/* packet-mgcp.c

 * Routines for mgcp packet disassembly

 * RFC 2705

 * RFC 3435 (obsoletes 2705): Media Gateway Control Protocol (MGCP) Version 1.0

 * RFC 3660: Basic MGCP Packages

 * RFC 3661: MGCP Return Code Usage

 * NCS 1.0: PacketCable Network-Based Call Signaling Protocol Specification,

 *          PKT-SP-EC-MGCP-I09-040113, January 13, 2004, Cable Television

 *          Laboratories, Inc., http://www.PacketCable.com/

 * NCS 1.5: PKT-SP-NCS1.5-I04-120412, April 12, 2012 Cable Television

 *          Laboratories, Inc., http://www.PacketCable.com/

 * www.iana.org/assignments/mgcp-localconnectionoptions

 *

 * Copyright (c) 2000 by Ed Warnicke <hagbard@physics.rutgers.edu>

 * Copyright (c) 2004 by Thomas Anders <thomas.anders [AT] blue-cable.de>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1999 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#define WS_LOG_DOMAIN "packet-mgcp"

#include "config.h"

#include <wireshark.h>

#include <stdlib.h>

#include <epan/packet.h>

#include <epan/exceptions.h>

#include <epan/prefs.h>

#include <epan/conversation.h>

#include <epan/tap.h>

#include <epan/strutil.h>

#include <epan/rtd_table.h>

#include <epan/expert.h>

#include "packet-media-type.h"

#include "packet-mgcp.h"

#include "packet-sdp.h"

#include <wsutil/strtoi.h>

#define TCP_PORT_MGCP_GATEWAY 2427

#define UDP_PORT_MGCP_GATEWAY 2427

#define TCP_PORT_MGCP_CALLAGENT 2727

#define UDP_PORT_MGCP_CALLAGENT 2727

/* Define the mgcp proto */

static int proto_mgcp;

/* Define many many headers for mgcp */

static int hf_mgcp_req;

static int hf_mgcp_req_verb;

static int hf_mgcp_req_endpoint;

static int hf_mgcp_req_frame;

static int hf_mgcp_rsp;

static int hf_mgcp_rsp_frame;

static int hf_mgcp_time;

static int hf_mgcp_transid;

static int hf_mgcp_version;

static int hf_mgcp_rsp_rspcode;

static int hf_mgcp_rsp_rspstring;

static int hf_mgcp_params;

static int hf_mgcp_param_rspack;

static int hf_mgcp_param_bearerinfo;

static int hf_mgcp_param_callid;

static int hf_mgcp_param_connectionid;

static int hf_mgcp_param_secondconnectionid;

static int hf_mgcp_param_notifiedentity;

static int hf_mgcp_param_requestid;

static int hf_mgcp_param_localconnoptions;

static int hf_mgcp_param_localconnoptions_p;

static int hf_mgcp_param_localconnoptions_a;

static int hf_mgcp_param_localconnoptions_s;

static int hf_mgcp_param_localconnoptions_e;

static int hf_mgcp_param_localconnoptions_scrtp;

static int hf_mgcp_param_localconnoptions_scrtcp;

static int hf_mgcp_param_localconnoptions_b;

static int hf_mgcp_param_localconnoptions_esccd;

static int hf_mgcp_param_localconnoptions_escci;

static int hf_mgcp_param_localconnoptions_dqgi;

static int hf_mgcp_param_localconnoptions_dqrd;

static int hf_mgcp_param_localconnoptions_dqri;

static int hf_mgcp_param_localconnoptions_dqrr;

static int hf_mgcp_param_localconnoptions_k;

static int hf_mgcp_param_localconnoptions_gc;

static int hf_mgcp_param_localconnoptions_fmtp;

static int hf_mgcp_param_localconnoptions_nt;

static int hf_mgcp_param_localconnoptions_ofmtp;

static int hf_mgcp_param_localconnoptions_r;

static int hf_mgcp_param_localconnoptions_t;

static int hf_mgcp_param_localconnoptions_rcnf;

static int hf_mgcp_param_localconnoptions_rdir;

static int hf_mgcp_param_localconnoptions_rsh;

static int hf_mgcp_param_localconnoptions_mp;

static int hf_mgcp_param_localconnoptions_fxr;

static int hf_mgcp_param_localvoicemetrics;

static int hf_mgcp_param_remotevoicemetrics;

static int hf_mgcp_param_voicemetrics_nlr;

static int hf_mgcp_param_voicemetrics_jdr;

static int hf_mgcp_param_voicemetrics_bld;

static int hf_mgcp_param_voicemetrics_gld;

static int hf_mgcp_param_voicemetrics_bd;

static int hf_mgcp_param_voicemetrics_gd;

static int hf_mgcp_param_voicemetrics_rtd;

