sip_tc_user, { "SIP TC User Part", "sip.tc.user", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Trigger Consent User", HFILL } }, { &hf_sip_tc_host, { "SIP TC Host Part", "sip.tc.host", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Trigger Consent Host", HFILL } }, { &hf_sip_tc_port, { "SIP TC Host Port", "sip.tc.port", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Trigger Consent Port", HFILL } }, { &hf_sip_tc_param, { "SIP TC URI parameter", "sip.tc.param", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_sip_tc_turi, { "SIP TC Target URI", "sip.tc.target-uri", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: Trigger Consent Target URI", HFILL } }, { &hf_header_array[POS_ACCEPT], { "Accept", "sip.Accept", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Accept Header", HFILL } }, { &hf_header_array[POS_ACCEPT_CONTACT], { "Accept-Contact", "sip.Accept-Contact", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3841: Accept-Contact Header", HFILL } }, { &hf_header_array[POS_ACCEPT_ENCODING], { "Accept-Encoding", "sip.Accept-Encoding", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3841: Accept-Encoding Header", HFILL } }, { &hf_header_array[POS_ACCEPT_LANGUAGE], { "Accept-Language", "sip.Accept-Language", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Accept-Language Header", HFILL } }, { &hf_header_array[POS_ACCEPT_RESOURCE_PRIORITY], { "Accept-Resource-Priority", "sip.Accept-Resource-Priority", FT_STRING, BASE_NONE,NULL,0x0, "Draft: Accept-Resource-Priority Header", HFILL } }, { &hf_header_array[POS_ADDITIONAL_IDENTITY], { "Additional-Identity", "sip.Additional-Identity", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_ALERT_INFO], { "Alert-Info", "sip.Alert-Info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Alert-Info Header", HFILL } }, { &hf_header_array[POS_ALLOW], { "Allow", "sip.Allow", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Allow Header", HFILL } }, { &hf_header_array[POS_ALLOW_EVENTS], { "Allow-Events", "sip.Allow-Events", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3265: Allow-Events Header", HFILL } }, { &hf_header_array[POS_ANSWER_MODE], { "Answer-Mode", "sip.Answer-Mode", FT_STRING, BASE_NONE,NULL,0x0, "RFC 5373: Answer-Mode Header", HFILL } }, { &hf_header_array[POS_ATTESTATION_INFO], { "Attestation-Info", "sip.Attestation-Info", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_AUTHENTICATION_INFO], { "Authentication-Info", "sip.Authentication-Info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Authentication-Info Header", HFILL } }, { &hf_header_array[POS_AUTHORIZATION], { "Authorization", "sip.Authorization", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Authorization Header", HFILL } }, { &hf_header_array[POS_CALL_ID], { "Call-ID", "sip.Call-ID", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Call-ID Header", HFILL } }, { &hf_header_array[POS_CALL_INFO], { "Call-Info", "sip.Call-Info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Call-Info Header", HFILL } }, { &hf_header_array[POS_CELLULAR_NETWORK_INFO], { "Cellular-Network-Info", "sip.Cellular-Network-Info", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_CONTACT], { "Contact", "sip.Contact", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Contact Header", HFILL } }, { &hf_header_array[POS_CONTENT_DISPOSITION], { "Content-Disposition", "sip.Content-Disposition", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Content-Disposition Header", HFILL } }, { &hf_header_array[POS_CONTENT_ENCODING], { "Content-Encoding", "sip.Content-Encoding", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Content-Encoding Header", HFILL } }, { &hf_header_array[POS_CONTENT_LANGUAGE], { "Content-Language", "sip.Content-Language", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Content-Language Header", HFILL } }, { &hf_header_array[POS_CONTENT_LENGTH], { "Content-Length", "sip.Content-Length", FT_UINT32, BASE_DEC,NULL,0x0, "RFC 3261: Content-Length Header", HFILL } }, { &hf_header_array[POS_CONTENT_TYPE], { "Content-Type", "sip.Content-Type", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Content-Type Header", HFILL } }, { &hf_header_array[POS_CSEQ], { "CSeq", "sip.CSeq", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: CSeq Header", HFILL } }, { &hf_header_array[POS_DATE], { "Date", "sip.Date", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Date Header", HFILL } }, { &hf_header_array[POS_ERROR_INFO], { "Error-Info", "sip.Error-Info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Error-Info Header", HFILL } }, { &hf_header_array[POS_EVENT], { "Event", "sip.Event", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3265: Event Header", HFILL } }, { &hf_header_array[POS_EXPIRES], { "Expires", "sip.Expires", FT_UINT32, BASE_DEC,NULL,0x0, "RFC 3261: Expires Header", HFILL } }, { &hf_header_array[POS_FEATURE_CAPS], { "Feature-Caps", "sip.Feature-Caps", FT_STRING, BASE_NONE,NULL,0x0, "RFC 6809: Feature-Caps", HFILL } }, { &hf_header_array[POS_FLOW_TIMER], { "Flow-Timer", "sip.Flow-Timer", FT_STRING, BASE_NONE,NULL,0x0, "RFC 5626: Flow-Timer", HFILL } }, { &hf_header_array[POS_FROM], { "From", "sip.From", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: From Header", HFILL } }, { &hf_header_array[POS_GEOLOCATION], { "Geolocation", "sip.Geolocation", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_GEOLOCATION_ERROR], { "Geolocation-Error", "sip.Geolocation-Error", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_GEOLOCATION_ROUTING], { "Geolocation-Routing", "sip.Geolocation-Routing", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_HISTORY_INFO], { "History-Info", "sip.History-Info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4244: Request History Information", HFILL } }, { &hf_header_array[POS_IDENTITY], { "Identity", "sip.Identity", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4474: Request Identity", HFILL } }, { &hf_header_array[POS_IDENTITY_INFO], { "Identity-info", "sip.Identity-info", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4474: Request Identity-info", HFILL } }, { &hf_header_array[POS_INFO_PKG], { "Info-Package", "sip.Info-Package", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_IN_REPLY_TO], { "In-Reply-To", "sip.In-Reply-To", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: In-Reply-To Header", HFILL } }, { &hf_header_array[POS_JOIN], { "Join", "sip.Join", FT_STRING, BASE_NONE,NULL,0x0, "Draft: Join Header", HFILL } }, { &hf_header_array[POS_MAX_BREADTH], { "Max-Breadth", "sip.Max-Breadth", FT_UINT32, BASE_DEC,NULL,0x0, "RFC 5393: Max-Breadth Header", HFILL } }, { &hf_header_array[POS_MAX_FORWARDS], { "Max-Forwards", "sip.Max-Forwards", FT_UINT32, BASE_DEC,NULL,0x0, "RFC 3261: Max-Forwards Header", HFILL } }, { &hf_header_array[POS_MIME_VERSION], { "MIME-Version", "sip.MIME-Version", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: MIME-Version Header", HFILL } }, { &hf_header_array[POS_MIN_EXPIRES], { "Min-Expires", "sip.Min-Expires", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Min-Expires Header", HFILL } }, { &hf_header_array[POS_MIN_SE], { "Min-SE", "sip.Min-SE", FT_STRING, BASE_NONE,NULL,0x0, "Draft: Min-SE Header", HFILL } }, { &hf_header_array[POS_ORGANIZATION], { "Organization", "sip.Organization", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Organization Header", HFILL } }, { &hf_header_array[POS_ORIGINATION_ID], { "Origination-Id", "sip.Origination-Id", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_P_ACCESS_NETWORK_INFO], { "P-Access-Network-Info", "sip.P-Access-Network-Info", FT_STRING, BASE_NONE,NULL,0x0, "P-Access-Network-Info Header", HFILL } }, { &hf_header_array[POS_P_ANSWER_STATE], { "P-Answer-State", "sip.P-Answer-State", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4964: P-Answer-State Header", HFILL } }, { &hf_header_array[POS_P_ASSERTED_IDENTITY], { "P-Asserted-Identity", "sip.P-Asserted-Identity", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Asserted-Identity Header", HFILL } }, { &hf_header_array[POS_P_ASSERTED_SERV], { "P-Asserted-Service", "sip.P-Asserted-Service", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_P_CHARGE_INFO], { "P-Charge-Info", "sip.P-Charge-Info", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_P_ASSOCIATED_URI], { "P-Associated-URI", "sip.P-Associated-URI", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3455: P-Associated-URI Header", HFILL } }, { &hf_header_array[POS_P_CALLED_PARTY_ID], { "P-Called-Party-ID", "sip.P-Called-Party-ID", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3455: P-Called-Party-ID Header", HFILL } }, { &hf_header_array[POS_P_CHARGING_FUNC_ADDRESSES], { "P-Charging-Function-Addresses","sip.P-Charging-Function-Addresses", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_P_CHARGING_VECTOR], { "P-Charging-Vector", "sip.P-Charging-Vector", FT_STRING, BASE_NONE,NULL,0x0, "P-Charging-Vector Header", HFILL } }, { &hf_header_array[POS_P_DCS_TRACE_PARTY_ID], { "P-DCS-Trace-Party-ID", "sip.P-DCS-Trace-Party-ID", FT_STRING, BASE_NONE,NULL,0x0, "P-DCS-Trace-Party-ID Header", HFILL } }, { &hf_header_array[POS_P_DCS_OSPS], { "P-DCS-OSPS", "sip.P-DCS-OSPS", FT_STRING, BASE_NONE,NULL,0x0, "P-DCS-OSPS Header", HFILL } }, { &hf_header_array[POS_P_DCS_BILLING_INFO], { "P-DCS-Billing-Info", "sip.P-DCS-Billing-Info", FT_STRING, BASE_NONE,NULL,0x0, "P-DCS-Billing-Info Header", HFILL } }, { &hf_header_array[POS_P_DCS_LAES], { "P-DCS-LAES", "sip.P-DCS-LAES", FT_STRING, BASE_NONE,NULL,0x0, "P-DCS-LAES Header", HFILL } }, { &hf_header_array[POS_P_DCS_REDIRECT], { "P-DCS-Redirect", "sip.P-DCS-Redirect", FT_STRING, BASE_NONE,NULL,0x0, "P-DCS-Redirect Header", HFILL } }, { &hf_header_array[POS_P_EARLY_MEDIA], { "P-Early-Media", "sip.P-Early-Media", FT_STRING, BASE_NONE,NULL,0x0, "P-Early-Media Header", HFILL } }, { &hf_header_array[POS_P_MEDIA_AUTHORIZATION], { "P-Media-Authorization", "sip.P-Media-Authorization", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3313: P-Media-Authorization Header", HFILL } }, { &hf_header_array[POS_P_PREFERRED_IDENTITY], { "P-Preferred-Identity", "sip.P-Preferred-Identity", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3325: P-Preferred-Identity Header", HFILL } }, { &hf_header_array[POS_P_PREFERRED_SERV], { "P-Preferred-Service", "sip.P-Preferred-Service", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_P_PROFILE_KEY], { "P-Profile-Key", "sip.P-Profile-Key", FT_STRING, BASE_NONE,NULL,0x0, "P-Profile-Key