/* packet-rtmpt.c

 * Routines for Real Time Messaging Protocol packet dissection

 * metatech <metatech@flashmail.com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*  This dissector is called RTMPT to avoid a conflict with

*   the other RTMP protocol (Routing Table Maintenance Protocol) implemented in packet-atalk.c

*   (RTMPT normally stands for RTMP-Tunnel via http)

*

*   RTMP in a nutshell

*

*   The protocol has very few "magic words" to facilitate detection,

*   but rather has "magic lengths".

*   This protocol has plenty of special cases and few general rules,

*   especially regarding the lengths and the structures.

*

*   Documentation:

*      RTMP protocol description on Wiki of Red5 Open Source Flash Server at

*

*          http://trac.red5.org/wiki/Codecs/RTMPSpecification

*

*      and the pages to which it links:

*

*          http://osflash.org/documentation/rtmp

*          http://wiki.gnashdev.org/RTMP

*          http://wiki.gnashdev.org/RTMP_Messages_Decoded

*          http://www.acmewebworks.com/Downloads/openCS/TheAMF.pdf

*          https://rtmp.veriskope.com/pdf/rtmp_specification_1.0.pdf

*

*   It's also available from Adobe at

*

*          https://www.adobe.com/devnet/rtmp.html

*

*   For AMF, see:

*

*          http://download.macromedia.com/pub/labs/amf/amf0_spec_121207.pdf

*

*   for AMF0 and

*

*          http://amf3cplusplus.googlecode.com/svn-history/r4/trunk/doc/amf3_spec_05_05_08.pdf

*

*   for AMF3.

*

*   For FLV, see:

*

*          https://rtmp.veriskope.com/pdf/video_file_format_spec_v10.pdf

*

*   For Enhanced RTMP, see:

*

*          https://veovera.org/docs/enhanced/enhanced-rtmp-v2.pdf

*

*   Default TCP port is 1935

*/

#include "config.h"

#define WS_LOG_DOMAIN "RTMPT"

#include <epan/packet.h>

#include <wsutil/pint.h>

#include <epan/prefs.h>

#include <epan/to_str.h>

#include <epan/expert.h>

#include "packet-tcp.h"

#define MAX_AMF_ITERATIONS 1000

void proto_register_rtmpt(void);

void proto_reg_handoff_rtmpt(void);

void proto_register_amf(void);

static int proto_rtmpt;

static int hf_rtmpt_handshake_c0;

static int hf_rtmpt_handshake_s0;

static int hf_rtmpt_handshake_c1;

static int hf_rtmpt_handshake_s1;

static int hf_rtmpt_handshake_c2;

static int hf_rtmpt_handshake_s2;

static int hf_rtmpt_header_format;

static int hf_rtmpt_header_csid;

static int hf_rtmpt_header_timestamp;

static int hf_rtmpt_header_timestamp_delta;

static int hf_rtmpt_header_body_size;

static int hf_rtmpt_header_typeid;

static int hf_rtmpt_header_streamid;

static int hf_rtmpt_header_ets;

static int hf_rtmpt_scm_chunksize;

static int hf_rtmpt_scm_csid;

static int hf_rtmpt_scm_seq;

static int hf_rtmpt_scm_was;

static int hf_rtmpt_scm_limittype;

static int hf_rtmpt_ucm_eventtype;

static int hf_rtmpt_function_call;

static int hf_rtmpt_function_response;

static int hf_rtmpt_audio_control;

static int hf_rtmpt_audio_multitrack_control;

static int hf_rtmpt_audio_is_ex_header;

static int hf_rtmpt_audio_format;

static int hf_rtmpt_audio_rate;

static int hf_rtmpt_audio_size;

static int hf_rtmpt_audio_type;

static int hf_rtmpt_audio_packet_type;

static int hf_rtmpt_audio_multitrack_type;

static int hf_rtmpt_audio_multitrack_packet_type;

static int hf_rtmpt_audio_fourcc;

static int hf_rtmpt_audio_track_id;

static int hf_rtmpt_audio_track_length;

static int hf_rtmpt_audio_data;

static int hf_rtmpt_video_control;

static int hf_rtmpt_video_multitrack_control;

static int hf_rtmpt_video_is_ex_header;

static int hf_rtmpt_video_type;

static int hf_rtmpt_video_command;

static int hf_rtmpt_video_format;

static int hf_rtmpt_video_packet_type;

static int hf_rtmpt_video_multitrack_type;

static int hf_rtmpt_video_multitrack_packet_type;

static int hf_rtmpt_video_fourcc;

static int hf_rtmpt_video_track_id;

static int hf_rtmpt_video_track_length;

static int hf_rtmpt_video_data;

static int hf_rtmpt_tag_type;

static int hf_rtmpt_tag_datasize;

static int hf_rtmpt_tag_timestamp;

static int hf_rtmpt_tag_ets;

static int hf_rtmpt_tag_streamid;

static int hf_rtmpt_tag_tagsize;

static expert_field ei_amf_loop;

static int ett_rtmpt;

static int ett_rtmpt_handshake;

static int ett_rtmpt_header;

static int ett_rtmpt_body;

static int ett_rtmpt_ucm;

static int ett_rtmpt_audio_control;

static int ett_rtmpt_video_control;

static int ett_rtmpt_audio_multitrack_control;

static int ett_rtmpt_audio_multitrack_track;

static int ett_rtmpt_video_multitrack_control;

static int ett_rtmpt_video_multitrack_track;

static int ett_rtmpt_tag;

static int ett_rtmpt_tag_data;

static dissector_handle_t amf_handle;

static dissector_handle_t rtmpt_tcp_handle;

static dissector_handle_t rtmpt_http_handle;

static bool rtmpt_desegment = true;

