/* packet-rtsp.c

 * Routines for RTSP packet disassembly (RFC 2326)

 *

 * Jason Lango <jal@netapp.com>

 * Liberally copied from packet-http.c, by Guy Harris <guy@alum.mit.edu>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 *

 * References:

 * RTSP is defined in RFC 2326, https://tools.ietf.org/html/rfc2326

 * https://www.iana.org/assignments/rsvp-parameters

 * RFC 7826 describes RTSP 2.0, and technically obsoletes RFC 2326.

 * However, in practice due to lack of backwards compatibility, it has

 * has seen limited adoption and this dissector does not attempt to

 * dissect it. RFC 7826 does, however, have some useful comments about

 * ambiguities and pitfalls in RFC 2326.

 */

#include "config.h"

#include <stdio.h>  /* for sscanf() */

#include <epan/packet.h>

#include <epan/req_resp_hdrs.h>

#include <epan/prefs.h>

#include <epan/conversation.h>

#include <epan/expert.h>

#include <epan/strutil.h>

#include <epan/tap-voip.h>

#include <epan/stats_tree.h>

#include <epan/addr_resolv.h>

#include <wsutil/str_util.h>

#include <wsutil/strtoi.h>

#include <wsutil/array.h>

#include "packet-rdt.h"

#include "packet-rtp.h"

#include "packet-rtcp.h"

#include "packet-e164.h"

#include "packet-rtsp.h"

#include "packet-media-type.h"

void proto_register_rtsp(void);

static int rtsp_tap;

/* http://www.iana.org/assignments/rtsp-parameters/rtsp-parameters.xml */

const value_string rtsp_status_code_vals[] = {

    { 100, "Continue" },

    { 199, "Informational - Others" },

    { 200, "OK"},

    { 201, "Created"},

    { 250, "Low on Storage Space"},

    { 299, "Success - Others"},

    { 300, "Multiple Choices"},

    { 301, "Moved Permanently"},

    { 302, "Moved Temporarily"},

    { 303, "See Other"},

    { 305, "Use Proxy"},

    { 399, "Redirection - Others"},

    { 400, "Bad Request"},

    { 401, "Unauthorized"},

    { 402, "Payment Required"},

    { 403, "Forbidden"},

    { 404, "Not Found"},

    { 405, "Method Not Allowed"},

    { 406, "Not Acceptable"},

    { 407, "Proxy Authentication Required"},

    { 408, "Request Timeout"},

    { 410, "Gone"},

    { 411, "Length Required"},

    { 412, "Precondition Failed"},

    { 413, "Request Entity Too Large"},

    { 414, "Request-URI Too Long"},

    { 415, "Unsupported Media Type"},

    { 451, "Invalid Parameter"},

    { 452, "Illegal Conference Identifier"},

    { 453, "Not Enough Bandwidth"},

    { 454, "Session Not Found"},

    { 455, "Method Not Valid In This State"},

    { 456, "Header Field Not Valid"},

    { 457, "Invalid Range"},

    { 458, "Parameter Is Read-Only"},

    { 459, "Aggregate Operation Not Allowed"},

    { 460, "Only Aggregate Operation Allowed"},

    { 461, "Unsupported Transport"},

    { 462, "Destination Unreachable"},

    { 499, "Client Error - Others"},

    { 500, "Internal Server Error"},

    { 501, "Not Implemented"},

    { 502, "Bad Gateway"},

    { 503, "Service Unavailable"},

    { 504, "Gateway Timeout"},

    { 505, "RTSP Version not supported"},

    { 551, "Option Not Support"},

    { 599, "Server Error - Others"},

    { 0,    NULL}

};

static int proto_rtsp;

static int ett_rtsp;

static int ett_rtspframe;

static int ett_rtsp_method;

static int hf_rtsp_request;

static int hf_rtsp_response;

static int hf_rtsp_response_in;

static int hf_rtsp_response_to;

static int hf_rtsp_content_type;

static int hf_rtsp_content_length;

static int hf_rtsp_method;

static int hf_rtsp_url;

static int hf_rtsp_status;

static int hf_rtsp_session;

static int hf_rtsp_transport;

static int hf_rtsp_rdtfeaturelevel;

static int hf_rtsp_cseq;

static int hf_rtsp_content_base;

static int hf_rtsp_content_location;

static int hf_rtsp_X_Vig_Msisdn;

static int hf_rtsp_magic;

static int hf_rtsp_channel;

static int hf_rtsp_length;

static int hf_rtsp_data;

static int voip_tap;

static expert_field ei_rtsp_unknown_transport_type;

