| blob | c8928b0072f29b2b7256854e4a7b03a95a1d1b7c |
1 /* packet-sip.c
2 * Routines for the Session Initiation Protocol (SIP) dissection.
3 * RFCs 3261-3264
4 *
5 * TODO:
6 * hf_ display filters for headers of SIP extension RFCs (ongoing)
7 *
8 * Copyright 2000, Heikki Vatiainen <hessu@cs.tut.fi>
9 * Copyright 2001, Jean-Francois Mule <jfm@cablelabs.com>
10 * Copyright 2004, Anders Broman <anders.broman@ericsson.com>
11 * Copyright 2011, Anders Broman <anders.broman@ericsson.com>, Johan Wahl <johan.wahl@ericsson.com>
12 * Copyright 2018, Anders Broman <anders.broman@ericsson.com>
13 * Copyright 2020, Atul Sharma <asharm37@ncsu.edu>
14 *
15 * Wireshark - Network traffic analyzer
16 * By Gerald Combs <gerald@wireshark.org>
17 * Copyright 1998 Gerald Combs
18 *
19 * SPDX-License-Identifier: GPL-2.0-or-later
20 *
21 */
25 #include <epan/packet.h>
27 #include <epan/exported_pdu.h>
28 #include <epan/expert.h>
29 #include <epan/prefs.h>
30 #include <epan/req_resp_hdrs.h>
31 #include <epan/stat_tap_ui.h>
32 #include <epan/proto_data.h>
33 #include <epan/uat.h>
34 #include <epan/follow.h>
35 #include <epan/addr_resolv.h>
36 #include <epan/epan_dissect.h>
37 #include <epan/iana_charsets.h>
38 #include <epan/tfs.h>
40 #include <wsutil/array.h>
41 #include <wsutil/str_util.h>
42 #include <wsutil/wsgcrypt.h>
56 /* un-comment the following as well as this line in conversation.c, to enable debug printing */
57 /* #define DEBUG_CONVERSATION */
60 #define TLS_PORT_SIP 5061
75 /* Dissector to dissect the text part of an reason code */
78 /* Initialize the protocol and registered fields */
249 /* Initialize the subtree pointers */
288 #if 0
290 #endif
300 /* patterns used for tvb_ws_mempbrk_pattern_uint8 */
311 /* PUBLISH method added as per https://tools.ietf.org/html/draft-ietf-sip-publish-01 */
313 #define SIP_METHOD_INVALID 0
315 #define SIP_METHOD_ACK 1
317 #define SIP_METHOD_BYE 2
319 #define SIP_METHOD_CANCEL 3
321 #define SIP_METHOD_DO 4
323 #define SIP_METHOD_INFO 5
325 #define SIP_METHOD_INVITE 6
327 #define SIP_METHOD_MESSAGE 7
329 #define SIP_METHOD_NOTIFY 8
331 #define SIP_METHOD_OPTIONS 9
333 #define SIP_METHOD_PRACK 10
335 #define SIP_METHOD_QAUTH 11
337 #define SIP_METHOD_REFER 12
339 #define SIP_METHOD_REGISTER 13
341 #define SIP_METHOD_SPRACK 14
343 #define SIP_METHOD_SUBSCRIBE 15
345 #define SIP_METHOD_UPDATE 16
347 #define SIP_METHOD_PUBLISH 17
348 "PUBLISH"
349 };
351 /* from RFC 3261
352 * Updated with info from https://www.iana.org/assignments/sip-parameters
353 * (last updated 2009-11-11)
354 * Updated with: https://tools.ietf.org/html/draft-ietf-sip-resource-priority-05
355 */
363 #define POS_ACCEPT 1
365 #define POS_ACCEPT_CONTACT 2
367 #define POS_ACCEPT_ENCODING 3
369 #define POS_ACCEPT_LANGUAGE 4
371 #define POS_ACCEPT_RESOURCE_PRIORITY 5
373 #define POS_ADDITIONAL_IDENTITY 6
375 #define POS_ALERT_INFO 7
377 #define POS_ALLOW 8
379 #define POS_ALLOW_EVENTS 9
381 #define POS_ANSWER_MODE 10
383 #define POS_ATTESTATION_INFO 11
385 #define POS_AUTHENTICATION_INFO 12
387 #define POS_AUTHORIZATION 13
389 #define POS_CALL_ID 14
391 #define POS_CALL_INFO 15
393 #define POS_CELLULAR_NETWORK_INFO 16
395 #define POS_CONTACT 17
397 #define POS_CONTENT_DISPOSITION 18
399 #define POS_CONTENT_ENCODING 19
401 #define POS_CONTENT_LANGUAGE 20
403 #define POS_CONTENT_LENGTH 21
405 #define POS_CONTENT_TYPE 22
407 #define POS_CSEQ 23
409 #define POS_DATE 24
410 /* Encryption (Deprecated) [RFC3261] */
412 #define POS_ERROR_INFO 25
414 #define POS_EVENT 26
416 #define POS_EXPIRES 27
418 #define POS_FEATURE_CAPS 28
420 #define POS_FLOW_TIMER 29
422 #define POS_FROM 30
425 #define POS_GEOLOCATION 31
427 #define POS_GEOLOCATION_ERROR 32
429 #define POS_GEOLOCATION_ROUTING 33
431 /* Hide RFC3261 (deprecated)*/
433 #define POS_HISTORY_INFO 34
435 #define POS_IDENTITY 35
437 #define POS_IDENTITY_INFO 36
439 #define POS_INFO_PKG 37
441 #define POS_IN_REPLY_TO 38
443 #define POS_JOIN 39
445 #define POS_MAX_BREADTH 40
447 #define POS_MAX_FORWARDS 41
449 #define POS_MIME_VERSION 42
451 #define POS_MIN_EXPIRES 43
453 #define POS_MIN_SE 44
455 #define POS_ORGANIZATION 45
457 #define POS_ORIGINATION_ID 46
459 #define POS_P_ACCESS_NETWORK_INFO 47
461 #define POS_P_ANSWER_STATE 48
463 #define POS_P_ASSERTED_IDENTITY 49
465 #define POS_P_ASSERTED_SERV 50
467 #define POS_P_ASSOCIATED_URI 51
469 #define POS_P_CALLED_PARTY_ID 52
471 #define POS_P_CHARGE_INFO 53
473 #define POS_P_CHARGING_FUNC_ADDRESSES 54
475 #define POS_P_CHARGING_VECTOR 55
477 #define POS_P_DCS_TRACE_PARTY_ID 56
479 #define POS_P_DCS_OSPS 57
481 #define POS_P_DCS_BILLING_INFO 58
483 #define POS_P_DCS_LAES 59
485 #define POS_P_DCS_REDIRECT 60
487 #define POS_P_EARLY_MEDIA 61
489 #define POS_P_MEDIA_AUTHORIZATION 62
491 #define POS_P_PREFERRED_IDENTITY 63
493 #define POS_P_PREFERRED_SERV 64
495 #define POS_P_PROFILE_KEY 65
497 #define POS_P_REFUSED_URI_LST 66
499 #define POS_P_SERVED_USER 67
501 #define POS_P_USER_DATABASE 68
503 #define POS_P_VISITED_NETWORK_ID 69
505 #define POS_PATH 70
507 #define POS_PERMISSION_MISSING 71
509 #define POS_POLICY_CONTACT 72
511 #define POS_POLICY_ID 73
513 #define POS_PRIORITY 74
515 #define POS_PRIORITY_SHARE 75
517 #define POS_PRIV_ANSWER_MODE 76
519 #define POS_PRIVACY 77
521 #define POS_PROXY_AUTHENTICATE 78
523 #define POS_PROXY_AUTHORIZATION 79
525 #define POS_PROXY_REQUIRE 80
527 #define POS_RACK 81
529 #define POS_REASON 82
531 #define POS_REASON_PHRASE 83
533 #define POS_RECORD_ROUTE 84
535 #define POS_RECV_INFO 85
537 #define POS_REFER_SUB 86
539 #define POS_REFER_TO 87
541 #define POS_REFERRED_BY 88
543 #define POS_REJECT_CONTACT 89
545 #define POS_RELAYED_CHARGE 90
547 #define POS_REPLACES 91
549 #define POS_REPLY_TO 92
551 #define POS_REQUEST_DISPOSITION 93
553 #define POS_REQUIRE 94
555 #define POS_RESOURCE_PRIORITY 95
557 #define POS_RESOURCE_SHARE 96
558 /*{ "Response-Key (Deprecated) [RFC3261]*/
560 #define POS_RESPONSE_SOURCE 97
562 #define POS_RESTORATION_INFO 98
564 #define POS_RETRY_AFTER 99
566 #define POS_ROUTE 100
568 #define POS_RSEQ 101
570 #define POS_SECURITY_CLIENT 102
572 #define POS_SECURITY_SERVER 103
574 #define POS_SECURITY_VERIFY 104
576 #define POS_SERVER 105
578 #define POS_SERVICE_INTERACT_INFO 106
580 #define POS_SERVICE_ROUTE 107
582 #define POS_SESSION_EXPIRES 108
584 #define POS_SESSION_ID 109
586 #define POS_SIP_ETAG 110
588 #define POS_SIP_IF_MATCH 111
590 #define POS_SUBJECT 112
592 #define POS_SUBSCRIPTION_STATE 113
594 #define POS_SUPPORTED 114
596 #define POS_SUPPRESS_IF_MATCH 115
598 #define POS_TARGET_DIALOG 116
600 #define POS_TIMESTAMP 117
602 #define POS_TO 118
604 #define POS_TRIGGER_CONSENT 119
606 #define POS_UNSUPPORTED 120
608 #define POS_USER_AGENT 121
610 #define POS_VIA 122
612 #define POS_WARNING 123
614 #define POS_WWW_AUTHENTICATE 124
616 #define POS_DIVERSION 125
618 #define POS_USER_TO_USER 126
619 };
624 /* Track associations between parameter name and hf item */
631 {
649 };
652 {
665 };
672 /* Track associations between parameter name and hf item for security mechanism*/
680 {
691 };
710 &ett_sip_pai_uri
711 };
720 &ett_sip_ppi_uri
721 };
730 &ett_sip_pmiss_uri
731 };
740 &ett_sip_tc_uri
741 };
750 &ett_sip_to_uri
751 };
760 &ett_sip_from_uri
761 };
770 &ett_sip_ruri
771 };
780 &ett_sip_curi
781 };
790 &ett_sip_route
791 };
800 &ett_sip_record_route
801 };
810 &ett_sip_service_route
811 };
820 &ett_sip_path
821 };
823 /*
824 * Type of line. It's either a SIP Request-Line, a SIP Status-Line, or
825 * another type of line.
826 */
828 REQUEST_LINE,
829 STATUS_LINE,
830 OTHER_LINE
833 /* Preferences */
836 /* global_sip_raw_text determines whether we are going to display */
837 /* the raw text of the SIP message, much like the MEGACO dissector does. */
839 /* global_sip_raw_text_without_crlf determines whether we are going to display */
840 /* the raw text of the SIP message with or without the '\r\n'. */
842 /* global_sip_raw_text_body_default_encoding determines what charset we are going to display the body */
844 /* strict_sip_version determines whether the SIP dissector enforces
845 * the SIP version to be "SIP/2.0". */
848 /*
849 * desegmentation of SIP headers
850 * (when we are over TCP or another protocol providing the desegmentation API)
851 */
854 /*
855 * desegmentation of SIP bodies
856 * (when we are over TCP or another protocol providing the desegmentation API)
857 */
860 /*
861 * same source port for retransmissions
862 */
865 /* whether we hold off tracking RTP conversations until an SDP answer is received */
868 /* Hide the generated Call IDs or not */
871 /* Extension header subdissectors */
874 /* Custom SIP headers */
886 static bool
888 {
895 }
901 }
903 /* Check for invalid characters (to avoid asserting out when
904 * registering the field).