/* Native Bandwidth Detection (using the checkBandwidth(), onBWCheck(),

 * onBWDone() calls) transmits a series of increasing size packets over

 * the course of 2 seconds. On a fast link the largest packet can just

 * exceed 256KB, but setting the limit there can cause massive memory

 * usage, especially with fuzzed packets where the length value is bogus.

 * Limit the initial allocation size and realloc if needed, i.e., in

 * future frames if the bytes are actually there.

 * This initial max allocation size can be reduced further if need be,

 * but keep it at least 18 so that the headers fit without checking,

 * See https://gitlab.com/wireshark/wireshark/-/issues/6898

 */

#define RTMPT_INIT_ALLOC_SIZE 32768

#define RTMP_PORT                     1935 /* Not IANA registered */

#define RTMPT_MAGIC                   0x03

#define RTMPT_HANDSHAKE_OFFSET_1         1

#define RTMPT_HANDSHAKE_OFFSET_2      1538

#define RTMPT_HANDSHAKE_OFFSET_3      3074

#define RTMPT_HANDSHAKE_LENGTH_1      1537

#define RTMPT_HANDSHAKE_LENGTH_2      3073

#define RTMPT_HANDSHAKE_LENGTH_3      1536

#define RTMPT_INITIAL_CHUNK_SIZE       128

static unsigned rtmpt_default_chunk_size = 128;

#define RTMPT_ID_MAX                     65599

#define RTMPT_TYPE_HANDSHAKE_1        0x100001

#define RTMPT_TYPE_HANDSHAKE_2        0x100002

#define RTMPT_TYPE_HANDSHAKE_3        0x100003

#define RTMPT_TYPE_CHUNK_SIZE         0x01

#define RTMPT_TYPE_ABORT_MESSAGE      0x02

#define RTMPT_TYPE_ACKNOWLEDGEMENT    0x03

#define RTMPT_TYPE_UCM                0x04

#define RTMPT_TYPE_WINDOW             0x05

#define RTMPT_TYPE_PEER_BANDWIDTH     0x06

#define RTMPT_TYPE_AUDIO_DATA         0x08

#define RTMPT_TYPE_VIDEO_DATA         0x09

#define RTMPT_TYPE_DATA_AMF3          0x0F

#define RTMPT_TYPE_SHARED_AMF3        0x10

#define RTMPT_TYPE_COMMAND_AMF3       0x11

#define RTMPT_TYPE_DATA_AMF0          0x12

#define RTMPT_TYPE_SHARED_AMF0        0x13

#define RTMPT_TYPE_COMMAND_AMF0       0x14

#define RTMPT_TYPE_AGGREGATE          0x16

#define RTMPT_UCM_STREAM_BEGIN        0x00

#define RTMPT_UCM_STREAM_EOF          0x01

#define RTMPT_UCM_STREAM_DRY          0x02

#define RTMPT_UCM_SET_BUFFER          0x03

#define RTMPT_UCM_STREAM_ISRECORDED   0x04

#define RTMPT_UCM_PING_REQUEST        0x06

#define RTMPT_UCM_PING_RESPONSE       0x07

#define RTMPT_IS_EX_AUDIO_HEADER      0x90

#define RTMPT_IS_EX_VIDEO_HEADER      0x80

#define RTMPT_IS_PACKET_TYPE_METADATA 0x04

#define RTMPT_IS_FRAME_TYPE_COMMAND   0x05

#define RTMPT_IS_AUDIO_MULTITRACK     0x05

#define RTMPT_IS_VIDEO_MULTITRACK     0x06

#define RTMPT_IS_ONETRACK             0x00

#define RTMPT_IS_MANYTRACKSMANYCODECS 0x02

#define RTMPT_TEXT_RTMP_HEADER        "RTMP Header"