Header", HFILL } }, { &hf_header_array[POS_P_REFUSED_URI_LST], { "P-Refused-URI-List", "sip.P-Refused-URI-List", FT_STRING, BASE_NONE,NULL,0x0, "P-Refused-URI-List Header", HFILL } }, { &hf_header_array[POS_P_SERVED_USER], { "P-Served-User", "sip.P-Served-User", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_P_USER_DATABASE], { "P-User-Database", "sip.P-User-Database", FT_STRING, BASE_NONE,NULL,0x0, "P-User-Database Header", HFILL } }, { &hf_header_array[POS_P_VISITED_NETWORK_ID], { "P-Visited-Network-ID", "sip.P-Visited-Network-ID", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3455: P-Visited-Network-ID Header", HFILL } }, { &hf_header_array[POS_PATH], { "Path", "sip.Path", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3327: Path Header", HFILL } }, { &hf_header_array[POS_PERMISSION_MISSING], { "Permission-Missing", "sip.Permission-Missing", FT_STRING, BASE_NONE,NULL,0x0, "RFC 5360: Permission Missing Header", HFILL } }, { &hf_header_array[POS_POLICY_CONTACT], { "Policy-Contact", "sip.Policy_Contact", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_POLICY_ID], { "Policy-ID", "sip.Policy_ID", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_PRIORITY], { "Priority", "sip.Priority", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Priority Header", HFILL } }, { &hf_header_array[POS_PRIORITY_SHARE], { "Priority-Share", "sip.Priority-Share", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_PRIV_ANSWER_MODE], { "Priv-Answer-mode", "sip.Priv-Answer-mode", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_PRIVACY], { "Privacy", "sip.Privacy", FT_STRING, BASE_NONE,NULL,0x0, "Privacy Header", HFILL } }, { &hf_header_array[POS_PROXY_AUTHENTICATE], { "Proxy-Authenticate", "sip.Proxy-Authenticate", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Proxy-Authenticate Header", HFILL } }, { &hf_header_array[POS_PROXY_AUTHORIZATION], { "Proxy-Authorization", "sip.Proxy-Authorization", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Proxy-Authorization Header", HFILL } }, { &hf_header_array[POS_PROXY_REQUIRE], { "Proxy-Require", "sip.Proxy-Require", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Proxy-Require Header", HFILL } }, { &hf_header_array[POS_RACK], { "RAck", "sip.RAck", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3262: RAck Header", HFILL } }, { &hf_header_array[POS_REASON], { "Reason", "sip.Reason", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3326 Reason Header", HFILL } }, { &hf_header_array[POS_REASON_PHRASE], { "Reason-Phrase", "sip.Reason-Phrase", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_RECORD_ROUTE], { "Record-Route", "sip.Record-Route", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Record-Route Header", HFILL } }, { &hf_header_array[POS_RECV_INFO], { "Recv-Info", "sip.Recv-Info", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_REFER_SUB], { "Refer-Sub", "sip.Refer-Sub", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4488: Refer-Sub Header", HFILL } }, { &hf_header_array[POS_REFER_TO], { "Refer-To", "sip.Refer-To", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3515: Refer-To Header", HFILL } }, { &hf_header_array[POS_REFERRED_BY], { "Referred By", "sip.Referred-by", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3892: Referred-by Header", HFILL } }, { &hf_header_array[POS_REJECT_CONTACT], { "Reject-Contact", "sip.Reject-Contact", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3841: Reject-Contact Header", HFILL } }, { &hf_header_array[POS_RELAYED_CHARGE], { "Relayed-Charge", "sip.Relayed-Charge", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_REPLACES], { "Replaces", "sip.Replaces", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3891: Replaces Header", HFILL } }, { &hf_header_array[POS_REPLY_TO], { "Reply-To", "sip.Reply-To", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Reply-To Header", HFILL } }, { &hf_header_array[POS_REQUEST_DISPOSITION], { "Request-Disposition", "sip.Request-Disposition", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3841: Request-Disposition Header", HFILL } }, { &hf_header_array[POS_REQUIRE], { "Require", "sip.Require", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Require Header", HFILL } }, { &hf_header_array[POS_RESOURCE_PRIORITY], { "Resource-Priority", "sip.Resource-Priority", FT_STRING, BASE_NONE,NULL,0x0, "Draft: Resource-Priority Header", HFILL } }, { &hf_header_array[POS_RESOURCE_SHARE], { "Resource-Share", "sip.Resource-Share", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_RESPONSE_SOURCE], { "Response-Source", "sip.Response-Source", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_RESTORATION_INFO], { "Restoration-Info", "sip.Restoration-Info", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_RETRY_AFTER], { "Retry-After", "sip.Retry-After", FT_UINT32, BASE_DEC,NULL,0x0, "RFC 3261: Retry-After Header", HFILL } }, { &hf_header_array[POS_ROUTE], { "Route", "sip.Route", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Route Header", HFILL } }, { &hf_header_array[POS_RSEQ], { "RSeq", "sip.RSeq", FT_UINT32, BASE_DEC,NULL,0x0, "RFC 3262: RSeq