905 */
910 }
914 }
918 {
926 }
928 static void
930 {
935 }
937 static void
939 {
941 /* Deregister all fields */
945 }
950 }
955 }
956 }
958 static void
960 {
989 }
992 }
993 }
995 static void
997 {
999 }
1004 /* SIP authorization parameters */
1016 static bool
1018 {
1025 }
1031 }
1033 /* Check for invalid characters (to avoid asserting out when
1034 * registering the field).
1035 */
1040 }
1044 }
1048 {
1057 }
1059 static void
1061 {
1067 }
1073 /* Forward declaration we need below */
1075 static int dissect_sip_common(tvbuff_t *tvb, int offset, int remaining_length, packet_info *pinfo,
1082 static void dfilter_sip_request_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int offset,
1084 static void dfilter_sip_status_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int line_end, int offset);
1085 static void tvb_raw_text_add(tvbuff_t *tvb, int offset, int length, int body_offset, packet_info* pinfo, proto_tree *tree);
1090 line_type_t line_type);
1105 {
1119 static bool sip_validate_authorization(sip_authorization_t *authorization_info, char *password);
1122 {
1128 }
1129 }
1131 }
1133 /* SIP content type and internet media type used by other dissectors
1134 * are the same. List of media types from IANA at:
1135 * http://www.iana.org/assignments/media-types/index.html */
1141 #define SIP2_HDR_LEN 7
1143 /* Store the info needed by the SIP tap for one packet */
1146 /* The buffer size for the cseq_method name */
1147 #define MAX_CSEQ_METHOD_SIZE 16
1149 /****************************************************************************
1150 * Conversation-type definitions
1151 *
1152 * For each call, keep track of the current cseq number and state of
1153 * transaction, in order to be able to detect retransmissions.
1154 *
1155 * Don't use the conversation mechanism, but instead:
1156 * - store with each dissected packet original frame (if any)
1157 * - maintain a global hash table of
1158 * (call_id, source_addr, dest_addr) -> (cseq, transaction_state, frame)
1159 *
1160 * N.B. This is broken for a couple of reasons:
1161 * - it won't cope properly with overlapping transactions within the
1162 * same dialog
1163 * - request response mapping won't work where the response uses a different
1164 * address pair from the request
1165 *
1166 * TODO: proper transaction matching uses RFC fields (use Max-forwards or
1167 * maybe Via count as extra key to limit view to one hop)
1168 ****************************************************************************/
1173 /* Types for hash table keys and values */
1174 #define MAX_CALL_ID_SIZE 128
1175 #define MAGIC_SOURCE_PORT 0
1177 /* Conversation-type key */
1179 {
1181 address source_address;
1183 address dest_address;
1185 port_type ptype;
1190 {
1191 nothing_seen,
1192 request_seen,
1193 provisional_response_seen,
1194 final_response_seen
1197 /* Current conversation-type value */
1199 {
1201 transaction_state_t transaction_state;
1203 nstime_t request_time;
1208 /* Result to be stored in per-packet info */
1210 {
1217 /************************/
1218 /* Hash table functions */
1220 /* Equal keys */
1222 {
1226 /* Call id must match */
1228 {
1230 }
1232 /* Addresses must match */
1238 }
1241 /* Initializes the hash table each time a new
1242 * file is loaded or re-loaded in wireshark */
1243 static void
1245 {
1250 /* Hash table for quick lookup of SIP headers names to hf entry (POS_x) */
1256 }
1257 }
1259 static void
1261 {
1264 }
1266 /* Call the export PDU tap with relevant data */
1267 static void
1269 {
1270 exp_pdu_data_t *exp_pdu_data = export_pdu_create_common_tags(pinfo, "sip", EXP_PDU_TAG_DISSECTOR_NAME);
1278 }
1281 {
1282 SIP_URI_TYPE_ABSOLUTE_URI,
1283 SIP_URI_TYPE_SIP,
1284 SIP_URI_TYPE_TEL
1288 /* Structure to collect info about a sip uri */
1290 {
1291 sip_uri_type_enum_t uri_type;
1308 static void
1311 /* Initialize the uri_offsets */
1328 }
1329 /* Code to parse a sip uri.
1330 * Returns Offset end off parsing or -1 for unsuccessful parsing
1331 * - sip_uri_offset_init() must have been called first.
1332 */
1333 static int
1336 {
1343 /* skip Spaces and Tabs */
1347 /* Nothing to parse */
1349 }
1350 /* Set uri start offset in case this was called directly */
1353 /* Check if it's really a sip uri ( it might be a tel uri, parse that?) */
1356 /* We know where the URI ends, set the offsets*/
1358 }
1360 }
1365 {
1366 /* name-addr form was NOT used e.g no closing ">" */
1367 /* look for the first ',' or ';' which will mark the end of this URI
1368 * In this case a semicolon indicates a header field parameter, and not an uri parameter.
1369 */
1372 end_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_comma_semi, NULL);
1375 {
1377 }
1378 else
1379 {
1380 /* We don't have a semicolon or a comma.
1381 * In that case, we assume that the end of the URI is at the line end
1382 */
1384 }
1386 }
1388 /* Look for URI address parts (user, host, host-port) */
1390 /* Look for '@' within URI */
1391 queried_offset = tvb_find_uint8(tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start, '@');
1393 {
1394 /* no '@' = no user part */
1395 uri_offsets->uri_host_start = tvb_find_uint8(tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start, ':')+1;
1396 }
1397 else
1398 {
1399 /* with '@' = with user part */
1400 uri_offsets->uri_user_start = tvb_find_uint8(tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start, ':')+1;
1401 uri_offsets->uri_user_end = tvb_find_uint8(tvb, uri_offsets->uri_user_start, uri_offsets->uri_end - uri_offsets->uri_start, '@')-1;
1403 }
1405 /* find URI-Host end*/
1410 {
1411 parameter_end_offset++;
1412 parameter_end_offset = tvb_ws_mempbrk_pattern_uint8(tvb, parameter_end_offset, line_end_offset - parameter_end_offset, &pbrk_param_end_colon_brackets, &c);
1414 {
1417 }
1419 /* after adding character to this switch() , update also pbrk_param_end_colon_brackets */
1444 }
1445 }
1447 uri_host_end_found:
1452 {
1456 {
1457 parameter_end_offset++;
1458 parameter_end_offset = tvb_ws_mempbrk_pattern_uint8(tvb, parameter_end_offset, line_end_offset - parameter_end_offset, &pbrk_param_end, &c);
1460 {
1463 }
1465 /* after adding character to this switch(), update also pbrk_param_end */
1480 }
1481 }
1483 uri_host_port_end_found:
1486 }
1489 }
1491 void
1492 dfilter_store_sip_from_addr(tvbuff_t *tvb,proto_tree *tree,unsigned parameter_offset, unsigned parameter_len)
1493 {
1496 pi = proto_tree_add_item(tree, hf_sip_from_addr, tvb, parameter_offset, parameter_len, ENC_UTF_8);
1498 }
1501 sip_proto_tree_add_uint(proto_tree *tree, int hfindex, tvbuff_t *tvb, int start, int length, int value_offset, int value_len)
1502 {
1506 /* don't fetch string when field is not referenced */
1514 }
1517 sip_proto_tree_add_string(proto_tree *tree, int hfindex, tvbuff_t *tvb, int start, int length, int value_offset, int value_len)
1518 {
1521 /* don't fetch string when field is not referenced */
1528 }
1530 static void
1531 sip_proto_set_format_text(const proto_tree *tree, proto_item *item, tvbuff_t *tvb, int offset, int length)
1532 {
1535 }
1536 /*
1537 * XXXX If/when more parameters are added consider doing something similar to what's done in
1538 * packet-magaco.c for find_megaco_localParam_names() possibly adding the hf to the array and have a generic
1539 * dissection function here.
1540 */
1541 static void
1542 dissect_sip_generic_parameters(tvbuff_t *tvb, proto_tree* tree, packet_info *pinfo, int current_offset, int line_end_offset)
1543 {
1545 /* Loop over the generic parameter(s)*/
1549 /* skip Spaces and Tabs */
1552 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
1556 }
1560 /* Parse parameter and value */
1563 /* Has value part */
1565 /* Extract the parameter name */
1566 param_name = tvb_get_string_enc(pinfo->pool, tvb, current_offset, par_name_end_offset - current_offset, ENC_UTF_8 | ENC_NA);
1567 /* Access-Info fields */
1571 }
1574 }
1575 }
1578 }
1580 }
1581 }
1584 /*
1585 * History-Info = "History-Info" HCOLON
1586 * hi-entry *(COMMA hi-entry)
1587 *
1588 * hi-entry = hi-targeted-to-uri *( SEMI hi-param )
1589 * hi-targeted-to-uri= name-addr
1590 *
1591 *
1592 * hi-param = hi-index / hi-extension
1593 *
1594 * hi-index = "index" EQUAL 1*DIGIT *(DOT 1*DIGIT)
1595 *
1596 * hi-extension = generic-param
1597 */
1599 static int
1600 dissect_sip_history_info(tvbuff_t *tvb, proto_tree* tree, packet_info *pinfo _U_, int current_offset,
1602 {
1606 /* split the line at the commas */
1611 /* It was only on parameter no need to split it up */
1613 }
1614 /* Last parameter */
1616 }
1621 }
1625 }
1628 /*
1629 * The syntax for the P-Charging-Function-Addresses header is described
1630 * as follows:
1631 *
1632 * P-Charging-Addr = "P-Charging-Function-Addresses" HCOLON
1633 * charge-addr-params
1634 * *(SEMI charge-addr-params)
1635 * charge-addr-params = ccf / ecf / generic-param
1636 * ccf = "ccf" EQUAL gen-value
1637 * ecf = "ecf" EQUAL gen-value
1638 * generic-param = token [ EQUAL gen-value ]
1639 * gen-value = token / host / quoted-string
1640 *
1641 */
1643 static int
1644 dissect_sip_p_charging_func_addresses(tvbuff_t *tvb, proto_tree* tree, packet_info *pinfo _U_, int current_offset,
1646 {
1651 /* Do we have a quoted string ? */
1652 start_quote_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, '"');
1654 /* Find end of quoted string */
1655 end_quote_offset = tvb_find_uint8(tvb, start_quote_offset+1, line_end_offset - (start_quote_offset+1), '"');
1656 /* Find parameter end */
1658 semi_offset = tvb_find_uint8(tvb, end_quote_offset+1, line_end_offset - (end_quote_offset+1), ';');
1660 /* XXX expert info about unterminated string */
1661 semi_offset = tvb_find_uint8(tvb, start_quote_offset+1, line_end_offset - (start_quote_offset+1), ';');
1662 }
1664 /* Find parameter end */
1666 }
1669 /* It was only one parameter no need to split it up */
1671 }
1672 /* Last parameter */
1674 }
1680 }
1683 }
1685 /*
1686 * token = 1*(alphanum / "-" / "." / "!" / "%" / "*"
1687 * / "_" / "+" / "`" / "'" / "~" )
1688 * LWS = [*WSP CRLF] 1*WSP ; linear whitespace
1689 * name-addr = [ display-name ] LAQUOT addr-spec RAQUOT
1690 * addr-spec = SIP-URI / SIPS-URI / absoluteURI
1691 * display-name = *(token LWS)/ quoted-string
1692 * absoluteURI = scheme ":" ( hier-part / opaque-part )
1693 */
1695 static int
1698 {
1706 /* skip Spaces and Tabs */
1710 /* Nothing to parse */
1712 }
1716 /* First look, if we have a display name */
1719 {
1721 /* We have a display name, look for the next unescaped '"' */
1723 do
1724 {
1725 queried_offset = tvb_find_uint8(tvb, current_offset + 1, line_end_offset - (current_offset + 1), '"');
1727 {
1728 /* malformed URI */
1730 }
1733 /* Is it escaped? */
1734 /* count back slashes before '"' */
1736 i--;
1739 {
1740 /* not escaped */
1742 }
1745 {
1746 /* malformed URI */
1748 }
1752 /* find start of the URI */
1755 {
1756 /* malformed Uri */
1758 }
1763 /* We don't have a display name */
1764 current_offset++;
1768 /* We have either an URI without angles or a display name with a limited character set */
1769 /* Look for the right angle quote or colon */
1773 {
1775 {
1776 /* we have an URI with angle quotes */
1780 }
1781 else
1782 {
1783 /* we have an URI without angle quotes */
1785 }
1786 }
1787 else
1788 {
1790 {
1791 /* we have an URI with angle quotes */
1796 }
1798 {
1799 /* we have an URI without angle quotes */
1802 }
1803 /* If this point is reached, we can't parse the URI */
1805 }
1807 }
1808 /* Start of URI */
1811 /* name-addr form was used */
1812 /* look for closing angle quote */
1815 {
1816 /* malformed Uri */
1818 }
1821 }
1823 }
1826 /*
1827 * Code to add dissected SIP URI Information to proto tree
1828 */
1831 display_sip_uri (tvbuff_t *tvb, proto_tree *sip_element_tree, packet_info *pinfo, uri_offset_info* uri_offsets, hf_sip_uri_t* uri)
1832 {
1838 proto_tree_add_item(sip_element_tree, *(uri->hf_sip_display), tvb, uri_offsets->display_name_start,
1840 ti = proto_tree_add_item(sip_element_tree, hf_sip_display, tvb, uri_offsets->display_name_start,
1843 }
1846 tvb, uri_offsets->uri_start, uri_offsets->uri_end - uri_offsets->uri_start + 1, ENC_UTF_8|ENC_NA);
1851 }