#define RTMPT_TEXT_RTMP_BODY          "RTMP Body"

static const value_string rtmpt_handshake_vals[] = {

        { RTMPT_TYPE_HANDSHAKE_1,           "Handshake C0+C1" },

        { RTMPT_TYPE_HANDSHAKE_2,           "Handshake S0+S1+S2" },

        { RTMPT_TYPE_HANDSHAKE_3,           "Handshake C2" },

        { 0, NULL }

};

static const value_string rtmpt_opcode_vals[] = {

        { RTMPT_TYPE_CHUNK_SIZE,            "Set Chunk Size" },

        { RTMPT_TYPE_ABORT_MESSAGE,         "Abort Message" },

        { RTMPT_TYPE_ACKNOWLEDGEMENT,       "Acknowledgement" },

        { RTMPT_TYPE_UCM,                   "User Control Message" },

        { RTMPT_TYPE_WINDOW,                "Window Acknowledgement Size" },

        { RTMPT_TYPE_PEER_BANDWIDTH,        "Set Peer Bandwidth" },

        { RTMPT_TYPE_AUDIO_DATA,            "Audio Data" },

        { RTMPT_TYPE_VIDEO_DATA,            "Video Data" },

        { RTMPT_TYPE_DATA_AMF3,             "AMF3 Data" },

        { RTMPT_TYPE_SHARED_AMF3,           "AMF3 Shared Object" },

        { RTMPT_TYPE_COMMAND_AMF3,          "AMF3 Command" },

        { RTMPT_TYPE_DATA_AMF0,             "AMF0 Data" },

        { RTMPT_TYPE_SHARED_AMF0,           "AMF0 Shared Object" },

        { RTMPT_TYPE_COMMAND_AMF0,          "AMF0 Command" },

        { RTMPT_TYPE_AGGREGATE,             "Aggregate" },

        { 0, NULL }

};

static const value_string rtmpt_limit_vals[] = {

/* These are a complete guess, from the order of the documented

 * options - the values aren't actually specified */

        { 0,                                "Hard" },

        { 1,                                "Soft" },

        { 2,                                "Dynamic" },

        { 0, NULL }

};

static const value_string rtmpt_ucm_vals[] = {

        { RTMPT_UCM_STREAM_BEGIN,           "Stream Begin" },

        { RTMPT_UCM_STREAM_EOF,             "Stream EOF" },

        { RTMPT_UCM_STREAM_DRY,             "Stream Dry" },

        { RTMPT_UCM_SET_BUFFER,             "Set Buffer Length" },

        { RTMPT_UCM_STREAM_ISRECORDED,      "Stream Is Recorded" },

        { RTMPT_UCM_PING_REQUEST,           "Ping Request" },

        { RTMPT_UCM_PING_RESPONSE,          "Ping Response" },

        { 0, NULL }

};

static const value_string rtmpt_tag_vals[] = {

        { RTMPT_TYPE_AUDIO_DATA,            "Audio Tag" },

        { RTMPT_TYPE_VIDEO_DATA,            "Video Tag" },

        { RTMPT_TYPE_DATA_AMF0,             "Script Tag" },

        { 0, NULL }

};

/* [Spec] https://github.com/runner365/read_book/blob/master/rtmp/rtmp_specification_1.0.pdf       */

/* [DevG] http://help.adobe.com/en_US/flashmediaserver/devguide/index.html "working with Live Video" => Adding metadata to a live stream */

/* [SWF] https://github.com/blackears/raven/blob/master/proj/SWFParser/doc/swf_file_format_spec_v10.pdf */

static const value_string rtmpt_audio_codecs[] = {

        {  0,                               "Uncompressed" },             /* [DevG] */

        {  1,                               "ADPCM" },                    /* [DevG] */

        {  2,                               "MP3" },                      /* [DevG] */

        {  3,                               "Uncompressed, little-endian"}, /* [SWF] */

        {  4,                               "Nellymoser 16kHz" },          /* [SWF] */

        {  5,                               "Nellymoser 8kHz" },          /* [DevG] [SWF]*/

        {  6,                               "Nellymoser" },               /* [DevG] [SWF]*/

        {  7,                               "G711A" },                    /* [Spec] */

        {  8,                               "G711U" },                    /* [Spec] */

        {  9,                               "Nellymoser 16kHz" },         /* [Spec] */

        { 10,                               "HE-AAC" },                   /* [DevG] */

        { 11,                               "SPEEX" },                    /* [DevG] */

        { 0, NULL }

};

static const value_string rtmpt_audio_packet_types[] = {

        { 0,                                "PacketTypeSequenceStart" },

        { 1,                                "PacketTypeCodedFrames" },

        { 4,                                "PacketTypeMultichannelConfig" },

        { 5,                                "PacketTypeMultitrack" },

        { 0, NULL }

};

static const value_string rtmpt_av_multitrack_types[] = {

        { 0,                                "AvMultitrackTypeOneTrack" },

        { 1,                                "AvMultitrackTypeManyTracks" },

        { 2,                                "AvMultitrackTypeManyTracksManyCodecs" },

        { 0, NULL }

};

static const value_string rtmpt_audio_rates[] = {

        { 0,                                "5.5 kHz" },

        { 1,                                "11 kHz" },

        { 2,                                "22 kHz" },

        { 3,                                "44 kHz" },

        { 0, NULL }

};

static const value_string rtmpt_audio_sizes[] = {

        { 0,                                "8 bit" },

        { 1,                                "16 bit" },

        { 0, NULL }

};

static const value_string rtmpt_audio_types[] = {

        { 0,                                "mono" },

        { 1,                                "stereo" },

        { 0, NULL }

};

