| blob | 3f70cb5796f0499d726a56d7f96e3d006fe0829f |
1 /* packet-rtmpt.c
2 * Routines for Real Time Messaging Protocol packet dissection
3 * metatech <metatech@flashmail.com>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
12 /* This dissector is called RTMPT to avoid a conflict with
13 * the other RTMP protocol (Routing Table Maintenance Protocol) implemented in packet-atalk.c
14 * (RTMPT normally stands for RTMP-Tunnel via http)
15 *
16 * RTMP in a nutshell
17 *
18 * The protocol has very few "magic words" to facilitate detection,
19 * but rather has "magic lengths".
20 * This protocol has plenty of special cases and few general rules,
21 * especially regarding the lengths and the structures.
22 *
23 * Documentation:
24 * RTMP protocol description on Wiki of Red5 Open Source Flash Server at
25 *
26 * http://trac.red5.org/wiki/Codecs/RTMPSpecification
27 *
28 * and the pages to which it links:
29 *
30 * http://osflash.org/documentation/rtmp
31 * http://wiki.gnashdev.org/RTMP
32 * http://wiki.gnashdev.org/RTMP_Messages_Decoded
33 * http://www.acmewebworks.com/Downloads/openCS/TheAMF.pdf
34 * https://rtmp.veriskope.com/pdf/rtmp_specification_1.0.pdf
35 *
36 * It's also available from Adobe at
37 *
38 * https://www.adobe.com/devnet/rtmp.html
39 *
40 * For AMF, see:
41 *
42 * http://download.macromedia.com/pub/labs/amf/amf0_spec_121207.pdf
43 *
44 * for AMF0 and
45 *
46 * http://amf3cplusplus.googlecode.com/svn-history/r4/trunk/doc/amf3_spec_05_05_08.pdf
47 *
48 * for AMF3.
49 *
50 * For FLV, see:
51 *
52 * https://rtmp.veriskope.com/pdf/video_file_format_spec_v10.pdf
53 *
54 * For Enhanced RTMP, see:
55 *
56 * https://veovera.org/docs/enhanced/enhanced-rtmp-v2.pdf
57 *
58 * Default TCP port is 1935
59 */
64 #include <epan/packet.h>
65 #include <wsutil/pint.h>
67 #include <epan/prefs.h>
68 #include <epan/to_str.h>
69 #include <epan/expert.h>
72 #define MAX_AMF_ITERATIONS 1000
166 /* Native Bandwidth Detection (using the checkBandwidth(), onBWCheck(),
167 * onBWDone() calls) transmits a series of increasing size packets over
168 * the course of 2 seconds. On a fast link the largest packet can just
169 * exceed 256KB, but setting the limit there can cause massive memory
170 * usage, especially with fuzzed packets where the length value is bogus.
171 * Limit the initial allocation size and realloc if needed, i.e., in
172 * future frames if the bytes are actually there.
173 * This initial max allocation size can be reduced further if need be,
174 * but keep it at least 18 so that the headers fit without checking,
175 * See https://gitlab.com/wireshark/wireshark/-/issues/6898
176 */
177 #define RTMPT_INIT_ALLOC_SIZE 32768
181 #define RTMPT_MAGIC 0x03
182 #define RTMPT_HANDSHAKE_OFFSET_1 1
183 #define RTMPT_HANDSHAKE_OFFSET_2 1538
184 #define RTMPT_HANDSHAKE_OFFSET_3 3074
185 #define RTMPT_HANDSHAKE_LENGTH_1 1537
186 #define RTMPT_HANDSHAKE_LENGTH_2 3073
187 #define RTMPT_HANDSHAKE_LENGTH_3 1536
188 #define RTMPT_INITIAL_CHUNK_SIZE 128
192 #define RTMPT_ID_MAX 65599
193 #define RTMPT_TYPE_HANDSHAKE_1 0x100001
194 #define RTMPT_TYPE_HANDSHAKE_2 0x100002
195 #define RTMPT_TYPE_HANDSHAKE_3 0x100003
197 #define RTMPT_TYPE_CHUNK_SIZE 0x01
198 #define RTMPT_TYPE_ABORT_MESSAGE 0x02
199 #define RTMPT_TYPE_ACKNOWLEDGEMENT 0x03
200 #define RTMPT_TYPE_UCM 0x04
201 #define RTMPT_TYPE_WINDOW 0x05
202 #define RTMPT_TYPE_PEER_BANDWIDTH 0x06
203 #define RTMPT_TYPE_AUDIO_DATA 0x08
204 #define RTMPT_TYPE_VIDEO_DATA 0x09