1857 dissect_e164_msisdn(tvb, uri_item_tree, uri_offsets->uri_user_start + 1, uri_offsets->uri_user_end - uri_offsets->uri_user_start, E164_ENC_UTF8);
1858 }
1860 /* If we have a SIP diagnostics sub dissector call it */
1865 }
1867 }
1875 }
1878 /* Move current offset to the start of the first param */
1885 /* Put the contact parameters in the tree */
1888 queried_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, uri_offsets->name_addr_end - current_offset, &pbrk_comma_semi, &c);
1891 /* Reached line end */
1892 /* Check if the line ends with a ">", if so decrement end offset. */
1899 }
1905 /* More parameters */
1907 current_offset = tvb_skip_wsp(tvb, queried_offset+1, uri_offsets->name_addr_end - queried_offset + 1);
1908 }
1913 /* In case there are more parameters, point to the start of it */
1915 }
1916 }
1919 }
1924 /* Code to parse a contact header item
1925 * Returns Offset end off parsing or -1 for unsuccessful parsing
1926 * * contact-param = (name-addr / addr-spec) *(SEMI contact-params)
1927 */
1928 static int
1929 dissect_sip_contact_item(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int start_offset, int line_end_offset,
1931 {
1936 /*int contact_param_end_offset = -1;*/
1937 uri_offset_info uri_offsets;
1941 /* skip Spaces and Tabs */
1945 /* Nothing to parse */
1947 }
1949 /* Initialize the uri_offsets */
1951 /* contact-param = (name-addr / addr-spec) *(SEMI contact-params) */
1952 current_offset = dissect_sip_name_addr_or_addr_spec(tvb, pinfo, start_offset, line_end_offset, &uri_offsets);
1954 {
1955 /* Parsing failed */
1957 }
1960 /* check if there's a comma before a ';', in which case we stop parsing this item at the comma */
1961 queried_offset = tvb_find_uint8(tvb, uri_offsets.uri_end, line_end_offset - uri_offsets.uri_end, ',');
1963 /* Check if we have contact parameters, the uri should be followed by a ';' */
1964 contact_params_start_offset = tvb_find_uint8(tvb, uri_offsets.uri_end, line_end_offset - uri_offsets.uri_end, ';');
1966 if (queried_offset != -1 && (queried_offset < contact_params_start_offset || contact_params_start_offset == -1)) {
1967 /* no expires param */
1970 }
1972 /* check if contact-params is present */
1974 /* no expires param */
1977 }
1979 /* Move current offset to the start of the first param */
1980 contact_params_start_offset++;
1983 /* Put the contact parameters in the tree */
1989 queried_offset++;
1990 queried_offset = (queried_offset < line_end_offset) ? tvb_ws_mempbrk_pattern_uint8(tvb, queried_offset, line_end_offset - queried_offset, &pbrk_header_end_dquote, &c) : -1;
1992 {
1994 /* prevent tree from displaying the '\r\n' as part of the param */
1998 /* fall through */
2006 }
2007 }
2010 /* Last parameter, line end */
2013 /* Do we have a quoted string ? */
2016 /* We have an opening quote but no closing quote. */
2019 current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, queried_offset+1, line_end_offset - queried_offset, &pbrk_comma_semi, &c);
2021 /* Last parameter, line end */
2023 }
2024 }
2027 }
2031 /* need to check for an 'expires' parameter
2032 * TODO: this should be done in a common way for all headers,
2033 * but To/From/etc do their own right now so doing the same here
2034 */
2035 /* also, this is a bad way of checking param names, but it's what To/From
2036 * etc, do. But legally "exPiRes = value" is also legit.
2037 */
2040 /* if the expires param value is 0, then it's de-registering
2041 * this assumes the message is a REGISTER request/response, but these
2042 * contacts_expires_0/contacts_expires_unknown variables only get used then,
2043 * so that's ok
2044 */
2051 /* RFC 3261 10.3 "Processing REGISTER requests":
2052 * "The registrar returns a 200 (OK) response. The response
2053 * MUST contain Contact header field values enumerating all
2054 * current bindings."
2055 * This implies it is invalid for the response to contain the
2056 * deregistered, no longer current, Contacts with expires=0.
2057 * However, this warning was removed due to 3GPP usage.
2058 * Cf. 3GPP TS 24.229 "5.4.1.4 User-initiated deregistration":
2059 * "send a 200 (OK) response to a REGISTER request that
2060 * contains a list of Contact header fields enumerating all
2061 * contacts and flows that are currently registered, and all
2062 * contacts that have been deregistered."
2063 * https://gitlab.com/wireshark/wireshark/-/issues/10364
2064 */
2065 #if 0
2071 }
2072 #endif
2073 }
2074 }
2076 /* In case there are more parameters, point to the start of it */
2080 /* '\r' or '\n' found, stop parsing and also set current offset to end
2081 * so the return value indicates we reached line end
2082 */
2084 }
2086 /* comma separator found, stop parsing of current contact-param here */
2088 }
2089 }
2093 }
2096 }
2098 /* Code to parse an authorization header item
2099 * Returns offset at end of parsing, or -1 for unsuccessful parsing
2100 */
2101 static int
2102 dissect_sip_authorization_item(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset, sip_authorization_t *authorization_info)
2103 {
2110 /* skip Spaces and Tabs */
2114 {
2115 /* Nothing to parse */
2117 }
2120 equals_offset = tvb_find_uint8(tvb, current_offset + 1, line_end_offset - (current_offset + 1), '=');
2122 /* malformed parameter */
2124 }
2128 /* Extract the parameter name */
2129 name = tvb_get_string_enc(wmem_packet_scope(), tvb, start_offset, par_name_end_offset-start_offset, ENC_UTF_8|ENC_NA);
2133 /* quoted value */
2136 value_search_offset++;
2137 queried_offset = tvb_find_uint8 (tvb, value_search_offset, line_end_offset - value_search_offset, '\"');
2140 /* Closing quote not found, return line end */
2143 /* Include closing quotes */
2145 }
2147 /* unquoted value */
2150 /* Last parameter, line end */
2154 }
2155 }
2157 /* Try to add parameter as a filterable item */
2161 {
2163 {
2170 if ((tvb_get_uint8(tvb, value_offset) == '\"') && (tvb_get_uint8(tvb, current_offset - 1) == '\"') && (real_value_length > 1)) {
2171 real_value_offset++;
2173 }
2175 authorization_info->response = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2177 authorization_info->nonce_count = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2179 authorization_info->username = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2181 authorization_info->realm = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2183 authorization_info->algorithm = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2185 authorization_info->nonce = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2187 authorization_info->qop = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2189 authorization_info->cnonce = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2191 authorization_info->uri = tvb_get_string_enc(wmem_packet_scope(), tvb, real_value_offset, real_value_length, ENC_ASCII);
2192 }
2193 }
2195 }
2196 }
2198 /* If not matched, just add as text... */
2200 {
2202 }
2204 /* Find comma/end of line */
2210 }
2212 }
2214 /* Dissect the details of a Reason header
2215 * Reason = "Reason" HCOLON reason-value *(COMMA reason-value)
2216 * reason-value = protocol *(SEMI reason-params)
2217 * protocol = "SIP" / "Q.850" / token
2218 * reason-params = protocol-cause / reason-text / reason-extension
2219 * protocol-cause = "cause" EQUAL cause
2220 * cause = 1*DIGIT
2221 * reason-text = "text" EQUAL quoted-string
2222 * reason-extension = generic-param
2223 */
2224 static void
2225 dissect_sip_reason_header(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int start_offset, int line_end_offset){
2230 sip_reason_code_info_t sip_reason_code_info;
2232 /* skip Spaces and Tabs */
2236 {
2237 /* Nothing to parse */
2239 }
2248 proto_tree_add_item_ret_string(tree, hf_sip_reason_protocols, tvb, start_offset, length, ENC_UTF_8|ENC_NA, pinfo->pool, ¶m_name);
2249 current_offset = tvb_find_uint8(tvb, semi_colon_offset, line_end_offset - semi_colon_offset, '=') + 1;
2250 /* Do we have a text parameter too? */
2251 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
2256 /* Text parameter exist, set length accordingly */
2258 }
2260 /* Get cause value */
2261 cause_value = (unsigned)strtoul(tvb_get_string_enc(pinfo->pool, tvb, current_offset, length, ENC_UTF_8 | ENC_NA), NULL, 10);
2266 }
2270 }
2272 proto_tree_add_uint(tree, hf_sip_reason_cause_other, tvb, current_offset, length, cause_value);
2274 }
2277 /* Nothing to parse */
2280 /* reason-text = "text" EQUAL quoted-string */
2281 current_offset = tvb_find_uint8(tvb, semi_colon_offset, line_end_offset - semi_colon_offset, '"') + 1;
2283 /* Nothing to parse */
2287 /* Nothing to parse */
2290 proto_tree_add_item(tree, hf_sip_reason_text, tvb, current_offset, length, ENC_UTF_8 | ENC_NA);
2298 call_dissector_with_data(sip_reason_code_handle, next_tvb, pinfo, tree, &sip_reason_code_info);
2299 }
2300 }
2302 /* Dissect the details of a security client header
2303 * sec-mechanism = mechanism-name *(SEMI mech-parameters)
2304 * mech-parameters = ( preference / digest-algorithm /
2305 * digest-qop / digest-verify / extension )
2306 * preference = "q" EQUAL qvalue
2307 * qvalue = ( "0" [ "." 0*3DIGIT ] )
2308 * / ( "1" [ "." 0*3("0") ] )
2309 * digest-algorithm = "d-alg" EQUAL token
2310 * digest-qop = "d-qop" EQUAL token
2311 * digest-verify = "d-ver" EQUAL LDQUOT 32LHEX RDQUOT
2312 * extension = generic-param
2313 *
2314 *
2315 */
2316 static void
2317 dissect_sip_sec_mechanism(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, int start_offset, int line_end_offset){
2321 /* skip Spaces and Tabs */
2325 {
2326 /* Nothing to parse */
2328 }
2334 }
2339 ENC_UTF_8);
2347 /* skip Spaces and Tabs */
2354 }
2358 /* Parse parameter and value */
2361 /* Has value part */
2363 /* Extract the parameter name */
2364 param_name = tvb_get_string_enc(pinfo->pool, tvb, current_offset, par_name_end_offset-current_offset, ENC_UTF_8|ENC_NA);
2365 /* Extract the value */
2366 value = tvb_get_string_enc(pinfo->pool, tvb, equals_offset+1, semi_colon_offset-equals_offset+1, ENC_UTF_8|ENC_NA);
2369 }
2373 /* Protection algorithm to be used */
2374 if (g_ascii_strcasecmp(param_name, sec_mechanism_parameters_hf_array[hf_index].param_name) == 0) {
2379 ENC_UTF_8);
2390 }
2394 }
2396 }
2397 hf_index++;
2398 }
2402 }
2405 }
2407 }
2409 /* Dissect the details of a Route (and Record-Route) header */
2410 static void dissect_sip_route_header(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, hf_sip_uri_t *sip_route_uri_p, int start_offset, int line_end_offset)
2411 {
2413 uri_offset_info uri_offsets;
2417 /* skip Spaces and Tabs */
2422 }
2425 current_offset = tvb_find_uint8(tvb, current_offset, (line_end_offset - 1) - current_offset, ',');
2429 current_offset = dissect_sip_name_addr_or_addr_spec(tvb, pinfo, start_offset, current_offset, &uri_offsets);
2434 current_offset++;
2438 /* current_offset = (line_end_offset - 1); */
2441 current_offset = dissect_sip_name_addr_or_addr_spec(tvb, pinfo, start_offset, line_end_offset, &uri_offsets);
2447 }
2449 current_offset++;
2450 }
2453 }
2455 /* Dissect the details of a Via header
2456 *
2457 * Via = ( "Via" / "v" ) HCOLON via-parm *(COMMA via-parm)
2458 * via-parm = sent-protocol LWS sent-by *( SEMI via-params )
2459 * via-params = via-ttl / via-maddr
2460 * / via-received / via-branch
2461 * / via-extension
2462 * via-ttl = "ttl" EQUAL ttl
2463 * via-maddr = "maddr" EQUAL host
2464 * via-received = "received" EQUAL (IPv4address / IPv6address)
2465 * via-branch = "branch" EQUAL token
2466 * via-extension = generic-param
2467 * sent-protocol = protocol-name SLASH protocol-version
2468 * SLASH transport
2469 * protocol-name = "SIP" / token
2470 * protocol-version = token
2471 * transport = "UDP" / "TCP" / "TLS" / "SCTP"
2472 * / other-transport
2473 * sent-by = host [ COLON port ]
2474 * ttl = 1*3DIGIT ; 0 to 255
2475 *
2476 */
2477 static void dissect_sip_via_header(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset, packet_info *pinfo)
2478 {
2491 {
2492 /* Reset flags and counters */
2498 /* skip Spaces and Tabs */
2502 {
2503 /* Nothing more to parse */
2505 }
2507 /* Now look for the end of the SIP/2.0/transport parameter.