static expert_field ei_rtsp_bad_server_port;

static expert_field ei_rtsp_bad_client_port;

static expert_field ei_rtsp_bad_interleaved_channel;

static expert_field ei_rtsp_content_length_invalid;

static expert_field ei_rtsp_rdtfeaturelevel_invalid;

static expert_field ei_rtsp_cseq_invalid;

static expert_field ei_rtsp_bad_server_ip_address;

static expert_field ei_rtsp_bad_client_ip_address;

static dissector_handle_t rtsp_handle;

static dissector_handle_t rtp_handle;

static dissector_handle_t rtp_rfc4571_handle;

static dissector_handle_t rtcp_handle;

static dissector_handle_t rdt_handle;

static dissector_table_t media_type_dissector_table;

static heur_dissector_list_t heur_subdissector_list;

static const char *st_str_packets = "Total RTSP Packets";

static const char *st_str_requests = "RTSP Request Packets";

static const char *st_str_responses = "RTSP Response Packets";

static const char *st_str_resp_broken = "???: broken";

static const char *st_str_resp_100 = "1xx: Informational";

static const char *st_str_resp_200 = "2xx: Success";

static const char *st_str_resp_300 = "3xx: Redirection";

static const char *st_str_resp_400 = "4xx: Client Error";

static const char *st_str_resp_500 = "5xx: Server Error";

static const char *st_str_other = "Other RTSP Packets";

static int st_node_packets = -1;

static int st_node_requests = -1;

static int st_node_responses = -1;

static int st_node_resp_broken = -1;

static int st_node_resp_100 = -1;

static int st_node_resp_200 = -1;

static int st_node_resp_300 = -1;

static int st_node_resp_400 = -1;

static int st_node_resp_500 = -1;

static int st_node_other = -1;

static void

rtsp_stats_tree_init(stats_tree* st)

{

    st_node_packets     = stats_tree_create_node(st, st_str_packets, 0, STAT_DT_INT, true);

    st_node_requests    = stats_tree_create_pivot(st, st_str_requests, st_node_packets);

    st_node_responses   = stats_tree_create_node(st, st_str_responses, st_node_packets, STAT_DT_INT, true);

    st_node_resp_broken = stats_tree_create_node(st, st_str_resp_broken, st_node_responses, STAT_DT_INT, true);

    st_node_resp_100    = stats_tree_create_node(st, st_str_resp_100,    st_node_responses, STAT_DT_INT, true);

    st_node_resp_200    = stats_tree_create_node(st, st_str_resp_200,    st_node_responses, STAT_DT_INT, true);

    st_node_resp_300    = stats_tree_create_node(st, st_str_resp_300,    st_node_responses, STAT_DT_INT, true);

    st_node_resp_400    = stats_tree_create_node(st, st_str_resp_400,    st_node_responses, STAT_DT_INT, true);

    st_node_resp_500    = stats_tree_create_node(st, st_str_resp_500,    st_node_responses, STAT_DT_INT, true);

    st_node_other       = stats_tree_create_node(st, st_str_other, st_node_packets, STAT_DT_INT, false);

}

/* RTSP/Packet Counter stats packet function */

static tap_packet_status

rtsp_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p, tap_flags_t flags _U_)

{

    const rtsp_info_value_t *v = (const rtsp_info_value_t *)p;

    unsigned      i = v->response_code;

    int           resp_grp;

    const char   *resp_str;

    static char   str[64];

    tick_stat_node(st, st_str_packets, 0, false);

    if (i) {

        tick_stat_node(st, st_str_responses, st_node_packets, false);

        if ( (i<100)||(i>=600) ) {

            resp_grp = st_node_resp_broken;

            resp_str = st_str_resp_broken;

        } else if (i<200) {

            resp_grp = st_node_resp_100;

            resp_str = st_str_resp_100;

        } else if (i<300) {

            resp_grp = st_node_resp_200;

            resp_str = st_str_resp_200;

        } else if (i<400) {

            resp_grp = st_node_resp_300;

            resp_str = st_str_resp_300;

        } else if (i<500) {

            resp_grp = st_node_resp_400;

            resp_str = st_str_resp_400;

        } else {

            resp_grp = st_node_resp_500;

            resp_str = st_str_resp_500;

        }

        tick_stat_node(st, resp_str, st_node_responses, false);

        snprintf(str, sizeof(str),"%u %s",i,val_to_str(i,rtsp_status_code_vals, "Unknown (%d)"));

        tick_stat_node(st, str, resp_grp, false);

    } else if (v->request_method) {

        stats_tree_tick_pivot(st,st_node_requests,v->request_method);