205 #define RTMPT_TYPE_DATA_AMF3 0x0F
206 #define RTMPT_TYPE_SHARED_AMF3 0x10
207 #define RTMPT_TYPE_COMMAND_AMF3 0x11
208 #define RTMPT_TYPE_DATA_AMF0 0x12
209 #define RTMPT_TYPE_SHARED_AMF0 0x13
210 #define RTMPT_TYPE_COMMAND_AMF0 0x14
211 #define RTMPT_TYPE_AGGREGATE 0x16
213 #define RTMPT_UCM_STREAM_BEGIN 0x00
214 #define RTMPT_UCM_STREAM_EOF 0x01
215 #define RTMPT_UCM_STREAM_DRY 0x02
216 #define RTMPT_UCM_SET_BUFFER 0x03
217 #define RTMPT_UCM_STREAM_ISRECORDED 0x04
218 #define RTMPT_UCM_PING_REQUEST 0x06
219 #define RTMPT_UCM_PING_RESPONSE 0x07
221 #define RTMPT_IS_EX_AUDIO_HEADER 0x90
222 #define RTMPT_IS_EX_VIDEO_HEADER 0x80
223 #define RTMPT_IS_PACKET_TYPE_METADATA 0x04
224 #define RTMPT_IS_FRAME_TYPE_COMMAND 0x05
225 #define RTMPT_IS_AUDIO_MULTITRACK 0x05
226 #define RTMPT_IS_VIDEO_MULTITRACK 0x06
227 #define RTMPT_IS_ONETRACK 0x00
228 #define RTMPT_IS_MANYTRACKSMANYCODECS 0x02
238 };
257 };
260 /* These are a complete guess, from the order of the documented
261 * options - the values aren't actually specified */
266 };
277 };
284 };
286 /* [Spec] https://github.com/runner365/read_book/blob/master/rtmp/rtmp_specification_1.0.pdf */
287 /* [DevG] http://help.adobe.com/en_US/flashmediaserver/devguide/index.html "working with Live Video" => Adding metadata to a live stream */
288 /* [SWF] https://github.com/blackears/raven/blob/master/proj/SWFParser/doc/swf_file_format_spec_v10.pdf */
303 };
311 };
318 };
326 };
332 };
338 };
340 /* from FLV v10.1 section E.4.3.1 */
348 };
350 /* From Enhanced RTMP */
355 };
357 /* from FLV v10.1 section E.4.3.1 */
367 };
369 /*
370 * https://raw.githubusercontent.com/veovera/enhanced-rtmp/main/enhanced-rtmp.pdf
371 */
381 };
390 /* static int hf_amf_header_value_type; */
406 /* static int hf_amf_longstringlength; */
442 /* AMF0 type markers */
443 #define AMF0_NUMBER 0x00
444 #define AMF0_BOOLEAN 0x01
445 #define AMF0_STRING 0x02
446 #define AMF0_OBJECT 0x03
447 #define AMF0_MOVIECLIP 0x04
448 #define AMF0_NULL 0x05
449 #define AMF0_UNDEFINED 0x06
450 #define AMF0_REFERENCE 0x07
451 #define AMF0_ECMA_ARRAY 0x08
452 #define AMF0_END_OF_OBJECT 0x09
453 #define AMF0_STRICT_ARRAY 0x0A
454 #define AMF0_DATE 0x0B
455 #define AMF0_LONG_STRING 0x0C
456 #define AMF0_UNSUPPORTED 0x0D
457 #define AMF0_RECORDSET 0x0E
458 #define AMF0_XML 0x0F
459 #define AMF0_TYPED_OBJECT 0x10
460 #define AMF0_AMF3_MARKER 0x11
461 #define AMF0_INT64 0x22
463 /* AMF3 type markers */
464 #define AMF3_UNDEFINED 0x00
465 #define AMF3_NULL 0x01
466 #define AMF3_FALSE 0x02
467 #define AMF3_TRUE 0x03
468 #define AMF3_INTEGER 0x04
469 #define AMF3_DOUBLE 0x05
470 #define AMF3_STRING 0x06
471 #define AMF3_XML_DOC 0x07
472 #define AMF3_DATE 0x08
473 #define AMF3_ARRAY 0x09
474 #define AMF3_OBJECT 0x0A
475 #define AMF3_XML 0x0B
476 #define AMF3_BYTEARRAY 0x0C
499 };
516 };
518 /* Holds the reassembled data for a packet during un-chunking
519 */
520 /* XXX: Because we don't use the TCP dissector's built-in desegmentation,
521 * or the standard reassembly API, we don't get FT_FRAMENUM links for
522 * chunk fragments, and we don't mark depended upon frames for export.
523 * Ideally we'd use the standard API (mark pinfo->desegment_offset and
524 * pinfo->desegment_len for TCP, or use the reassembly API), or call
525 * mark_frame_as_depended_upon and add the FT_FRAMENUM fields ourselves.
526 * To do the latter, we should have a data structure indicating which
527 * frames contributed to the packet.
