asn1/t38/packet-t38-template.c

   1 /* packet-t38.c
   2  * Routines for T.38 packet dissection
   3  * 2003  Hans Viens
   4  * 2004  Alejandro Vaquero, add support Conversations for SDP
   5  * 2006  Alejandro Vaquero, add T30 reassemble and dissection
   6  *
   7  * $Id$
   8  *
   9  * Wireshark - Network traffic analyzer
  10  * By Gerald Combs <gerald@wireshark.org>
  11  * Copyright 1998 Gerald Combs
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  26  */
  27
  28
  29 /* Depending on what ASN.1 specification is used you may have to change
  30  * the preference setting regarding Pre-Corrigendum ASN.1 specification:
  31  * http://www.itu.int/ITU-T/asn1/database/itu-t/t/t38/1998/T38.html  (Pre-Corrigendum=TRUE)
  32  * http://www.itu.int/ITU-T/asn1/database/itu-t/t/t38/2003/T38(1998).html (Pre-Corrigendum=TRUE)
  33  *
  34  * http://www.itu.int/ITU-T/asn1/database/itu-t/t/t38/2003/T38(2002).html (Pre-Corrigendum=FALSE)
  35  * http://www.itu.int/ITU-T/asn1/database/itu-t/t/t38/2002/t38.html  (Pre-Corrigendum=FALSE)
  36  * http://www.itu.int/ITU-T/asn1/database/itu-t/t/t38/2002-Amd1/T38.html (Pre-Corrigendum=FALSE)
  37  */
  38
  39 /* TO DO:
  40  * - TCP desegmentation is currently not supported for T.38 IFP directly over TCP.
  41  * - H.245 dissectors should be updated to start conversations for T.38 similar to RTP.
  42  * - Sometimes the last octet is not high-lighted when selecting something in the tree. Bug in PER dissector?
  43  * - Add support for RTP payload audio/t38 (draft-jones-avt-audio-t38-03.txt), i.e. T38 in RTP packets.
  44  */
  45
  46
  47 #include "config.h"
  48
  49 #include <glib.h>
  50 #include <epan/packet.h>
  51 #include <epan/reassemble.h>
  52 #include <epan/conversation.h>
  53 #include <epan/tap.h>
  54 #include <epan/expert.h>
  55
  56 #include <string.h>
  57
  58 #include "packet-t38.h"
  59 #include <epan/prefs.h>
  60 #include <epan/ipproto.h>
  61 #include <epan/asn1.h>
  62 #include "packet-per.h"
  63 #include "packet-tpkt.h"
  64 #include <epan/wmem/wmem.h>
  65 #include <epan/strutil.h>
  66
  67 void proto_register_t38(void);
  68 void proto_reg_handoff_t38(void);
  69
  70 #define PORT_T38 6004
  71 static guint global_t38_tcp_port = PORT_T38;
  72 static guint global_t38_udp_port = PORT_T38;
  73
  74 static int t38_tap = -1;
  75
  76 /* dissect using the Pre Corrigendum T.38 ASN.1 specification (1998) */
  77 static gboolean use_pre_corrigendum_asn1_specification = TRUE;
  78
  79 /* dissect packets that looks like RTP version 2 packets as RTP     */
  80 /* instead of as T.38. This may result in that some T.38 UPTL       */
  81 /* packets with sequence number values higher than 32767 may be     */
  82 /* shown as RTP packets.                                            */
  83 static gboolean dissect_possible_rtpv2_packets_as_rtp = FALSE;
  84
  85
  86 /* Reassembly of T.38 PDUs over TPKT over TCP */
  87 static gboolean t38_tpkt_reassembly = TRUE;
  88
  89 /* Preference setting whether TPKT header is used when sending T.38 over TCP.
  90  * The default setting is Maybe where the dissector will look on the first
  91  * bytes to try to determine whether TPKT header is used or not. This may not
  92  * work so well in some cases. You may want to change the setting to Always or
  93  * Newer.