2508 * There may be spaces between the slashes
2509 * sent-protocol = protocol-name SLASH protocol-version
2510 * SLASH transport
2511 */
2515 {
2516 current_offset++;
2518 }
2521 {
2522 current_offset++;
2523 /* skip Spaces and Tabs */
2529 /* We should now be at the start of the first transport name (or at the end of the line) */
2531 /*
2532 * transport = "UDP" / "TCP" / "TLS" / "SCTP"
2533 * / other-transport
2534 */
2536 {
2539 current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_tab_sp_fslash, &c);
2543 /* Check if we have more transport parameters */
2545 current_offset++;
2547 }
2551 current_offset++;
2553 }
2557 }
2559 }
2561 /* skip Spaces and Tabs */
2564 /* Now read the address part */
2567 {
2568 current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_addr_end, &c);
2570 {
2573 }
2578 }
2580 {
2582 }
2584 if (colon_seen || (c == ' ') || (c == '\t') || ((c == ':') && (ipv6_reference == false)) || (c == ';'))
2585 {
2587 }
2589 current_offset++;
2590 }
2591 /* Add address to tree */
2598 }
2600 /* Transport port number may follow ([space] : [space])*/
2605 {
2606 /* Port number will follow any space after : */
2608 current_offset++;
2610 /* Skip optional space after colon */
2615 /* Find digits of port number */
2617 {
2621 {
2623 {
2624 /* Add address port number to tree */
2634 }
2635 else
2636 {
2637 /* Shouldn't see a colon without a port number given */
2639 }
2641 }
2643 current_offset++;
2644 }
2645 }
2647 /* skip Spaces and Tabs */
2651 /* Dissect any parameters found */
2653 {
2660 /* Look for the semicolon that signals the start of a parameter */
2662 {
2665 {
2667 current_offset++;
2669 }
2670 else
2672 {
2675 }
2676 current_offset++;
2677 }
2680 {
2682 }
2685 {
2687 }
2689 /* Look for end of parameter name */
2691 {
2694 {
2696 }
2697 current_offset++;
2698 }
2700 /* Not all params have an = */
2702 {
2704 }
2707 /* Read until end of parameter value */
2708 current_offset = tvb_ws_mempbrk_pattern_uint8(tvb, current_offset, line_end_offset - current_offset, &pbrk_via_param_end, NULL);
2712 /* Note parameter name */
2716 /* Try to add parameter as a filterable item */
2720 {
2722 {
2724 {
2731 {
2733 next_tvb = tvb_new_subset_length(tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1);
2736 }
2745 }
2748 nstime_t ts;
2762 }
2765 next_tvb = tvb_new_subset_length(tvb, parameter_name_end + 1, current_offset - parameter_name_end - 1);
2766 call_dissector(sip_via_be_route_handle, next_tvb, pinfo, proto_item_add_subtree(via_parameter_item, ett_sip_via_be_route));
2767 }
2768 }
2769 else
2770 {
2774 }
2776 }
2777 }
2779 /* If not matched, just add as text... */
2781 {
2783 }
2785 /* skip Spaces and Tabs */
2788 /* There may be a comma, followed by more Via entries... */
2790 {
2793 {
2794 /* Skip it and get out of parameter loop */
2795 current_offset++;
2797 }
2798 }
2799 }
2800 }
2801 }
2803 /* Dissect the details of a Session-ID header
2804 *
2805 * Session-ID = "Session-ID" HCOLON sess-id
2806 * *( SEMI generic-param )
2807 * sess-id = 32(DIGIT / %x61-66) ; 32 chars of [0-9a-f]
2808 */
2809 static void dissect_sip_session_id_header(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset, packet_info *pinfo)
2810 {
2819 }
2831 }
2835 /* skip Spaces and Tabs */
2839 /* Parse parameter and value */
2842 /* Extract the parameter name */
2852 /* Decode header as draft-ietf-insipid-session-id
2853 *
2854 * session-id = "Session-ID" HCOLON session-id-value
2855 * session-id-value = local-uuid *(SEMI sess-id-param)
2856 * local-uuid = sess-uuid / null
2857 * remote-uuid = sess-uuid / null
2858 * sess-uuid = 32(DIGIT / %x61-66) ;32 chars of [0-9a-f]
2859 * sess-id-param = remote-param / generic-param
2860 * remote-param = "remote" EQUAL remote-uuid
2861 * null = 32("0")
2862 */
2863 e_guid_t guid;
2880 /* Decode logme parameter as per https://tools.ietf.org/html/rfc8497
2881 *
2882 * sess-id-param =/ logme-param
2883 * logme-param = "logme"
2884 */
2885 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
2891 /* Extract logme parameter name */
2892 char *name = tvb_get_string_enc(pinfo->pool, tvb, current_offset,logme_end_offset - current_offset, ENC_UTF_8|ENC_NA);
2894 proto_tree_add_boolean(tree, hf_sip_session_id_logme, tvb, current_offset, logme_end_offset - current_offset, 1);
2896 proto_tree_add_item(tree, hf_sip_session_id_param, tvb, current_offset,line_end_offset - current_offset, ENC_UTF_8);
2897 }
2898 }
2899 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
2900 }
2902 /* Display generic parameter */
2905 }
2908 /* Display generic parameter */
2911 }
2912 }
2915 }
2917 /* Dissect the headers for P-Access-Network-Info Headers
2918 *
2919 * Spec found in 3GPP 24.229 7.2A.4
2920 * P-Access-Network-Info = "P-Access-Network-Info" HCOLON
2921 * access-net-spec *(COMMA access-net-spec)
2922 * access-net-spec = (access-type / access-class) *(SEMI access-info)
2923 * access-type = "IEEE-802.11" / "IEEE-802.11a" / "IEEE-802.11b" / "IEEE-802.11g" / "IEEE-802.11n" / "3GPP-GERAN" /
2924 * "3GPP-UTRAN-FDD" / "3GPP-UTRAN-TDD" / "3GPP-E-UTRAN-FDD" / "3GPP-E-UTRAN-TDD" / "ADSL" / "ADSL2" /
2925 * "ADSL2+" / "RADSL" / "SDSL" / "HDSL" / "HDSL2" / "G.SHDSL" / "VDSL" / "IDSL" / "3GPP2-1X" /
2926 * "3GPP2-1X-Femto" / "3GPP2-1X-HRPD" / "3GPP2-UMB" / "DOCSIS" / "IEEE-802.3" / "IEEE-802.3a" /
2927 * "IEEE-802.3e" / "IEEE-802.3i" / "IEEE-802.3j" / "IEEE-802.3u" / "IEEE-802.3ab"/ "IEEE-802.3ae" /
2928 * "IEEE-802.3ak" / "IEEE-802.3aq" / "IEEE-802.3an" / "IEEE-802.3y" / "IEEE-802.3z" / "GPON" /
2929 "XGPON1" / "GSTN"/ token
2930 * access-class = "3GPP-GERAN" / "3GPP-UTRAN" / "3GPP-E-UTRAN" / "3GPP-WLAN" / "3GPP-GAN" / "3GPP-HSPA" / token
2931 * np = "network-provided"
2932 * access-info = cgi-3gpp / utran-cell-id-3gpp / dsl-location / i-wlan-node-id / ci-3gpp2 / ci-3gpp2-femto /
2933 eth-location / fiber-location / np / gstn-location / extension-access-info
2934 * extension-access-info = gen-value
2935 * cgi-3gpp = "cgi-3gpp" EQUAL (token / quoted-string)
2936 * utran-cell-id-3gpp = "utran-cell-id-3gpp" EQUAL (token / quoted-string)
2937 * i-wlan-node-id = "i-wlan-node-id" EQUAL (token / quoted-string)
2938 * dsl-location = "dsl-location" EQUAL (token / quoted-string)
2939 * eth-location = "eth-location" EQUAL (token / quoted-string)
2940 * fiber-location = "fiber-location" EQUAL (token / quoted-string)
2941 * ci-3gpp2 = "ci-3gpp2" EQUAL (token / quoted-string)
2942 * ci-3gpp2-femto = "ci-3gpp2-femto" EQUAL (token / quoted-string)
2943 * gstn-location = "gstn-location" EQUAL (token / quoted-string)
2944 *
2945 */
2946 void dissect_sip_p_access_network_info_header(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int start_offset, int line_end_offset)
2947 {
2951 /* skip Spaces and Tabs */
2955 {
2956 /* Nothing to parse */
2958 }
2960 /* Get the Access Type / Access Class*/
2962 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
2968 proto_tree_add_item(tree, hf_sip_p_acc_net_i_acc_type, tvb, start_offset, length, ENC_UTF_8 | ENC_NA);
2976 /* skip Spaces and Tabs */
2979 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
2983 }
2987 /* Parse parameter and value */
2990 /* Has value part */
2992 /* Extract the parameter name */
2993 param_name = tvb_get_string_enc(pinfo->pool, tvb, current_offset, par_name_end_offset - current_offset, ENC_UTF_8 | ENC_NA);
2994 /* Access-Info fields */
2998 /* check if value is quoted */
3003 }
3004 }
3007 }
3008 }
3011 }
3014 }
3015 }
3017 /*
3018 The syntax for the P-Charging-Vector header field is described as
3019 follows:
3021 P-Charging-Vector = "P-Charging-Vector" HCOLON icid-value
3022 *(SEMI charge-params)
3023 charge-params = icid-gen-addr / orig-ioi / term-ioi /
3024 transit-ioi / related-icid /
3025 related-icid-gen-addr / generic-param
3026 icid-value = "icid-value" EQUAL gen-value
3027 icid-gen-addr = "icid-generated-at" EQUAL host
3028 orig-ioi = "orig-ioi" EQUAL gen-value
3029 term-ioi = "term-ioi" EQUAL gen-value
3030 transit-ioi = "transit-ioi" EQUAL transit-ioi-list
3031 transit-ioi-list = DQUOTE transit-ioi-param
3032 *(COMMA transit-ioi-param) DQUOTE
3033 transit-ioi-param = transit-ioi-indexed-value /
3034 transit-ioi-void-value
3035 transit-ioi-indexed-value = transit-ioi-name "."