528 */
541 /* used during unchunking */
551 /* Chunk Basic Header */
555 /* Chunk Message Header (offsets assume bhlen == 1) */
567 /* Represents a header or a chunk that is split over two TCP
568 * segments
569 */
583 /* The full message header information for the last packet on a particular
584 * ID - used for defaulting short headers
585 */
596 /* Historical view of a whole TCP connection
597 */
607 static void
609 {
613 }
615 /* Header length helpers */
618 {
623 }
624 }
627 {
633 }
634 }
636 /* Lightweight access to AMF0 blobs - more complete dissection is done
637 * in dissect_rtmpt_body_command */
639 static uint32_t
641 {
654 }
663 }
670 rv++;
671 depth--;
673 }
706 depth++;
710 depth++;
714 }
720 }
723 }
727 {
738 param--;
739 }
748 }
749 }
752 offset++;
753 remain--;
768 return tvb_get_string_enc(wmem_packet_scope(), tvb, offset+2+iPropLength+3, iStringLength, ENC_ASCII);
769 }
776 }
777 }
778 }
781 }
783 static uint32_t
785 {
794 }
799 }
800 }
803 }
806 /* Generate a useful description for various packet types */
809 rtmpt_get_packet_desc(tvbuff_t *tvb, uint32_t offset, proto_item* pi, uint32_t remain, rtmpt_conv_t *rconv, int cdir,
811 {
819 }
828 }
843 }
849 }
855 }
856 }
869 }
872 }
894 }
903 }
909 }
910 }
911 }
918 }
919 }
920 }
923 }
926 /* Tree dissection helpers for various packet body forms */
928 static void
930 {
951 }
952 }
954 static int
955 dissect_amf0_value_type(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, bool *amf3_encoding, proto_item *parent_ti);
957 /*
958 * A "property list" is a sequence of name/value pairs, terminated by
959 * and "end of object" indicator. AMF0 "object"s and "ECMA array"s
960 * are encoded as property lists.
961 */
962 static int
963 // NOLINTNEXTLINE(misc-no-recursion)
964 dissect_amf0_property_list(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, unsigned *countp, bool *amf3_encoding)
965 {
973 /*
974 * XXX - at least as I read "3.1 AVM+ Type Marker" in the AMF0
975 * specification, the AVM+ Type Marker only affects "the following
976 * Object". For now, we have a single "AMF3 encoding" flag, and
977 * set it when we see the type marker, and never clear it.
978 */
980 /* UTF-8: property name */
985 count++;
989 iStringValue);
1000 /* value-type: property value */
1003 }
1010 }
1012 static int
1013 // NOLINTNEXTLINE(misc-no-recursion)
1014 dissect_amf0_value_type(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, bool *amf3_encoding, proto_item *parent_ti)
1015 {
1027 nstime_t t;
1038 /*
1039 * For object types, make the top-level protocol tree
1040 * item a field for that type.
1041 */
1047 /*
1048 * For ECMA array types, make the top-level protocol tree
1049 * item a field for that type.
1050 */
1056 /*
1057 * For strict array types, make the top-level protocol tree
1058 * item a field for that type.
1059 */
1065 /*
1066 * For all other types, make it just a text item; the
1067 * field for that type will be used for the value.
1068 */
1072 }
1075 iValueOffset++;
1099 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset, iStringLength, ENC_UTF_8|ENC_NA);
1101 proto_tree_add_string(val_tree, hf_amf_string, tvb, iValueOffset, iStringLength, iStringValue);
1108 iValueOffset = dissect_amf0_property_list(tvb, pinfo, iValueOffset, val_tree, &count, amf3_encoding);
1121 /*
1122 * Counted list type, with end marker. The count appears to be
1123 * more of a hint than a rule, and is sometimes sent as 0 or
1124 * invalid.
1125 *
1126 * Basically the same as OBJECT but with the extra count field.
1127 * There being many strange encoders/metadata injectors out
1128 * there, sometimes you see a valid count and no end marker.
1129 * Figuring out which you've got for a deeply nested structure
1130 * is non-trivial.
1131 */
1135 iValueOffset = dissect_amf0_property_list(tvb, pinfo, iValueOffset, val_tree, &count, amf3_encoding);
1143 /*
1144 * Counted list type, without end marker. Number of values
1145 * is determined by count, values are assumed to form a
1146 * [0..N-1] numbered array and are presented as plain AMF
1147 * types, not OBJECT or ECMA_ARRAY style named properties.
1148 */
1153 iValueOffset = dissect_amf0_value_type(tvb, pinfo, iValueOffset, val_tree, amf3_encoding, NULL);
1162 proto_item_append_text(ti, " %s", abs_time_to_str(pinfo->pool, &t, ABSOLUTE_TIME_LOCAL, true));
1164 proto_item_append_text(parent_ti, " %s", abs_time_to_str(pinfo->pool, &t, ABSOLUTE_TIME_LOCAL, true));
1165 /* time-zone */
1173 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset, iStringLength, ENC_UTF_8|ENC_NA);
1175 proto_tree_add_string(val_tree, (iObjType == AMF0_XML) ? hf_amf_xml_doc : hf_amf_longstring, tvb, iValueOffset, iStringLength, iStringValue);
1184 /* class-name */
1188 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset, iStringLength, ENC_UTF_8|ENC_NA);
1189 proto_tree_add_string(val_tree, hf_amf_string, tvb, iValueOffset, iStringLength, iStringValue);
1191 iValueOffset = dissect_amf0_property_list(tvb, pinfo, iValueOffset, val_tree, &count, amf3_encoding);
1205 /*
1206 * If we can't determine the length, don't carry on;
1207 * just skip to the end of the tvbuff.