  94  */
  95 #define T38_TPKT_NEVER 0   /* Assume that there is never a TPKT header    */
  96 #define T38_TPKT_ALWAYS 1  /* Assume that there is always a TPKT header   */
  97 #define T38_TPKT_MAYBE 2   /* Assume TPKT if first octets are 03-00-xx-xx */
  98 static gint t38_tpkt_usage = T38_TPKT_MAYBE;
  99
 100 static const enum_val_t t38_tpkt_options[] = {
 101   {"never", "Never", T38_TPKT_NEVER},
 102   {"always", "Always", T38_TPKT_ALWAYS},
 103   {"maybe", "Maybe", T38_TPKT_MAYBE},
 104   {NULL, NULL, -1}
 105 };
 106
 107
 108
 109 /* T38 */
 110 static dissector_handle_t t38_udp_handle;
 111 static dissector_handle_t t38_tcp_handle;
 112 static dissector_handle_t t38_tcp_pdu_handle;
 113 static dissector_handle_t rtp_handle;
 114 static dissector_handle_t t30_hdlc_handle;
 115 static dissector_handle_t data_handle;
 116
 117 static gint32 Type_of_msg_value;
 118 static guint32 Data_Field_field_type_value;
 119 static guint32 Data_value;
 120 static guint32 T30ind_value;
 121 static guint32 Data_Field_item_num;
 122
 123 static int proto_t38 = -1;
 124 #include "packet-t38-hf.c"
 125
 126 /* T38 setup fields */
 127 static int hf_t38_setup        = -1;
 128 static int hf_t38_setup_frame  = -1;
 129 static int hf_t38_setup_method = -1;
 130
 131 /* T38 Data reassemble fields */
 132 static int hf_t38_fragments = -1;
 133 static int hf_t38_fragment = -1;
 134 static int hf_t38_fragment_overlap = -1;
 135 static int hf_t38_fragment_overlap_conflicts = -1;
 136 static int hf_t38_fragment_multiple_tails = -1;
 137 static int hf_t38_fragment_too_long_fragment = -1;
 138 static int hf_t38_fragment_error = -1;
 139 static int hf_t38_fragment_count = -1;
 140 static int hf_t38_reassembled_in = -1;
 141 static int hf_t38_reassembled_length = -1;
 142
 143 static gint ett_t38 = -1;
 144 #include "packet-t38-ett.c"
 145 static gint ett_t38_setup = -1;
 146
 147 static gint ett_data_fragment = -1;
 148 static gint ett_data_fragments = -1;
 149
 150 static gboolean primary_part = TRUE;
 151 static guint32 seq_number = 0;
 152
 153 /* Tables for reassembly of Data fragments. */
 154 static reassembly_table data_reassembly_table;
 155
 156 static const fragment_items data_frag_items = {
 157         /* Fragment subtrees */
 158         &ett_data_fragment,
 159         &ett_data_fragments,
 160         /* Fragment fields */
 161         &hf_t38_fragments,
 162         &hf_t38_fragment,
 163         &hf_t38_fragment_overlap,
 164         &hf_t38_fragment_overlap_conflicts,
 165         &hf_t38_fragment_multiple_tails,
 166         &hf_t38_fragment_too_long_fragment,
 167         &hf_t38_fragment_error,
 168         &hf_t38_fragment_count,
 169         /* Reassembled in field */
 170         &hf_t38_reassembled_in,
 171         /* Reassembled length field */
 172         &hf_t38_reassembled_length,
 173         /* Reassembled data field */
 174         NULL,
 175         /* Tag */
 176         "Data fragments"
 177 };
 178
 179 typedef struct _fragment_key {
 180         address src;
 181         address dst;
 182         guint32 id;
 183 } fragment_key;
 184
 185 static conversation_t *p_conv= NULL;
 186 static t38_conv *p_t38_conv = NULL;
 187 static t38_conv *p_t38_packet_conv = NULL;
 188 static t38_conv_info *p_t38_conv_info = NULL;
 189 static t38_conv_info *p_t38_packet_conv_info = NULL;
 190
 191 /* RTP Version is the first 2 bits of the first octet in the UDP payload*/
 192 #define RTP_VERSION(octet)      ((octet) >> 6)
 193
 194 void proto_reg_handoff_t38(void);
 195
 196 static void show_setup_info(tvbuff_t *tvb, proto_tree *tree, t38_conv *p_t38_conv);
 197 /* Preferences bool to control whether or not setup info should be shown */
 198 static gboolean global_t38_show_setup_info = TRUE;
 199
 200 /* Can tap up to 4 T38 packets within same packet */
 201 /* We only tap the primary part, not the redundancy */
 202 #define MAX_T38_MESSAGES_IN_PACKET 4
 203 static t38_packet_info t38_info_arr[MAX_T38_MESSAGES_IN_PACKET];
 204 static int t38_info_current=0;
 205 static t38_packet_info *t38_info=NULL;
 206
 207 static void t38_defragment_init(void)
 208 {
 209         /* Init reassembly table */
 210         reassembly_table_init(&data_reassembly_table,
 211                               &addresses_reassembly_table_functions);
 212 }
 213
 214
 215 /* Set up an T38 conversation */
 216 void t38_add_address(packet_info *pinfo,
 217                      address *addr, int port,
 218                      int other_port,
 219                      const gchar *setup_method, guint32 setup_frame_number)
 220 {
 221         address null_addr;
 222         conversation_t* p_conversation;
 223         t38_conv* p_conversation_data = NULL;
 224
 225         /*
 226          * If this isn't the first time this packet has been processed,
 227          * we've already done this work, so we don't need to do it
 228          * again.
