/*

 * packet-iax2.c

 *

 * Routines for IAX2 packet disassembly

 * By Alastair Maw <asterisk@almaw.com>

 * Copyright 2003 Alastair Maw

 *

 * IAX2 is a VoIP protocol for the open source PBX Asterisk. Please see

 * http://www.asterisk.org for more information; see RFC 5456 for the

 * protocol.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/conversation.h>

#include <epan/reassemble.h>

#include <epan/expert.h>

#include <epan/aftypes.h>

#include <epan/tap.h>

#include <epan/proto_data.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wsutil/str_util.h>

#include "packet-iax2.h"

void proto_register_iax2(void);

void proto_reg_handoff_iax2(void);

#define IAX2_PORT               4569

#define PROTO_TAG_IAX2          "IAX2"

/* enough to hold any address in an address_t */

#define MAX_ADDRESS 16

/* the maximum number of transfers (of each end) we can deal with per call,

 * plus one */

#define IAX_MAX_TRANSFERS 2

/* #define DEBUG_HASHING */

/* #define DEBUG_DESEGMENT */

/* Wireshark ID of the IAX2 protocol */

static int proto_iax2;

/* tap register id */

static int iax2_tap;

/* protocol tap info */

static iax2_info_t ii_arr[1];

static iax2_info_t *iax2_info = ii_arr;

/* The following hf_* variables are used to hold the wireshark IDs of

 * our header fields; they are filled out when we call

 * proto_register_field_array() in proto_register_iax2()

 */

static int hf_iax2_packet_type;

static int hf_iax2_retransmission;

static int hf_iax2_callno;

static int hf_iax2_scallno;

static int hf_iax2_dcallno;

static int hf_iax2_ts;

static int hf_iax2_minits;

static int hf_iax2_minividts;

static int hf_iax2_absts;

static int hf_iax2_lateness;

static int hf_iax2_minividmarker;

static int hf_iax2_oseqno;

static int hf_iax2_iseqno;

static int hf_iax2_type;

static int hf_iax2_csub;

static int hf_iax2_dtmf_csub;

static int hf_iax2_cmd_csub;

static int hf_iax2_iax_csub;

static int hf_iax2_voice_csub;

static int hf_iax2_voice_codec;

static int hf_iax2_video_csub;

static int hf_iax2_video_codec;

static int hf_iax2_marker;

static int hf_iax2_modem_csub;

static int hf_iax2_text_csub;

static int hf_iax2_text_text;

static int hf_iax2_html_csub;

static int hf_iax2_html_url;

static int hf_iax2_trunk_metacmd;

static int hf_iax2_trunk_cmddata;

static int hf_iax2_trunk_cmddata_ts;

static int hf_iax2_trunk_ts;

static int hf_iax2_trunk_ncalls;

static int hf_iax2_trunk_call_len;

static int hf_iax2_trunk_call_scallno;

static int hf_iax2_trunk_call_ts;

static int hf_iax2_trunk_call_data;

static int hf_iax2_ie_id;

static int hf_iax2_length;

static int hf_iax2_version;

static int hf_iax2_cap_g723_1;

static int hf_iax2_cap_gsm;

static int hf_iax2_cap_ulaw;

static int hf_iax2_cap_alaw;

static int hf_iax2_cap_g726_aal2;

static int hf_iax2_cap_adpcm;

static int hf_iax2_cap_slinear;

static int hf_iax2_cap_lpc10;

static int hf_iax2_cap_g729a;

static int hf_iax2_cap_speex;

static int hf_iax2_cap_ilbc;

static int hf_iax2_cap_g726;

static int hf_iax2_cap_g722;

static int hf_iax2_cap_siren7;

static int hf_iax2_cap_siren14;

static int hf_iax2_cap_slinear16;

static int hf_iax2_cap_jpeg;

static int hf_iax2_cap_png;

static int hf_iax2_cap_h261;

static int hf_iax2_cap_h263;

static int hf_iax2_cap_h263_plus;

static int hf_iax2_cap_h264;

static int hf_iax2_cap_mpeg4;

static int hf_iax2_cap_vp8;

static int hf_iax2_cap_t140_red;

static int hf_iax2_cap_t140;

static int hf_iax2_cap_g719;

static int hf_iax2_cap_speex16;

static int hf_iax2_cap_opus;

static int hf_iax2_cap_testlaw;

static int * const hf_iax2_caps[] = {

  &hf_iax2_cap_g723_1,

  &hf_iax2_cap_gsm,

  &hf_iax2_cap_ulaw,

  &hf_iax2_cap_alaw,

  &hf_iax2_cap_g726_aal2,

  &hf_iax2_cap_adpcm,

  &hf_iax2_cap_slinear,

  &hf_iax2_cap_lpc10,

  &hf_iax2_cap_g729a,

  &hf_iax2_cap_speex,

  &hf_iax2_cap_ilbc,

  &hf_iax2_cap_g726,

  &hf_iax2_cap_g722,

  &hf_iax2_cap_siren7,

  &hf_iax2_cap_siren14,

  &hf_iax2_cap_slinear16,

  &hf_iax2_cap_jpeg,

  &hf_iax2_cap_png,

  &hf_iax2_cap_h261,

  &hf_iax2_cap_h263,

  &hf_iax2_cap_h263_plus,

  &hf_iax2_cap_h264,

  &hf_iax2_cap_mpeg4,

  &hf_iax2_cap_vp8,

  &hf_iax2_cap_t140_red,

  &hf_iax2_cap_t140,

  &hf_iax2_cap_g719,

  &hf_iax2_cap_speex16,

  &hf_iax2_cap_opus,

  &hf_iax2_cap_testlaw,

  NULL

};