Header", HFILL } }, { &hf_header_array[ POS_SECURITY_CLIENT], { "Security-Client", "sip.Security-Client", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3329 Security-Client Header", HFILL } }, { &hf_header_array[ POS_SECURITY_SERVER], { "Security-Server", "sip.Security-Server", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3329 Security-Server Header", HFILL } }, { &hf_header_array[ POS_SECURITY_VERIFY], { "Security-Verify", "sip.Security-Verify", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3329 Security-Verify Header", HFILL } }, { &hf_header_array[POS_SERVER], { "Server", "sip.Server", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Server Header", HFILL } }, { &hf_header_array[POS_SERVICE_INTERACT_INFO], { "Service-Interact-Info", "sip.Service-Interact-Info", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_SERVICE_ROUTE], { "Service-Route", "sip.Service-Route", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3608: Service-Route Header", HFILL } }, { &hf_header_array[POS_SESSION_EXPIRES], { "Session-Expires", "sip.Session-Expires", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4028: Session-Expires Header", HFILL } }, { &hf_header_array[POS_SESSION_ID], { "Session-ID", "sip.Session-ID", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_header_array[POS_SIP_ETAG], { "ETag", "sip.ETag", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3903: SIP-ETag Header", HFILL } }, { &hf_header_array[POS_SIP_IF_MATCH], { "If_Match", "sip.If_Match", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3903: SIP-If-Match Header", HFILL } }, { &hf_header_array[POS_SUBJECT], { "Subject", "sip.Subject", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Subject Header", HFILL } }, { &hf_header_array[POS_SUBSCRIPTION_STATE], { "Subscription-State", "sip.Subscription-State", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3265: Subscription-State Header", HFILL } }, { &hf_header_array[POS_SUPPORTED], { "Supported", "sip.Supported", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Supported Header", HFILL } }, { &hf_header_array[POS_SUPPRESS_IF_MATCH], { "Suppress-If-Match", "sip.Suppress_If_Match", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }, { &hf_header_array[POS_TARGET_DIALOG], { "Target-Dialog", "sip.Target-Dialog", FT_STRING, BASE_NONE,NULL,0x0, "RFC 4538: Target-Dialog Header", HFILL } }, { &hf_header_array[POS_TIMESTAMP], { "Timestamp", "sip.Timestamp", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Timestamp Header", HFILL } }, { &hf_header_array[POS_TO], { "To", "sip.To", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: To Header", HFILL } }, { &hf_header_array[POS_TRIGGER_CONSENT], { "Trigger-Consent", "sip.Trigger-Consent", FT_STRING, BASE_NONE,NULL,0x0, "RFC 5380: Trigger Consent", HFILL } }, { &hf_header_array[POS_UNSUPPORTED], { "Unsupported", "sip.Unsupported", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Unsupported Header", HFILL } }, { &hf_header_array[POS_USER_AGENT], { "User-Agent", "sip.User-Agent", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: User-Agent Header", HFILL } }, { &hf_header_array[POS_VIA], { "Via", "sip.Via", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Via Header", HFILL } }, { &hf_header_array[POS_WARNING], { "Warning", "sip.Warning", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: Warning Header", HFILL } }, { &hf_header_array[POS_WWW_AUTHENTICATE], { "WWW-Authenticate", "sip.WWW-Authenticate", FT_STRING, BASE_NONE,NULL,0x0, "RFC 3261: WWW-Authenticate Header", HFILL } }, { &hf_header_array[POS_DIVERSION], { "Diversion", "sip.Diversion", FT_STRING, BASE_NONE,NULL,0x0, "RFC 5806: Diversion Header", HFILL } }, { &hf_header_array[POS_USER_TO_USER], { "User-to-User", "sip.uui", FT_STRING, BASE_NONE,NULL,0x0, "draft-johnston-sipping-cc-uui-09: User-to-User header", HFILL } }, { &hf_sip_resend, { "Resent Packet", "sip.resend", FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_original_frame, { "Suspected resend of frame", "sip.resend-original", FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_RETRANS_PREV), 0x0, "Original transmission of frame", HFILL} }, { &hf_sip_matching_request_frame, { "Request Frame", "sip.response-request", FT_FRAMENUM, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_response_time, { "Response Time (ms)", "sip.response-time", FT_UINT32, BASE_DEC, NULL, 0x0, "Response time since original request (in milliseconds)", HFILL} }, { &hf_sip_release_time, { "Release Time (ms)", "sip.release-time", FT_UINT32, BASE_DEC, NULL, 0x0, "release time since original BYE (in milliseconds)", HFILL} }, { &hf_sip_auth, { "Authentication", "sip.auth", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication", HFILL} }, { &hf_sip_auth_scheme, { "Authentication Scheme", "sip.auth.scheme", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Scheme", HFILL} }, { &hf_sip_auth_digest_response, { "Digest Authentication Response", "sip.auth.digest.response", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Digest Authentication Response Value", HFILL} }, { &hf_sip_auth_nc, { "Nonce Count", "sip.auth.nc", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Nonce