1208 */
1211 }
1215 }
1217 static uint32_t
1219 {
1226 offset++;
1227 len++;
1229 /* 1 byte value */
1232 }
1235 offset++;
1236 len++;
1238 /* 2 byte value */
1241 }
1244 offset++;
1245 len++;
1247 /* 3 byte value */
1250 }
1253 len++;
1256 }
1258 static int
1259 // NOLINTNEXTLINE(misc-no-recursion)
1260 dissect_amf3_value_type(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, proto_item *parent_ti)
1261 {
1290 /*
1291 * For array types, make the top-level protocol tree
1292 * item a field for that type.
1293 */
1299 /*
1300 * For object types, make the top-level protocol tree
1301 * item a field for that type.
1302 */
1308 /*
1309 * For all other types, make it just a text item; the
1310 * field for that type will be used for the value.
1311 */
1315 }
1318 iValueOffset++;
1334 /* XXX - signed or unsigned? */
1353 /* the upper 28 bits of the integer value is a string length */
1355 proto_tree_add_uint(val_tree, hf_amf_stringlength, tvb, iValueOffset, iValueLength, iStringLength);
1357 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset, iStringLength, ENC_UTF_8|ENC_NA);
1359 proto_tree_add_string(val_tree, hf_amf_string, tvb, iValueOffset, iStringLength, iStringValue);
1365 /* the upper 28 bits of the integer value are a string reference index */
1366 proto_tree_add_uint(val_tree, hf_amf_string_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1371 }
1376 /*
1377 * The upper 28 bits of the integer value are
1378 * ignored; what follows is a double
1379 * containing milliseconds since the Epoch.
1380 */
1381 nstime_t t;
1391 proto_item_append_text(parent_ti, "%s", abs_time_to_str(pinfo->pool, &t, ABSOLUTE_TIME_LOCAL, true));
1393 /* the upper 28 bits of the integer value are an object reference index */
1394 proto_tree_add_uint(val_tree, hf_amf_object_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1399 }
1404 /*
1405 * The upper 28 bits of the integer value are
1406 * a count of the number of elements in
1407 * the dense portion of the array.
1408 */
1410 proto_tree_add_uint(val_tree, hf_amf_arraydenselength, tvb, iValueOffset, iValueLength, iArrayLength);
1413 /*
1414 * The AMF3 spec bit on the Array type is slightly
1415 * confusingly written, but seems to be saying that
1416 * the associative portion of the array follows the
1417 * size of the dense portion of the array, and the
1418 * dense portion of the array follows the associative
1419 * portion.
1420 *
1421 * Dissect the associative portion.
1422 */
1424 /* Fetch the name */
1427 /* the upper 28 bits of the integer value is a string length */
1430 /* null name marks the end of the associative part */
1431 proto_tree_add_item(val_tree, hf_amf_end_of_associative_part, tvb, iValueOffset, iValueLength, ENC_NA);
1434 }
1435 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset+iValueLength, iStringLength, ENC_UTF_8|ENC_NA);
1438 proto_tree_add_uint(subval_tree, hf_amf_stringlength, tvb, iValueOffset, iValueLength, iStringLength);
1440 proto_tree_add_string(subval_tree, hf_amf_string, tvb, iValueOffset, iStringLength, iStringValue);
1442 /* the upper 28 bits of the integer value are a string reference index */
1445 proto_tree_add_uint(subval_tree, hf_amf_string_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1446 }
1448 /* Fetch the value */
1454 }
1456 /*
1457 * Dissect the dense portion.
1458 */
1464 /* the upper 28 bits of the integer value are an object reference index */
1465 proto_tree_add_uint(val_tree, hf_amf_object_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1469 }
1476 /*
1477 * U29O-traits-ext; the rest of
1478 * iIntegerValue is not significant,
1479 * and, worse, we have idea what
1480 * follows the class name, or even
1481 * how many bytes follow the class
1482 * name - that's by convention between
1483 * the client and server.
1484 */
1487 /*
1488 * U29O-traits; the 0x00000008 bit
1489 * specifies whether the type is
1490 * dynamic.