static int hf_iax2_fragment_unfinished;

static int hf_iax2_payload_data;

static int hf_iax2_fragments;

static int hf_iax2_fragment;

static int hf_iax2_fragment_overlap;

static int hf_iax2_fragment_overlap_conflict;

static int hf_iax2_fragment_multiple_tails;

static int hf_iax2_fragment_too_long_fragment;

static int hf_iax2_fragment_error;

static int hf_iax2_fragment_count;

static int hf_iax2_reassembled_in;

static int hf_iax2_reassembled_length;

/* hf_iax2_ies is an array of header fields, one per potential Information

 * Element. It's done this way (rather than having separate variables for each

 * IE) to make the dissection of information elements clearer and more

 * orthogonal.

 *

 * To add the ability to dissect a new information element, just add an

 * appropriate entry to hf[] in proto_register_iax2(); dissect_ies() will then

 * pick it up automatically.

 */

#define NUM_HF_IAX2_IES 256

static int hf_iax2_ies[NUM_HF_IAX2_IES];

static int hf_iax2_ie_datetime;

static int hf_IAX_IE_APPARENTADDR_SINFAMILY;

static int hf_IAX_IE_APPARENTADDR_SINPORT;

static int hf_IAX_IE_APPARENTADDR_SINADDR;

static int hf_IAX_IE_UNKNOWN_BYTE;

static int hf_IAX_IE_UNKNOWN_I16;

static int hf_IAX_IE_UNKNOWN_I32;

static int hf_IAX_IE_UNKNOWN_BYTES;

/* These are the ids of the subtrees that we may be creating */

static int ett_iax2;

static int ett_iax2_full_mini_subtree;

static int ett_iax2_type;              /* Frame-type specific subtree */

static int ett_iax2_ie;                /* single IE */

static int ett_iax2_codecs;            /* capabilities IE */

static int ett_iax2_ies_apparent_addr; /* apparent address IE */

static int ett_iax2_fragment;

static int ett_iax2_fragments;

static int ett_iax2_trunk_cmddata;

static int ett_iax2_trunk_call;

static expert_field ei_iax_too_many_transfers;

static expert_field ei_iax_circuit_id_conflict;

static expert_field ei_iax_peer_address_unsupported;

static expert_field ei_iax_invalid_len;

static dissector_handle_t iax2_handle;

static const fragment_items iax2_fragment_items = {

  &ett_iax2_fragment,

  &ett_iax2_fragments,

  &hf_iax2_fragments,

  &hf_iax2_fragment,

  &hf_iax2_fragment_overlap,

  &hf_iax2_fragment_overlap_conflict,

  &hf_iax2_fragment_multiple_tails,

  &hf_iax2_fragment_too_long_fragment,

  &hf_iax2_fragment_error,

  &hf_iax2_fragment_count,

  &hf_iax2_reassembled_in,

  &hf_iax2_reassembled_length,

  /* Reassembled data field */

  NULL,

  "iax2 fragments"

};

/* data-call subdissectors, AST_DATAFORMAT_* */

static dissector_table_t iax2_dataformat_dissector_table;

/* voice/video call subdissectors, AST_FORMAT_* */

static dissector_table_t iax2_codec_dissector_table;

/* IAX2 Meta trunk packet Command data flags */

#define IAX2_TRUNK_TS 1

/* IAX2 Full-frame types */

static const value_string iax_frame_types[] = {

  {0,                    "(0?)"},

  {AST_FRAME_DTMF_END,   "DTMF End"},

  {AST_FRAME_VOICE,      "Voice"},

  {AST_FRAME_VIDEO,      "Video"},

  {AST_FRAME_CONTROL,    "Control"},

  {AST_FRAME_NULL,       "NULL"},

  {AST_FRAME_IAX,        "IAX"},

  {AST_FRAME_TEXT,       "Text"},

  {AST_FRAME_IMAGE,      "Image"},

  {AST_FRAME_HTML,       "HTML"},

  {AST_FRAME_CNG,        "Comfort Noise"},

  {AST_FRAME_MODEM,      "Modem"},

  {AST_FRAME_DTMF_BEGIN, "DTMF Begin"},

  {0, NULL}

};

static value_string_ext iax_frame_types_ext = VALUE_STRING_EXT_INIT(iax_frame_types);