3036 transit-ioi-index
3037 transit-ioi-name = ALPHA *(ALPHA / DIGIT)
3038 transit-ioi-index = 1*DIGIT
3039 transit-ioi-void-value = "void"
3040 related-icid = "related-icid" EQUAL gen-value
3041 related-icid-gen-addr = "related-icid-generated-at" EQUAL host
3042 */
3043 static void
3044 dissect_sip_p_charging_vector_header(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset)
3045 {
3049 /* skip Spaces and Tabs */
3053 {
3054 /* Nothing to parse */
3056 }
3058 /* icid-value = "icid-value" EQUAL gen-value */
3060 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
3063 /* No parameters, is that allowed?*/
3065 }
3069 /* Parse parameter and value */
3072 /* Does not conform to ABNF */
3074 }
3076 /* Get the icid-value */
3082 /* Add the rest of the parameters to the tree */
3086 /* skip Spaces and Tabs */
3089 semi_colon_offset = tvb_find_uint8(tvb, current_offset, line_end_offset - current_offset, ';');
3093 }
3097 /* Parse parameter and value */
3100 /* Has value part */
3102 /* Extract the parameter name */
3103 param_name = tvb_get_string_enc(wmem_packet_scope(), tvb, current_offset, par_name_end_offset - current_offset, ENC_UTF_8 | ENC_NA);
3104 /* charge-params */
3108 }
3111 }
3112 }
3115 }
3118 }
3121 }
3123 /*
3124 https://tools.ietf.org/html/rfc6809
3125 The ABNF for the Feature-Caps header fields is:
3127 Feature-Caps = "Feature-Caps" HCOLON fc-value
3128 *(COMMA fc-value)
3129 fc-value = "*" *(SEMI feature-cap)
3131 The ABNF for the feature-capability indicator is:
3133 feature-cap = "+" fcap-name [EQUAL LDQUOT (fcap-value-list
3134 / fcap-string-value ) RDQUOT]
3135 fcap-name = ftag-name
3136 fcap-value-list = tag-value-list
3137 fcap-string-value = string-value
3138 ;; ftag-name, tag-value-list, string-value defined in RFC 3840
3140 NOTE: In comparison with media feature tags, the "+" sign in front of
3141 the feature-capability indicator name is mandatory.
3143 */
3144 static void
3145 dissect_sip_p_feature_caps(tvbuff_t *tvb, proto_tree *tree, int start_offset, int line_end_offset)
3146 {
3150 /* skip Spaces and Tabs */
3154 /* Nothing to parse */
3156 }
3159 /* Find the end of feature cap or start of feature cap parameter, ";+" should indicate the start of a new feature-cap */
3161 next_offset = tvb_find_uint16(tvb, current_offset, line_end_offset - current_offset, semi_plus);
3165 }
3169 }
3170 proto_tree_add_item(tree, hf_sip_feature_cap, tvb, current_offset, length, ENC_UTF_8 | ENC_NA);
3171 }
3172 }
3174 /* Code to actually dissect the packets */
3175 static int
3177 {
3186 }
3192 else
3194 }
3196 static int
3198 {
3208 }
3211 /* If we have exactly one non printable byte of payload, this is
3212 * probably just a keep alive at the beginning of a capture. Better
3213 * to treat it as such than to mark it and everything up to the next
3214 * line end as Continuation Data.
3215 */
3218 }
3219 /* Check if we have enough data or if we need another segment, as a safety measure set a length limit*/
3226 }
3227 }
3234 /*
3235 * This is a bit of a cludge as the TCP dissector does not call the dissectors again if not all
3236 * the data in the segment was dissected and we do not know if we need another segment or not.
3237 * so DESEGMENT_ONE_MORE_SEGMENT can't be used in all cases.
3238 *
3239 */
3241 /* Check if we have enough data or if we need another segment, as a safety measure set a length limit*/
3248 }
3249 }
3255 }
3257 }
3259 static bool
3261 {
3272 /*
3273 * If the first packet doesn't start with
3274 * a valid SIP request or response, don't
3275 * treat this as SIP.
3276 */
3278 }
3280 }
3286 }
3288 }
3290 static bool
3292 {
3296 }
3298 static int
3299 dissect_sip_common(tvbuff_t *tvb, int offset, int remaining_length, packet_info *pinfo, proto_tree *tree,
3301 {
3305 line_type_t line_type;
3318 unsigned char contacts = 0, contact_is_star = 0, expires_is_0 = 0, contacts_expires_0 = 0, contacts_expires_unknown = 0;
3332 /*
3333 * If this should be a request of response, do this quick check to see if
3334 * it begins with a string...
3335 * Otherwise, SIP heuristics are expensive...
3336 *
3337 */
3341 {
3343 }
3345 /*
3346 * Note that "tvb_find_line_end()" will return a value that
3347 * is not longer than what's in the buffer, so the
3348 * "tvb_get_ptr()" calls below won't throw exceptions.
3349 *
3350 * Note that "tvb_strneql()" doesn't throw exceptions, so
3351 * "sip_parse_line()" won't throw an exception.
3352 */
3357 }
3360 {
3361 /*
3362 * There's a NULL in the line,
3363 * this may be SIP within another protocol.
3364 * This heuristic still needs to improve.
3365 */
3367 }
3371 /*
3372 * This is neither a SIP request nor response.
3373 */
3375 /*
3376 * We were asked to reject this.
3377 */
3379 }
3381 /*
3382 * Just dissect it as a continuation.
3383 */
3385 /*
3386 * Yes, it's a request or response.
3387 * Do header desegmentation if we've been told to,
3388 * and do body desegmentation if we've been told to and
3389 * we find a Content-Length header.
3390 *
3391 * RFC 6594, Section 20.14. requires Content-Length for TCP.
3392 */
3396 /*
3397 * More data needed for desegmentation.
3398 */
3400 }
3401 }
3403 /* Initialise stat info for passing to tap
3404 * Note: this isn't _only_ for taps - internal code here uses it too
3405 * also store stat info in proto_data for subdissectors
3406 */
3418 /* For SIP messages with other sip messages embeded in the body, don't export those individually.
3419 * E.g. if we are called from the mime_multipart dissector don't export the message.
3420 */
3427 }
3428 }
3440 COL_ADD_LSTR_TERMINATOR);
3450 COL_ADD_LSTR_TERMINATOR);
3463 }
3476 }
3485 }
3494 /* XXX: Is adding to 'reqresp_tree as intended ? Changed from original 'sip_tree' */
3496 }
3498 }
3505 /*
3506 * Find the blank line separating the headers from the message body.
3507 * Do this now so we can add the msg_hdr FT_STRING item with the correct
3508 * length.
3509 */
3517 /*
3518 * This is a blank line separating the
3519 * message header from the message body.
3520 */
3523 }
3527 while (tvb_offset_exists(tvb, next_offset) && ((c = tvb_get_uint8(tvb, next_offset)) == ' ' || c == '\t'))
3528 {
3529 /*
3530 * This line end is not a header seperator.
3531 * It just extends the header with another line.
3532 * Look for next line end:
3533 */
3537 }
3538 }
3552 /*
3553 * Process the headers - if we're not building a protocol tree,
3554 * we just do this to find the blank line separating the
3555 * headers from the message body.
3556 */
3568 dissector_handle_t ext_hdr_handle;
3577 uri_offset_info uri_offsets;
3581 /*
3582 * This is a blank line separating the
3583 * message header from the message body.
3584 */
3587 }
3593 while (tvb_offset_exists(tvb, next_offset) && ((c = tvb_get_uint8(tvb, next_offset)) == ' ' || c == '\t'))
3594 {
3595 /*
3596 * This line end is not a header seperator.
3597 * It just extends the header with another line.
3598 * Look for next line end:
3599 */
3603 }
3604 }
3607 /*
3608 * Malformed header - no colon after the name.
3609 */
3613 header_name = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset, header_len, ENC_UTF_8|ENC_NA);
3617 /*
3618 * Skip whitespace after the colon.
3619 */
3628 }
3642 dissector_try_string_with_data(ext_hdr_subdissector_table, header_name, next_tvb2, pinfo, ti_tree, true, NULL);
3646 header_name);
3647 }
3648 }
3653 /*
3654 * Add it to the protocol tree,
3655 * but display the line as is.
3656 */
3671 ett_sip_element);
3672 /* To = ( "To" / "t" ) HCOLON ( name-addr
3673 * / addr-spec ) *( SEMI to-param )
3674 */
3676 if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1){
3681 }
3683 }
3685 /* Find parameter tag if present.
3686 * TODO make this generic to find any interesting parameter
3687 * use the same method as for SIP headers ?
3688 */
3693 parameter_offset++;
3708 /* Tag indicates in-dialog messages, in case we have a INVITE, SUBSCRIBE or REFER, mark it */
3716 }
3717 }
3732 /*
3733 * From = ( "From" / "f" ) HCOLON from-spec
3734 * from-spec = ( name-addr / addr-spec )
3735 * *( SEMI from-param )
3736 */
3739 if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1){
3744 }
3746 }
3748 /* Find parameter tag if present.
3749 * TODO make this generic to find any interesting parameter
3750 * use the same method as for SIP headers ?