1491 */
1494 proto_tree_add_uint(val_tree, hf_amf_traitcount, tvb, iValueOffset, iValueLength, iTraitCount);
1498 /* the upper 28 bits of the integer value is a string length */
1500 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset+iValueLength, iStringLength, ENC_UTF_8|ENC_NA);
1502 ett_amf_traits, &traits_ti, "Traits for class %s (%u member names)", iStringValue, iTraitCount);
1504 iValueOffset,
1507 iStringValue);
1508 proto_tree_add_uint(name_tree, hf_amf_classnamelength, tvb, iValueOffset, iValueLength, iStringLength);
1510 proto_tree_add_string(name_tree, hf_amf_classname, tvb, iValueOffset, iStringLength, iStringValue);
1513 /* the upper 28 bits of the integer value are a string reference index */
1516 proto_tree_add_uint(traits_tree, hf_amf_string_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1518 }
1522 /* the upper 28 bits of the integer value is a string length */
1524 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset+iValueLength, iStringLength, ENC_UTF_8|ENC_NA);
1525 member_tree = proto_tree_add_subtree_format(traits_tree, tvb, iValueOffset, iValueLength+iStringLength,
1527 proto_tree_add_uint(member_tree, hf_amf_membernamelength, tvb, iValueOffset, iValueLength, iStringLength);
1529 proto_tree_add_string(member_tree, hf_amf_membername, tvb, iValueOffset, iStringLength, iStringValue);
1532 /* the upper 28 bits of the integer value are a string reference index */
1533 proto_tree_add_uint(traits_tree, hf_amf_string_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1535 }
1536 }
1541 /* Fetch the name */
1544 /* the upper 28 bits of the integer value is a string length */
1547 /* null name marks the end of the associative part */
1548 proto_tree_add_item(traits_tree, hf_amf_end_of_dynamic_members, tvb, iValueOffset, iValueLength, ENC_NA);
1551 }
1552 iStringValue = tvb_get_string_enc(pinfo->pool, tvb, iValueOffset+iValueLength, iStringLength, ENC_UTF_8|ENC_NA);
1556 iValueOffset,
1559 iStringValue);
1560 proto_tree_add_uint(name_tree, hf_amf_membernamelength, tvb, iValueOffset, iValueLength, iStringLength);
1562 proto_tree_add_string(name_tree, hf_amf_membername, tvb, iValueOffset, iStringLength, iStringValue);
1565 /* the upper 28 bits of the integer value are a string reference index */
1568 proto_tree_add_uint(subval_tree, hf_amf_string_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1570 }
1572 /* Fetch the value */
1575 }
1576 }
1578 }
1580 /*
1581 * U29O-traits-ref; the upper 27 bits of
1582 * the integer value are a traits reference
1583 * index.
1584 */
1585 proto_tree_add_uint(val_tree, hf_amf_trait_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 2);
1587 }
1589 /*
1590 * U29O-ref; the upper 28 bits of the integer value
1591 * are an object reference index.
1592 */
1593 proto_tree_add_uint(val_tree, hf_amf_object_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1597 }
1602 /*
1603 * The upper 28 bits of the integer value are
1604 * a count of the number of bytes in the
1605 * XML string.
1606 */
1608 proto_tree_add_uint(val_tree, hf_amf_xmllength, tvb, iValueOffset, iValueLength, iStringLength);
1612 /* the upper 28 bits of the integer value are a string reference index */
1613 proto_tree_add_uint(val_tree, hf_amf_object_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1617 }
1622 /*
1623 * The upper 28 bits of the integer value are
1624 * a count of the number of bytes in the
1625 * byte array.
1626 */
1628 proto_tree_add_uint(val_tree, hf_amf_bytearraylength, tvb, iValueOffset, iValueLength, iArrayLength);
1631 proto_tree_add_bytes(val_tree, hf_amf_bytearray, tvb, iValueOffset, iArrayLength, iByteArrayValue);
1634 proto_item_append_text(parent_ti, " %s", bytes_to_str(pinfo->pool, iByteArrayValue, iArrayLength));
1636 /* the upper 28 bits of the integer value are a object reference index */
1637 proto_tree_add_uint(val_tree, hf_amf_object_reference, tvb, iValueOffset, iValueLength, iIntegerValue >> 1);
1641 }
1644 /*
1645 * If we can't determine the length, don't carry on;
1646 * just skip to the end of the tvbuff.
1647 */
1650 }
1654 }
1656 static int
1657 dissect_rtmpt_body_command(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *rtmpt_tree, bool amf3)
1658 {
1662 /* Looks like for the AMF3 variants we get a 0 byte here,
1663 * followed by AMF0 encoding - I've never seen actual AMF3
1664 * encoding used, which is completely different. I speculate
1665 * that if the byte is AMF0_AMF3_MARKER then the rest
1666 * will be in AMF3. For now, assume AMF0 only. */
1667 offset++;
1668 }
1671 {
1674 else
1676 }
1678 }
1680 static void
1682 {
1708 ai = proto_tree_add_uint_format(rtmpt_tree, hf_rtmpt_audio_multitrack_control, tvb, offset, 1, iAudioMultitrackCtl,
1710 val_to_str_const((iAudioMultitrackCtl & 0x0f), rtmpt_av_multitrack_types, "Reserved av multitrack type"),
1711 val_to_str_const((iAudioMultitrackCtl & 0xf0) >> 4, rtmpt_audio_packet_types, "Reserved audio packet type"));
1713 proto_tree_add_uint(at, hf_rtmpt_audio_multitrack_packet_type, tvb, offset, 1, iAudioMultitrackCtl);