    } else {

        tick_stat_node(st, st_str_other, st_node_packets, false);

    }

    return TAP_PACKET_REDRAW;

}

void proto_reg_handoff_rtsp(void);

/*

 * desegmentation of RTSP headers

 * (when we are over TCP or another protocol providing the desegmentation API)

 */

static bool rtsp_desegment_headers = true;

/*

 * desegmentation of RTSP bodies

 * (when we are over TCP or another protocol providing the desegmentation API)

 * TODO let the user filter on content-type the bodies he wants desegmented

 */

static bool rtsp_desegment_body = true;

/* http://www.iana.org/assignments/port-numbers lists two rtsp ports.

 * In Addition RTSP uses display port over Wi-Fi Display: 7236.

 */

#define RTSP_TCP_PORT_RANGE           "554,8554,7236"

/*

 * Takes an array of bytes, assumed to contain a null-terminated

 * string, as an argument, and returns the length of the string -

 * i.e., the size of the array, minus 1 for the null terminator.

 */

#define STRLEN_CONST(str)   (sizeof (str) - 1)

#define RTSP_FRAMEHDR   ('$')

typedef struct {

    char    *request_uri;

    uint32_t req_frame;

    uint32_t resp_frame;

} rtsp_req_resp_t;

typedef struct {

    dissector_handle_t      dissector;

} rtsp_interleaved_t;

#define RTSP_MAX_INTERLEAVED        (256)

/*

 * Careful about dynamically allocating memory in this structure (say

 * for dynamically increasing the size of the 'interleaved' array) -

 * the containing structure is garbage collected and contained

 * pointers will not be freed.

 *

 * XXX - This is wmem allocated now. Rather than a array of fixed size,

 * the array could be, e.g., a tree or map indexed by the channel.

 */

typedef struct {

    rtsp_interleaved_t      interleaved[RTSP_MAX_INTERLEAVED];

    wmem_map_t  *req_resp_map;

} rtsp_conversation_data_t;

static rtsp_conversation_data_t*

get_rtsp_conversation_data(conversation_t *conv, packet_info *pinfo)

{

    rtsp_conversation_data_t *data;

    if (conv == NULL) {

        conv = find_or_create_conversation_strat(pinfo);

    }

    /* Look for previous data */

    data = (rtsp_conversation_data_t *)conversation_get_proto_data(conv, proto_rtsp);

    /* Create new data if necessary */

    if (!data)

    {

        data = wmem_new0(wmem_file_scope(), rtsp_conversation_data_t);

        data->req_resp_map = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);

        conversation_add_proto_data(conv, proto_rtsp, data);

    }

    return data;

}

static int

dissect_rtspinterleaved(tvbuff_t *tvb, int offset, packet_info *pinfo,

    proto_tree *tree)

{

    unsigned        length_remaining;

    proto_item     *ti;

    proto_tree     *rtspframe_tree = NULL;

    int             orig_offset;

    uint8_t         rf_chan;    /* interleaved channel id */

    uint16_t        rf_len;     /* packet length */

    tvbuff_t       *next_tvb;

    conversation_t *conv;

    rtsp_conversation_data_t *data;

    dissector_handle_t        dissector;

    /*

     * This will throw an exception if we don't have any data left.

     * That's what we want.  (See "tcp_dissect_pdus()", which is

     * similar.)

     */

    length_remaining = tvb_ensure_captured_length_remaining(tvb, offset);

    /*

     * Can we do reassembly?

     */

    if (rtsp_desegment_headers && pinfo->can_desegment) {

        /*

         * Yes - would an RTSP multiplexed header starting at

         * this offset be split across segment boundaries?

         */

        if (length_remaining < 4) {

            /*

             * Yes.  Tell the TCP dissector where the data for

             * this message starts in the data it handed us and

             * that we need "some more data."  Don't tell it

             * exactly how many bytes we need because if/when we

             * ask for even more (after the header) that will

             * break reassembly.

             */

            pinfo->desegment_offset = offset;

            pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;

            return -1;

        }

    }

    /*

     * Get the "$", channel, and length from the header.

     */

    orig_offset = offset;

    rf_chan = tvb_get_uint8(tvb, offset+1);

    rf_len = tvb_get_ntohs(tvb, offset+2);

    /*

     * Can we do reassembly?

     */

    if (rtsp_desegment_body && pinfo->can_desegment) {

        /*

         * Yes - is the header + encapsulated packet split

         * across segment boundaries?