static int hf_mgcp_param_voicemetrics_esd;

static int hf_mgcp_param_voicemetrics_sl;

static int hf_mgcp_param_voicemetrics_nl;

static int hf_mgcp_param_voicemetrics_rerl;

static int hf_mgcp_param_voicemetrics_gmn;

static int hf_mgcp_param_voicemetrics_nsr;

static int hf_mgcp_param_voicemetrics_xsr;

static int hf_mgcp_param_voicemetrics_mlq;

static int hf_mgcp_param_voicemetrics_mcq;

static int hf_mgcp_param_voicemetrics_plc;

static int hf_mgcp_param_voicemetrics_jba;

static int hf_mgcp_param_voicemetrics_jbr;

static int hf_mgcp_param_voicemetrics_jbn;

static int hf_mgcp_param_voicemetrics_jbm;

static int hf_mgcp_param_voicemetrics_jbs;

static int hf_mgcp_param_voicemetrics_iaj;

static int hf_mgcp_param_connectionmode;

static int hf_mgcp_param_reqevents;

static int hf_mgcp_param_restartmethod;

static int hf_mgcp_param_restartdelay;

static int hf_mgcp_param_signalreq;

static int hf_mgcp_param_digitmap;

static int hf_mgcp_param_observedevent;

static int hf_mgcp_param_connectionparam;

static int hf_mgcp_param_connectionparam_ps;

static int hf_mgcp_param_connectionparam_os;

static int hf_mgcp_param_connectionparam_pr;

static int hf_mgcp_param_connectionparam_or;

static int hf_mgcp_param_connectionparam_pl;

static int hf_mgcp_param_connectionparam_ji;

static int hf_mgcp_param_connectionparam_la;

static int hf_mgcp_param_connectionparam_pcrps;

static int hf_mgcp_param_connectionparam_pcros;

static int hf_mgcp_param_connectionparam_pcrpl;

static int hf_mgcp_param_connectionparam_pcrji;

static int hf_mgcp_param_connectionparam_x;

static int hf_mgcp_param_reasoncode;

static int hf_mgcp_param_eventstates;

static int hf_mgcp_param_specificendpoint;

static int hf_mgcp_param_secondendpointid;

static int hf_mgcp_param_reqinfo;

static int hf_mgcp_param_quarantinehandling;

static int hf_mgcp_param_detectedevents;

static int hf_mgcp_param_capabilities;

static int hf_mgcp_param_maxmgcpdatagram;

static int hf_mgcp_param_packagelist;

static int hf_mgcp_param_extension;

static int hf_mgcp_param_extension_critical;

static int hf_mgcp_param_resourceid;

static int hf_mgcp_param_invalid;

static int hf_mgcp_messagecount;

static int hf_mgcp_dup;

static int hf_mgcp_req_dup;

static int hf_mgcp_req_dup_frame;

static int hf_mgcp_rsp_dup;

static int hf_mgcp_rsp_dup_frame;

static int hf_mgcp_param_x_osmux;

static int hf_mgcp_unknown_parameter;

static int hf_mgcp_malformed_parameter;

static expert_field ei_mgcp_rsp_rspcode_invalid;

static const value_string mgcp_return_code_vals[] = {

  {000, "Response Acknowledgement"},

  {100, "The transaction is currently being executed.  An actual completion message will follow on later."},

  {101, "The transaction has been queued for execution.  An actual completion message will follow later."},

  {200, "The requested transaction was executed normally."},

  {250, "The connection was deleted."},

  {400, "The transaction could not be executed, due to a transient error."},

  {401, "The phone is already off hook"},

  {402, "The phone is already on hook"},

  {403, "The transaction could not be executed, because the endpoint does not have sufficient resources at this time"},

  {404, "Insufficient bandwidth at this time"},

  {405, "The transaction could not be executed, because the endpoint is \"restarting\"."},

  {406, "Transaction time-out.  The transaction did not complete in a reasonable period of time and has been aborted."},

  {407, "Transaction aborted.  The transaction was aborted by some external action, e.g., a ModifyConnection command aborted by a DeleteConnection command."},

  {409, "The transaction could not be executed because of internal overload."},

  {410, "No endpoint available.  A valid \"any of\" wildcard was used, however there was no endpoint available to satisfy the request."},

  {500, "The transaction could not be executed, because the endpoint is unknown."},

  {501, "The transaction could not be executed, because the endpoint is not ready."},

  {502, "The transaction could not be executed, because the endpoint does not have sufficient resources"},

  {503, "\"All of\" wildcard too complicated."},

  {504, "Unknown or unsupported command."},

  {505, "Unsupported RemoteConnectionDescriptor."},

  {506, "Unable to satisfy both LocalConnectionOptions and RemoteConnectionDescriptor."},