/* Subclasses for IAX packets */

static const value_string iax_iax_subclasses[] = {

  { 0, "(0?)"},

  { 1, "NEW"},

  { 2, "PING"},

  { 3, "PONG"},

  { 4, "ACK"},

  { 5, "HANGUP"},

  { 6, "REJECT"},

  { 7, "ACCEPT"},

  { 8, "AUTHREQ"},

  { 9, "AUTHREP"},

  {10, "INVAL"},

  {11, "LAGRQ"},

  {12, "LAGRP"},

  {13, "REGREQ"},

  {14, "REGAUTH"},

  {15, "REGACK"},

  {16, "REGREJ"},

  {17, "REGREL"},

  {18, "VNAK"},

  {19, "DPREQ"},

  {20, "DPREP"},

  {21, "DIAL"},

  {22, "TXREQ"},

  {23, "TXCNT"},

  {24, "TXACC"},

  {25, "TXREADY"},

  {26, "TXREL"},

  {27, "TXREJ"},

  {28, "QUELCH"},

  {29, "UNQULCH"},

  {30, "POKE"},

  {31, "PAGE"},

  {32, "MWI"},

  {33, "UNSUPPORTED"},

  {34, "TRANSFER"},

  {35, "PROVISION"},

  {36, "FWDOWNL"},

  {37, "FWDATA"},

  {38, "TXMEDIA"},

  {39, "RTKEY"},

  {40, "CALLTOKEN"},

  {0, NULL}

};

static value_string_ext iax_iax_subclasses_ext = VALUE_STRING_EXT_INIT(iax_iax_subclasses);

/* Subclasses for Control packets */

static const value_string iax_cmd_subclasses[] = {

  {0, "(0?)"},

  {1, "HANGUP"},

  {2, "RING"},

  {3, "RINGING"},

  {4, "ANSWER"},

  {5, "BUSY"},

  {6, "TKOFFHK"},

  {7, "OFFHOOK"},

  {0xFF, "stop sounds"}, /* sent by app_dial, and not much else */

  {0, NULL}

};

static value_string_ext iax_cmd_subclasses_ext = VALUE_STRING_EXT_INIT(iax_cmd_subclasses);

/* IAX2 to tap-voip call state mapping for command frames */

static const voip_call_state tap_cmd_voip_state[] = {

  VOIP_NO_STATE,

  VOIP_COMPLETED, /*HANGUP*/

  VOIP_RINGING,   /*RING*/

  VOIP_RINGING,   /*RINGING*/

  VOIP_IN_CALL,   /*ANSWER*/

  VOIP_REJECTED,  /*BUSY*/

  VOIP_UNKNOWN,   /*TKOFFHK*/

  VOIP_UNKNOWN    /*OFFHOOK*/

};

#define NUM_TAP_CMD_VOIP_STATES array_length(tap_cmd_voip_state)

/* IAX2 to tap-voip call state mapping for IAX frames */

static const voip_call_state tap_iax_voip_state[] = {

  VOIP_NO_STATE,

  VOIP_CALL_SETUP, /*NEW*/

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_COMPLETED,  /*HANGUP*/

  VOIP_REJECTED,   /*REJECT*/

  VOIP_RINGING,    /*ACCEPT*/

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_CALL_SETUP, /*DIAL*/

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE,

  VOIP_NO_STATE

};

#define NUM_TAP_IAX_VOIP_STATES array_length(tap_iax_voip_state)

/* Subclasses for Modem packets */

static const value_string iax_modem_subclasses[] = {

  {0, "(0?)"},

  {1, "T.38"},

  {2, "V.150"},

  {0, NULL}

};

/* Subclasses for Text packets */

static const value_string iax_text_subclasses[] = {

  {0, "Text"},

  {0, NULL}

};

/* Subclasses for HTML packets */

static const value_string iax_html_subclasses[] = {

  {0x01, "Sending a URL"},

  {0x02, "Data frame"},

  {0x04, "Beginning frame"},

  {0x08, "End frame"},

  {0x10, "Load is complete"},

  {0x11, "Peer does not support HTML"},

  {0x12, "Link URL"},

  {0x13, "Unlink URL"},

  {0x14, "Reject Link URL"},

  {0, NULL}

};