 229          */
 230         if ((pinfo->fd->flags.visited) || (t38_udp_handle == NULL))
 231         {
 232                 return;
 233         }
 234
 235         SET_ADDRESS(&null_addr, AT_NONE, 0, NULL);
 236
 237         /*
 238          * Check if the ip address and port combination is not
 239          * already registered as a conversation.
 240          */
 241         p_conversation = find_conversation( setup_frame_number, addr, &null_addr, PT_UDP, port, other_port,
 242                                 NO_ADDR_B | (!other_port ? NO_PORT_B : 0));
 243
 244         /*
 245          * If not, create a new conversation.
 246          */
 247         if ( !p_conversation || p_conversation->setup_frame != setup_frame_number) {
 248                 p_conversation = conversation_new( setup_frame_number, addr, &null_addr, PT_UDP,
 249                                            (guint32)port, (guint32)other_port,
 250                                                                    NO_ADDR2 | (!other_port ? NO_PORT2 : 0));
 251         }
 252
 253         /* Set dissector */
 254         conversation_set_dissector(p_conversation, t38_udp_handle);
 255
 256         /*
 257          * Check if the conversation has data associated with it.
 258          */
 259         p_conversation_data = (t38_conv*)conversation_get_proto_data(p_conversation, proto_t38);
 260
 261         /*
 262          * If not, add a new data item.
 263          */
 264         if ( ! p_conversation_data ) {
 265                 /* Create conversation data */
 266                 p_conversation_data = wmem_new(wmem_file_scope(), t38_conv);
 267
 268                 conversation_add_proto_data(p_conversation, proto_t38, p_conversation_data);
 269         }
 270
 271         /*
 272          * Update the conversation data.
 273          */
 274         g_strlcpy(p_conversation_data->setup_method, setup_method, MAX_T38_SETUP_METHOD_SIZE);
 275         p_conversation_data->setup_frame_number = setup_frame_number;
 276                 p_conversation_data->src_t38_info.reass_ID = 0;
 277                 p_conversation_data->src_t38_info.reass_start_seqnum = -1;
 278                 p_conversation_data->src_t38_info.reass_data_type = 0;
 279                 p_conversation_data->src_t38_info.last_seqnum = -1;
 280                 p_conversation_data->src_t38_info.packet_lost = 0;
 281                 p_conversation_data->src_t38_info.burst_lost = 0;
 282                 p_conversation_data->src_t38_info.time_first_t4_data = 0;
 283
 284
 285                 p_conversation_data->dst_t38_info.reass_ID = 0;
 286                 p_conversation_data->dst_t38_info.reass_start_seqnum = -1;
 287                 p_conversation_data->dst_t38_info.reass_data_type = 0;
 288                 p_conversation_data->dst_t38_info.last_seqnum = -1;
 289                 p_conversation_data->dst_t38_info.packet_lost = 0;
 290                 p_conversation_data->dst_t38_info.burst_lost = 0;
 291                 p_conversation_data->dst_t38_info.time_first_t4_data = 0;
 292 }
 293
 294
 295 fragment_head *
 296 force_reassemble_seq(reassembly_table *table, packet_info *pinfo, guint32 id)
 297 {
 298         fragment_head *fd_head;
 299         fragment_item *fd_i;
 300         fragment_item *last_fd;
 301         guint32 dfpos, size, packet_lost, burst_lost, seq_num;
 302         guint8 *data;
 303
 304         fd_head = fragment_get(table, pinfo, id, NULL);
 305
 306         /* have we already seen this frame ?*/
 307         if (pinfo->fd->flags.visited) {
 308                 if (fd_head != NULL && fd_head->flags & FD_DEFRAGMENTED) {
 309                         return fd_head;
 310                 } else {
 311                         return NULL;
 312                 }
 313         }
 314
 315         if (fd_head==NULL){
 316                 /* we must have it to continue */
 317                 return NULL;
 318         }
 319