/* from FLV v10.1 section E.4.3.1 */

static const value_string rtmpt_video_types[] = {

        { 1,                                "keyframe" },

        { 2,                                "inter-frame" },

        { 3,                                "disposable inter-frame" },

        { 4,                                "generated key frame" },

        { 5,                                "video info/command frame" },

        { 0, NULL }

};

/* From Enhanced RTMP */

static const value_string rtmpt_video_commands[] = {

        { 0,                                "StartSeek" },

        { 1,                                "EndSeek" },

        { 0, NULL }

};

/* from FLV v10.1 section E.4.3.1 */

static const value_string rtmpt_video_codecs[] = {

        {  2,                               "Sorensen H.263" },

        {  3,                               "Screen video" },

        {  4,                               "On2 VP6" },

        {  5,                               "On2 VP6+alpha" },

        {  6,                               "Screen video version 2" },

        {  7,                               "H.264" },

        { 12,                               "H.265" },

        { 0, NULL }

};

/*

 * https://raw.githubusercontent.com/veovera/enhanced-rtmp/main/enhanced-rtmp.pdf

 */

static const value_string rtmpt_video_packet_types[] = {

        { 0,                                "PacketTypeSequenceStart" },

        { 1,                                "PacketTypeCodedFrames" },

        { 2,                                "PacketTypeSequenceEnd" },

        { 3,                                "PacketTypeCodedFramesX" },

        { 4,                                "PacketTypeMetadata" },

        { 5,                                "PacketTypeMPEG2TSSequenceStart" },

        { 6,                                "PacketTypeMultitrack" },

        { 0, NULL }

};

static int proto_amf;

static int hf_amf_version;

static int hf_amf_header_count;

static int hf_amf_header_name;

static int hf_amf_header_must_understand;

static int hf_amf_header_length;

/* static int hf_amf_header_value_type; */

static int hf_amf_message_count;

static int hf_amf_message_target_uri;

static int hf_amf_message_response_uri;

static int hf_amf_message_length;

static int hf_amf_amf0_type;

static int hf_amf_amf3_type;

static int hf_amf_number;

static int hf_amf_integer;

static int hf_amf_boolean;

static int hf_amf_stringlength;

static int hf_amf_string;

static int hf_amf_string_reference;

static int hf_amf_object_reference;

static int hf_amf_date;

/* static int hf_amf_longstringlength; */

static int hf_amf_longstring;

static int hf_amf_xml_doc;

static int hf_amf_xmllength;

static int hf_amf_xml;

static int hf_amf_int64;

static int hf_amf_bytearraylength;

static int hf_amf_bytearray;

static int hf_amf_object;

static int hf_amf_traitcount;

static int hf_amf_classnamelength;

static int hf_amf_classname;

static int hf_amf_membernamelength;

static int hf_amf_membername;

static int hf_amf_trait_reference;

static int hf_amf_ecmaarray;

static int hf_amf_strictarray;

static int hf_amf_array;

static int hf_amf_arraylength;

static int hf_amf_arraydenselength;

static int hf_amf_end_of_object_marker;

static int hf_amf_end_of_associative_part;

static int hf_amf_end_of_dynamic_members;

static int ett_amf;

static int ett_amf_headers;

static int ett_amf_messages;

static int ett_amf_value;

static int ett_amf_property;

static int ett_amf_string;

static int ett_amf_array_element;

static int ett_amf_traits;

static int ett_amf_trait_member;