count", HFILL} }, { &hf_sip_auth_username, { "Username", "sip.auth.username", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Username", HFILL} }, { &hf_sip_auth_realm, { "Realm", "sip.auth.realm", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Realm", HFILL} }, { &hf_sip_auth_nonce, { "Nonce Value", "sip.auth.nonce", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Nonce", HFILL} }, { &hf_sip_auth_algorithm, { "Algorithm", "sip.auth.algorithm", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Algorithm", HFILL} }, { &hf_sip_auth_opaque, { "Opaque Value", "sip.auth.opaque", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Opaque value", HFILL} }, { &hf_sip_auth_qop, { "QOP", "sip.auth.qop", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication QOP", HFILL} }, { &hf_sip_auth_cnonce, { "CNonce Value", "sip.auth.cnonce", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Client Nonce", HFILL} }, { &hf_sip_auth_uri, { "Authentication URI", "sip.auth.uri", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication URI", HFILL} }, { &hf_sip_auth_domain, { "Authentication Domain", "sip.auth.domain", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Domain", HFILL} }, { &hf_sip_auth_stale, { "Stale Flag", "sip.auth.stale", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Stale Flag", HFILL} }, { &hf_sip_auth_auts, { "Authentication Token", "sip.auth.auts", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Token", HFILL} }, { &hf_sip_auth_rspauth, { "Response auth", "sip.auth.rspauth", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Response auth", HFILL} }, { &hf_sip_auth_nextnonce, { "Next Nonce", "sip.auth.nextnonce", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Next Nonce", HFILL} }, { &hf_sip_auth_ik, { "Integrity Key", "sip.auth.ik", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Integrity Key", HFILL} }, { &hf_sip_auth_ck, { "Cyphering Key", "sip.auth.ck", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Authentication Cyphering Key", HFILL} }, { &hf_sip_cseq_seq_no, { "Sequence Number", "sip.CSeq.seq", FT_UINT32, BASE_DEC, NULL, 0x0, "CSeq header sequence number", HFILL} }, { &hf_sip_cseq_method, { "Method", "sip.CSeq.method", FT_STRING, BASE_NONE, NULL, 0x0, "CSeq header method", HFILL} }, { &hf_sip_via_transport, { "Transport", "sip.Via.transport", FT_STRING, BASE_NONE, NULL, 0x0, "Via header Transport", HFILL} }, { &hf_sip_via_sent_by_address, { "Sent-by Address", "sip.Via.sent-by.address", FT_STRING, BASE_NONE, NULL, 0x0, "Via header Sent-by Address", HFILL} }, { &hf_sip_via_sent_by_port, { "Sent-by port", "sip.Via.sent-by.port", FT_UINT16, BASE_DEC, NULL, 0x0, "Via header Sent-by Port", HFILL} }, { &hf_sip_via_branch, { "Branch", "sip.Via.branch", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via Branch", HFILL}, }, { &hf_sip_via_maddr, { "Maddr", "sip.Via.maddr", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via Maddr", HFILL}, }, { &hf_sip_via_rport, { "RPort", "sip.Via.rport", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via RPort", HFILL}, }, { &hf_sip_via_received, { "Received", "sip.Via.received", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via Received", HFILL}, }, { &hf_sip_via_ttl, { "TTL", "sip.Via.ttl", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via TTL", HFILL} }, { &hf_sip_via_comp, { "Comp", "sip.Via.comp", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via comp", HFILL} }, { &hf_sip_via_sigcomp_id, { "Sigcomp identifier", "sip.Via.sigcomp-id", FT_STRING, BASE_NONE, NULL, 0x0, "SIP Via sigcomp identifier", HFILL} }, { &hf_sip_via_oc, { "Overload Control", "sip.Via.oc", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_via_oc_val, { "Overload Control Value", "sip.Via.oc_val", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } }, { &hf_sip_via_oc_validity, { "Overload Control Validity", "sip.Via.oc_validity", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_via_oc_seq, { "Overload Control Sequence", "sip.Via.oc_seq", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_oc_seq_timestamp, { "Overload Control Sequence Time Stamp", "sip.Via.oc_seq.ts", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, NULL, HFILL } }, { &hf_sip_via_oc_algo, { "Overload Control Algorithm", "sip.Via.oc_algo", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_via_be_route, { "be-route", "sip.Via.be_route", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_p_acc_net_i_acc_type, { "access-type", "sip.P-Access-Network-Info.access-type", FT_STRING, BASE_NONE, NULL, 0x0, "SIP P-Access-Network-Info access-type", HFILL} }, { &hf_sip_p_acc_net_i_ucid_3gpp, { "utran-cell-id-3gpp", "sip.P-Access-Network-Info.utran-cell-id-3gpp", FT_STRING, BASE_NONE, NULL, 0x0, "SIP P-Access-Network-Info utran-cell-id-3gpp", HFILL} }, { &hf_sip_rack_rseq_no, { "RSeq Sequence Number", "sip.RAck.RSeq.seq", FT_UINT32, BASE_DEC, NULL, 0x0, "RAck RSeq header sequence number (from prov response)", HFILL} }, { &hf_sip_rack_cseq_no, { "CSeq Sequence Number", "sip.RAck.CSeq.seq", FT_UINT32, BASE_DEC, NULL, 0x0, "RAck CSeq header sequence number (from prov response)", HFILL} }, { &hf_sip_rack_cseq_method, { "CSeq Method", "sip.RAck.CSeq.method", FT_STRING, BASE_NONE, NULL, 