 320         /* check for packet lost and count the burst of packet lost */
 321         packet_lost = 0;
 322         burst_lost = 0;
 323         seq_num = 0;
 324         for(fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
 325                 if (seq_num != fd_i->offset) {
 326                         packet_lost += fd_i->offset - seq_num;
 327                         if ( (fd_i->offset - seq_num) > burst_lost ) {
 328                                 burst_lost = fd_i->offset - seq_num;
 329                         }
 330                 }
 331                 seq_num = fd_i->offset + 1;
 332         }
 333
 334         /* we have received an entire packet, defragment it and
 335          * free all fragments
 336          */
 337         size=0;
 338         last_fd=NULL;
 339         for(fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
 340           if(!last_fd || last_fd->offset!=fd_i->offset){
 341             size+=fd_i->len;
 342           }
 343           last_fd=fd_i;
 344         }
 345
 346         data = (guint8 *) g_malloc(size);
 347         fd_head->tvb_data = tvb_new_real_data(data, size, size);
 348         fd_head->len = size;            /* record size for caller       */
 349
 350         /* add all data fragments */
 351         dfpos = 0;
 352         last_fd=NULL;
 353         for (fd_i=fd_head->next;fd_i && fd_i->len + dfpos <= size;fd_i=fd_i->next) {
 354           if (fd_i->len) {
 355             if(!last_fd || last_fd->offset!=fd_i->offset){
 356               memcpy(data+dfpos,tvb_get_ptr(fd_i->tvb_data,0,fd_i->len),fd_i->len);
 357               dfpos += fd_i->len;
 358             } else {
 359               /* duplicate/retransmission/overlap */
 360               fd_i->flags    |= FD_OVERLAP;
 361               fd_head->flags |= FD_OVERLAP;
 362               if( (last_fd->len!=fd_i->datalen)
 363                   || tvb_memeql(last_fd->tvb_data, 0, tvb_get_ptr(fd_i->tvb_data, 0, last_fd->len), last_fd->len) ){
 364                         fd_i->flags    |= FD_OVERLAPCONFLICT;
 365                         fd_head->flags |= FD_OVERLAPCONFLICT;
 366               }
 367             }
 368           }
 369           last_fd=fd_i;
 370         }
 371
 372         /* we have defragmented the pdu, now free all fragments*/
 373         for (fd_i=fd_head->next;fd_i;fd_i=fd_i->next) {
 374           if(fd_i->tvb_data){
 375             tvb_free(fd_i->tvb_data);
 376             fd_i->tvb_data=NULL;
 377           }
 378         }
 379
 380         /* mark this packet as defragmented */
 381         fd_head->flags |= FD_DEFRAGMENTED;
 382         fd_head->reassembled_in=pinfo->fd->num;
 383
 384         col_append_fstr(pinfo->cinfo, COL_INFO, " (t4-data Reassembled: %d pack lost, %d pack burst lost)", packet_lost, burst_lost);
 385
 386         p_t38_packet_conv_info->packet_lost = packet_lost;
 387         p_t38_packet_conv_info->burst_lost = burst_lost;
 388
 389         return fd_head;
 390 }
 391
 392 /* T38 Routines */
 393 #include "packet-t38-fn.c"
 394
 395 /* initialize the tap t38_info and the conversation */
 396 static void
 397 init_t38_info_conv(packet_info *pinfo)
 398 {
 399         /* tap info */
 400         t38_info_current++;
 401         if (t38_info_current==MAX_T38_MESSAGES_IN_PACKET) {
 402                 t38_info_current=0;
 403         }
 404         t38_info = &t38_info_arr[t38_info_current];
 405
 406         t38_info->seq_num = 0;
 407         t38_info->type_msg = 0;
 408         t38_info->data_value = 0;
 409         t38_info->t30ind_value =0;
 410         t38_info->setup_frame_number = 0;
 411         t38_info->Data_Field_field_type_value = 0;
 412         t38_info->desc[0] = '\0';
 413         t38_info->desc_comment[0] = '\0';
 414         t38_info->time_first_t4_data = 0;
 415         t38_info->frame_num_first_t4_data = 0;
 416
 417
 418         /*
 419                 p_t38_packet_conv hold the conversation info in each of the packets.