/* Information elements */

static const value_string iax_ies_type[] = {

  {IAX_IE_CALLED_NUMBER,   "Number/extension being called"},

  {IAX_IE_CALLING_NUMBER,  "Calling number"},

  {IAX_IE_CALLING_ANI,     "Calling number ANI for billing"},

  {IAX_IE_CALLING_NAME,    "Name of caller"},

  {IAX_IE_CALLED_CONTEXT,  "Context for number"},

  {IAX_IE_USERNAME,        "Username (peer or user) for authentication"},

  {IAX_IE_PASSWORD,        "Password for authentication"},

  {IAX_IE_CAPABILITY,      "Actual codec capability"},

  {IAX_IE_FORMAT,          "Desired codec format"},

  {IAX_IE_LANGUAGE,        "Desired language"},

  {IAX_IE_VERSION,         "Protocol version"},

  {IAX_IE_ADSICPE,         "CPE ADSI capability"},

  {IAX_IE_DNID,            "Originally dialed DNID"},

  {IAX_IE_AUTHMETHODS,     "Authentication method(s)"},

  {IAX_IE_CHALLENGE,       "Challenge data for MD5/RSA"},

  {IAX_IE_MD5_RESULT,      "MD5 challenge result"},

  {IAX_IE_RSA_RESULT,      "RSA challenge result"},

  {IAX_IE_APPARENT_ADDR,   "Apparent address of peer"},

  {IAX_IE_REFRESH,         "When to refresh registration"},

  {IAX_IE_DPSTATUS,        "Dialplan status"},

  {IAX_IE_CALLNO,          "Call number of peer"},

  {IAX_IE_CAUSE,           "Cause"},

  {IAX_IE_IAX_UNKNOWN,     "Unknown IAX command"},

  {IAX_IE_MSGCOUNT,        "How many messages waiting"},

  {IAX_IE_AUTOANSWER,      "Request auto-answering"},

  {IAX_IE_MUSICONHOLD,     "Request musiconhold with QUELCH"},

  {IAX_IE_TRANSFERID,      "Transfer Request Identifier"},

  {IAX_IE_RDNIS,           "Referring DNIS"},

  {IAX_IE_PROVISIONING,    "Provisioning info"},

  {IAX_IE_AESPROVISIONING, "AES Provisioning info"},

  {IAX_IE_DATETIME,        "Date/Time"},

  {IAX_IE_DEVICETYPE,      "Device type"},

  {IAX_IE_SERVICEIDENT,    "Service Identifier"},

  {IAX_IE_FIRMWAREVER,     "Firmware revision"},

  {IAX_IE_FWBLOCKDESC,     "Firmware block description"},

  {IAX_IE_FWBLOCKDATA,     "Firmware block of data"},

  {IAX_IE_PROVVER,         "Provisioning version"},

  {IAX_IE_CALLINGPRES,     "Calling presentation"},

  {IAX_IE_CALLINGTON,      "Calling type of number"},

  {IAX_IE_CALLINGTNS,      "Calling transit network select"},

  {IAX_IE_SAMPLINGRATE,    "Supported sampling rates"},

  {IAX_IE_CAUSECODE,       "Hangup cause"},

  {IAX_IE_ENCRYPTION,      "Encryption format"},

  {IAX_IE_ENCKEY,          "Raw encryption key"},

  {IAX_IE_CODEC_PREFS,     "Codec preferences"},

  {IAX_IE_RR_JITTER,       "Received jitter"},

  {IAX_IE_RR_LOSS,         "Received loss"},

  {IAX_IE_RR_PKTS,         "Received frames"},

  {IAX_IE_RR_DELAY,        "Max playout delay in ms for received frames"},

  {IAX_IE_RR_DROPPED,      "Dropped frames"},

  {IAX_IE_RR_OOO,          "Frames received out of order"},

  {IAX_IE_VARIABLE,        "IAX2 variable"},

  {IAX_IE_OSPTOKEN,        "OSP Token"},

  {IAX_IE_CALLTOKEN,       "Call Token"},

  {IAX_IE_CAPABILITY2,     "64-bit codec capability"},

  {IAX_IE_FORMAT2,         "64-bit codec format"},

  {IAX_IE_DATAFORMAT,      "Data call format"},

  {0, NULL}

};

static value_string_ext iax_ies_type_ext = VALUE_STRING_EXT_INIT(iax_ies_type);

#define CODEC_MASK(codec) ((codec) == (uint32_t)-1 ? 0 : (UINT64_C(1) << (codec)))

static const val64_string codec_types[] = {

  {CODEC_MASK(AST_FORMAT_G723_1),    "G.723.1 compression"},

  {CODEC_MASK(AST_FORMAT_GSM),       "GSM compression"},

  {CODEC_MASK(AST_FORMAT_ULAW),      "Raw mu-law data (G.711)"},

  {CODEC_MASK(AST_FORMAT_ALAW),      "Raw A-law data (G.711)"},

  {CODEC_MASK(AST_FORMAT_G726_AAL2), "ADPCM (G.726), 32kbps, AAL2 codeword packing)"},

  {CODEC_MASK(AST_FORMAT_ADPCM),     "ADPCM (IMA)"},

  {CODEC_MASK(AST_FORMAT_SLINEAR),   "Raw 16-bit Signed Linear (8000 Hz) PCM"},

  {CODEC_MASK(AST_FORMAT_LPC10),     "LPC10, 180 samples/frame"},

  {CODEC_MASK(AST_FORMAT_G729A),     "G.729a Audio"},

  {CODEC_MASK(AST_FORMAT_SPEEX),     "SpeeX Free Compression"},

  {CODEC_MASK(AST_FORMAT_ILBC),      "iLBC Free Compression"},

  {CODEC_MASK(AST_FORMAT_G726),      "ADPCM (G.726, 32kbps, RFC3551 codeword packing)"},

  {CODEC_MASK(AST_FORMAT_G722),      "G.722"},

  {CODEC_MASK(AST_FORMAT_SIREN7),    "G.722.1 (also known as Siren7, 32kbps assumed)"},