0x0, "RAck CSeq header method (from prov response)", HFILL} }, { &hf_sip_reason_protocols, { "Reason protocols", "sip.reason_protocols", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_reason_cause_q850, { "Cause", "sip.reason_cause_q850", FT_UINT32, BASE_DEC_HEX|BASE_EXT_STRING, &q850_cause_code_vals_ext, 0x0, NULL, HFILL} }, { &hf_sip_reason_cause_sip, { "Cause", "sip.reason_cause_sip", FT_UINT32, BASE_DEC, VALS(sip_response_code_vals), 0x0, NULL, HFILL } }, { &hf_sip_reason_cause_other, { "Cause", "sip.reason_cause_other", FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } }, { &hf_sip_reason_text, { "Text", "sip.reason_text", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_msg_body, { "Message Body", "sip.msg_body", FT_BYTES, BASE_NONE|BASE_NO_DISPLAY_VALUE, NULL, 0x0, "Message Body in SIP message", HFILL } }, { &hf_sip_sec_mechanism, { "[Security-mechanism]", "sip.sec_mechanism", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_alg, { "alg", "sip.sec_mechanism.alg", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_ealg, { "ealg", "sip.sec_mechanism.ealg", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_prot, { "prot", "sip.sec_mechanism.prot", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_spi_c, { "spi-c", "sip.sec_mechanism.spi_c", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_spi_s, { "spi-s", "sip.sec_mechanism.spi_s", FT_UINT32, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_port1, { "port1", "sip.sec_mechanism.port1", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_port_c, { "port-c", "sip.sec_mechanism.port_c", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_port2, { "port2", "sip.sec_mechanism.port2", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL} }, { &hf_sip_sec_mechanism_port_s, { "port-s", "sip.sec_mechanism.port_s", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL} }, { &hf_sip_session_id_sess_id, { "sess-id", "sip.Session-ID.sess_id", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_session_id_param, { "param", "sip.Session-ID.param", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_session_id_local_uuid, { "local-uuid", "sip.Session-ID.local_uuid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_session_id_remote_uuid, { "remote-uuid", "sip.Session-ID.remote_uuid", FT_GUID, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_session_id_logme, { "logme", "sip.Session-ID.logme", FT_BOOLEAN, BASE_NONE, TFS(&tfs_set_notset), 0x0, NULL, HFILL} }, { &hf_sip_continuation, { "Continuation data", "sip.continuation", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL} }, { &hf_sip_feature_cap, { "Feature Cap", "sip.feature_cap", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_service_priority, { "Service Priority", "sip.service_priority", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_icid_value, { "icid-value", "sip.icid_value", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_icid_gen_addr, { "icid-gen-addr", "sip.icid_gen_addr", FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } }, { &hf_sip_call_id_gen, { "Generated Call-ID", "sip.call_id_generated", FT_STRING, BASE_NONE,NULL,0x0, "Use to catch call id across protocols", HFILL } }, }; /* raw_sip header field(s) */ static hf_register_info raw_hf[] = { { &hf_sip_raw_line, { "Raw SIP Line", "raw_sip.line", FT_STRING, BASE_NONE,NULL,0x0, NULL, HFILL } }}; /* Setup protocol subtree array */ static int *ett[] = { &ett_sip, &ett_sip_reqresp, &ett_sip_hdr, &ett_sip_ext_hdr, &ett_sip_element, &ett_sip_hist, &ett_sip_uri, &ett_sip_contact_item, &ett_sip_message_body, &ett_sip_cseq, &ett_sip_via, &ett_sip_reason, &ett_sip_security_client, &ett_sip_security_server, &ett_sip_security_verify, &ett_sip_rack, &ett_sip_record_route, &ett_sip_service_route, &ett_sip_route, &ett_sip_path, &ett_sip_ruri, &ett_sip_pai_uri, &ett_sip_pmiss_uri, &ett_sip_ppi_uri, &ett_sip_tc_uri, &ett_sip_to_uri, &ett_sip_from_uri, &ett_sip_curi, &ett_sip_session_id, &ett_sip_p_access_net_info, &ett_sip_p_charging_vector, &ett_sip_feature_caps, &ett_sip_via_be_route }; static int *ett_raw[] = { &ett_raw_text, }; static ei_register_info ei[] = { { &ei_sip_unrecognized_header, { "sip.unrecognized_header", PI_UNDECODED, PI_NOTE, "Unrecognised SIP header", EXPFILL }}, { &ei_sip_header_no_colon, { "sip.header_no_colon", PI_MALFORMED, PI_WARN, "Header has no colon after the name", EXPFILL }}, { &ei_sip_header_not_terminated, { "sip.header_not_terminated", PI_MALFORMED, PI_WARN, "Header not terminated by empty line (CRLF)", EXPFILL }}, #if 0 { &ei_sip_odd_register_response, { "sip.response.unusual", PI_RESPONSE_CODE, PI_WARN, "SIP Response is unusual", EXPFILL }}, #endif { &ei_sip_call_id_invalid, { "sip.Call-ID.invalid", PI_PROTOCOL, PI_WARN, "Call ID is mandatory", EXPFILL }}, { &ei_sip_sipsec_malformed, { "sip.sec_mechanism.malformed", PI_MALFORMED, PI_WARN, "SIP Security-mechanism header malformed", EXPFILL }}, { &ei_sip_via_sent_by_port, { "sip.Via.sent-by.port.invalid", PI_MALFORMED, PI_NOTE, "Invalid SIP Via sent-by-port", EXPFILL }}, { &ei_sip_content_length_invalid, { "sip.content_length.invalid", PI_MALFORMED, PI_NOTE, "Invalid content_length", EXPFILL }}, { &ei_sip_retry_after_invalid, { "sip.retry_after.invalid", PI_MALFORMED, PI_NOTE, "Invalid retry_after value", EXPFILL }}, { &ei_sip_Status_Code_invalid, { "sip.Status-Code.invalid", PI_MALFORMED, PI_NOTE, "Invalid Status-Code", EXPFILL }}, { &ei_sip_authorization_invalid, { "sip.authorization.invalid", PI_PROTOCOL, PI_WARN, "Invalid authorization response for known credentials", EXPFILL }}, { &ei_sip_session_id_sess_id,{ "sip.Session-ID.sess_id.invalid", PI_PROTOCOL, PI_WARN, "Session ID cannot be empty", EXPFILL }} }; module_t *sip_module; expert_module_t* expert_sip; uat_t* sip_custom_headers_uat; uat_t* sip_authorization_users_uat; static tap_param sip_stat_params[] = { { PARAM_FILTER, "filter", "Filter", NULL, true } }; static stat_tap_table_ui sip_stat_table = { REGISTER_TELEPHONY_GROUP_UNSORTED, "SIP Statistics", "sip", "sip,stat", sip_stat_init, sip_stat_packet, sip_stat_reset, sip_stat_free_table_item, NULL, array_length(sip_stat_fields), sip_stat_fields, array_length(sip_stat_params), sip_stat_params, NULL, 0 }; /* UAT for header fields */ static uat_field_t sip_custom_header_uat_fields[] = { UAT_FLD_CSTRING(sip_custom_header_fields, header_name, "Header name", "SIP header name"), UAT_FLD_CSTRING(sip_custom_header_fields, header_desc, "Field desc", "Description of the value contained in the header"), UAT_END_FIELDS }; static uat_field_t sip_authorization_users_uat_fields[] = { UAT_FLD_CSTRING(sip_authorization_users, username, "Username", "SIP authorization username"), UAT_FLD_CSTRING(sip_authorization_users, realm, "Realm", "SIP authorization realm"), UAT_FLD_CSTRING(sip_authorization_users, password, "Password", "SIP authorization password"), UAT_END_FIELDS }; /* Register the protocol name and description */ proto_sip = proto_register_protocol("Session Initiation Protocol", "SIP", "sip"); proto_raw_sip = proto_register_protocol("Session Initiation Protocol (SIP as raw text)", "Raw_SIP", "raw_sip"); sip_handle = register_dissector("sip", dissect_sip, proto_sip); sip_tcp_handle = register_dissector("sip.tcp", dissect_sip_tcp, proto_sip); /* Required function calls to register the header fields and subtrees used */ proto_register_field_array(proto_sip, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); expert_sip = expert_register_protocol(proto_sip); expert_register_field_array(expert_sip, ei, array_length(ei)); proto_register_subtree_array(ett_raw, array_length(ett_raw)); /* Register raw_sip field(s) */ proto_register_field_array(proto_raw_sip, raw_hf, array_length(raw_hf)); sip_module = prefs_register_protocol(proto_sip, proto_reg_handoff_sip); prefs_register_uint_preference(sip_module, "tls.port", "SIP TLS Port", "SIP Server TLS Port", 10, &sip_tls_port); prefs_register_bool_preference(sip_module, "display_raw_text", "Display raw text for SIP message", "Specifies that the raw text of the " "SIP message should be displayed " "in addition to the dissection tree", &global_sip_raw_text); prefs_register_bool_preference(sip_module, "display_raw_text_without_crlf", "Don't show '\\r\\n' in raw SIP messages", "If the raw text of the SIP message " "is displayed, the trailing carriage " "return and line feed are not shown", &global_sip_raw_text_without_crlf); prefs_register_enum_preference(sip_module, "raw_text_body_default_encoding", "Default charset of raw SIP messages", "Display sip body of raw text by using this charset. The default is UTF-8.", &global_sip_raw_text_body_default_encoding, ws_supported_mibenum_vals_character_sets_ev_array, false); prefs_register_bool_preference(sip_module, "strict_sip_version", "Enforce strict SIP version check (" SIP2_HDR ")", "If enabled, only " SIP2_HDR " traffic will be dissected as SIP. " "Disable it to allow SIP traffic with a different version " "to be dissected as SIP.", &strict_sip_version); prefs_register_bool_preference(sip_module, "desegment_headers", "Reassemble SIP headers spanning multiple TCP segments", "Whether the SIP dissector should reassemble headers " "of a request spanning multiple TCP segments. " "To use this option, you must also enable " "\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.", &sip_desegment_headers); prefs_register_bool_preference(sip_module, "desegment_body", "Reassemble SIP bodies spanning multiple TCP segments", "Whether the SIP dissector should use the " "\"Content-length:\" value, if present, to reassemble " "the body of a request spanning multiple TCP segments, " "and reassemble chunked data spanning multiple TCP segments. " "To use this option, you must also enable " "\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.", &sip_desegment_body); prefs_register_bool_preference(sip_module, "retrans_the_same_sport", "Retransmissions always use the same source port", "Whether retransmissions are detected coming from the same source port only.", &sip_retrans_the_same_sport); prefs_register_bool_preference(sip_module, "delay_sdp_changes", "Delay SDP changes for tracking media", "Whether SIP should delay tracking the media (e.g., RTP/RTCP) until an SDP offer " "is answered. If enabled, mid-dialog changes to SDP and media state only take " "effect if and when an SDP offer is successfully answered; however enabling this " "prevents tracking media