 420                 p_t38_conv hold the conversation info used to reassemble the HDLC packets, and also the Setup info (e.g SDP)
 421                 If we already have p_t38_packet_conv in the packet, it means we already reassembled the HDLC packets, so we don't
 422                 need to use p_t38_conv
 423         */
 424         p_t38_packet_conv = NULL;
 425         p_t38_conv = NULL;
 426
 427         /* Use existing packet info if available */
 428          p_t38_packet_conv = (t38_conv *)p_get_proto_data(pinfo->fd, proto_t38, 0);
 429
 430
 431         /* find the conversation used for Reassemble and Setup Info */
 432         p_conv = find_conversation(pinfo->fd->num, &pinfo->net_dst, &pinfo->net_src,
 433                                    pinfo->ptype,
 434                                    pinfo->destport, pinfo->srcport, NO_ADDR_B | NO_PORT_B);
 435
 436         /* create a conv if it doen't exist */
 437         if (!p_conv) {
 438                 p_conv = conversation_new(pinfo->fd->num, &pinfo->net_src, &pinfo->net_dst,
 439                               pinfo->ptype, pinfo->srcport, pinfo->destport, NO_ADDR_B | NO_PORT_B);
 440
 441                 /* Set dissector */
 442                 conversation_set_dissector(p_conv, t38_udp_handle);
 443         }
 444
 445         if (!p_t38_packet_conv) {
 446                 p_t38_conv = (t38_conv *)conversation_get_proto_data(p_conv, proto_t38);
 447
 448                 /* create the conversation if it doen't exist */
 449                 if (!p_t38_conv) {
 450                         p_t38_conv = wmem_new(wmem_file_scope(), t38_conv);
 451                         p_t38_conv->setup_method[0] = '\0';
 452                         p_t38_conv->setup_frame_number = 0;
 453
 454                         p_t38_conv->src_t38_info.reass_ID = 0;
 455                         p_t38_conv->src_t38_info.reass_start_seqnum = -1;
 456                         p_t38_conv->src_t38_info.reass_data_type = 0;
 457                         p_t38_conv->src_t38_info.last_seqnum = -1;
 458                         p_t38_conv->src_t38_info.packet_lost = 0;
 459                         p_t38_conv->src_t38_info.burst_lost = 0;
 460                         p_t38_conv->src_t38_info.time_first_t4_data = 0;
 461                         p_t38_conv->src_t38_info.additional_hdlc_data_field_counter = 0;
 462                         p_t38_conv->src_t38_info.seqnum_prev_data_field = -1;
 463
 464                         p_t38_conv->dst_t38_info.reass_ID = 0;
 465                         p_t38_conv->dst_t38_info.reass_start_seqnum = -1;
 466                         p_t38_conv->dst_t38_info.reass_data_type = 0;
 467                         p_t38_conv->dst_t38_info.last_seqnum = -1;
 468                         p_t38_conv->dst_t38_info.packet_lost = 0;
 469                         p_t38_conv->dst_t38_info.burst_lost = 0;
 470                         p_t38_conv->dst_t38_info.time_first_t4_data = 0;
 471                         p_t38_conv->dst_t38_info.additional_hdlc_data_field_counter = 0;
 472                         p_t38_conv->dst_t38_info.seqnum_prev_data_field = -1;
 473
 474                         conversation_add_proto_data(p_conv, proto_t38, p_t38_conv);
 475                 }
 476
 477                 /* copy the t38 conversation info to the packet t38 conversation */
 478                 p_t38_packet_conv = wmem_new(wmem_file_scope(), t38_conv);
 479                 g_strlcpy(p_t38_packet_conv->setup_method, p_t38_conv->setup_method, MAX_T38_SETUP_METHOD_SIZE);
 480                 p_t38_packet_conv->setup_frame_number = p_t38_conv->setup_frame_number;
 481
 482                 memcpy(&(p_t38_packet_conv->src_t38_info), &(p_t38_conv->src_t38_info), sizeof(t38_conv_info));
 483                 memcpy(&(p_t38_packet_conv->dst_t38_info), &(p_t38_conv->dst_t38_info), sizeof(t38_conv_info));
 484
 485                 p_add_proto_data(pinfo->fd, proto_t38, 0, p_t38_packet_conv);
 486         }
 487
 488         if (ADDRESSES_EQUAL(&p_conv->key_ptr->addr1, &pinfo->net_src)) {
 489                 p_t38_conv_info = &(p_t38_conv->src_t38_info);
 490                 p_t38_packet_conv_info = &(p_t38_packet_conv->src_t38_info);
 491         } else {
 492                 p_t38_conv_info = &(p_t38_conv->dst_t38_info);
 493                 p_t38_packet_conv_info = &(p_t38_packet_conv->dst_t38_info);
 494         }
 495
 496         /* update t38_info */
 497         t38_info->setup_frame_number = p_t38_packet_conv->setup_frame_number;
 498 }
 499
 500 /* Entry point for dissection */
 501 static void
 502 dissect_t38_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 503 {
 504         guint8 octet1;
 505         proto_item *it;
 506         proto_tree *tr;
 507         guint32 offset=0;
 508
 509         /*
 510          * XXX - heuristic to check for misidentified packets.