  {CODEC_MASK(AST_FORMAT_SIREN14),   "G.722.1 Annex C (also known as Siren14, 48kbps assumed)"},

  {CODEC_MASK(AST_FORMAT_SLINEAR16), "Raw 16-bit Signed Linear (16000 Hz) PCM"},

  {CODEC_MASK(AST_FORMAT_JPEG),      "JPEG Images"},

  {CODEC_MASK(AST_FORMAT_PNG),       "PNG Images"},

  {CODEC_MASK(AST_FORMAT_H261),      "H.261 Video"},

  {CODEC_MASK(AST_FORMAT_H263),      "H.263 Video"},

  {CODEC_MASK(AST_FORMAT_H263_PLUS), "H.263+ Video"},

  {CODEC_MASK(AST_FORMAT_H264),      "H.264 Video"},

  {CODEC_MASK(AST_FORMAT_MP4_VIDEO), "MPEG4 Video"},

  {CODEC_MASK(AST_FORMAT_VP8),       "VP8 Video"},

  {CODEC_MASK(AST_FORMAT_T140_RED),  "T.140 RED Text format RFC 4103"},

  {CODEC_MASK(AST_FORMAT_T140),      "T.140 Text format - ITU T.140, RFC 4103"},

  {CODEC_MASK(AST_FORMAT_G719),      "G.719 (64 kbps assumed)"},

  {CODEC_MASK(AST_FORMAT_SPEEX16),   "SpeeX Wideband (16kHz) Free Compression"},

  {CODEC_MASK(AST_FORMAT_OPUS),      "Opus audio (8kHz, 16kHz, 24kHz, 48Khz)"},

  {CODEC_MASK(AST_FORMAT_TESTLAW),   "Raw testing-law data (G.711)"},

  {0, NULL}

};

static val64_string_ext codec_types_ext = VAL64_STRING_EXT_INIT(codec_types);

static const value_string iax_dataformats[] = {

  {AST_DATAFORMAT_NULL,      "N/A (analogue call?)"},

  {AST_DATAFORMAT_V110,      "ITU-T V.110 rate adaption"},

  {AST_DATAFORMAT_H223_H245, "ITU-T H.223/H.245"},

  {0, NULL}

};

static const value_string iax_packet_types[] = {

  {IAX2_FULL_PACKET,       "Full packet"},

  {IAX2_MINI_VOICE_PACKET, "Mini voice packet"},

  {IAX2_MINI_VIDEO_PACKET, "Mini video packet"},

  {IAX2_TRUNK_PACKET,      "Trunk packet"},

  {0, NULL}

};