  {507, "Unsupported functionality."},

  {508, "Unknown or unsupported quarantine handling."},

  {509, "Error in RemoteConnectionDescriptor."},

  {510, "The transaction could not be executed, because a protocol error was detected."},

  {511, "The transaction could not be executed, because the command contained an unrecognized extension."},

  {512, "The transaction could not be executed, because the gateway is not equipped to detect one of the requested events."},

  {513, "The transaction could not be executed, because the gateway is not equipped to generate one of the requested signals."},

  {514, "The transaction could not be executed, because the gateway cannot send the specified announcement."},

  {515, "The transaction refers to an incorrect connection-id (may have been already deleted)"},

  {516, "The transaction refers to an unknown call-id."},

  {517, "Unsupported or invalid mode."},

  {518, "Unsupported or unknown package."},

  {519, "Endpoint does not have a digit map."},

  {520, "The transaction could not be executed, because the endpoint is 'restarting'."},

  {521, "Endpoint redirected to another Call Agent."},

  {522, "No such event or signal."},

  {523, "Unknown action or illegal combination of actions"},

  {524, "Internal inconsistency in LocalConnectionOptions"},

  {525, "Unknown extension in LocalConnectionOptions"},

  {526, "Insufficient bandwidth"},

  {527, "Missing RemoteConnectionDescriptor"},

  {528, "Incompatible protocol version"},

  {529, "Internal hardware failure"},

  {530, "CAS signaling protocol error."},

  {531, "failure of a grouping of trunks (e.g. facility failure)."},

  {532, "Unsupported value(s) in LocalConnectionOptions."},

  {533, "Response too large."},

  {534, "Codec negotiation failure."},

  {535, "Packetization period not supported"},

  {536, "Unknown or unsupported RestartMethod"},

  {537, "Unknown or unsupported digit map extension"},

  {538, "Event/signal parameter error (e.g., missing, erroneous, unsupported, unknown, etc.)"},

  {539, "Invalid or unsupported command parameter."},

  {540, "Per endpoint connection limit exceeded."},

  {541, "Invalid or unsupported LocalConnectionOptions"},

  {0,   NULL }

};

static value_string_ext mgcp_return_code_vals_ext = VALUE_STRING_EXT_INIT(mgcp_return_code_vals);

/* TODO: add/use when tested/have capture to test with */

/*

static const value_string mgcp_reason_code_vals[] = {

  {0,   "Endpoint state is normal"},

  {900, "Endpoint malfunctioning."},

  {901, "Endpoint taken out-of-service."},

  {902, "Loss of lower layer connectivity (e.g., downstream sync)."},

  {903, "QoS resource reservation was lost."},

  {904, "Manual intervention."},

  {905, "Facility failure (e.g., DS-0 failure)."},

  {0,   NULL }

};

*/

/*

 * Define the trees for mgcp

 * We need one for MGCP itself, one for the MGCP parameters and one

 * for each of the dissected parameters

 */

static int ett_mgcp;

static int ett_mgcp_param;

static int ett_mgcp_param_connectionparam;

static int ett_mgcp_param_localconnectionoptions;

static int ett_mgcp_param_localvoicemetrics;

static int ett_mgcp_param_remotevoicemetrics;

/*

 * Define the tap for mgcp

 */

static int mgcp_tap;

/*

 * Here are the global variables associated with

 * the various user definable characteristics of the dissection

 *

 * MGCP has two kinds of "agents", gateways and callagents.  Callagents

 * control gateways in a master/slave sort of arrangement.  Since gateways

 * and callagents have different well known ports and could both

 * operate under either udp or tcp we have rather a lot of port info to

 * specify.

 *

 * global_mgcp_raw_text determines whether we are going to display

 * the raw text of the mgcp message, much like the HTTP dissector does.

 *

 */

static unsigned global_mgcp_gateway_tcp_port   = TCP_PORT_MGCP_GATEWAY;

static unsigned global_mgcp_gateway_udp_port   = UDP_PORT_MGCP_GATEWAY;

static unsigned global_mgcp_callagent_tcp_port = TCP_PORT_MGCP_CALLAGENT;

static unsigned global_mgcp_callagent_udp_port = UDP_PORT_MGCP_CALLAGENT;

static bool global_mgcp_raw_text;

static bool global_mgcp_message_count;

/* Some basic utility functions that are specific to this dissector */

static bool is_mgcp_verb(tvbuff_t *tvb, int offset, int maxlength, const char **verb_name);

static bool is_mgcp_rspcode(tvbuff_t *tvb, int offset, int maxlength);

/*

 * The various functions that either dissect some

 * subpart of MGCP.  These aren't really proto dissectors but they

 * are written in the same style.