/* AMF0 type markers */

#define AMF0_NUMBER              0x00

#define AMF0_BOOLEAN             0x01

#define AMF0_STRING              0x02

#define AMF0_OBJECT              0x03

#define AMF0_MOVIECLIP           0x04

#define AMF0_NULL                0x05

#define AMF0_UNDEFINED           0x06

#define AMF0_REFERENCE           0x07

#define AMF0_ECMA_ARRAY          0x08

#define AMF0_END_OF_OBJECT       0x09

#define AMF0_STRICT_ARRAY        0x0A

#define AMF0_DATE                0x0B

#define AMF0_LONG_STRING         0x0C

#define AMF0_UNSUPPORTED         0x0D

#define AMF0_RECORDSET           0x0E

#define AMF0_XML                 0x0F

#define AMF0_TYPED_OBJECT        0x10

#define AMF0_AMF3_MARKER         0x11

#define AMF0_INT64               0x22

/* AMF3 type markers */

#define AMF3_UNDEFINED           0x00

#define AMF3_NULL                0x01

#define AMF3_FALSE               0x02

#define AMF3_TRUE                0x03

#define AMF3_INTEGER             0x04

#define AMF3_DOUBLE              0x05

#define AMF3_STRING              0x06

#define AMF3_XML_DOC             0x07

#define AMF3_DATE                0x08

#define AMF3_ARRAY               0x09

#define AMF3_OBJECT              0x0A

#define AMF3_XML                 0x0B

#define AMF3_BYTEARRAY           0x0C

static const value_string amf0_type_vals[] = {

        { AMF0_NUMBER,                "Number" },

        { AMF0_BOOLEAN,               "Boolean" },

        { AMF0_STRING,                "String" },

        { AMF0_OBJECT,                "Object" },

        { AMF0_MOVIECLIP,             "Movie clip" },

        { AMF0_NULL,                  "Null" },

        { AMF0_UNDEFINED,             "Undefined" },

        { AMF0_REFERENCE,             "Reference" },

        { AMF0_ECMA_ARRAY,            "ECMA array" },

        { AMF0_END_OF_OBJECT,         "End of object" },

        { AMF0_STRICT_ARRAY,          "Strict array" },

        { AMF0_DATE,                  "Date" },

        { AMF0_LONG_STRING,           "Long string" },

        { AMF0_UNSUPPORTED,           "Unsupported" },

        { AMF0_RECORDSET,             "Record set" },

        { AMF0_XML,                   "XML" },

        { AMF0_TYPED_OBJECT,          "Typed object" },

        { AMF0_AMF3_MARKER,           "Switch to AMF3" },

        { AMF0_INT64,                 "Int64" },

        { 0, NULL }

};

static const value_string amf3_type_vals[] = {

        { AMF3_UNDEFINED,             "Undefined" },

        { AMF3_NULL,                  "Null" },

        { AMF3_FALSE,                 "False" },

        { AMF3_TRUE,                  "True" },

        { AMF3_INTEGER,               "Integer" },

        { AMF3_DOUBLE,                "Double" },

        { AMF3_STRING,                "String" },

        { AMF3_XML_DOC,               "XML document" },

        { AMF3_DATE,                  "Date" },

        { AMF3_ARRAY,                 "Array" },

        { AMF3_OBJECT,                "Object" },

        { AMF3_XML,                   "XML" },

        { AMF3_BYTEARRAY,             "ByteArray" },

        { 0, NULL }

};

/* Holds the reassembled data for a packet during un-chunking

 */

/* XXX: Because we don't use the TCP dissector's built-in desegmentation,

 * or the standard reassembly API, we don't get FT_FRAMENUM links for

 * chunk fragments, and we don't mark depended upon frames for export.

 * Ideally we'd use the standard API (mark pinfo->desegment_offset and

 * pinfo->desegment_len for TCP, or use the reassembly API), or call

 * mark_frame_as_depended_upon and add the FT_FRAMENUM fields ourselves.

 * To do the latter, we should have a data structure indicating which

 * frames contributed to the packet.

 */

typedef struct rtmpt_packet {

        uint32_t         seq;

        uint32_t         lastseq;

        int              resident;

        union {

                uint8_t *p;

                uint32_t offset;

        } data;

        wmem_list_t *frames;

        /* used during unchunking */

        int              alloc;

        int              want;

        int              have;

        int              chunkwant;

        int              chunkhave;

        uint8_t          bhlen;

        uint8_t          mhlen;

        /* Chunk Basic Header */

        uint8_t          fmt;   /* byte 0 */

        uint32_t         id;    /* byte 0 */

        /* Chunk Message Header (offsets assume bhlen == 1) */

        uint32_t         ts;    /* bytes 1-3, or from ETS @ mhlen-4 if -1 */

        uint32_t         len;   /* bytes 4-6 */

        uint8_t          cmd;   /* byte 7 */

        uint32_t         src;   /* bytes 8-11 */

        uint32_t         txid;

        int              isresponse;

        int              otherframe;

} rtmpt_packet_t;

/* Represents a header or a chunk that is split over two TCP

 * segments

 */

typedef struct rtmpt_frag {

        int     ishdr;

        uint32_t seq;

        uint32_t lastseq;

        int     have;

        int     len;

        union {

                uint8_t d[18]; /* enough for a complete header (3 + 11 + 4) */

                uint32_t id;

        } saved;

} rtmpt_frag_t;

/* The full message header information for the last packet on a particular

 * ID - used for defaulting short headers

 */

typedef struct rtmpt_id {

        uint32_t ts;   /* bytes 1-3 */

        uint32_t tsd;

        uint32_t len;  /* bytes 4-6 */

        uint32_t src;  /* bytes 8-11 */

        uint8_t cmd;  /* byte 7 */

        wmem_tree_t *packets;

} rtmpt_id_t;

/* Historical view of a whole TCP connection

 */

typedef struct rtmpt_conv {

        wmem_tree_t *seqs[2];

        wmem_tree_t *frags[2];

        wmem_tree_t *ids[2];

        wmem_tree_t *packets[2];

        wmem_tree_t *chunksize[2];

        wmem_tree_t *txids[2];

} rtmpt_conv_t;

static void

rtmpt_packet_mark_depended(void *data, void *user_data)

{

    frame_data *fd = (frame_data *)user_data;

    uint32_t frame_num = GPOINTER_TO_UINT(data);

    mark_frame_as_depended_upon(fd, frame_num);

}

/* Header length helpers */

static int rtmpt_basic_header_length(int id)

{

        switch (id & 0x3f) {

        case 0: return 2;

        case 1: return 3;

        default: return 1;

        }

}

static int rtmpt_message_header_length(int id)

{

        switch ((id>>6) & 3) {

        case 0: return 11;

        case 1: return 7;

        case 2: return 3;

        default: return 0;