3751 */
3756 parameter_offset++;
3769 }
3775 {
3783 ett_sip_element);
3785 /*
3786 * PAssertedID = "P-Asserted-Identity" HCOLON PAssertedID-value
3787 * *(COMMA PAssertedID-value)
3788 * PAssertedID-value = name-addr / addr-spec
3789 *
3790 * Initialize the uri_offsets
3791 */
3793 if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1)
3795 }
3799 {
3805 /*
3806 * P-Associated-URI = "P-Associated-URI" HCOLON
3807 * [p-aso-uri-spec]
3808 * *(COMMA p-aso-uri-spec)
3809 * p-aso-uri-spec = name-addr *(SEMI ai-param)
3810 * ai-param = generic-param
3811 */
3812 /* Skip to the end of the URI directly */
3815 semi_colon_offset = tvb_find_uint8(tvb, semi_colon_offset, line_end_offset - semi_colon_offset, ';');
3818 ett_sip_element);
3819 /* We have generic parameters */
3820 dissect_sip_generic_parameters(tvb, sip_element_tree, pinfo, semi_colon_offset + 1, line_end_offset);
3821 }
3822 }
3824 }
3828 {
3836 ett_sip_hist);
3838 }
3843 {
3851 ett_sip_element);
3852 dissect_sip_p_charging_func_addresses(tvb, sip_element_tree, pinfo, value_offset, line_end_offset);
3853 }
3858 {
3866 ett_sip_element);
3867 /*
3868 * PPreferredID = "P-Preferred-Identity" HCOLON PPreferredID-value
3869 * *(COMMA PPreferredID-value)
3870 * PPreferredID-value = name-addr / addr-spec
3871 *
3872 * Initialize the uri_offsets
3873 */
3875 if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1)
3877 }
3882 {
3890 ett_sip_element);
3891 /*
3892 * Permission-Missing = "Permission-Missing" HCOLON per-miss-spec
3893 * *( COMMA per-miss-spec )
3894 * per-miss-spec = ( name-addr / addr-spec )
3895 * *( SEMI generic-param )
3896 * Initialize the uri_offsets
3897 */
3899 if((dissect_sip_name_addr_or_addr_spec(tvb, pinfo, value_offset, line_end_offset+2, &uri_offsets)) != -1)
3901 }
3907 {
3915 ett_sip_element);
3916 /*
3917 * Trigger-Consent = "Trigger-Consent" HCOLON trigger-cons-spec
3918 * *( COMMA trigger-cons-spec )
3919 * trigger-cons-spec = ( SIP-URI / SIPS-URI )
3920 * *( SEMI trigger-param )
3921 * trigger-param = target-uri / generic-param
3922 * target-uri = "target-uri" EQUAL
3923 * LDQUOT *( qdtext / quoted-pair ) RDQUOT
3924 * Initialize the uri_offsets
3925 */
3932 /* Is there a header parameter */
3935 /* Is this a target-uri ? */
3941 proto_tree_add_item(tc_uri_item_tree, hf_sip_tc_turi, tvb, turi_start_offset,(turi_end_offset - turi_start_offset),ENC_UTF_8);
3942 else
3944 }
3946 }
3947 }
3948 }
3949 }
3953 {
3954 /* Store the retry number */
3955 char *value = tvb_get_string_enc(pinfo->pool, tvb, value_offset, value_len, ENC_UTF_8 | ENC_NA);
3962 retry);
3966 }
3967 }
3970 {
3971 /* Store the sequence number */
3978 /* Add CSeq tree */
3983 value);
3987 }
3989 /* Walk past number and spaces characters to get to start
3990 of method name */
3992 {
3994 {
3997 cseq_number);
3999 }
4000 }
4003 {
4005 {
4006 /* Have reached start of method name */
4008 }
4009 }
4012 {
4013 /* Didn't find method name */
4015 }
4017 /* Extract method name from value */
4020 /* Note the error in the protocol tree */
4026 strlen_to_copy);
4028 }
4030 /* Add CSeq method to the tree */
4034 }
4035 }
4039 {
4042 /*int cseq_method_offset;*/
4044 /* Add RAck tree */
4049 value);
4053 }
4055 /* RSeq number */
4057 {
4059 {
4064 }
4065 }
4067 /* Get to start of CSeq number */
4069 {
4072 {
4074 }
4075 }
4078 /* CSeq number */
4080 {
4082 {
4088 }
4089 }
4091 /* Get to start of CSeq method name */
4093 {
4095 {
4096 /* Have reached start of method name */
4098 }
4099 }
4100 /*cseq_method_offset = sub_value_offset;*/
4103 {
4104 /* Didn't find method name */
4106 }
4108 /* Add CSeq method to the tree */
4110 {
4114 }
4117 }
4120 {
4124 /* Store the Call-id */
4127 /* Add 'Call-id' string item to tree */
4131 call_id);
4135 call_id);
4139 }
4141 }
4146 {
4148 }
4150 /* Add 'Expires' string item to tree */
4157 /*
4158 * Content-Type is the same as Internet
4159 * media type used by other dissectors,
4160 * appropriate dissector found by
4161 * lookup in "media_type" dissector table.
4162 */
4172 /* Content-Type = ( "Content-Type" / "c" ) HCOLON media-type
4173 * media-type = m-type SLASH m-subtype *(SEMI m-parameter)
4174 * SEMI = SWS ";" SWS ; semicolon
4175 * LWS = [*WSP CRLF] 1*WSP ; linear whitespace
4176 * SWS = [LWS] ; sep whitespace
4177 */
4180 /*
4181 * Skip whitespace after the semicolon.
4182 */
4183 parameter_offset = tvb_skip_wsp(tvb, semi_colon_offset +1, value_offset + value_len - (semi_colon_offset +1));
4189 }
4191 (char *)tvb_get_string_enc(pinfo->pool, tvb, value_offset, content_type_len, ENC_UTF_8|ENC_NA));
4193 /* Debug code
4194 proto_tree_add_debug_text(hdr_tree, tvb, value_offset,content_type_len,
4195 "media_type_str(lower cased)=%s",media_type_str_lower_case);
4196 */
4200 {
4207 content_length);
4213 }
4225 /*
4226 * Contact = ("Contact" / "m" ) HCOLON
4227 * ( STAR / (contact-param *(COMMA contact-param)))
4228 * contact-param = (name-addr / addr-spec) *(SEMI contact-params)
4229 */
4237 ett_sip_element);
4239 /* value_offset points to the first non SWS character after ':' */
4244 }
4250 {
4251 contacts++;
4253 {
4254 /* Line End reached: Stop Parsing */
4256 }
4259 {
4260 /* Undefined value reached: Stop Parsing */
4262 }
4264 }
4265 }
4269 /* Authorization = "Authorization" HCOLON credentials
4270 * credentials = ("Digest" LWS digest-response)
4271 * / other-response
4272 * digest-response = dig-resp *(COMMA dig-resp)
4273 * other-response = auth-scheme LWS auth-param
4274 * *(COMMA auth-param)
4275 */
4277 /* Proxy-Authenticate = "Proxy-Authenticate" HCOLON challenge
4278 * challenge = ("Digest" LWS digest-cln *(COMMA digest-cln))
4279 * / other-challenge
4280 * other-challenge = auth-scheme LWS auth-param
4281 * *(COMMA auth-param)
4282 * auth-scheme = token
4283 */
4285 /* Proxy-Authenticate = "Proxy-Authenticate" HCOLON challenge
4286 */
4288 /* Proxy-Authorization = "Proxy-Authorization" HCOLON credentials
4289 */
4291 /* Authentication-Info = "Authentication-Info" HCOLON ainfo
4292 * *(COMMA ainfo)
4293 * ainfo = nextnonce / message-qop
4294 * / response-auth / cnonce
4295 * / nonce-count
4296 */
4297 /* Add tree using whole text of line */
4302 /* Add whole line as header tree */
4310 ett_sip_element);
4312 /* Set sip.auth as a hidden field/filter */
4315 ENC_UTF_8);
4318 /* Check if we have any parameters */
4320 /* Authentication-Info does not begin with the scheme name */
4322 {
4323 /* The first time comma_offset is "start of parameters" */
4324 comma_offset = tvb_ws_mempbrk_pattern_uint8(tvb, value_offset, line_end_offset - value_offset, &pbrk_whitespace, NULL);
4329 /* The first time comma_offset is "start of parameters" */
4331 }
4333 /* Parse each individual parameter in the line */
4334 while ((comma_offset = dissect_sip_authorization_item(tvb, sip_element_tree, comma_offset, line_end_offset, &authorization_info)) != -1)
4335 {
4337 {
4338 /* Line End reached: Stop Parsing */
4340 }
4343 {
4344 /* Undefined value reached: Stop Parsing */
4346 }
4348 }
4350 (authorization_info.username != NULL) && (authorization_info.realm != NULL)) { /* If there is a response, check for valid credentials */
4355 proto_tree_add_expert_format(tree, pinfo, &ei_sip_authorization_invalid, tvb, offset, line_end_offset - offset, "SIP digest does not match known password %s", authorization_user->password);
4356 }
4357 }
4358 }
4364 /* Add Route subtree */
4373 dissect_sip_route_header(tvb, route_tree, pinfo, &sip_route_uri, value_offset, line_end_offset);
4374 }
4377 /* Add Record-Route subtree */
4386 dissect_sip_route_header(tvb, route_tree, pinfo, &sip_record_route_uri, value_offset, line_end_offset);
4387 }
4390 /* Add Service-Route subtree */
4399 dissect_sip_route_header(tvb, route_tree, pinfo, &sip_service_route_uri, value_offset, line_end_offset);
4400 }
4403 /* Add Path subtree */
4412 dissect_sip_route_header(tvb, route_tree, pinfo, &sip_path_uri, value_offset, line_end_offset);
4413 }
4416 /* Add Via subtree */
4426 }
4438 }
4441 /* Content-Encoding = ( "Content-Encoding" / "e" ) HCOLON
4442 * content-coding *(COMMA content-coding)
4443 */
4450 content_encoding_parameter_str = ascii_strdown_inplace(tvb_get_string_enc(pinfo->pool, tvb, value_offset,
4454 /* security-client = "Security-Client" HCOLON
4455 * sec-mechanism *(COMMA sec-mechanism)
4456 */
4468 }
4472 }
4476 /* security-server = "Security-Server" HCOLON
4477 * sec-mechanism *(COMMA sec-mechanism)
4478 */
4490 }
4494 }
4498 /* security-verify = "Security-Verify" HCOLON
4499 * sec-mechanism *(COMMA sec-mechanism)
4500 */
4512 }
4516 }
4528 }
4531 /* Add P-Access-Network-Info subtree */
4539 dissect_sip_p_access_network_info_header(tvb, pinfo, p_access_net_info_tree, value_offset, line_end_offset);
4540 }
4552 dissect_sip_p_charging_vector_header(tvb, p_charging_vector_tree, value_offset, line_end_offset);
4553 }
4566 }
4569 /* Default case is to assume it's an FT_STRING field */
4580 /* Header not terminated by empty line CRLF */
4583 }
4595 }
4600 /* XXX: The hash table lookups below (setup time, request/response,
4601 * resend) are less reliable when the mandatory Call-Id header field
4602 * is missing.
4603 */
4604 }
4606 /* Add to info column interesting things learned from header fields. */
4608 /* for either REGISTER requests or responses, any contacts without expires
4609 * parameter use the Expires header's value
4610 */
4612 /* this may add nothing, but that's ok */
4614 }
4616 /* Registration requests */
4618 {
4619 /* TODO: what if there's a *-contact but also non-*-contacts?
4620 * we should create expert info for that someday I guess
4621 */
4623 {
4625 }
4626 else
4628 {
4635 }
4636 }
4637 else
4639 {
4641 }
4642 else
4643 {
4646 }
4647 }
4649 /* Registration responses - this info only makes sense in 2xx responses */
4651 {
4653 {
4655 }
4658 {
4666 }
4670 }
4671 }
4672 }
4674 /* We've finished writing to the info col for this SIP message
4675 * Set fence in case there is more than one (SIP)message in the frame
4676 */
4677 /* XXX: this produces ugly output, since usually there's only one SIP
4678 * message in a frame yet this '|' gets added at the end. Need a better
4679 * way to do this.
4680 */
4684 /* Find the total setup time, Must be done before checking for resend
4685 * As that will overwrite the "Request packet no".
4686 */
4688 {
4693 }
4695 /* For responses, try to link back to request frame */
4697 {
4701 }
4703 /* Check if this packet is a resend. */
4706 line_type);
4707 /* Mark whether this is a resend for the tap */
4710 /* Report this packet to the tap */
4712 {
4714 }
4717 /*
4718 * There's a message body starting at "offset".
4719 * Set the length of the header item.
4720 */
4721 sdp_setup_info_t setup_info = {
4726 };
4732 /* The body is gzip:ed */
4738 ENC_NA);
4740 }
4745 ENC_NA);
4747 }
4748 }
4753 ENC_NA);
4755 }
4756 }
4758 /* give the content type parameters to sub dissectors */
4760 /* SDP needs a transport layer to determine request/response */
4762 /* Resends don't count */
4768 setup_sdp_transport(next_tvb, pinfo, SDP_EXCHANGE_OFFER, pinfo->num, sip_delay_sdp_changes, &setup_info);
4776 /* SIP client request failed, so SDP offer should fail */
4777 setup_sdp_transport(next_tvb, pinfo, SDP_EXCHANGE_ANSWER_REJECT, request_for_response, sip_delay_sdp_changes, &setup_info);
4779 }
4785 /* SIP success request, so SDP offer should be accepted */
4786 setup_sdp_transport(next_tvb, pinfo, SDP_EXCHANGE_ANSWER_ACCEPT, request_for_response, sip_delay_sdp_changes, &setup_info);
4788 }
4789 }
4797 }
4798 }
4800 /* XXX: why is this called even if setup_sdp_transport() was called before? That will
4801 parse the SDP a second time, for 'application/sdp' media MIME bodies */
4805 media_type_str_lower_case,
4815 /* Try to decode the unknown multipart subtype anyway */
4822 }
4823 /* If no match dump as text */
4824 }
4826 {
4839 }
4841 }
4843 }
4845 /* And add the filterable field to the request/response line */
4847 {
4853 {
4857 }
4860 {
4871 }
4872 }
4873 }
4881 /* Append a brief summary to the SIP root item */
4884 }
4887 }
4889 }
4891 /* Display filter for SIP Request-Line */
4892 static void
4893 dfilter_sip_request_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int offset, unsigned meth_len, int linelen)
4894 {
4897 uri_offset_info uri_offsets;
4899 /*
4900 * We know we have the entire method; otherwise, "sip_parse_line()"
4901 * would have returned OTHER_LINE.