in early-media call scenarios", &sip_delay_sdp_changes); prefs_register_bool_preference(sip_module, "hide_generatd_call_id", "Hide the generated Call Id", "Whether the generated call id should be hidden(not displayed) in the tree or not.", &sip_hide_generatd_call_ids); /* UAT */ sip_custom_headers_uat = uat_new("Custom SIP Header Fields", sizeof(header_field_t), "custom_sip_header_fields", true, &sip_custom_header_fields, &sip_custom_num_header_fields, /* specifies named fields, so affects dissection and the set of named fields */ UAT_AFFECTS_DISSECTION|UAT_AFFECTS_FIELDS, NULL, header_fields_copy_cb, header_fields_update_cb, header_fields_free_cb, header_fields_post_update_cb, header_fields_reset_cb, sip_custom_header_uat_fields ); prefs_register_uat_preference(sip_module, "custom_sip_header_fields", "Custom SIP header fields", "A table to define custom SIP header for which fields can be setup and used for filtering/data extraction etc.", sip_custom_headers_uat); prefs_register_bool_preference(sip_module, "validate_authorization", "Validate SIP authorization", "Validate SIP authorizations with known credentials", &global_sip_validate_authorization); sip_authorization_users_uat = uat_new("SIP authorization users", sizeof(authorization_user_t), "authorization_users_sip", true, &sip_authorization_users, &sip_authorization_num_users, /* specifies named fields, so affects dissection and the set of named fields */ UAT_AFFECTS_DISSECTION|UAT_AFFECTS_FIELDS, NULL, authorization_users_copy_cb, authorization_users_update_cb, authorization_users_free_cb, NULL, NULL, sip_authorization_users_uat_fields ); prefs_register_uat_preference(sip_module, "authorization_users_sip", "SIP authorization users", "A table to define user credentials used for validating authorization attempts", sip_authorization_users_uat); register_init_routine(&sip_init_protocol); register_cleanup_routine(&sip_cleanup_protocol); heur_subdissector_list = register_heur_dissector_list_with_description("sip", "SIP message fallback", proto_sip); /* Register for tapping */ sip_tap = register_tap("sip"); sip_follow_tap = register_tap("sip_follow"); ext_hdr_subdissector_table = register_dissector_table("sip.hdr", "SIP Extension header", proto_sip, FT_STRING, STRING_CASE_SENSITIVE); register_stat_tap_table_ui(&sip_stat_table); /* compile patterns */ ws_mempbrk_compile(&pbrk_comma_semi, ",;"); ws_mempbrk_compile(&pbrk_whitespace, " \t\r\n"); ws_mempbrk_compile(&pbrk_param_end, ">,;? \r"); ws_mempbrk_compile(&pbrk_param_end_colon_brackets, ">,;? \r:[]"); ws_mempbrk_compile(&pbrk_header_end_dquote, "\r\n,;\""); ws_mempbrk_compile(&pbrk_tab_sp_fslash, "\t /"); ws_mempbrk_compile(&pbrk_addr_end, "[] \t:;"); ws_mempbrk_compile(&pbrk_via_param_end, "\t;, "); register_follow_stream(proto_sip, "sip_follow", sip_follow_conv_filter, sip_follow_index_filter, sip_follow_address_filter, udp_port_to_display, follow_tvb_tap_listener, NULL, NULL); } void proto_reg_handoff_sip(void) { static unsigned saved_sip_tls_port; static bool sip_prefs_initialized = false; if (!sip_prefs_initialized) { sigcomp_handle = find_dissector_add_dependency("sigcomp", proto_sip); sip_diag_handle = find_dissector("sip.diagnostic"); sip_uri_userinfo_handle = find_dissector("sip.uri_userinfo"); sip_via_branch_handle = find_dissector("sip.via_branch"); sip_via_be_route_handle = find_dissector("sip.via_be_route"); /* Check for a dissector to parse Reason Code texts */ sip_reason_code_handle = find_dissector("sip.reason_code"); /* SIP content type and internet media type used by other dissectors are the same */ media_type_dissector_table = find_dissector_table("media_type"); dissector_add_uint_range_with_preference("udp.port", DEFAULT_SIP_PORT_RANGE, sip_handle); dissector_add_string("media_type", "message/sip", sip_handle); dissector_add_string("ws.protocol", "sip", sip_handle); /* RFC 7118 */ dissector_add_uint_range_with_preference("tcp.port", DEFAULT_SIP_PORT_RANGE, sip_tcp_handle); heur_dissector_add("udp", dissect_sip_heur, "SIP over UDP", "sip_udp", proto_sip, HEURISTIC_ENABLE); heur_dissector_add("tcp", dissect_sip_tcp_heur, "SIP over TCP", "sip_tcp", proto_sip, HEURISTIC_ENABLE); heur_dissector_add("sctp", dissect_sip_heur, "SIP over SCTP", "sip_sctp", proto_sip, HEURISTIC_ENABLE); heur_dissector_add("stun", dissect_sip_heur, "SIP over TURN", "sip_stun", proto_sip, HEURISTIC_ENABLE); dissector_add_uint("acdr.tls_application_port", 5061, sip_handle); dissector_add_uint("acdr.tls_application", TLS_APP_SIP, sip_handle); dissector_add_string("protobuf_field", "adc.sip.ResponsePDU.body", sip_handle); dissector_add_string("protobuf_field", "adc.sip.RequestPDU.body", sip_handle); exported_pdu_tap = find_tap_id(EXPORT_PDU_TAP_NAME_LAYER_7); sip_prefs_initialized = true; } else { ssl_dissector_delete(saved_sip_tls_port, sip_tcp_handle); } /* Set our port number for future use */ ssl_dissector_add(sip_tls_port, sip_tcp_handle); saved_sip_tls_port = sip_tls_port; } /* * Editor modelines - https://www.wireshark.org/tools/modelines.html * * Local variables: * c-basic-offset: 4 * tab-width: 8 * indent-tabs-mode: nil * End: * * vi: set shiftwidth=4 tabstop=8 expandtab: * :indentSize=4:tabSize=8:noTabs=true: */