1722 }
1726 }
1737 }
1747 }
1751 }
1752 }
1767 }
1768 }
1770 static void
1772 {
1789 /*
1790 * https://veovera.org/docs/enhanced/enhanced-rtmp-v2.pdf
1791 */
1806 if (iVideoPacketType != RTMPT_IS_PACKET_TYPE_METADATA && iVideoFrameType == RTMPT_IS_FRAME_TYPE_COMMAND) {
1813 vi = proto_tree_add_uint_format(rtmpt_tree, hf_rtmpt_video_multitrack_control, tvb, offset, 1, iMultitrackCtl,
1816 val_to_str_const(iMultitrackCtl & 0xf, rtmpt_video_packet_types, "Reserved video packet type"));
1819 proto_tree_add_item(vt, hf_rtmpt_video_multitrack_packet_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1827 }
1831 }
1840 }
1851 }
1855 }
1856 }
1872 }
1873 }
1874 }
1876 static void
1877 dissect_rtmpt_body_aggregate(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *rtmpt_tree)
1878 {
1890 tag_tree = proto_tree_add_subtree(rtmpt_tree, tvb, offset, 11+iDataSize+4, ett_rtmpt_tag, NULL,
1898 data_tree = proto_tree_add_subtree(tag_tree, tvb, offset+11, iDataSize, ett_rtmpt_tag_data, NULL, "Data");
1912 }
1914 proto_tree_add_item(tag_tree, hf_rtmpt_tag_tagsize, tvb, offset+11+iDataSize, 4, ENC_BIG_ENDIAN);
1916 }
1917 }
1919 /* The main dissector for unchunked packets */
1921 static void
1922 dissect_rtmpt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rtmpt_conv_t *rconv, int cdir, rtmpt_packet_t *tp)
1923 {
1938 /* Clear any previous data in Info column (RTMP packets are protected by a "fence") */
1948 }
1957 }
1958 }
1965 }
1970 }
1971 }
1975 }
1978 {
1979 sDesc = rtmpt_get_packet_desc(tvb, iBodyOffset, tree, iBodyRemain, rconv, cdir, tp, &deschasopcode);
1980 }
1993 }
1996 {
2003 /* Dissect handshake */
2007 rtmpt_tree = proto_tree_add_subtree(rtmptroot_tree, tvb, offset, -1, ett_rtmpt_handshake, NULL,
2011 {
2014 }
2016 {
2020 }
2022 {
2024 }
2027 }
2037 }
2040 /* Function call/response matching */
2046 }
2048 /* Dissect header fields */
2049 rtmpt_tree = proto_tree_add_subtree(rtmptroot_tree, tvb, offset, tp->bhlen+tp->mhlen, ett_rtmpt_header, NULL, RTMPT_TEXT_RTMP_HEADER);
2050 /* proto_item_append_text(ti, " (%s)", val_to_str(tp->cmd, rtmpt_opcode_vals, "Unknown (0x%01x)")); */
2052 if (tp->fmt <= 3) proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_format, tvb, offset + 0, 1, ENC_BIG_ENDIAN);
2053 if (tp->fmt <= 3) proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_csid, tvb, offset + 0, tp->bhlen, ENC_BIG_ENDIAN);
2056 proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_timestamp_delta, tvb, offset + tp->bhlen, 3, ENC_BIG_ENDIAN);
2058 proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_timestamp, tvb, offset + tp->bhlen, 3, ENC_BIG_ENDIAN);
2059 }
2061 proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_ets, tvb, offset + tp->bhlen + tp->mhlen - 4, 4, ENC_BIG_ENDIAN);
2062 }
2063 }
2065 proto_tree_add_uint_format_value(rtmpt_tree, hf_rtmpt_header_timestamp, tvb, offset + tp->bhlen, 0, tp->ts, "%d (calculated)", tp->ts);
2066 }
2067 if (tp->fmt <= 1) proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_body_size, tvb, offset + tp->bhlen + 3, 3, ENC_BIG_ENDIAN);
2068 if (tp->fmt <= 1) proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_typeid, tvb, offset + tp->bhlen + 6, 1, ENC_BIG_ENDIAN);
2069 if (tp->fmt <= 0) proto_tree_add_item(rtmpt_tree, hf_rtmpt_header_streamid, tvb, offset + tp->bhlen + 7, 4, ENC_LITTLE_ENDIAN);
2071 /* Dissect body */
2075 rtmpt_tree = proto_tree_add_subtree(rtmptroot_tree, tvb, offset, -1, ett_rtmpt_body, NULL, RTMPT_TEXT_RTMP_BODY);
2103 }
2104 }
2105 }
2107 /* Unchunk a data stream into individual RTMP packets */
2109 static void
2110 dissect_rtmpt_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, rtmpt_conv_t *rconv, int cdir, uint32_t seq, uint32_t lastackseq)
2111 {
2140 /* Already done the work, so just dump the existing state */
2141 /* XXX: If there's bogus sequence numbers and the
2142 * tcp.analyze_sequence_numbers pref is true, we can't actually
2143 * assume that we processed this frame the first time around,
2144 * since the TCP dissector might not have given it to us.
2145 */
2148 /* List all RTMP packets terminating in this TCP segment, from end to beginning */
2155 /* Sequence numbers can wrap around (especially with
2156 * tcp.relative_sequence_numbers false), so use the
2157 * wrap around aware comparison from packet-tcp.h
2158 */
2161 // reached first segment.
2162 /* XXX: Assuming tcp.relative_sequence_numbers
2163 * is true, that is, since on TCP we just
2164 * reuse the sequence numbers from tcpinfo.
2165 */
2167 }
2169 /* XXX: There are some problems with sequence
2170 * numbers that wraparound in the middle of
2171 * a segment and using wmem_tree_lookup32_le
2172 * below. Break out here to guarantee that there
2173 * is a limit to the tree lookups and we don't
2174 * have infinite loops. Really a lot of this
2175 * code should be rewritten to deal with
2176 * sequence numbers that wrap around (especially
2177 * (SYN packets with altered sequence numbers
2178 * and out of order packets.)