 511          */
 512         if (dissect_possible_rtpv2_packets_as_rtp){
 513                 octet1 = tvb_get_guint8(tvb, offset);
 514                 if (RTP_VERSION(octet1) == 2){
 515                         call_dissector(rtp_handle,tvb,pinfo,tree);
 516                         return;
 517                 }
 518         }
 519
 520         col_set_str(pinfo->cinfo, COL_PROTOCOL, "T.38");
 521         col_clear(pinfo->cinfo, COL_INFO);
 522
 523         primary_part = TRUE;
 524
 525         /* This indicate the item number in the primary part of the T38 message, it is used for the reassemble of T30 packets */
 526         Data_Field_item_num = 0;
 527
 528         it=proto_tree_add_protocol_format(tree, proto_t38, tvb, 0, -1, "ITU-T Recommendation T.38");
 529         tr=proto_item_add_subtree(it, ett_t38);
 530
 531         /* init tap and conv info */
 532         init_t38_info_conv(pinfo);
 533
 534         /* Show Conversation setup info if exists*/
 535         if (global_t38_show_setup_info) {
 536                 show_setup_info(tvb, tr, p_t38_packet_conv);
 537         }
 538
 539         col_append_str(pinfo->cinfo, COL_INFO, "UDP: UDPTLPacket ");
 540
 541         offset = dissect_UDPTLPacket_PDU(tvb, pinfo, tr, NULL);
 542
 543         if (tvb_length_remaining(tvb,offset)>0){
 544                 if (tr){
 545                         proto_tree_add_text(tr, tvb, offset, tvb_reported_length_remaining(tvb, offset),
 546                                 "[MALFORMED PACKET or wrong preference settings]");
 547                 }
 548                 col_append_str(pinfo->cinfo, COL_INFO, " [Malformed?]");
 549         }
 550 }
 551
 552 static void
 553 dissect_t38_tcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 554 {
 555         proto_item *it;
 556         proto_tree *tr;
 557         guint32 offset=0;
 558     tvbuff_t *next_tvb;
 559         guint16 ifp_packet_number=1;
 560
 561         col_set_str(pinfo->cinfo, COL_PROTOCOL, "T.38");
 562         col_clear(pinfo->cinfo, COL_INFO);
 563
 564         primary_part = TRUE;
 565
 566         /* This indicate the item number in the primary part of the T38 message, it is used for the reassemble of T30 packets */
 567         Data_Field_item_num = 0;
 568
 569         it=proto_tree_add_protocol_format(tree, proto_t38, tvb, 0, -1, "ITU-T Recommendation T.38");
 570         tr=proto_item_add_subtree(it, ett_t38);
 571
 572         /* init tap and conv info */
 573         init_t38_info_conv(pinfo);
 574
 575         /* Show Conversation setup info if exists*/
 576         if (global_t38_show_setup_info) {
 577                 show_setup_info(tvb, tr, p_t38_packet_conv);
 578         }
 579
 580         col_append_str(pinfo->cinfo, COL_INFO, "TCP: IFPPacket");
 581
 582         while(tvb_length_remaining(tvb,offset)>0)
 583         {
 584                 next_tvb = tvb_new_subset_remaining(tvb, offset);
 585                 offset += dissect_IFPPacket_PDU(next_tvb, pinfo, tr, NULL);
 586                 ifp_packet_number++;
 587
 588                 if(tvb_length_remaining(tvb,offset)>0){
 589                         if(t38_tpkt_usage == T38_TPKT_ALWAYS){
 590                                 if(tr){
 591                                         proto_tree_add_text(tr, tvb, offset, tvb_reported_length_remaining(tvb, offset),
 592                                                 "[MALFORMED PACKET or wrong preference settings]");
 593                                 }
 594                                 col_append_str(pinfo->cinfo, COL_INFO, " [Malformed?]");
 595                                 break;
 596                         }else {
 597                                 col_append_fstr(pinfo->cinfo, COL_INFO, " IFPPacket#%u",ifp_packet_number);
 598                         }
 599                 }
 600         }
 601
 602 }
 603
 604 static void
 605 dissect_t38_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 606 {
 607         primary_part = TRUE;
 608
 609         if(t38_tpkt_usage == T38_TPKT_ALWAYS){
 610                 dissect_tpkt_encap(tvb,pinfo,tree,t38_tpkt_reassembly,t38_tcp_pdu_handle);
 611         }
 612         else if((t38_tpkt_usage == T38_TPKT_NEVER) || (is_tpkt(tvb,1) == -1)){
 613                 dissect_t38_tcp_pdu(tvb, pinfo, tree);
 614         }
 615         else {
 616                 dissect_tpkt_encap(tvb,pinfo,tree,t38_tpkt_reassembly,t38_tcp_pdu_handle);
 617         }
 618 }
 619
 620 static void
 621 dissect_t38(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 622 {
 623         if(pinfo->ipproto == IP_PROTO_TCP)