 */

static void dissect_mgcp_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,

         proto_tree *mgcp_tree, proto_tree *ti);

static void dissect_mgcp_firstline(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, mgcp_info_t* mi);

static void dissect_mgcp_params(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, mgcp_info_t* mi);

static void dissect_mgcp_connectionparams(proto_tree *parent_tree, packet_info* pinfo, tvbuff_t *tvb,

            int offset, int param_type_len,

            int param_val_len);

static void dissect_mgcp_localconnectionoptions(proto_tree *parent_tree, packet_info* pinfo, tvbuff_t *tvb,

            int offset, int param_type_len,

            int param_val_len);

static void dissect_mgcp_localvoicemetrics(proto_tree *parent_tree, packet_info* pinfo, tvbuff_t *tvb,

            int offset, int param_type_len,

            int param_val_len);

static void dissect_mgcp_remotevoicemetrics(proto_tree *parent_tree, packet_info* pinfo, tvbuff_t *tvb,

            int offset, int param_type_len,

            int param_val_len);

static void mgcp_raw_text_add(tvbuff_t *tvb, proto_tree *tree);

#define NUM_TIMESTATS 11

static const value_string mgcp_message_type[] = {

  {  0, "Overall"},

  {  1, "EPCF   "},

  {  2, "CRCX   "},

  {  3, "MDCX   "},

  {  4, "DLCX   "},

  {  5, "RQNT   "},

  {  6, "NTFY   "},

  {  7, "AUEP   "},

  {  8, "AUCX   "},

  {  9, "RSIP   "},

  {  0, NULL}

};

static tap_packet_status

mgcpstat_packet(void *pms, packet_info *pinfo, epan_dissect_t *edt _U_, const void *pmi, tap_flags_t flags _U_)

{

  rtd_data_t* rtd_data = (rtd_data_t*)pms;

  rtd_stat_table* ms = &rtd_data->stat_table;

  const mgcp_info_t *mi = (const mgcp_info_t *)pmi;

  nstime_t delta;

  tap_packet_status ret = TAP_PACKET_DONT_REDRAW;

  switch (mi->mgcp_type) {

  case MGCP_REQUEST:

    if (mi->is_duplicate) {

      /* Duplicate is ignored */

      ms->time_stats[0].req_dup_num++;

    }

    else {

      ms->time_stats[0].open_req_num++;

    }

    break;

  case MGCP_RESPONSE:

    if (mi->is_duplicate) {

      /* Duplicate is ignored */

      ms->time_stats[0].rsp_dup_num++;

    }

    else if (!mi->request_available) {

      /* no request was seen */

      ms->time_stats[0].disc_rsp_num++;

    }

    else {

      ms->time_stats[0].open_req_num--;

      /* calculate time delta between request and response */

      nstime_delta(&delta, &pinfo->abs_ts, &mi->req_time);

      time_stat_update(&(ms->time_stats[0].rtd[0]), &delta, pinfo);

      if (g_ascii_strncasecmp(mi->code, "EPCF", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[1]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "CRCX", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[2]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "MDCX", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[3]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "DLCX", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[4]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "RQNT", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[5]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "NTFY", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[6]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "AUEP", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[7]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "AUCX", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[8]), &delta, pinfo);

      }

      else if (g_ascii_strncasecmp(mi->code, "RSIP", 4) == 0 ) {

        time_stat_update(&(ms->time_stats[0].rtd[9]), &delta, pinfo);

      }

      else {

        time_stat_update(&(ms->time_stats[0].rtd[10]), &delta, pinfo);

      }

      ret = TAP_PACKET_REDRAW;

    }

    break;

  default:

    break;

  }

  return ret;

}

/*

 * Some functions which should be moved to a library

 * as I think that people may find them of general usefulness.

 */

static int tvb_find_null_line(tvbuff_t* tvb, int offset, int len, int* next_offset);

static int tvb_find_dot_line(tvbuff_t* tvb, int offset, int len, int* next_offset);

static dissector_handle_t sdp_handle;

static dissector_handle_t mgcp_handle;

extern void

dissect_asciitpkt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,

      dissector_handle_t subdissector_handle);

extern uint16_t is_asciitpkt(tvbuff_t *tvb);

/*

 * Init Hash table stuff

 */

typedef struct _mgcp_call_info_key

{

  uint32_t transid;

  conversation_t *conversation;

} mgcp_call_info_key;

static wmem_map_t *mgcp_calls;

/* Compare 2 keys */

static int mgcp_call_equal(const void *k1, const void *k2)

{

  const mgcp_call_info_key* key1 = (const mgcp_call_info_key*) k1;

  const mgcp_call_info_key* key2 = (const mgcp_call_info_key*) k2;

  return (key1->transid == key2->transid &&

          key1->conversation == key2->conversation);

}

/* Calculate a hash key */

static unsigned mgcp_call_hash(const void *k)