static const value_string iax_causecodes[] = {

  {AST_CAUSE_UNALLOCATED,                   "Unallocated"},

  {AST_CAUSE_NO_ROUTE_TRANSIT_NET,          "No route transit net"},

  {AST_CAUSE_NO_ROUTE_DESTINATION,          "No route to destination"},

  {AST_CAUSE_MISDIALLED_TRUNK_PREFIX,       "Misdialled trunk prefix"},

  {AST_CAUSE_CHANNEL_UNACCEPTABLE,          "Channel unacceptable"},

  {AST_CAUSE_CALL_AWARDED_DELIVERED,        "Call awarded delivered"},

  {AST_CAUSE_PRE_EMPTED,                    "Preempted"},

  {AST_CAUSE_NUMBER_PORTED_NOT_HERE,        "Number ported not here"},

  {AST_CAUSE_NORMAL_CLEARING,               "Normal clearing"},

  {AST_CAUSE_USER_BUSY,                     "User busy"},

  {AST_CAUSE_NO_USER_RESPONSE,              "No user response"},

  {AST_CAUSE_NO_ANSWER,                     "No answer"},

  {AST_CAUSE_SUBSCRIBER_ABSENT,             "Subscriber absent"},

  {AST_CAUSE_CALL_REJECTED,                 "Call rejected"},

  {AST_CAUSE_NUMBER_CHANGED,                "Number changed"},

  {AST_CAUSE_REDIRECTED_TO_NEW_DESTINATION, "Redirected to new destination"},

  {AST_CAUSE_ANSWERED_ELSEWHERE,            "Answered elsewhere"},

  {AST_CAUSE_DESTINATION_OUT_OF_ORDER,      "Destination out of order"},

  {AST_CAUSE_INVALID_NUMBER_FORMAT,         "Invalid number format"},

  {AST_CAUSE_FACILITY_REJECTED,             "Facility rejected"},

  {AST_CAUSE_RESPONSE_TO_STATUS_ENQUIRY,    "Response to status inquiry"},

  {AST_CAUSE_NORMAL_UNSPECIFIED,            "Normal unspecified"},

  {AST_CAUSE_NORMAL_CIRCUIT_CONGESTION,     "Normal circuit congestion"},

  {AST_CAUSE_NETWORK_OUT_OF_ORDER,          "Network out of order"},

  {AST_CAUSE_NORMAL_TEMPORARY_FAILURE,      "Normal temporary failure"},

  {AST_CAUSE_SWITCH_CONGESTION,             "Switch congestion"},

  {AST_CAUSE_ACCESS_INFO_DISCARDED,         "Access info discarded"},

  {AST_CAUSE_REQUESTED_CHAN_UNAVAIL,        "Requested channel unavailable"},

  {AST_CAUSE_FACILITY_NOT_SUBSCRIBED,       "Facility not subscribed"},

  {AST_CAUSE_OUTGOING_CALL_BARRED,          "Outgoing call barred"},

  {AST_CAUSE_INCOMING_CALL_BARRED,          "Incoming call barred"},

  {AST_CAUSE_BEARERCAPABILITY_NOTAUTH,      "Bearer capability not authorized"},

  {AST_CAUSE_BEARERCAPABILITY_NOTAVAIL,     "Bearer capability not available"},

  {AST_CAUSE_BEARERCAPABILITY_NOTIMPL,      "Bearer capability not implemented"},

  {AST_CAUSE_CHAN_NOT_IMPLEMENTED,          "Channel not implemented"},

  {AST_CAUSE_FACILITY_NOT_IMPLEMENTED,      "Facility not implemented"},

  {AST_CAUSE_INVALID_CALL_REFERENCE,        "Invalid call reference"},

  {AST_CAUSE_INCOMPATIBLE_DESTINATION,      "Incompatible destination"},

  {AST_CAUSE_INVALID_MSG_UNSPECIFIED,       "Invalid message unspecified"},

  {AST_CAUSE_MANDATORY_IE_MISSING,          "Mandatory IE missing"},

  {AST_CAUSE_MESSAGE_TYPE_NONEXIST,         "Message type nonexistent"},

  {AST_CAUSE_WRONG_MESSAGE,                 "Wrong message"},

  {AST_CAUSE_IE_NONEXIST,                   "IE nonexistent"},

  {AST_CAUSE_INVALID_IE_CONTENTS,           "Invalid IE contents"},

  {AST_CAUSE_WRONG_CALL_STATE,              "Wrong call state"},

  {AST_CAUSE_RECOVERY_ON_TIMER_EXPIRE,      "Recovery on timer expire"},

  {AST_CAUSE_MANDATORY_IE_LENGTH_ERROR,     "Mandatory IE length error"},

  {AST_CAUSE_PROTOCOL_ERROR,                "Protocol error"},

  {AST_CAUSE_INTERWORKING,                  "Interworking"},

  {0, NULL}

};

static value_string_ext iax_causecodes_ext = VALUE_STRING_EXT_INIT(iax_causecodes);

/* ************************************************************************* */

/* In order to track IAX calls, we have a hash table which maps

 * {addr,port type,port,call} to a unique circuit id.

 *

 * Each call has two such circuits associated with it (a forward and a

 * reverse circuit, where 'forward' is defined as the direction the NEW

 * packet went in), and we maintain an iax_call_data structure for each

 * call, attached to both circuits with circuit_add_proto_data.

 *

 * Because {addr,port type,port,call} quadruplets can be reused

 * (Asterisk reuses call numbers), circuit ids aren't unique to

 * individual calls and we treat NEW packets somewhat specially. When we

 * get such a packet, we see if there are any calls with a matching

 * circuit id, and make sure that its circuits are marked as ended

 * before that packet.

 *

 * A second complication is that we only know one quadruplet at the time

 * the NEW packet is processed: there is therefore cunningness in

 * iax_lookup_circuit_details() to look for replies to NEW packets and

 * create the reverse circuit.

 */

/* start with a hash of {addr,port type,port,call}->{id} */

typedef struct {

  address   addr;

  port_type ptype;

  uint32_t  port;

  uint32_t  callno;

  /* this is where addr->data points to. it's put in here for easy freeing */

  uint8_t address_data[MAX_ADDRESS];

} iax_circuit_key;

/* tables */

static GHashTable *iax_fid_table;

static reassembly_table iax_reassembly_table;

static GHashTable *iax_circuit_hashtab;

static unsigned circuitcount;

/* the number of keys and values to reserve space for in each memory chunk.

   We assume we won't be tracking many calls at once so this is quite low.

*/

#define IAX_INIT_PACKET_COUNT 10

#ifdef DEBUG_HASHING

static char *key_to_str( const iax_circuit_key *key )

{

  static int    i = 0;

  static char   str[3][80];

  char         *strp;

  char         *addrstr;

  i++;

  if (i >= 3) {

    i = 0;

  }

  strp = str[i];

  addrstr = address_to_str(NULL, &key->addr);

  snprintf(strp, 80, "{%s:%i,%i}",

             addrstr,

             key->port,

             key->callno);

  wmem_free(NULL, addrstr);

  return strp;

}

#endif

/* Hash Functions */

static int iax_circuit_equal(const void *v, const void *w)

{

  const iax_circuit_key *v1 = (const iax_circuit_key *)v;

  const iax_circuit_key *v2 = (const iax_circuit_key *)w;

  int result;

  result = (addresses_equal(&(v1->addr), &(v2->addr)) &&

            v1->ptype == v2->ptype &&

            v1->port  == v2->port  &&

            v1->callno== v2->callno);