 624         {
 625                 dissect_t38_tcp(tvb, pinfo, tree);
 626         }
 627         else if(pinfo->ipproto == IP_PROTO_UDP)
 628         {
 629                 dissect_t38_udp(tvb, pinfo, tree);
 630         }
 631 }
 632
 633 /* Look for conversation info and display any setup info found */
 634 void
 635 show_setup_info(tvbuff_t *tvb, proto_tree *tree, t38_conv *p_t38_conversation)
 636 {
 637         proto_tree *t38_setup_tree;
 638         proto_item *ti;
 639
 640         if (!p_t38_conversation || p_t38_conversation->setup_frame_number == 0) {
 641                 /* there is no Setup info */
 642                 return;
 643         }
 644
 645         ti =  proto_tree_add_string_format(tree, hf_t38_setup, tvb, 0, 0,
 646                       "",
 647                       "Stream setup by %s (frame %u)",
 648                       p_t38_conversation->setup_method,
 649                       p_t38_conversation->setup_frame_number);
 650     PROTO_ITEM_SET_GENERATED(ti);
 651     t38_setup_tree = proto_item_add_subtree(ti, ett_t38_setup);
 652     if (t38_setup_tree)
 653     {
 654                 /* Add details into subtree */
 655                 proto_item* item = proto_tree_add_uint(t38_setup_tree, hf_t38_setup_frame,
 656                                                                tvb, 0, 0, p_t38_conversation->setup_frame_number);
 657                 PROTO_ITEM_SET_GENERATED(item);
 658                 item = proto_tree_add_string(t38_setup_tree, hf_t38_setup_method,
 659                                                      tvb, 0, 0, p_t38_conversation->setup_method);
 660                 PROTO_ITEM_SET_GENERATED(item);
 661     }
 662 }
 663
 664
 665
 666 /* Wireshark Protocol Registration */
 667 void
 668 proto_register_t38(void)
 669 {
 670         static hf_register_info hf[] =
 671         {
 672 #include "packet-t38-hfarr.c"
 673                 {   &hf_t38_setup,
 674                     { "Stream setup", "t38.setup", FT_STRING, BASE_NONE,
 675                     NULL, 0x0, "Stream setup, method and frame number", HFILL }},
 676                 {   &hf_t38_setup_frame,
 677             { "Stream frame", "t38.setup-frame", FT_FRAMENUM, BASE_NONE,
 678             NULL, 0x0, "Frame that set up this stream", HFILL }},
 679         {   &hf_t38_setup_method,
 680             { "Stream Method", "t38.setup-method", FT_STRING, BASE_NONE,
 681             NULL, 0x0, "Method used to set up this stream", HFILL }},
 682                 {&hf_t38_fragments,
 683                         {"Message fragments", "t38.fragments",
 684                         FT_NONE, BASE_NONE, NULL, 0x00, NULL, HFILL } },
 685                 {&hf_t38_fragment,
 686                         {"Message fragment", "t38.fragment",
 687                         FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },
 688                 {&hf_t38_fragment_overlap,
 689                         {"Message fragment overlap", "t38.fragment.overlap",
 690                         FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 691                 {&hf_t38_fragment_overlap_conflicts,
 692                         {"Message fragment overlapping with conflicting data",
 693                         "t38.fragment.overlap.conflicts",
 694                         FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 695                 {&hf_t38_fragment_multiple_tails,
 696                         {"Message has multiple tail fragments",
 697                         "t38.fragment.multiple_tails",
 698                         FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 699                 {&hf_t38_fragment_too_long_fragment,
 700                         {"Message fragment too long", "t38.fragment.too_long_fragment",
 701                         FT_BOOLEAN, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 702                 {&hf_t38_fragment_error,
 703                         {"Message defragmentation error", "t38.fragment.error",
 704                         FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },
 705                 {&hf_t38_fragment_count,
 706                         {"Message fragment count", "t38.fragment.count",
 707                         FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } },
 708                 {&hf_t38_reassembled_in,
 709                         {"Reassembled in", "t38.reassembled.in",
 710                         FT_FRAMENUM, BASE_NONE, NULL, 0x00, NULL, HFILL } },
 711                 {&hf_t38_reassembled_length,