{

  const mgcp_call_info_key* key = (const mgcp_call_info_key*) k;

  return key->transid  + key->conversation->conv_index;

}

/************************************************************************

 * dissect_mgcp - The dissector for the Media Gateway Control Protocol

 ************************************************************************/

static int dissect_mgcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

  int sectionlen;

  uint32_t num_messages;

  int tvb_sectionend, tvb_sectionbegin, tvb_len;

  proto_tree *mgcp_tree = NULL;

  proto_item *ti = NULL, *tii;

  const char *verb_name = "";

  /* Initialize variables */

  tvb_sectionend = 0;

  tvb_sectionbegin = tvb_sectionend;

  tvb_len = tvb_reported_length(tvb);

  num_messages = 0;

  /*

   * Check to see whether we're really dealing with MGCP by looking

   * for a valid MGCP verb or response code.  This isn't infallible,

   * but it's cheap and it's better than nothing.

   */

  if (!is_mgcp_verb(tvb, 0, tvb_len, &verb_name) && !is_mgcp_rspcode(tvb, 0, tvb_len))

    return 0;

  /*

   * Set the columns now, so that they'll be set correctly if we throw

   * an exception.  We can set them later as well....

   */

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "MGCP");

  col_clear(pinfo->cinfo, COL_INFO);

  /*

   * Loop through however many mgcp messages may be stuck in

   * this packet using piggybacking

   */

  do

  {

    num_messages++;

    /* Create our mgcp subtree */

    ti = proto_tree_add_item(tree, proto_mgcp, tvb, 0, -1, ENC_NA);

    mgcp_tree = proto_item_add_subtree(ti, ett_mgcp);

    sectionlen = tvb_find_dot_line(tvb, tvb_sectionbegin, -1, &tvb_sectionend);

    if (sectionlen != -1)

    {

      dissect_mgcp_message(tvb_new_subset_length(tvb, tvb_sectionbegin, sectionlen),

          pinfo, tree, mgcp_tree, ti);

      tvb_sectionbegin = tvb_sectionend;

    }

    else

    {

      break;

    }

  } while (tvb_sectionend < tvb_len);

  tii = proto_tree_add_uint(mgcp_tree, hf_mgcp_messagecount, tvb,

      0 , 0 , num_messages);

  proto_item_set_hidden(tii);

  /*

   * Add our column information after dissecting SDP

   * in order to prevent the column info changing to reflect the SDP

   * (when showing message count)

   */

  tvb_sectionbegin = 0;

  if (global_mgcp_message_count == true )

  {

    if (num_messages > 1)

    {

      col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "MGCP (%i messages)", num_messages);

    }

    else

    {

      col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "MGCP (%i message)", num_messages);

    }

  }

  sectionlen = tvb_find_line_end(tvb, tvb_sectionbegin, -1,

      &tvb_sectionend, false);

  col_prepend_fstr(pinfo->cinfo, COL_INFO, "%s",

      tvb_format_text(pinfo->pool, tvb, tvb_sectionbegin, sectionlen));

  return tvb_len;

}

/************************************************************************

 * dissect_tpkt_mgcp - The dissector for the ASCII TPKT Media Gateway Control Protocol

 ************************************************************************/

static int dissect_tpkt_mgcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

  uint16_t ascii_tpkt;

  int     offset = 0;

  /* Check whether this looks like a ASCII TPKT-encapsulated

   *  MGCP packet.

   */

  ascii_tpkt = is_asciitpkt(tvb);

  if (ascii_tpkt != 1 )

  {

    /*

     * It's not a ASCII TPKT packet

     * in MGCP

     */

    offset = dissect_mgcp(tvb, pinfo, tree, NULL);

  }

  else

  {

    /*

     * Dissect ASCII TPKT header

     */

    dissect_asciitpkt(tvb, pinfo, tree, mgcp_handle);

    offset = tvb_reported_length(tvb);

  }

  return offset;

}

/* Dissect an individual MGCP message */

static void dissect_mgcp_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,

         proto_tree *mgcp_tree, proto_tree *ti)

{

  /* Declare variables */

  int sectionlen;

  int tvb_sectionend, tvb_sectionbegin, tvb_len;

  tvbuff_t *next_tvb;

  const char *verb_name = "";

  mgcp_info_t* mi = wmem_new0(pinfo->pool, mgcp_info_t);

  sdp_setup_info_t setup_info = { .hf_id = 0, .hf_type = SDP_TRACE_ID_HF_TYPE_UINT32 };

  media_content_info_t content_info = { MEDIA_CONTAINER_SIP_DATA, NULL, NULL, &setup_info };

  mi->mgcp_type = MGCP_OTHERS;

  /* Initialize variables */

  tvb_len = tvb_reported_length(tvb);

  /*

   * Check to see whether we're really dealing with MGCP by looking

   * for a valid MGCP verb or response code.  This isn't infallible,

   * but it's cheap and it's better than nothing.