         */

        if (length_remaining < 4U + rf_len) {

            /*

             * Yes.  Tell the TCP dissector where the data

             * for this message starts in the data it handed

             * us, and how many more bytes we need, and return.

             */

            pinfo->desegment_offset = offset;

            pinfo->desegment_len = 4U + rf_len - length_remaining;

            return -1;

        }

    }

    col_add_fstr(pinfo->cinfo, COL_INFO,

            "Interleaved channel 0x%02x, %u bytes",

            rf_chan, rf_len);

    ti = proto_tree_add_protocol_format(tree, proto_rtsp, tvb,

        offset, 4,

        "RTSP Interleaved Frame, Channel: 0x%02x, %u bytes",

        rf_chan, rf_len);

    rtspframe_tree = proto_item_add_subtree(ti, ett_rtspframe);

    proto_tree_add_item(rtspframe_tree, hf_rtsp_magic, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    proto_tree_add_item(rtspframe_tree, hf_rtsp_channel, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    proto_tree_add_item(rtspframe_tree, hf_rtsp_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    /*

     * We set the actual length of the tvbuff for the interleaved

     * stuff to the minimum of what's left in the tvbuff and the

     * length in the header.

     *

     * XXX - what if there's nothing left in the tvbuff?

     * We'd want a BoundsError exception to be thrown, so

     * that a Short Frame would be reported.

     */

    if (length_remaining > rf_len)

        length_remaining = rf_len;

    next_tvb = tvb_new_subset_length_caplen(tvb, offset, length_remaining, rf_len);

    conv = find_conversation_pinfo_strat(pinfo, 0);

    if (conv &&

        (data = (rtsp_conversation_data_t *)conversation_get_proto_data(conv, proto_rtsp)) &&

        /* Add the following condition if it is not always true.

        rf_chan < RTSP_MAX_INTERLEAVED &&

        */

        (dissector = data->interleaved[rf_chan].dissector)) {

        call_dissector(dissector, next_tvb, pinfo, tree);

    } else {

        bool dissected = false;

        heur_dtbl_entry_t *hdtbl_entry = NULL;

        dissected = dissector_try_heuristic(heur_subdissector_list,

                            next_tvb, pinfo, tree, &hdtbl_entry, NULL);

        if (!dissected) {

            proto_tree_add_item(rtspframe_tree, hf_rtsp_data, tvb, offset, rf_len, ENC_NA);

        }

    }

    offset += rf_len;

    return offset - orig_offset;

}

static char* process_rtsp_request(tvbuff_t *tvb, int offset, const unsigned char *data,

                                 size_t linelen, packet_info *pinfo, proto_tree *tree);

static void process_rtsp_reply(tvbuff_t *tvb, int offset, const unsigned char *data,

                               size_t linelen, packet_info *pinfo, proto_tree *tree);

typedef enum {

    RTSP_REQUEST,

    RTSP_REPLY,

    RTSP_NOT_FIRST_LINE

} rtsp_type_t;

static const char *rtsp_methods[] = {

    "DESCRIBE",

    "ANNOUNCE",

    "GET_PARAMETER",

    "OPTIONS",

    "PAUSE",

    "PLAY",

    "RECORD",

    "REDIRECT",

    "SETUP",

    "SET_PARAMETER",

    "TEARDOWN"

};

#define RTSP_NMETHODS   array_length(rtsp_methods)

static bool

is_rtsp_request_or_reply(const unsigned char *line, size_t linelen, rtsp_type_t *type,

                         rtsp_info_value_t *rtsp_stat_info, wmem_allocator_t *pool)

{

    unsigned      ii;

    const unsigned char *token, *next_token;

    int           tokenlen;

    char          response_chars[4];

    /* Is this an RTSP reply? */

    if (linelen >= 5 && g_ascii_strncasecmp("RTSP/", line, 5) == 0) {

        /*

         * Yes.

         */

        *type = RTSP_REPLY;

        /* The first token is the version. */

        tokenlen = get_token_len(line, line+linelen, &token);

        if (tokenlen != 0) {

            /* The next token is the status code. */

            tokenlen = get_token_len(token, line+linelen, &next_token);

            if (tokenlen >= 3) {

                memcpy(response_chars, token, 3);

                response_chars[3] = '\0';

                ws_strtou32(response_chars, NULL, &rtsp_stat_info->response_code);

            }

        }

        return true;

    }

    /*

     * Is this an RTSP request?

     * Check whether the line begins with one of the RTSP request

     * methods.