#ifdef DEBUG_HASHING

  ws_debug("+++ Comparing for equality: %s, %s: %u", key_to_str(v1), key_to_str(v2), result);

#endif

  return result;

}

static unsigned iax_circuit_hash(const void *v)

{

  const iax_circuit_key *key = (const iax_circuit_key *)v;

  unsigned               hash_val;

  hash_val = 0;

  hash_val = add_address_to_hash(hash_val, &key->addr);

  hash_val += (unsigned)(key->ptype);

  hash_val += (unsigned)(key->port);

  hash_val += (unsigned)(key->callno);

#ifdef DEBUG_HASHING

  ws_debug("+++ Hashing key: %s, result %#x", key_to_str(key), hash_val);

#endif

  return (unsigned)hash_val;

}

/* Find, or create, a circuit for the given

   {address,porttype,port,call} quadruplet

*/

static unsigned iax_circuit_lookup(const address *address_p,

                                port_type ptype,

                                uint32_t port,

                                uint32_t callno)

{

  iax_circuit_key  key;

  uint32_t        *circuit_id_p;

  key.addr   = *address_p;

  key.ptype  = ptype;

  key.port   = port;

  key.callno = callno;

  circuit_id_p = (uint32_t *)g_hash_table_lookup(iax_circuit_hashtab, &key);

  if (! circuit_id_p) {

    iax_circuit_key *new_key;

    new_key = wmem_new(wmem_file_scope(), iax_circuit_key);

    new_key->addr.type = address_p->type;

    new_key->addr.len  = MIN(address_p->len, MAX_ADDRESS);

    new_key->addr.data = new_key->address_data;

    if (new_key->addr.len > 0)

      memcpy(new_key->address_data, address_p->data, new_key->addr.len);

    new_key->ptype     = ptype;

    new_key->port      = port;

    new_key->callno    = callno;

    circuit_id_p  = (uint32_t *)wmem_new(wmem_file_scope(), iax_circuit_key);

    *circuit_id_p = ++circuitcount;

    g_hash_table_insert(iax_circuit_hashtab, new_key, circuit_id_p);

#ifdef DEBUG_HASHING

    ws_debug("Created new circuit id %u for node %s", *circuit_id_p, key_to_str(new_key));

#endif

  }

  return *circuit_id_p;

}

/* ************************************************************************* */

typedef struct {

  uint32_t    current_frag_id; /* invalid unless current_frag_bytes > 0 */

  uint32_t    current_frag_bytes;

  uint32_t    current_frag_minlen;

} iax_call_dirdata;

/* This is our per-call data structure, which is attached to both the

 * forward and reverse circuits.

 */

typedef struct iax_call_data {

  /* For this data, src and dst are relative to the original direction under

     which this call is stored. Obviously if the reversed flag is set true by

     iax_find_call, src and dst are reversed relative to the direction the

     actual source and destination of the data.

     if the codec changes mid-call, we update it here; because we store a codec

     number with each packet too, we handle going back to earlier packets

     without problem.

  */

  iax_dataformat_t dataformat;

  uint32_t         src_codec, dst_codec;

  uint32_t         src_vformat, dst_vformat;

  /* when a transfer takes place, we'll get a new circuit id; we assume that we

     don't try to transfer more than IAX_MAX_TRANSFERS times in a call */

  unsigned forward_circuit_ids[IAX_MAX_TRANSFERS];

  unsigned reverse_circuit_ids[IAX_MAX_TRANSFERS];

  unsigned n_forward_circuit_ids;

  unsigned n_reverse_circuit_ids;

  /* this is the subdissector for the call */

  dissector_handle_t subdissector;

  /* the absolute start time of the call */

  nstime_t start_time;

  /* time stamp from last full frame, in the first pass */

  uint32_t last_full_frame_ts;

  iax_call_dirdata dirdata[2];

} iax_call_data;

/* creates a new CONVERSATION_IAX2 circuit with a specified circuit id for a call

 *

 * typically a call has up to three associated circuits: an original source, an

 * original destination, and the result of a transfer.

 *

 * For each endpoint, a CONVERSATION_IAX2 circuit is created and added to the call_data

 * by this function

 *

 * 'reversed' should be true if this end is the one which would have _received_

 * the NEW packet, or it is an endpoint to which the 'destination' is being

 * transferred.

 *

 */

static conversation_t *iax2_new_circuit_for_call(packet_info *pinfo, proto_item * item,

                                            unsigned circuit_id, unsigned framenum,

                                            iax_call_data *iax_call, bool reversed)

{

  conversation_t *conv;

  if(!iax_call){

    return NULL;

  }

  if ((reversed && iax_call->n_reverse_circuit_ids >= IAX_MAX_TRANSFERS) ||

      (! reversed && iax_call->n_forward_circuit_ids >= IAX_MAX_TRANSFERS)) {

    expert_add_info(pinfo, item, &ei_iax_too_many_transfers);

    return NULL;