        }

}

/* Lightweight access to AMF0 blobs - more complete dissection is done

 * in dissect_rtmpt_body_command */

static uint32_t

rtmpt_get_amf_length(tvbuff_t *tvb, int offset, proto_item* pi)

{

        uint8_t iObjType;

        int     remain  = tvb_reported_length_remaining(tvb, offset);

        uint32_t depth   = 0;

        uint32_t itemlen = 0;

        uint32_t rv      = 0;

        unsigned   iterations = MAX_AMF_ITERATIONS;

        while (rv == 0 || depth > 0) {

                if (--iterations == 0) {

                        expert_add_info(NULL, pi, &ei_amf_loop);

                        return 0;

                }

                if (depth > 0) {

                        if (remain-rv < 2)

                                return remain;

                        itemlen = tvb_get_ntohs(tvb, offset+rv) + 2;

                        if (remain-rv<itemlen+1)

                                return remain;

                        rv += itemlen;

                }

                if (remain-rv < 1)

                        return remain;

                iObjType = tvb_get_uint8(tvb, offset+rv);

                if (depth > 0 && itemlen == 2 && iObjType == AMF0_END_OF_OBJECT) {

                        rv++;

                        depth--;

                        continue;

                }

                switch (iObjType) {

                case AMF0_NUMBER:

                        itemlen = 9;

                        break;

                case AMF0_BOOLEAN:

                        itemlen = 2;

                        break;

                case AMF0_STRING:

                        if (remain-rv < 3)

                                return remain;

                        itemlen = tvb_get_ntohs(tvb, offset+rv+1) + 3;

                        break;

                case AMF0_NULL:

                case AMF0_UNDEFINED:

                case AMF0_UNSUPPORTED:

                        itemlen = 1;

                        break;

                case AMF0_DATE:

                        itemlen = 11;

                        break;

                case AMF0_LONG_STRING:

                case AMF0_XML:

                        if (remain-rv < 5)

                                return remain;

                        itemlen = tvb_get_ntohl(tvb, offset+rv+1) + 5;

                        break;

                case AMF0_INT64:

                        itemlen = 9;

                        break;

                case AMF0_OBJECT:

                        itemlen = 1;

                        depth++;

                        break;

                case AMF0_ECMA_ARRAY:

                        itemlen = 5;

                        depth++;

                        break;

                default:

                        return remain;

                }

                if (remain-rv < itemlen)

                        return remain;

                rv += itemlen;

        }

        return rv;

}

static char *

rtmpt_get_amf_param(wmem_allocator_t* allocator, tvbuff_t *tvb, int offset, proto_item* pi, int param, const char *prop)

{

        uint32_t remain = tvb_reported_length_remaining(tvb, offset);

        uint32_t itemlen;

        uint32_t iStringLength;

        while (remain > 0 && param > 0) {

                itemlen = rtmpt_get_amf_length(tvb, offset, pi);

                if (itemlen == 0)

                        break;

                offset += itemlen;

                remain -= itemlen;

                param--;

        }

        if (remain > 0 && param == 0) {

                uint8_t iObjType = tvb_get_uint8(tvb, offset);

                if (!prop && iObjType == AMF0_STRING && remain >= 3) {

                        iStringLength = tvb_get_ntohs(tvb, offset+1);

                        if (remain >= iStringLength+3) {

                                return (char*)tvb_get_string_enc(allocator, tvb, offset+3, iStringLength, ENC_ASCII);

                        }

                }

                if (prop && iObjType == AMF0_OBJECT) {

                        offset++;

                        remain--;

                        while (remain > 2) {

                                uint32_t iPropLength = tvb_get_ntohs(tvb, offset);

                                if (remain < 2+iPropLength+3)

                                        break;

                                if (tvb_strneql(tvb, offset+2, prop, strlen(prop)) == 0) {

                                        if (tvb_get_uint8(tvb, offset+2+iPropLength) != AMF0_STRING)

                                                break;

                                        iStringLength = tvb_get_ntohs(tvb, offset+2+iPropLength+1);

                                        if (remain < 2+iPropLength+3+iStringLength)

                                                break;

                                        return (char*)tvb_get_string_enc(allocator, tvb, offset+2+iPropLength+3, iStringLength, ENC_ASCII);

                                }

                                itemlen = rtmpt_get_amf_length(tvb, offset+2+iPropLength, pi);

                                if (itemlen == 0)

                                        break;

                                offset += 2+iPropLength+itemlen;

                                remain -= 2+iPropLength+itemlen;

                        }

                }

        }

        return NULL;

}

static uint32_t

rtmpt_get_amf_txid(tvbuff_t *tvb, int offset, proto_item* pi)

{

        uint32_t remain = tvb_reported_length_remaining(tvb, offset);

        if (remain > 0) {

                uint32_t itemlen = rtmpt_get_amf_length(tvb, offset, pi);

                if (itemlen == 0 || remain < itemlen)

                        return 0;

                offset += itemlen;

                remain -= itemlen;