2179 */
2181 }
2183 }
2185 /* Dissect the generated list in reverse order (beginning to end) */
2193 }
2195 }
2198 }
2205 /* Check for outstanding fragmented headers/chunks first */
2211 /* May need to reassemble cross-TCP-segment fragments */
2213 if (tf->have >= tf->len || seq+offset < tf->seq || seq+offset > tf->lastseq+tf->len-tf->have) {
2219 }
2222 }
2226 }
2229 /* The preceding segment contained an incomplete chunk header */
2244 }
2245 }
2254 }
2255 }
2256 }
2257 }
2260 /* No preceding data, get header data starting at current position */
2281 }
2282 }
2285 /* Ran out of packet mid-header, save and try again next time */
2295 }
2302 }
2305 /* Use reassembled header data */
2316 }
2318 /* Calculate header values, defaulting from previous packets with same id */
2335 else
2338 /* Calculate chunk_size now as a last-resort default payload length */
2350 }
2356 else
2358 }
2361 /* Start a new packet if:
2362 * no previous packet with same id
2363 * not a short 1-byte header
2364 * previous packet with same id was complete
2365 * previous incomplete chunk not handled by fragment handler
2366 */
2367 ws_noisy("New packet cdir=%d seq=%d ti=%p tp=%p header_type=%d header_len=%d id=%d tph=%d tpw=%d len=%d cs=%d",
2369 ti, tp, header_type, basic_hlen+message_hlen, id, tp?tp->have:0, tp?tp->want:0, body_len, chunk_size);
2377 }
2383 }
2388 ts = tf ? pntoh32(tf->saved.d+basic_hlen+message_hlen-4) : tvb_get_ntohl(tvb, offset+basic_hlen+message_hlen-4);
2392 }
2396 }
2398 /* create a new packet structure */
2413 else
2423 /* Save the header information for future defaulting needs */
2430 /* store against the id only until unchunking is complete */
2434 /* The easy case - a whole packet contiguous and fully within this segment */
2450 /* Some more reassembly required */
2452 /* tp->want is how much data we think we want.
2453 * If it's a really big number, we don't want
2454 * to allocate it all at once, due to memory
2455 * exhaustion on fuzzed data (#6898).
2456 * RTMPT_INIT_ALLOC_SIZE should always be larger
2457 * than basic_hlen + message_hlen.
2458 */
2468 }
2480 }
2485 }
2489 /* Header type 3 resends the extended time stamp if the last message on the chunk
2490 * stream had an extended timestamp.
2491 * See: https://gitlab.com/wireshark/wireshark/-/issues/15718
2492 */
2494 }
2495 ws_noisy("Old packet cdir=%d seq=%d ti=%p tp=%p header_len=%d id=%d tph=%d tpw=%d len=%d cs=%d",
2505 }
2509 /* Last case to deal with is unchunking the packet body */
2510 unchunk:
2516 /* message length is a 3 byte number, never overflows an int */
2518 /* tp->want - how much data is supposedly in the entire
2519 * unchunked packet, according to the header. Up to a
2520 * 24-bit integer. Actually allocating this amount can
2521 * cause memory exhaustion on fuzzed data.
2522 * want - how much more data we are going to copy from the
2523 * current tvbuff. No more than necessary to finish the
2524 * current chunk, or what's actually in the tvbuff.
2525 * Allocating this amount shouldn't cause memory exhaustion
2526 * because it's present in the frame.
2527 *
2528 * We should have calculated those values so that the
2529 * following assertion is true.
2530 */
2535 }
2540 }
2545 }
2554 /* Chunk is complete - wait for next header */
2557 }
2560 /* Whole packet is complete */
2568 /* Chunk is split across segment boundary */
2578 }
2579 }
2580 }
2584 {
2602 }
2604 static int
2606 {
2612 /* Reject the packet if data is NULL */
2615 }
2623 }
2632 }
2634 static int
2636 {
2648 /*
2649 * Request flow:
2650 *
2651 * POST /open/1
2652 * request body is a single non-RTMP byte
2653 * response contains a client ID <cid> followed by NL
2654 * POST /send/<cid>/<seq>
2655 * <seq> starts at 0 after open and increments on each
2656 * subsequent post
2657 * request body is pure RTMP data
2658 * response is a single non-RTMP byte followed by RTMP data
2659 * POST /idle/<cid>/<seq>
2660 * request contains a single non-RTMP byte
2661 * response is a single non-RTMP byte followed by RTMP data
2662 * POST /close/<cid>/<seq>
2663 * request and response contain a single non-RTMP byte
2664 *
2665 * Ideally here we'd know:
2666 *
2667 * 1) Whether this is was a HTTP request or response
2668 * (this gives us cdir directly)
2669 * 2) The requested URL (for both cases)
2670 * (this tells us the type of framing bytes present,
2671 * so whether there are any real bytes present). We
2672 * could also use the client ID to identify the
2673 * conversation, since each POST is likely to be on
2674 * a different TCP connection, and there could be
2675 * multiple simultaneous sessions from a single
2676 * client (which we don't deal with here.)