   */

  if (is_mgcp_verb(tvb, 0, tvb_len, &verb_name) || is_mgcp_rspcode(tvb, 0, tvb_len))

  {

    /* dissect first line */

    tvb_sectionbegin = 0;

    tvb_sectionend = tvb_sectionbegin;

    sectionlen = tvb_find_line_end(tvb, 0, -1, &tvb_sectionend, false);

    if (sectionlen > 0)

    {

      dissect_mgcp_firstline(tvb_new_subset_length(tvb, tvb_sectionbegin,

                             sectionlen), pinfo,

                             mgcp_tree, mi);

    }

    tvb_sectionbegin = tvb_sectionend;

    /* Dissect params */

    if (tvb_sectionbegin < tvb_len)

    {

      sectionlen = tvb_find_null_line(tvb, tvb_sectionbegin, -1,

                                      &tvb_sectionend);

      if (sectionlen > 0)

      {

        dissect_mgcp_params(tvb_new_subset_length(tvb, tvb_sectionbegin, sectionlen),

                                           pinfo, mgcp_tree, mi);

      }

    }

    /* Set the mgcp payload length correctly so we don't include any

       encapsulated SDP */

    sectionlen = tvb_sectionend;

    proto_item_set_len(ti, sectionlen);

    /* Display the raw text of the mgcp message if desired */

    /* Do we want to display the raw text of our MGCP packet? */

    if (global_mgcp_raw_text)

    {

      mgcp_raw_text_add(tvb, mgcp_tree);

    }

    /* Dissect sdp payload */

    if (tvb_sectionend < tvb_len)

    {

      setup_info.is_osmux = mi->is_osmux;

      next_tvb = tvb_new_subset_remaining(tvb, tvb_sectionend);

      call_dissector_with_data(sdp_handle, next_tvb, pinfo, tree, &content_info);

    }

  }

}

/*

 * Add the raw text of the message to the dissect tree if appropriate

 * preferences are specified.

 */

static void mgcp_raw_text_add(tvbuff_t *tvb, proto_tree *tree)

{

  int tvb_linebegin, tvb_lineend, linelen;

  tvb_linebegin = 0;

  do

  {

    tvb_find_line_end(tvb, tvb_linebegin, -1, &tvb_lineend, false);

    linelen = tvb_lineend - tvb_linebegin;

    proto_tree_add_format_text(tree, tvb, tvb_linebegin, linelen);

    tvb_linebegin = tvb_lineend;

  } while (tvb_offset_exists(tvb, tvb_lineend));

}

/*

 * is_mgcp_verb - A function for determining whether there is a

 *                MGCP verb at offset in tvb

 *

 * Parameter:

 * tvb - The tvbuff in which we are looking for an MGCP verb

 * offset - The offset in tvb at which we are looking for a MGCP verb

 * maxlength - The maximum distance from offset we may look for the

 *             characters that make up a MGCP verb.

 * verb_name - The name for the verb code found (output)

 *

 * Return: true if there is an MGCP verb at offset in tvb, otherwise false

 */

static bool is_mgcp_verb(tvbuff_t *tvb, int offset, int maxlength, const char **verb_name)

{

  bool returnvalue = false;

  char word[5];

  /* This function is used for checking if a packet is actually an

     mgcp packet. Make sure that we do not throw an exception

     during such a check. If we did throw an exception, we could

     not refuse the packet and give other dissectors the chance to

     look at it. */

  if (tvb_captured_length_remaining(tvb, offset) < (int)sizeof(word))

    return false;

  /* Read the string into 'word' and see if it looks like the start of a verb */

  if ((maxlength >= 4) && tvb_get_raw_bytes_as_string(tvb, offset, word, sizeof word))

  {

    if (((g_ascii_strncasecmp(word, "EPCF", 4) == 0) && (*verb_name = "EndpointConfiguration")) ||

        ((g_ascii_strncasecmp(word, "CRCX", 4) == 0) && (*verb_name = "CreateConnection")) ||

        ((g_ascii_strncasecmp(word, "MDCX", 4) == 0) && (*verb_name = "ModifyConnection")) ||

        ((g_ascii_strncasecmp(word, "DLCX", 4) == 0) && (*verb_name = "DeleteConnection")) ||

        ((g_ascii_strncasecmp(word, "RQNT", 4) == 0) && (*verb_name = "NotificationRequest")) ||

        ((g_ascii_strncasecmp(word, "NTFY", 4) == 0) && (*verb_name = "Notify")) ||

        ((g_ascii_strncasecmp(word, "AUEP", 4) == 0) && (*verb_name = "AuditEndpoint")) ||