 712                         {"Reassembled T38 length", "t38.reassembled.length",
 713                         FT_UINT32, BASE_DEC, NULL, 0x00, NULL, HFILL } },
 714         };
 715
 716         static gint *ett[] =
 717         {
 718                 &ett_t38,
 719 #include "packet-t38-ettarr.c"
 720                 &ett_t38_setup,
 721                 &ett_data_fragment,
 722                 &ett_data_fragments
 723         };
 724
 725         module_t *t38_module;
 726
 727         proto_t38 = proto_register_protocol("T.38", "T.38", "t38");
 728         proto_register_field_array(proto_t38, hf, array_length(hf));
 729         proto_register_subtree_array(ett, array_length(ett));
 730         register_dissector("t38", dissect_t38, proto_t38);
 731
 732         /* Init reassemble tables for HDLC */
 733         register_init_routine(t38_defragment_init);
 734
 735         t38_tap = register_tap("t38");
 736
 737         t38_module = prefs_register_protocol(proto_t38, proto_reg_handoff_t38);
 738         prefs_register_bool_preference(t38_module, "use_pre_corrigendum_asn1_specification",
 739             "Use the Pre-Corrigendum ASN.1 specification",
 740             "Whether the T.38 dissector should decode using the Pre-Corrigendum T.38 "
 741                 "ASN.1 specification (1998).",
 742             &use_pre_corrigendum_asn1_specification);
 743         prefs_register_bool_preference(t38_module, "dissect_possible_rtpv2_packets_as_rtp",
 744             "Dissect possible RTP version 2 packets with RTP dissector",
 745             "Whether a UDP packet that looks like RTP version 2 packet will "
 746                 "be dissected as RTP packet or T.38 packet. If enabled there is a risk that T.38 UDPTL "
 747                 "packets with sequence number higher than 32767 may be dissected as RTP.",
 748             &dissect_possible_rtpv2_packets_as_rtp);
 749         prefs_register_uint_preference(t38_module, "tcp.port",
 750                 "T.38 TCP Port",
 751                 "Set the TCP port for T.38 messages",
 752                 10, &global_t38_tcp_port);
 753         prefs_register_uint_preference(t38_module, "udp.port",
 754                 "T.38 UDP Port",
 755                 "Set the UDP port for T.38 messages",
 756                 10, &global_t38_udp_port);
 757         prefs_register_bool_preference(t38_module, "reassembly",
 758                 "Reassemble T.38 PDUs over TPKT over TCP",
 759                 "Whether the dissector should reassemble T.38 PDUs spanning multiple TCP segments "
 760                 "when TPKT is used over TCP. "
 761                 "To use this option, you must also enable \"Allow subdissectors to reassemble "
 762                 "TCP streams\" in the TCP protocol settings.",
 763                 &t38_tpkt_reassembly);
 764         prefs_register_enum_preference(t38_module, "tpkt_usage",
 765                 "TPKT used over TCP",
 766                 "Whether T.38 is used with TPKT for TCP",
 767                 (gint *)&t38_tpkt_usage,t38_tpkt_options,FALSE);
 768
 769         prefs_register_bool_preference(t38_module, "show_setup_info",
 770                 "Show stream setup information",
 771                 "Where available, show which protocol and frame caused "
 772                 "this T.38 stream to be created",
 773                 &global_t38_show_setup_info);
 774
 775 }
 776
 777 void
 778 proto_reg_handoff_t38(void)
 779 {
 780         static gboolean t38_prefs_initialized = FALSE;
 781         static guint tcp_port;
 782         static guint udp_port;
 783
 784         if (!t38_prefs_initialized) {
 785                 t38_udp_handle=create_dissector_handle(dissect_t38_udp, proto_t38);
 786                 t38_tcp_handle=create_dissector_handle(dissect_t38_tcp, proto_t38);
 787                 t38_tcp_pdu_handle=create_dissector_handle(dissect_t38_tcp_pdu, proto_t38);
 788                 rtp_handle = find_dissector("rtp");
 789                 t30_hdlc_handle = find_dissector("t30.hdlc");
 790                 data_handle = find_dissector("data");
 791                 t38_prefs_initialized = TRUE;
 792         }
 793         else {
 794                 dissector_delete_uint("tcp.port", tcp_port, t38_tcp_handle);
 795                 dissector_delete_uint("udp.port", udp_port, t38_udp_handle);
 796         }
 797         tcp_port = global_t38_tcp_port;
 798         udp_port = global_t38_udp_port;
 799
 800         dissector_add_uint("tcp.port", tcp_port, t38_tcp_handle);
 801         dissector_add_uint("udp.port", udp_port, t38_udp_handle);
 802
 803 }
 804