        }

        if (remain >= 9) {

                uint8_t iObjType = tvb_get_uint8(tvb, offset);

                if (iObjType == AMF0_NUMBER) {

                        return (uint32_t)tvb_get_ntohieee_double(tvb, offset+1);

                }

        }

        return 0;

}

/* Generate a useful description for various packet types */

static char *

rtmpt_get_packet_desc(wmem_allocator_t* allocator, tvbuff_t *tvb, uint32_t offset, proto_item* pi, uint32_t remain, rtmpt_conv_t *rconv, int cdir,

        rtmpt_packet_t *tp, bool *deschasopcode)

{

        if (tp->cmd == RTMPT_TYPE_CHUNK_SIZE || tp->cmd == RTMPT_TYPE_ABORT_MESSAGE ||

            tp->cmd == RTMPT_TYPE_ACKNOWLEDGEMENT || tp->cmd == RTMPT_TYPE_WINDOW) {

                if (tp->len >= 4 && remain >= 4) {

                        *deschasopcode = true;

                        return wmem_strdup_printf(allocator, "%s %d",

                                                val_to_str(allocator, tp->cmd, rtmpt_opcode_vals, "Unknown (0x%01x)"),

                                                tvb_get_ntohl(tvb, offset));

                }

        } else if (tp->cmd == RTMPT_TYPE_PEER_BANDWIDTH) {

                if (tp->len >= 5 && remain >= 5) {

                        *deschasopcode = true;

                        return wmem_strdup_printf(allocator, "%s %d,%s",

                                                val_to_str(allocator, tp->cmd, rtmpt_opcode_vals, "Unknown (0x%01x)"),

                                                tvb_get_ntohl(tvb, offset),

                                                val_to_str(allocator, tvb_get_uint8(tvb, offset+4), rtmpt_limit_vals, "Unknown (%d)"));

                }

        } else if (tp->cmd == RTMPT_TYPE_UCM) {

                uint16_t iUCM = -1;

                const char *sFunc;

                const char *sParam = "";

                if (tp->len < 2 || remain < 2)

                        return NULL;

                iUCM = tvb_get_ntohs(tvb, offset);

                sFunc = try_val_to_str(iUCM, rtmpt_ucm_vals);

                if (sFunc == NULL) {

                        *deschasopcode = true;

                        sFunc = wmem_strdup_printf(allocator, "User Control Message 0x%01x", iUCM);

                }

                if (iUCM == RTMPT_UCM_STREAM_BEGIN || iUCM == RTMPT_UCM_STREAM_EOF ||

                    iUCM == RTMPT_UCM_STREAM_DRY || iUCM == RTMPT_UCM_STREAM_ISRECORDED) {

                        if (tp->len >= 6 && remain >= 6) {

                                sParam = wmem_strdup_printf(allocator, " %d", tvb_get_ntohl(tvb, offset+2));

                        }

                } else if (iUCM == RTMPT_UCM_SET_BUFFER) {

                        if (tp->len >= 10 && remain >= 10) {

                                sParam = wmem_strdup_printf(allocator, " %d,%dms",

                                                          tvb_get_ntohl(tvb, offset+2),

                                                          tvb_get_ntohl(tvb, offset+6));

                        }

                }

                return wmem_strdup_printf(allocator, "%s%s", sFunc, sParam);

        } else if (tp->cmd == RTMPT_TYPE_COMMAND_AMF0 || tp->cmd == RTMPT_TYPE_COMMAND_AMF3 ||

                   tp->cmd == RTMPT_TYPE_DATA_AMF0 || tp->cmd == RTMPT_TYPE_DATA_AMF3) {

                uint32_t slen = 0;

                uint32_t soff = 0;

                char *sFunc = NULL;

                char *sParam = NULL;

                if (tp->cmd == RTMPT_TYPE_COMMAND_AMF3 || tp->cmd == RTMPT_TYPE_DATA_AMF3) {

                        soff = 1;

                }

                if (tp->len >= 3+soff && remain >= 3+soff) {

                        slen = tvb_get_ntohs(tvb, offset+1+soff);

                }

                if (slen > 0) {

                        sFunc = (char*)tvb_get_string_enc(allocator, tvb, offset+3+soff, slen, ENC_ASCII);

                        ws_debug("got function call '%s'", sFunc);

                        if (strcmp(sFunc, "connect") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 2, "app");

                        } else if (strcmp(sFunc, "play") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, NULL);

                        } else if (strcmp(sFunc, "play2") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, "streamName");

                        } else if (strcmp(sFunc, "releaseStream") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, NULL);

                        } else if (strcmp(sFunc, "FCPublish") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, NULL);

                        } else if (strcmp(sFunc, "publish") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, NULL);

                        } else if (strcmp(sFunc, "onStatus") == 0) {

                                if (tp->cmd == RTMPT_TYPE_COMMAND_AMF0 || tp->cmd == RTMPT_TYPE_COMMAND_AMF3) {

                                        sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, "code");

                                } else {

                                        sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 1, "code");

                                }

                        } else if (strcmp(sFunc, "onPlayStatus") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 1, "code");

                        } else if (strcmp(sFunc, "_result") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, "code");

                                tp->isresponse = true;