4902 * Request-Line = Method SP Request-URI SP SIP-Version CRLF
4903 * SP = single space
4904 * Request-URI = SIP-URI / SIPS-URI / absoluteURI
4905 */
4907 /* get method string*/
4908 proto_tree_add_item_ret_string(tree, hf_sip_Method, tvb, offset, parameter_len, ENC_ASCII | ENC_NA,
4911 /* Copy request method for telling tap */
4915 /* build Request-URI tree*/
4918 /* calc R-URI len*/
4922 }
4923 }
4925 /* Display filter for SIP Status-Line */
4926 static void
4927 dfilter_sip_status_line(tvbuff_t *tvb, proto_tree *tree, packet_info *pinfo, int line_end, int offset)
4928 {
4935 /*
4936 * We know we have the entire status code; otherwise,
4937 * "sip_parse_line()" would have returned OTHER_LINE.
4938 * We also know that we have a version string followed by a
4939 * space at the beginning of the line, for the same reason.
4940 */
4945 /* Add numerical response code to tree */
4950 /* Add response code for sending to tap */
4953 /* Skip past the response code and possible trailing space */
4956 /* Check for diagnostics */
4961 /* If we have a SIP diagnostics sub dissector call it */
4965 }
4966 }
4968 /* From section 4.1 of RFC 2543:
4969 *
4970 * Request-Line = Method SP Request-URI SP SIP-Version CRLF
4971 *
4972 * From section 5.1 of RFC 2543:
4973 *
4974 * Status-Line = SIP-version SP Status-Code SP Reason-Phrase CRLF
4975 *
4976 * From section 7.1 of RFC 3261:
4977 *
4978 * Unlike HTTP, SIP treats the version number as a literal string.
4979 * In practice, this should make no difference.
4980 */
4981 static line_type_t
4983 {
4996 /*
4997 * Either there's no space in the line (which means
4998 * the line is empty or doesn't have a token followed
4999 * by a space; neither is valid for a request or status), or
5000 * the first character in the line is a space (meaning
5001 * the method is empty, which isn't valid for a request,
5002 * or the SIP version is empty, which isn't valid for a
5003 * status).
5004 */
5006 }
5011 /*
5012 * There's no space after the second token, so we don't
5013 * have a third token.
5014 */
5016 }
5023 /*
5024 * Is the first token a version string?
5025 */
5027 token_1_len == SIP2_HDR_LEN
5031 )) {
5032 /*
5033 * Yes, so this is either a Status-Line or something
5034 * else other than a Request-Line. To be a Status-Line,
5035 * the second token must be a 3-digit number.
5036 */
5038 /*
5039 * We don't have 3-character status code.
5040 */
5042 }
5046 /*
5047 * 3 characters yes, 3 digits no.
5048 */
5050 }
5053 /*
5054 * No, so this is either a Request-Line or something
5055 * other than a Status-Line. To be a Request-Line, the
5056 * second token must be a URI and the third token must
5057 * be a version string.
5058 */
5060 /*
5061 * We don't have a URI consisting of at least 3
5062 * characters.
5063 */
5065 }
5068 /*
5069 * There is no colon after the method, so the URI
5070 * doesn't have a colon in it, so it's not valid.
5071 */
5073 }
5075 /*
5076 * The colon is in the version string, not the URI.
5077 */
5079 }
5080 /* XXX - Check for a proper URI prefix? */
5082 token_3_len != SIP2_HDR_LEN
5086 )) {
5087 /*
5088 * The version string isn't an SIP version 2.0 version
5089 * string.
5090 */
5092 }
5094 }
5095 }
5099 {
5103 meth_name = tvb_get_string_enc(wmem_packet_scope(), tvb, meth_offset, meth_len, ENC_UTF_8|ENC_NA);
5108 {
5111 }
5112 }
5115 }
5117 /*
5118 * Returns index of method in sip_headers
5119 * Header namne should be in lower case
5120 */
5122 {
5125 /* Compact name is one character long */
5130 }
5132 /* Look for compact name match */
5138 }
5141 }
5143 /*
5144 * Display the entire message as raw text.
5145 */
5146 static void
5147 tvb_raw_text_add(tvbuff_t *tvb, int offset, int length, int body_offset, packet_info* pinfo, proto_tree *tree)
5148 {
5162 /* UTF-8 compatible with ASCII */
5164 {
5165 /* Create body tvb with new character encoding */
5170 /* Encoding body with the new encoding */
5177 add_new_data_source(pinfo, body_tvb, wmem_strdup_printf(pinfo->pool, "Decoded %s text", encoding_name));
5178 }
5179 }
5181 /* Display the headers of SIP message as raw text */
5188 else
5191 str,
5193 str);
5194 }
5196 }
5198 DISSECTOR_ASSERT_HINT(offset == body_offset, "The offset must be equal to body_offset before dissect body as raw text.");
5201 /* Dissect the body of SIP message as raw text */
5207 }
5215 else
5220 }
5222 }
5223 }
5224 }
5226 /* Check to see if this packet is a resent request. Return value is the frame number
5227 of the original frame this packet seems to be resending (0 = no resend). */
5233 {
5235 sip_hash_key key;
5241 /* Don't consider packets that appear to be resent only because
5242 they are e.g. returned in ICMP unreachable messages. */
5244 {
5246 }
5248 /* A broken packet may have no cseq number set. Don't consider it as
5249 a resend */
5251 {
5253 }
5255 /* Return any answer stored from previous dissection */
5257 {
5258 sip_frame_result = (sip_frame_result_value*)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num);
5260 {
5262 }
5263 else
5264 {
5266 }
5267 }
5269 /* No packet entry found, consult global hash table */
5271 /* Prepare the key */
5274 /* We're only using these addresses locally (for the hash lookup) so
5275 * there is no need to make a (g_malloc'd) copy of them.
5276 */
5286 }
5289 /* Do the lookup */
5293 {
5294 /* Table entry found, we'll use its value for comparison */
5297 /* First time through, must update value with current details if
5298 cseq number has changed */
5300 {
5306 {
5308 }
5309 }
5310 }
5311 else
5312 {
5313 /* Need to create a new table entry */
5315 /* Allocate a new key and value */
5319 /* Fill in key and value details */
5328 }
5335 {
5337 }
5339 /* Add entry */
5342 /* Assume have seen no cseq yet */
5344 }
5347 /******************************************/
5348 /* Is it a resend??? */
5350 /* Does this look like a resent request (discount ACK, CANCEL, or a
5351 different method from the original one) ? */
5358 {
5360 }
5362 /* Does this look like a resent final response ? */
5368 {
5370 }
5372 /* Update state for this entry */
5376 {
5380 {
5381 /* This frame is the original request */
5384 }
5388 {
5392 {
5393 /* This frame is the original response */
5395 }
5396 }
5397 else
5398 {
5400 }
5404 }
5406 sip_frame_result = (sip_frame_result_value *)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num);
5408 {
5410 p_add_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num, sip_frame_result);
5411 }
5413 /* Store return value with this packet */
5417 }
5420 /* Check to see if this packet is a resent request. Return value is the frame number
5421 of the original frame this packet seems to be resending (0 = no resend). */
5428 {
5430 sip_hash_key key;
5437 /* Ignore error (usually ICMP) frames */
5439 {
5441 }
5443 /* A broken packet may have no cseq number set. Ignore. */
5445 {
5447 }
5449 /* Return any answer stored from previous dissection */
5451 {
5452 sip_frame_result = (sip_frame_result_value*)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num);
5454 {
5457 }
5458 else
5459 {
5461 }
5462 }
5464 /* No packet entry found, consult global hash table */
5466 /* Prepare the key */
5469 /* Looking for matching request, so reverse addresses for this lookup */
5478 /* Do the lookup */
5482 {
5483 /* Table entry found, we'll use its value for comparison */
5485 }
5486 else
5487 {
5488 /* We don't have the request */
5490 }
5493 /**************************************************/
5494 /* Is it a response to a request that we've seen? */
5498 {
5500 }
5503 /* Store return value with this packet */
5504 sip_frame_result = (sip_frame_result_value *)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num);
5506 {
5507 /* Allocate and set all values to zero */
5509 p_add_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num, sip_frame_result);
5510 }
5514 /* Work out response time */
5517 nseconds_between_packets =
5524 }
5526 /*
5527 * Find the initial INVITE to calculate the total setup time
5528 */
5535 {
5536 #if 0
5538 #endif
5539 sip_hash_key key;
5546 /* Ignore error (usually ICMP) frames */
5548 {
5550 }
5552 /* A broken packet may have no cseq number set. Ignore. */
5554 {
5556 }
5558 /* Return any answer stored from previous dissection */
5560 {
5561 sip_frame_result = (sip_frame_result_value*)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num);
5563 {
5566 }
5567 else
5568 {
5570 }
5571 }
5573 /* No packet entry found, consult global hash table */
5575 /* Prepare the key */
5578 /* Looking for matching INVITE */
5587 /* Do the lookup */
5591 {
5592 #if 0
5593 /* Table entry found, we'll use its value for comparison */
5595 #endif
5596 }
5597 else
5598 {
5599 /* We don't have the request */
5601 }
5604 /**************************************************/
5605 /* Is it a response to a request that we've seen? */
5606 #if 0
5610 {
5612 }
5613 #endif
5617 /* Store return value with this packet */
5618 sip_frame_result = (sip_frame_result_value *)p_get_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num);
5620 {
5621 /* Allocate and set all values to zero */
5623 p_add_proto_data(wmem_file_scope(), pinfo, proto_sip, pinfo->curr_layer_num, sip_frame_result);
5624 }
5628 /* Work out response time */
5631 nseconds_between_packets =
5639 }
5641 static bool sip_validate_authorization(sip_authorization_t *authorization_info, char *password) {
5645 gcry_md_hd_t md5_handle;
5653 }
5660 }
5664 }
5671 /* Array is zeroed out so there is always a \0 at index 32 for string termination */
5677 /* Array is zeroed out so there is always a \0 at index 32 for string termination */
5684 gcry_md_write(md5_handle, authorization_info->nonce_count, strlen(authorization_info->nonce_count));
5691 /* Array is zeroed out so there is always a \0 at index 32 for string termination */
5696 }
5698 }
5700 /* TAP STAT INFO */
5702 /*
5703 * Much of this is from ui/gtk/sip_stat.c:
5704 * sip_stat 2004 Martin Mathieson
5705 */
5707 /* TODO: extra codes to be added from SIP extensions?
5708 * https://www.iana.org/assignments/sip-parameters/sip-parameters.xhtml#sip-parameters-6
5709 */
5794 };
5795 #define RESPONSE_CODE_MIN 100
5796 #define RESPONSE_CODE_MAX 699
5799 {
5800 REQ_RESP_METHOD_COLUMN,
5801 COUNT_COLUMN,
5802 RESENT_COLUMN,
5803 MIN_SETUP_COLUMN,
5804 AVG_SETUP_COLUMN,
5805 MAX_SETUP_COLUMN
5815 };
5821 {
5822 /* XXX Should we have a single request + response table instead? */
5829 // These values are fixed for all entries.
5849 }
5854 // For req_table, first column value is method.
5858 }
5859 }
5865 }
5870 // For responses entries, first column gets code and description.