        ((g_ascii_strncasecmp(word, "AUCX", 4) == 0) && (*verb_name = "AuditConnection")) ||

        ((g_ascii_strncasecmp(word, "RSIP", 4) == 0) && (*verb_name = "RestartInProgress")) ||

        ((g_ascii_strncasecmp(word, "MESG", 4) == 0) && (*verb_name = "Message")) ||

        (word[0] == 'X' && g_ascii_isalpha(word[1]) && g_ascii_isalpha(word[2]) &&

                           g_ascii_isalpha(word[3]) && (*verb_name = "*Experimental*")))

    {

      returnvalue = true;

    }

  }

  /* May be whitespace after verb code - anything else is an error.. */

  if (returnvalue && maxlength >= 5)

  {

    char next = tvb_get_uint8(tvb, 4);

    if ((next != ' ') && (next != '\t'))

    {

      returnvalue = false;

    }

  }

  return returnvalue;

}

/*

 * is_mgcp_rspcode - A function for determining whether something which

 *                   looks roughly like a MGCP response code (3-digit number)

 *                   is at 'offset' in tvb

 *

 * Parameters:

 * tvb - The tvbuff in which we are looking for an MGCP response code

 * offset - The offset in tvb at which we are looking for a MGCP response code

 * maxlength - The maximum distance from offset we may look for the

 *             characters that make up a MGCP response code.

 *

 * Return: true if there is an MGCP response code at offset in tvb,

 *         otherwise false

 */

static bool is_mgcp_rspcode(tvbuff_t *tvb, int offset, int maxlength)

{

  bool returnvalue = false;

  char word[4];

  /* see the comment in is_mgcp_verb() */

  if (tvb_captured_length_remaining(tvb, offset) < (int)sizeof(word))

    return false;

  /* Do 1st 3 characters look like digits? */

  if (maxlength >= 3)

  {

    tvb_get_raw_bytes_as_string(tvb, offset, word, sizeof word);

    if (g_ascii_isdigit(word[0]) && g_ascii_isdigit(word[1]) && g_ascii_isdigit(word[2]))

    {

      returnvalue = true;

    }

  }

  /* Maybe some white space after the 3rd digit - anything else is an error */

  if (returnvalue && maxlength >= 4)

  {

    char next = tvb_get_uint8(tvb, 3);

    if ((next != ' ') && (next != '\t'))

    {

      returnvalue = false;

    }

  }

  return returnvalue;

}

/*

 * tvb_parse_param - Parse the MGCP param into a type and a value.

 *

 * Parameters:

 * tvb - The tvbuff containing the MGCP param we are to parse.

 * offset - The offset in tvb at which we will begin looking for a

 *          MGCP parameter to parse.

 * len - The maximum distance from offset in tvb that we can look for

 *       an MGCP parameter to parse.

 * hf - The place to write a pointer to the integer representing the

 *      header field associated with the MGCP parameter parsed.

 *

 * Returns: The offset in tvb where the value of the MGCP parameter

 *          begins.

 */

static int tvb_parse_param(tvbuff_t* tvb, packet_info* pinfo, int offset, int len, int** hf, mgcp_info_t* mi)

{

  int returnvalue = -1, tvb_current_offset, ext_off;

  uint8_t tempchar, plus_minus;

  char **buf;

  tvb_current_offset = offset;

  *hf = NULL;

  buf = NULL;

  if (len > 0)

  {

    tempchar = (uint8_t)g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset));

    switch (tempchar)

    {

      case 'K':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_rspack;

        break;

      case 'B':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_bearerinfo;

        break;

      case 'C':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_callid;

        break;

      case 'I':

        tvb_current_offset++;

        if (len > (tvb_current_offset - offset) &&

           (tempchar = tvb_get_uint8(tvb, tvb_current_offset)) == ':')

        {

          *hf = &hf_mgcp_param_connectionid;

          tvb_current_offset--;

        }

        else

          if (tempchar == '2')

        {

          *hf = &hf_mgcp_param_secondconnectionid;

        }

        break;

      case 'N':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_notifiedentity;

        break;

      case 'X':

        /* Move past 'X' */

        tvb_current_offset++;

        /* X: is RequestIdentifier */

        if (len > (tvb_current_offset - offset) &&

           (tempchar = tvb_get_uint8(tvb, tvb_current_offset)) == ':')

        {

          *hf = &hf_mgcp_param_requestid;

          tvb_current_offset--;

        }

        /* XRM/MCR */

        else

        if (len > (tvb_current_offset - offset) &&

           ((uint8_t)g_ascii_toupper(tvb_get_uint8(tvb,tvb_current_offset))) == 'R')

        {

          /* Move past 'R' */

          tvb_current_offset += 3;

          if (len > (tvb_current_offset - offset) &&

            ((uint8_t)g_ascii_toupper(tvb_get_uint8(tvb,tvb_current_offset))) == 'R')