     */

    for (ii = 0; ii < RTSP_NMETHODS; ii++) {

        size_t len = strlen(rtsp_methods[ii]);

        if (linelen >= len &&

            g_ascii_strncasecmp(rtsp_methods[ii], line, len) == 0 &&

            (len == linelen || g_ascii_isspace(line[len])))

        {

            *type = RTSP_REQUEST;

            rtsp_stat_info->request_method =

               wmem_strndup(pool, rtsp_methods[ii], len+1);

            return true;

        }

    }

    /* Wasn't a request or a response */

    *type = RTSP_NOT_FIRST_LINE;

    return false;

}

static const char rtsp_content_type[]      = "Content-Type:";

static const char rtsp_transport[]         = "Transport:";

static const char rtsp_sps_server_port[]   = "server_port=";

static const char rtsp_cps_server_port[]   = "client_port=";

static const char rtsp_sps_dest_addr[]     = "dest_addr=";

static const char rtsp_cps_src_addr[]      = "src_addr=";

static const char rtsp_rtp_udp_default[]   = "rtp/avp";

static const char rtsp_rtp_udp[]           = "rtp/avp/udp";

static const char rtsp_rtp_tcp[]           = "rtp/avp/tcp";

static const char rtsp_rdt_feature_level[] = "RDTFeatureLevel";

static const char rtsp_real_rdt[]          = "x-real-rdt/";

static const char rtsp_real_tng[]          = "x-pn-tng/"; /* synonym for x-real-rdt */

static const char rtsp_inter[]             = "interleaved=";

static const char rtsp_cseq[]              = "CSeq:";

static const char rtsp_content_base[]      = "Content-Base:";

static const char rtsp_content_location[]  = "Content-Location:";

static sdp_setup_info_t*

rtsp_create_setup_info(packet_info *pinfo, const char* session_id, const char *base_uri)

{

    sdp_setup_info_t *setup_info = NULL;

    if (!PINFO_FD_VISITED(pinfo)) {

        // setup_info is only used on the first pass (by SDP or RTP)

        setup_info = wmem_new0(pinfo->pool, sdp_setup_info_t);

        setup_info->hf_id = hf_rtsp_session;

        setup_info->hf_type = SDP_TRACE_ID_HF_TYPE_STR;

        /* The session is a mandatory, opaque string for the session - but

         * not necessarily available at the time of media initialization via SDP,

         * whether DESCRIBE or via HTTP or some other protocol. It is known at

         * the time of actual RTP setup by RTSP, though.

         *

         * wmem_strdup will return "<NULL>" when it is not available, which

         * shouldn't ever be used by SDP (due to the "control" media attribute)

         * but prevents a possible null dereference with, e.g., fuzzed captures.

         *

         * It's in file scope (unlike the setup_info struct itself) because the

         * SDP and RTP dissectors don't copy the string but use it directly.

         * We probably could store the session id copy in conversation data.

         */

        setup_info->trace_id.str = wmem_strdup(wmem_file_scope(), session_id);

        setup_info->base_uri = base_uri;

    }

    return setup_info;

}

static void

rtsp_create_conversation(packet_info *pinfo, proto_item *ti,

                         const unsigned char *line_begin, size_t line_len,

                         int rdt_feature_level,

                         rtsp_type_t rtsp_type_packet,

                         sdp_setup_info_t *setup_info)

{

    char     buf[256];

    char    *tmp;

    bool      rtp_udp_transport = false;

    bool      rtp_tcp_transport = false;

    bool      rdt_transport = false;

    unsigned  c_data_port, c_mon_port;

    unsigned  s_data_port, s_mon_port;

    unsigned  ipv4_1, ipv4_2, ipv4_3, ipv4_4;

    bool      is_video      = false; /* FIX ME - need to indicate video or not */

    address   src_addr;

    address   dst_addr;

    uint32_t  ip4_addr;

    rtp_dyn_payload_t *rtp_dyn_payload = NULL;

    if (rtsp_type_packet != RTSP_REPLY) {

        return;

    }

    src_addr=pinfo->src;

    dst_addr=pinfo->dst;

    /* Copy line into buf */

    if (line_len > sizeof(buf) - 1)

    {

        /* Don't overflow the buffer. */

        line_len = sizeof(buf) - 1;

    }

    memcpy(buf, line_begin, line_len);

    buf[line_len] = '\0';

    /* Get past "Transport:" and spaces */

    tmp = buf + STRLEN_CONST(rtsp_transport);

    while (*tmp && g_ascii_isspace(*tmp))

        tmp++;

    /* Work out which transport type is here */

    if (g_ascii_strncasecmp(tmp, rtsp_rtp_udp, strlen(rtsp_rtp_udp)) == 0)