5877 }
5878 }
5879 }
5881 static tap_packet_status
5882 sip_stat_packet(void *tapdata, packet_info *pinfo _U_, epan_dissect_t *edt _U_, const void *siv_ptr, tap_flags_t flags _U_)
5883 {
5890 /* Request table */
5901 }
5902 }
5905 /* Response table */
5916 }
5923 }
5924 }
5928 }
5941 }
5944 stat_tap_table_item_type *min_item_data = stat_tap_get_field_data(cur_table, cur_row, MIN_SETUP_COLUMN);
5945 stat_tap_table_item_type *avg_item_data = stat_tap_get_field_data(cur_table, cur_row, AVG_SETUP_COLUMN);
5946 stat_tap_table_item_type *max_item_data = stat_tap_get_field_data(cur_table, cur_row, MAX_SETUP_COLUMN);
5952 avg_item_data->user_data.float_value += setup_time; /* We store the total setup time in AVG_SETUP_COLUMN */
5961 }
5965 }
5966 }
5971 }
5972 }
5975 }
5977 static void
5979 {
5984 {
6007 }
6008 }
6010 static void
6011 sip_stat_free_table_item(stat_tap_table* table _U_, unsigned row _U_, unsigned column, stat_tap_table_item_type* field_data)
6012 {
6016 }
6018 static char *sip_follow_conv_filter(epan_dissect_t *edt, packet_info *pinfo _U_, unsigned *stream _U_, unsigned *sub_stream _U_)
6019 {
6022 /* Extract si.Call-ID from decoded tree in edt */
6027 filter = ws_strdup_printf("sip.Call-ID == \"%s\"", fvalue_get_string(((field_info *)gp->pdata[0])->value));
6028 }
6032 }
6035 }
6038 {
6040 }
6042 static char *sip_follow_address_filter(address *src_addr _U_, address *dst_addr _U_, int src_port _U_, int dst_port _U_)
6043 {
6045 }
6048 /* Register the protocol with Wireshark */
6050 {
6052 /* Setup list of header fields */
6059 },
6064 },
6069 },
6074 },
6079 },
6084 },
6089 },
6094 },
6099 },
6104 },
6109 },
6114 },
6119 },
6124 },
6129 },
6134 },
6139 },
6144 },
6149 },
6154 },
6159 },
6164 },
6169 },
6174 },
6179 },
6184 },
6189 },
6194 },
6199 },
6204 },
6209 },
6214 },
6218 },
6222 },
6226 },
6230 },
6234 },
6238 },
6242 },
6246 },
6250 },
6254 },
6258 },
6262 },
6266 },
6270 },
6274 },
6278 },
6282 },
6286 },
6290 },
6294 },
6298 },
6302 },
6306 },
6310 },
6315 },
6320 },
6325 },
6330 },
6335 },
6340 },
6345 },
6350 },
6355 },
6360 },
6365 },
6370 },
6375 },
6380 },
6385 },
6390 },
6395 },
6400 },
6405 },
6410 },
6415 },
6420 },
6425 },
6430 },
6435 },
6440 },
6445 },
6450 },
6455 },
6460 },
6465 },
6470 },
6475 },
6480 },
6485 },
6490 },
6495 },
6500 },
6505 },
6510 },
6515 },
6520 },
6525 },
6530 },
6535 },
6540 },
6545 },
6550 },
6555 },
6560 },
6565 },
6570 },
6575 },
6580 },
6585 },
6590 },
6595 },
6600 },
6605 },
6610 },
6615 },
6620 },
6625 },
6630 },
6635 },
6640 },
6645 },
6650 },
6655 },
6660 },
6665 },
6670 },
6675 },
6680 },
6685 },
6690 },
6695 },
6700 },
6705 },
6711 },
6717 },
6723 },
6729 },
6735 },
6741 },
6747 },
6753 },
6759 },
6765 },
6771 },
6776 },
6781 },
6786 },
6791 },
6796 },
6802 },
6808 },
6814 },
6819 },
6824 },
6829 },
6834 },
6839 },
6844 },
6850 },
6855 },
6861 },
6866 },
6871 },
6876 },
6881 },
6886 },
6891 },
6896 },
6901 },
6906 },
6911 },
6916 },
6921 },
6926 },
6931 },
6936 },
6941 },
6946 },
6951 },
6956 },
6961 },
6966 },
6971 },
6976 },
6981 },
6986 },
6991 },
6996 },
7001 },
7006 },
7011 },
7016 },
7021 },
7026 },
7031 },
7036 },
7041 },
7046 },
7051 },
7057 },
7063 },
7068 },
7073 },
7078 },
7084 },
7089 },
7094 },
7099 },
7104 },
7109 },
7114 },
7119 },
7124 },
7129 },
7134 },
7139 },
7144 },
7149 },
7154 },
7159 },
7164 },
7169 },
7174 },
7179 },
7184 },
7189 },
7194 },
7199 },
7204 },
7209 },
7214 },
7219 },
7224 },
7229 },
7234 },
7239 },
7244 },
7249 },
7254 },
7259 },
7264 },
7269 },
7274 },
7279 },
7284 },
7289 },
7294 },
7300 },
7305 },
7310 },
7315 },
7320 },
7325 },
7330 },
7335 },
7340 },
7345 },
7350 },
7355 },
7360 },
7365 },
7370 },
7375 },
7380 },
7385 },
7390 },
7395 },
7400 },
7405 },
7410 },
7415 },
7420 },
7425 },
7430 },
7435 },
7440 },
7445 },
7450 },
7455 },
7460 },
7465 },
7470 },
7472 };
7474 /* raw_sip header field(s) */
7481 }};
7483 /* Setup protocol subtree array */
7517 &ett_sip_via_be_route
7518 };
7521 };
7524 { &ei_sip_unrecognized_header, { "sip.unrecognized_header", PI_UNDECODED, PI_NOTE, "Unrecognised SIP header", EXPFILL }},
7525 { &ei_sip_header_no_colon, { "sip.header_no_colon", PI_MALFORMED, PI_WARN, "Header has no colon after the name", EXPFILL }},
7526 { &ei_sip_header_not_terminated, { "sip.header_not_terminated", PI_MALFORMED, PI_WARN, "Header not terminated by empty line (CRLF)", EXPFILL }},
7527 #if 0
7528 { &ei_sip_odd_register_response, { "sip.response.unusual", PI_RESPONSE_CODE, PI_WARN, "SIP Response is unusual", EXPFILL }},
7529 #endif
7530 { &ei_sip_call_id_invalid, { "sip.Call-ID.invalid", PI_PROTOCOL, PI_WARN, "Call ID is mandatory", EXPFILL }},
7531 { &ei_sip_sipsec_malformed, { "sip.sec_mechanism.malformed", PI_MALFORMED, PI_WARN, "SIP Security-mechanism header malformed", EXPFILL }},
7532 { &ei_sip_via_sent_by_port, { "sip.Via.sent-by.port.invalid", PI_MALFORMED, PI_NOTE, "Invalid SIP Via sent-by-port", EXPFILL }},
7533 { &ei_sip_content_length_invalid, { "sip.content_length.invalid", PI_MALFORMED, PI_NOTE, "Invalid content_length", EXPFILL }},
7534 { &ei_sip_retry_after_invalid, { "sip.retry_after.invalid", PI_MALFORMED, PI_NOTE, "Invalid retry_after value", EXPFILL }},
7535 { &ei_sip_Status_Code_invalid, { "sip.Status-Code.invalid", PI_MALFORMED, PI_NOTE, "Invalid Status-Code", EXPFILL }},
7536 { &ei_sip_authorization_invalid, { "sip.authorization.invalid", PI_PROTOCOL, PI_WARN, "Invalid authorization response for known credentials", EXPFILL }},
7537 { &ei_sip_session_id_sess_id,{ "sip.Session-ID.sess_id.invalid", PI_PROTOCOL, PI_WARN, "Session ID cannot be empty", EXPFILL }}
7538 };
7547 };
7550 REGISTER_TELEPHONY_GROUP_UNSORTED,
7554 sip_stat_init,
7555 sip_stat_packet,
7556 sip_stat_reset,
7557 sip_stat_free_table_item,
7558 NULL,
7561 NULL,
7562 0
7563 };
7565 /* UAT for header fields */
7568 UAT_FLD_CSTRING(sip_custom_header_fields, header_desc, "Field desc", "Description of the value contained in the header"),
7569 UAT_END_FIELDS
7570 };
7576 UAT_END_FIELDS
7577 };
7579 /* Register the protocol name and description */
7586 /* Required function calls to register the header fields and subtrees used */
7593 /* Register raw_sip field(s) */
7605 "Specifies that the raw text of the "
7606 "SIP message should be displayed "
7612 "If the raw text of the SIP message "
7613 "is displayed, the trailing carriage "
7626 "Disable it to allow SIP traffic with a different version "
7632 "Whether the SIP dissector should reassemble headers "
7633 "of a request spanning multiple TCP segments. "
7634 "To use this option, you must also enable "
7640 "Whether the SIP dissector should use the "
7642 "the body of a request spanning multiple TCP segments, "
7643 "and reassemble chunked data spanning multiple TCP segments. "
7644 "To use this option, you must also enable "
7655 "Whether SIP should delay tracking the media (e.g., RTP/RTCP) until an SDP offer "
7656 "is answered. If enabled, mid-dialog changes to SDP and media state only take "
7657 "effect if and when an SDP offer is successfully answered; however enabling this "
7666 /* UAT */
7673 /* specifies named fields, so affects dissection
7674 and the set of named fields */
7676 NULL,
7677 header_fields_copy_cb,
7678 header_fields_update_cb,
7679 header_fields_free_cb,
7680 header_fields_post_update_cb,
7681 header_fields_reset_cb,
7682 sip_custom_header_uat_fields
7683 );
7685 prefs_register_uat_preference(sip_module, "custom_sip_header_fields", "Custom SIP header fields",
7686 "A table to define custom SIP header for which fields can be setup and used for filtering/data extraction etc.",
7687 sip_custom_headers_uat);
7700 /* specifies named fields, so affects dissection
7701 and the set of named fields */
7703 NULL,
7704 authorization_users_copy_cb,
7705 authorization_users_update_cb,
7706 authorization_users_free_cb,
7707 NULL,
7708 NULL,
7709 sip_authorization_users_uat_fields
7710 );
7712 prefs_register_uat_preference(sip_module, "authorization_users_sip", "SIP authorization users",
7714 sip_authorization_users_uat);
7718 heur_subdissector_list = register_heur_dissector_list_with_description("sip", "SIP message fallback", proto_sip);
7719 /* Register for tapping */
7723 ext_hdr_subdissector_table = register_dissector_table("sip.hdr", "SIP Extension header", proto_sip, FT_STRING, STRING_CASE_SENSITIVE);
7727 /* compile patterns */
7737 register_follow_stream(proto_sip, "sip_follow", sip_follow_conv_filter, sip_follow_index_filter, sip_follow_address_filter,
7739 }
7741 void
7743 {
7753 /* Check for a dissector to parse Reason Code texts */
7755 /* SIP content type and internet media type used by other dissectors are the same */
7764 heur_dissector_add("udp", dissect_sip_heur, "SIP over UDP", "sip_udp", proto_sip, HEURISTIC_ENABLE);
7765 heur_dissector_add("tcp", dissect_sip_tcp_heur, "SIP over TCP", "sip_tcp", proto_sip, HEURISTIC_ENABLE);
7766 heur_dissector_add("sctp", dissect_sip_heur, "SIP over SCTP", "sip_sctp", proto_sip, HEURISTIC_ENABLE);
7767 heur_dissector_add("stun", dissect_sip_heur, "SIP over TURN", "sip_stun", proto_sip, HEURISTIC_ENABLE);
7779 }
7780 /* Set our port number for future use */
7784 }
7786 /*
7787 * Editor modelines - https://www.wireshark.org/tools/modelines.html
7788 *
7789 * Local variables:
7790 * c-basic-offset: 4
7791 * tab-width: 8
7792 * indent-tabs-mode: nil
7793 * End:
7794 *
7795 * vi: set shiftwidth=4 tabstop=8 expandtab:
7796 * :indentSize=4:tabSize=8:noTabs=true:
7797 */