2677 *
2678 * As it is, we currently have to just guess, and are
2679 * likely easily confused.
2680 */
2685 conv = find_conversation(pinfo->num, &pinfo->dst, &pinfo->src, conversation_pt_to_conversation_type(pinfo->ptype), 0, pinfo->srcport, 0);
2688 conv = conversation_new(pinfo->num, &pinfo->dst, &pinfo->src, conversation_pt_to_conversation_type(pinfo->ptype), 0, pinfo->srcport, 0);
2689 }
2691 conv = find_conversation(pinfo->num, &pinfo->src, &pinfo->dst, conversation_pt_to_conversation_type(pinfo->ptype), 0, pinfo->destport, 0);
2694 conv = conversation_new(pinfo->num, &pinfo->src, &pinfo->dst, conversation_pt_to_conversation_type(pinfo->ptype), 0, pinfo->destport, 0);
2695 }
2696 }
2701 }
2703 /* Work out a TCP-like sequence numbers for the tunneled data stream.
2704 * If we've seen the packet before we'll have stored the seq of our
2705 * last byte against the frame number - since we know how big we are
2706 * we can work out the seq of our first byte. If this is the first
2707 * time, we use the stored seq of the last byte of the previous frame
2708 * plus one. If there is no previous frame then we must be at seq=1!
2709 * (This is per-conversation and per-direction, of course.) */
2714 /* Session startup: the client makes an /open/ request and
2715 * the server responds with a 16 bytes client
2716 * identifier followed by a newline */
2720 /* All other server responses start with one byte which
2721 * is not part of the RTMP stream. Client /idle/ requests
2722 * contain a single byte also not part of the stream. We
2723 * must discard these */
2724 offset++;
2725 remain--;
2726 }
2734 }
2738 ws_debug("RTMPT f=%d cdir=%d seq=%d lastackseq=%d len=%d", pinfo->num, cdir, seq, lastackseq, remain);
2748 }
2750 }
2752 static bool
2754 {
2757 {
2758 /* To avoid a too high rate of false positive, this heuristics only matches the protocol
2759 from the first server response packet and not from the client request packets before.
2760 Therefore it is necessary to a "Decode as" to properly decode the first packets */
2765 {
2766 /* Register this dissector for this conversation */
2770 /* Dissect the packet */
2773 }
2774 }
2776 }
2778 static int
2780 {
2789 /*
2790 * XXX - is "application/x-amf" just AMF3?
2791 */
2801 headers_tree = proto_tree_add_subtree(amf_tree, tvb, offset, -1, ett_amf_headers, NULL, "Headers");
2804 proto_tree_add_item(headers_tree, hf_amf_header_name, tvb, offset, 2, ENC_UTF_8|ENC_BIG_ENDIAN);
2810 proto_tree_add_uint_format_value(headers_tree, hf_amf_header_length, tvb, offset, 4, header_length, "Unknown");
2811 else
2816 else
2818 }
2819 }
2824 messages_tree = proto_tree_add_subtree(amf_tree, tvb, offset, -1, ett_amf_messages, NULL, "Messages");
2827 proto_tree_add_item(messages_tree, hf_amf_message_target_uri, tvb, offset, 2, ENC_UTF_8|ENC_BIG_ENDIAN);
2830 proto_tree_add_item(messages_tree, hf_amf_message_response_uri, tvb, offset, 2, ENC_UTF_8|ENC_BIG_ENDIAN);
2834 proto_tree_add_uint_format_value(messages_tree, hf_amf_message_length, tvb, offset, 4, message_length, "Unknown");
2835 else
2839 }
2840 }
2842 }
2844 void
2846 {
2848 /* RTMP Handshake data */
2873 /* RTMP chunk/packet header */
2906 /* Stream Control Messages */
2928 /* User Control Messages */
2933 /* Frame links */
2943 /* Audio packets */
2961 { "Audio multitrack packet type", "rtmpt.audio.multitrack.track.packet_type", FT_UINT8, BASE_HEX,
3000 /* Video packets */
3053 /* Aggregate packets */
3077 };
3091 &ett_rtmpt_tag_data
3092 };
3104 /* XXX: This desegment preference doesn't do anything */
3107 "Whether the RTMPT dissector should reassemble messages spanning multiple TCP segments."
3116 "Chunk size to use for connections where the initial handshake is missing,"
3119 }
3121 void
3123 {
3145 #if 0
3149 #endif
3168 /* AMF basic types */
3209 #if 0
3213 #endif
3243 /* AMF object types and subfields of the object types */
3303 };
3307 };
3320 };
3331 }
3333 void
3335 {
3336 heur_dissector_add("tcp", dissect_rtmpt_heur, "RTMPT over TCP", "rtmpt_tcp", proto_rtmpt, HEURISTIC_DISABLE);
3341 }
3343 /*
3344 * Editor modelines - https://www.wireshark.org/tools/modelines.html
3345 *
3346 * Local variables:
3347 * c-basic-offset: 8
3348 * tab-width: 8
3349 * indent-tabs-mode: nil
3350 * End:
3351 *
3352 * vi: set shiftwidth=8 tabstop=8 expandtab:
3353 * :indentSize=8:tabSize=8:noTabs=true:
3354 */