    {

        rtp_udp_transport = true;

    }

    else if (g_ascii_strncasecmp(tmp, rtsp_rtp_tcp, strlen(rtsp_rtp_tcp)) == 0)

    {

        rtp_tcp_transport = true;

    }

    else if (g_ascii_strncasecmp(tmp, rtsp_rtp_udp_default, strlen(rtsp_rtp_udp_default)) == 0)

    {

        rtp_udp_transport = true;

    }

    else if (g_ascii_strncasecmp(tmp, rtsp_real_rdt, strlen(rtsp_real_rdt)) == 0 ||

                 g_ascii_strncasecmp(tmp, rtsp_real_tng, strlen(rtsp_real_tng)) == 0)

    {

        rdt_transport = true;

    }

    else

    {

        /* Give up on unknown transport types */

        expert_add_info(pinfo, ti, &ei_rtsp_unknown_transport_type);

        return;

    }

    c_data_port = c_mon_port = 0;

    s_data_port = s_mon_port = 0;

    /* Look for server port */

    if ((tmp = strstr(buf, rtsp_sps_server_port))) {

        tmp += strlen(rtsp_sps_server_port);

        if (sscanf(tmp, "%u-%u", &s_data_port, &s_mon_port) < 1) {

            expert_add_info(pinfo, ti, &ei_rtsp_bad_server_port);

            return;

        }

    }

    else if ((tmp = strstr(buf, rtsp_sps_dest_addr))) {

        tmp += strlen(rtsp_sps_dest_addr);

        if (sscanf(tmp, "\":%u\"", &s_data_port) == 1) {

            /* :9 mean ignore */

            if (s_data_port == 9) {

                s_data_port = 0;

            }

        }

        else if (sscanf(tmp, "\"%u.%u.%u.%u:%u\"", &ipv4_1, &ipv4_2, &ipv4_3, &ipv4_4, &s_data_port) == 5) {

            char *tmp2;

            char *tmp3;

            /* Skip leading " */

            tmp++;

            tmp2=strstr(tmp,":");

            tmp3=g_strndup(tmp,tmp2-tmp);

            if (!str_to_ip(tmp3, &ip4_addr)) {

                g_free(tmp3);

                expert_add_info(pinfo, ti, &ei_rtsp_bad_server_ip_address);

                return;

            }

            set_address(&dst_addr, AT_IPv4, 4, &ip4_addr);

            g_free(tmp3);

        }

        else if (sscanf(tmp, "\"%u.%u.%u.%u\"", &ipv4_1, &ipv4_2, &ipv4_3, &ipv4_4) == 4) {

            char *tmp2;

            char *tmp3;

            /* Skip leading " */

            tmp++;

            tmp2=strstr(tmp,"\"");

            tmp3=g_strndup(tmp,tmp2-tmp);

            if (!str_to_ip(tmp3, &ip4_addr)) {

                g_free(tmp3);

                expert_add_info(pinfo, ti, &ei_rtsp_bad_server_ip_address);

                return;

            }

            set_address(&dst_addr, AT_IPv4, 4, &ip4_addr);

            g_free(tmp3);

        }

        else

        {

            expert_add_info(pinfo, ti, &ei_rtsp_bad_server_port);

            return;

        }

    }

    /* Look for client port */

    if ((tmp = strstr(buf, rtsp_cps_server_port))) {

        tmp += strlen(rtsp_cps_server_port);

        if (sscanf(tmp, "%u-%u", &c_data_port, &c_mon_port) < 1) {

            expert_add_info(pinfo, ti, &ei_rtsp_bad_client_port);

            return;

        }

    }

    else if ((tmp = strstr(buf, rtsp_cps_src_addr))) {

        tmp += strlen(rtsp_cps_src_addr);

        if (sscanf(tmp, "\"%u.%u.%u.%u:%u\"", &ipv4_1, &ipv4_2, &ipv4_3, &ipv4_4, &c_data_port) == 5) {

            char *tmp2;

            char *tmp3;

            /* Skip leading " */

            tmp++;

            tmp2=strstr(tmp,":");

            tmp3=g_strndup(tmp,tmp2-tmp);

            if (!str_to_ip(tmp3, &ip4_addr)) {

                g_free(tmp3);

                expert_add_info(pinfo, ti, &ei_rtsp_bad_client_ip_address);

                return;

            }

            set_address(&src_addr, AT_IPv4, 4, &ip4_addr);

            g_free(tmp3);

        }

    }

    if (setup_info && setup_info->base_uri) {

        rtp_dyn_payload = sdp_get_rtsp_media_desc(setup_info->base_uri);