                        } else if (strcmp(sFunc, "_error") == 0) {

                                sParam = rtmpt_get_amf_param(allocator, tvb, offset+soff, pi, 3, "code");

                                tp->isresponse = true;

                        }

                        if (tp->txid != 0 && tp->otherframe == 0) {

                                tp->otherframe = GPOINTER_TO_INT(wmem_tree_lookup32(rconv->txids[cdir^1], tp->txid));

                                if (tp->otherframe) {

                                        ws_debug("got otherframe=%d", tp->otherframe);

                                }

                        }

                }

                if (sFunc) {

                        if (sParam) {

                                return wmem_strdup_printf(allocator, "%s('%s')", sFunc, sParam);

                        } else {

                                return wmem_strdup_printf(allocator, "%s()", sFunc);

                        }

                }

        }

        return NULL;

}

/* Tree dissection helpers for various packet body forms */

static void

dissect_rtmpt_body_scm(tvbuff_t *tvb, int offset, proto_tree *rtmpt_tree, unsigned scm)

{

        switch (scm) {

        case RTMPT_TYPE_CHUNK_SIZE:

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_scm_chunksize, tvb, offset, 4, ENC_BIG_ENDIAN);

                break;

        case RTMPT_TYPE_ABORT_MESSAGE:

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_scm_csid, tvb, offset, 4, ENC_BIG_ENDIAN);

                break;

        case RTMPT_TYPE_ACKNOWLEDGEMENT:

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_scm_seq, tvb, offset, 4, ENC_BIG_ENDIAN);

                break;

        case RTMPT_TYPE_UCM:

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_ucm_eventtype, tvb, offset, 2, ENC_BIG_ENDIAN);

                break;

        case RTMPT_TYPE_WINDOW:

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_scm_was, tvb, offset, 4, ENC_BIG_ENDIAN);

                break;

        case RTMPT_TYPE_PEER_BANDWIDTH:

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_scm_was, tvb, offset, 4, ENC_BIG_ENDIAN);

                proto_tree_add_item(rtmpt_tree, hf_rtmpt_scm_limittype, tvb, offset+4, 1, ENC_BIG_ENDIAN);

                break;

        }

}

static int

dissect_amf0_value_type(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, bool *amf3_encoding, proto_item *parent_ti);

/*

 * A "property list" is a sequence of name/value pairs, terminated by

 * and "end of object" indicator.  AMF0 "object"s and "ECMA array"s

 * are encoded as property lists.

 */

static int

// NOLINTNEXTLINE(misc-no-recursion)

dissect_amf0_property_list(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, unsigned *countp, bool *amf3_encoding)

{

        proto_item *prop_ti;

        proto_tree *prop_tree;

        proto_tree *name_tree;

        unsigned    iStringLength;

        char       *iStringValue;

        unsigned    count = 0;

        /*

         * XXX - at least as I read "3.1 AVM+ Type Marker" in the AMF0

         * specification, the AVM+ Type Marker only affects "the following

         * Object".  For now, we have a single "AMF3 encoding" flag, and

         * set it when we see the type marker, and never clear it.

         */

        for (;;) {

                /* UTF-8: property name */

                iStringLength = tvb_get_ntohs(tvb, offset);

                if (iStringLength == 0 &&

                    tvb_get_uint8(tvb, offset + 2) == AMF0_END_OF_OBJECT)

                        break;

                count++;

                iStringValue = (char*)tvb_get_string_enc(pinfo->pool, tvb, offset + 2, iStringLength, ENC_ASCII);

                prop_tree = proto_tree_add_subtree_format(tree, tvb, offset, -1,

                                              ett_amf_property, &prop_ti, "Property '%s'",

                                              iStringValue);

                name_tree = proto_tree_add_subtree_format(prop_tree, tvb,

                                              offset, 2+iStringLength,

                                              ett_amf_string, NULL, "Name: %s", iStringValue);

                proto_tree_add_uint(name_tree, hf_amf_stringlength, tvb, offset, 2, iStringLength);

                offset += 2;

                proto_tree_add_item(name_tree, hf_amf_string, tvb, offset, iStringLength, ENC_UTF_8);

                offset += iStringLength;

                /* value-type: property value */

                offset = dissect_amf0_value_type(tvb, pinfo, offset, prop_tree, amf3_encoding, prop_ti);

                proto_item_set_end(prop_ti, tvb, offset);

        }

        proto_tree_add_item(tree, hf_amf_end_of_object_marker, tvb, offset, 3, ENC_NA);

        offset += 3;

        *countp = count;

        return offset;

}

static int

// NOLINTNEXTLINE(misc-no-recursion)

dissect_amf0_value_type(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree, bool *amf3_encoding, proto_item *parent_ti)

{

        uint8_t     iObjType;

        proto_item *ti;

        proto_tree *val_tree;

        int         iValueOffset = offset;

        uint32_t    iIntegerValue;

        double      iDoubleValue;

        bool        iBooleanValue;

        unsigned    iStringLength;

        char       *iStringValue;

        unsigned    iArrayLength;

        unsigned    i;

        nstime_t    t;