          {

            *hf = &hf_mgcp_param_remotevoicemetrics;

          }

          else

          if (len > (tvb_current_offset - offset) &&

             ((uint8_t)g_ascii_toupper(tvb_get_uint8(tvb,tvb_current_offset))) == 'L')

          {

            *hf = &hf_mgcp_param_localvoicemetrics;

          }

          tvb_current_offset -= 4;

        }

        /* X+...: or X-....: are vendor extension parameters */

        else

        if (len > (tvb_current_offset - offset) &&

            ((plus_minus = tvb_get_uint8(tvb, tvb_current_offset)) == '-' ||

             (plus_minus == '+')))

        {

          /* Move past + or - */

          tvb_current_offset++;

          /* Keep going, through possible vendor param name */

          /* We have a mempbrk; perhaps an equivalent of strspn

           * for tvbs would be useful.

           */

          for (ext_off = 0; len > (ext_off + tvb_current_offset-offset); ext_off++) {

            tempchar = tvb_get_uint8(tvb, tvb_current_offset + ext_off);

            if (!g_ascii_isalpha(tempchar) && !g_ascii_isdigit(tempchar)) break;

          }

          if (tempchar == ':')

          {

            /* Looks like a valid vendor param name */

            ws_debug("MGCP Extension: %s", tvb_get_string_enc(pinfo->pool, tvb, tvb_current_offset, ext_off, ENC_ASCII));

            switch (plus_minus)

            {

              case '+':

                *hf = &hf_mgcp_param_extension_critical;

                break;

              case '-':

                if (tvb_strncaseeql(tvb, tvb_current_offset, "OSMUX", ext_off) == 0) {

                  *hf = &hf_mgcp_param_x_osmux;

                } else {

                  *hf = &hf_mgcp_param_extension;

                }

                break;

            }

            /* -1: Final generic path below expects us to point to char before the ':'. */

            tvb_current_offset += ext_off - 1;

          }

        }

        break;

      case 'L':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_localconnoptions;

        break;

      case 'M':

        tvb_current_offset++;

        if (len > (tvb_current_offset - offset) &&

           (tempchar = (uint8_t)g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset))) == ':')

        {

          *hf = &hf_mgcp_param_connectionmode;

          tvb_current_offset--;

        }

        else

        if (tempchar == 'D')

        {

          *hf = &hf_mgcp_param_maxmgcpdatagram;

        }

        break;

      case 'R':

        tvb_current_offset++;

        if (len > (tvb_current_offset - offset) &&

            (tempchar = (uint8_t)g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset))) == ':')

        {

          *hf = &hf_mgcp_param_reqevents;

          tvb_current_offset--;

        }

        else

        if ( tempchar == 'M')

        {

          *hf = &hf_mgcp_param_restartmethod;

        }

        else

        if (tempchar == 'D')

        {

          *hf = &hf_mgcp_param_restartdelay;

        }

        break;

      case 'S':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_signalreq;

        buf = &(mi->signalReq);

        break;

      case 'D':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          if (len > (tvb_current_offset + 5 - offset) &&

            (g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset + 1) == 'Q')) &&

            (                tvb_get_uint8(tvb, tvb_current_offset + 2) == '-' ) &&

            (g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset + 3) == 'R')) &&

            (g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset + 4) == 'I')) &&

            (                tvb_get_uint8(tvb, tvb_current_offset + 5) == ':' )

          ) {

            tvb_current_offset+=4;

            *hf = &hf_mgcp_param_resourceid;

            break;

          }

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_digitmap;

        mi->hasDigitMap = true;

        break;

      case 'O':

        if (tvb_get_uint8(tvb, tvb_current_offset+1) != ':')

        {

          *hf = &hf_mgcp_param_invalid;

          break;

        }

        *hf = &hf_mgcp_param_observedevent;

        buf = &(mi->observedEvents);

        break;

      case 'P':

        tvb_current_offset++;

        if (len > (tvb_current_offset - offset) &&

            (tempchar = (uint8_t)g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset))) == ':')

        {

          *hf = &hf_mgcp_param_connectionparam;

          tvb_current_offset--;

        }

        else

        if ( tempchar == 'L')

        {

          *hf = &hf_mgcp_param_packagelist;

        }

        break;

      case 'E':

        tvb_current_offset++;

        if (len > (tvb_current_offset - offset) &&

            (tempchar = (uint8_t)g_ascii_toupper(tvb_get_uint8(tvb, tvb_current_offset))) == ':')

        {

          *hf = &hf_mgcp_param_reasoncode;

          tvb_current_offset--;

        }

        else

        if ( tempchar == 'S')

        {

          *hf = &hf_mgcp_param_eventstates;