    }

    /* Deal with RTSP TCP-interleaved conversations. */

    tmp = strstr(buf, rtsp_inter);

    if (tmp != NULL) {

        rtsp_conversation_data_t    *data;

        unsigned            s_data_chan, s_mon_chan;

        int             i;

        /* Move tmp to beyond interleaved string */

        tmp += strlen(rtsp_inter);

        /* Look for channel number(s) */

        i = sscanf(tmp, "%u-%u", &s_data_chan, &s_mon_chan);

        if (i < 1)

        {

            expert_add_info(pinfo, ti, &ei_rtsp_bad_interleaved_channel);

            return;

        }

        /* At least data channel present, look for conversation (presumably TCP) */

        data = get_rtsp_conversation_data(NULL, pinfo);

        /* XXX - This doesn't set up the rtp conversation data, including RTP

         * dynamic payload types and setup info. Two possible approaches:

         * 1) The RTP dissector have a function that attaches dynamic payload

         *    type and setup info to the TCP conversation but does *not* set

         *    the conversation dissector (TCP needs to call the RTSP dissector

         *    first for interleaved data).

         * 2) Define a CONVERSATION_RTSP type and change the RTP dissector to

         *    do something other than only look for conversations that match

         *    conversation_pt_to_conversation_type(pinfo->ptype).

         *

         * The former needs to attach a "bundled" rtp_dyn_payload_t that

         * includes mapping for the payload types of all possible channels;

         * this usually happens when RTSP is used because the media descriptor

         * port is usually 0, but we'd want to ensure it. (It also would not

         * work if multiple sessions were SETUP simultaneously and media

         * descriptors with different meanings for the same RTP dynamic payload

         * type were PLAYed on different interleaved channels simulateously.)

         */

        /* Now set the dissector handle of the interleaved channel

           according to the transport protocol used */

        if (rtp_tcp_transport)

        {

            if (s_data_chan < RTSP_MAX_INTERLEAVED) {

                data->interleaved[s_data_chan].dissector =

                    rtp_handle;

            }

            if (i > 1 && s_mon_chan < RTSP_MAX_INTERLEAVED) {

                data->interleaved[s_mon_chan].dissector =

                    rtcp_handle;

            }

        }

        else if (rdt_transport)

        {

            if (s_data_chan < RTSP_MAX_INTERLEAVED) {

                data->interleaved[s_data_chan].dissector =

                    rdt_handle;

            }

        }

        return;

    }

    /* Noninterleaved options follow */

    /*

     * We only want to match on the destination address, not the

     * source address, because the server might send back a packet

     * from an address other than the address to which its client

     * sent the packet, so we construct a conversation with no

     * second address.

     */

    else if (rtp_udp_transport)

    {

        /* RTP only if indicated */

        if (c_data_port)

        {

            srtp_add_address(pinfo, PT_UDP, &dst_addr, c_data_port, s_data_port,

                            "RTSP", pinfo->num, is_video, rtp_dyn_payload, NULL, setup_info);

        }

        else if (s_data_port)

        {

            srtp_add_address(pinfo, PT_UDP, &src_addr, s_data_port, 0,

                            "RTSP", pinfo->num, is_video, rtp_dyn_payload, NULL, setup_info);

        }

        /* RTCP only if indicated */

        if (c_mon_port)

        {

            rtcp_add_address(pinfo, &pinfo->dst, c_mon_port, s_mon_port,

                             "RTSP", pinfo->num);

        }

    }

    else if (rtp_tcp_transport)

    {

        /* RTP only if indicated */

        srtp_add_address(pinfo, PT_TCP, &src_addr, c_data_port, s_data_port,

                        "RTSP", pinfo->num, is_video, rtp_dyn_payload, NULL, setup_info);

    }

    else if (rdt_transport)

    {

        /* Real Data Transport */

        rdt_add_address(pinfo, &pinfo->dst, c_data_port, s_data_port,

                        "RTSP", rdt_feature_level);

    }

    return;

}

static const char rtsp_content_length[] = "Content-Length:";

static int

rtsp_get_content_length(const unsigned char *line_begin, size_t line_len)

{

    char  buf[256];

    char *tmp;

    int32_t content_length;

    const char *p;

    const char *up;

    if (line_len > sizeof(buf) - 1) {

        /*

         * Don't overflow the buffer.

         */

        line_len = sizeof(buf) - 1;

    }

    memcpy(buf, line_begin, line_len);

    buf[line_len] = '\0';

    tmp = buf + STRLEN_CONST(rtsp_content_length);

    while (*tmp && g_ascii_isspace(*tmp))

        tmp++;

    ws_strtoi32(tmp, &p, &content_length);

    up = p;

    if (up == tmp || (*up != '\0' && !g_ascii_isspace(*up)))

        return -1;  /* not a valid number */

    return content_length;

}

static const char rtsp_Session[] = "Session:";

static const char rtsp_X_Vig_Msisdn[] = "X-Vig-Msisdn";

static int

dissect_rtspmessage(tvbuff_t *tvb, int offset, packet_info *pinfo,

    proto_tree *tree)

{

    proto_tree   *rtsp_tree = NULL;

    proto_tree   *req_tree  = NULL;

    proto_tree   *sub_tree  = NULL;

    proto_item   *ti_top    = NULL;

    proto_item   *ti        = NULL;

    const unsigned char *line;

    int           next_offset;

    const unsigned char *linep, *lineend;

    int           orig_offset;

    int           first_linelen, linelen;

    int           line_end_offset;

    int           colon_offset;

    bool          is_request_or_reply;

    bool          body_requires_content_len;

    bool          saw_req_resp_or_header;

    unsigned char c;

    rtsp_type_t   rtsp_type_packet;

    rtsp_type_t   rtsp_type_line;

    bool          is_header;

    int           datalen;

    int           content_length;

    int           reported_datalen;

    int           value_offset;

    int           value_len;

    e164_info_t   e164_info;

    int           rdt_feature_level = 0;

    char         *media_type_str_lower_case = NULL;

    int           semi_colon_offset;

    int           par_end_offset;

    char         *frame_label = NULL;

    char         *session_id  = NULL;

    voip_packet_info_t *stat_info = NULL;

    bool          cseq_valid = false;

    uint32_t      cseq = 0;

    char         *content_base = NULL;

    char         *content_location = NULL;

    char         *request_uri = NULL;

    char         *base_uri = NULL;

    const char   *transport_line = NULL;

    int           transport_linelen;

    sdp_setup_info_t *setup_info = NULL;

    rtsp_info_value_t *rtsp_stat_info;

    rtsp_stat_info = wmem_new(pinfo->pool, rtsp_info_value_t);

    rtsp_stat_info->framenum = pinfo->num;

    rtsp_stat_info->response_code = 0;

    rtsp_stat_info->request_method = NULL;

    rtsp_stat_info->request_uri = NULL;

    rtsp_stat_info->rtsp_host = NULL;

    /*

     * Is this a request or response?

     *

     * Note that "tvb_find_line_end()" will return a value that

     * is not longer than what's in the buffer, so the

     * "tvb_get_ptr()" call won't throw an exception.

     */

    first_linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, false);

    /*

     * Is the first line a request or response?

     */

    line = tvb_get_ptr(tvb, offset, first_linelen);

    is_request_or_reply = is_rtsp_request_or_reply(line, first_linelen,

        &rtsp_type_packet, rtsp_stat_info, pinfo->pool);

    if (is_request_or_reply) {

        /*

         * Yes, it's a request or response.

         * Do header desegmentation if we've been told to,

         * and do body desegmentation if we've been told to and

         * we find a Content-Length header.

         *

         * RFC 7826, Section 18.17. requires Content-Length and

         * assumes zero if missing.

         */

        if (!req_resp_hdrs_do_reassembly(tvb, offset, pinfo,

            rtsp_desegment_headers, rtsp_desegment_body, false, NULL,

            NULL, NULL)) {

            /*

             * More data needed for desegmentation.

             */

            return -1;

        }

    }

    /*

     * RFC 2326 says that a content length must be specified

     * in requests that have a body, although section 4.4 speaks

     * of a server closing the connection indicating the end of

     * a reply body.

     *

     * To support pipelining, we check if line behind blank line

     * looks like RTSP header. If so, we process rest of packet with

     * RTSP loop.

     *

     * If no, we assume that an absent content length in a request means

     * that we don't have a body, and that an absent content length

     * in a reply means that the reply body runs to the end of

     * the connection.  If the first line is neither, we assume

     * that whatever follows a blank line should be treated as a

     * body; there's not much else we can do, as we're jumping

     * into the message in the middle.

     *

     * XXX - if there was no Content-Length entity header, we should

     * accumulate all data until the end of the connection.

     * That'd require that the TCP dissector call subdissectors

     * for all frames with FIN, even if they contain no data,

     * which would require subdissectors to deal intelligently

     * with empty segments.

     */

    if (rtsp_type_packet == RTSP_REQUEST)

        body_requires_content_len = true;

    else