  }

  conv = conversation_new_by_id(framenum, CONVERSATION_IAX2,

                    circuit_id);

  conversation_add_proto_data(conv, proto_iax2, iax_call);

  if (reversed)

    iax_call -> reverse_circuit_ids[iax_call->n_reverse_circuit_ids++] = circuit_id;

  else

    iax_call -> forward_circuit_ids[iax_call->n_forward_circuit_ids++] = circuit_id;

  return conv;

}

/* returns true if this circuit id is a "forward" circuit for this call: ie, it

 * is the point which _sent_ the original 'NEW' packet, or a point to which that

 * end was subsequently transferred */

static bool is_forward_circuit(unsigned circuit_id,

                                   const iax_call_data *iax_call)

{

  unsigned i;

  for(i=0; i<iax_call->n_forward_circuit_ids; i++) {

    if (circuit_id == iax_call->forward_circuit_ids[i])

      return true;

  }

  return false;

}

/* returns true if this circuit id is a "reverse" circuit for this call: ie, it

 * is the point which _received_ the original 'NEW' packet, or a point to which that

 * end was subsequently transferred */

static bool is_reverse_circuit(unsigned circuit_id,

                                   const iax_call_data *iax_call)

{

  unsigned i;

  for(i=0; i<iax_call->n_reverse_circuit_ids; i++){

    if (circuit_id == iax_call->reverse_circuit_ids[i])

      return true;

  }

  return false;

}

static iax_call_data *iax_lookup_call_from_dest(packet_info *pinfo, proto_item * item,

                                                 unsigned src_circuit_id,

                                                 unsigned dst_circuit_id,

                                                 unsigned framenum,

                                                 bool *reversed_p)

{

  conversation_t  *dst_conv;

  iax_call_data *iax_call;

  bool           reversed = false;

  dst_conv = find_conversation_by_id(framenum, CONVERSATION_IAX2, dst_circuit_id);

  if (!dst_conv) {

#ifdef DEBUG_HASHING

    ws_debug("++ destination circuit not found, must have missed NEW packet");

#endif

    if (reversed_p)

      *reversed_p = false;

    return NULL;

  }

#ifdef DEBUG_HASHING

  ws_debug("++ found destination circuit");

#endif

  iax_call = (iax_call_data *)conversation_get_proto_data(dst_conv, proto_iax2);

  /* there's no way we can create a CONVERSATION_IAX2 circuit without adding

     iax call data to it; assert this */

  DISSECTOR_ASSERT(iax_call);

  if (is_forward_circuit(dst_circuit_id, iax_call)) {

#ifdef DEBUG_HASHING

    ws_debug("++ destination circuit matches forward_circuit_id of call, "

             "therefore packet is reversed");

#endif

    reversed = true;

    if (iax_call -> n_reverse_circuit_ids == 0) {

      /* we are going in the reverse direction, and this call

         doesn't have a reverse circuit associated with it.

         create one now. */

#ifdef DEBUG_HASHING

      ws_debug("++ reverse_circuit_id of call is zero, need to create a "

              "new reverse circuit for this call");

#endif

      iax2_new_circuit_for_call(pinfo, item, src_circuit_id, framenum, iax_call, true);

#ifdef DEBUG_HASHING

      ws_debug("++ done");

#endif

    } else if (!is_reverse_circuit(src_circuit_id, iax_call)) {

      expert_add_info_format(pinfo, item, &ei_iax_circuit_id_conflict,

                "IAX Packet %u from circuit ids %u->%u conflicts with earlier call with circuit ids %u->%u",

                framenum,

                src_circuit_id, dst_circuit_id,

                iax_call->forward_circuit_ids[0],

                iax_call->reverse_circuit_ids[0]);

      return NULL;

    }

  } else if (is_reverse_circuit(dst_circuit_id, iax_call)) {

#ifdef DEBUG_HASHING

    ws_debug("++ destination circuit matches reverse_circuit_id of call, "

            "therefore packet is forward");

#endif

    reversed = false;

    if (!is_forward_circuit(src_circuit_id, iax_call)) {

      expert_add_info_format(pinfo, item, &ei_iax_circuit_id_conflict,

                "IAX Packet %u from circuit ids %u->%u conflicts with earlier call with circuit ids %u->%u",

                framenum,

                src_circuit_id, dst_circuit_id,

                iax_call->forward_circuit_ids[0],

                iax_call->reverse_circuit_ids[0]);

      if (reversed_p)

        *reversed_p = false;

      return NULL;

    }

  } else {

    DISSECTOR_ASSERT_NOT_REACHED();

  }

  if (reversed_p)

    *reversed_p = reversed;

  return iax_call;

}

/* looks up an iax_call for this packet */

static iax_call_data *iax_lookup_call( packet_info *pinfo,

                                       uint32_t scallno,

                                       uint32_t dcallno,

                                       bool *reversed_p)

{

  bool           reversed = false;

  iax_call_data *iax_call = NULL;

  unsigned       src_circuit_id;

#ifdef DEBUG_HASHING

  char          *srcstr, *dststr;

#endif

#ifdef DEBUG_HASHING

  srcstr = address_to_str(NULL, &pinfo->src);

  dststr = address_to_str(NULL, &pinfo->dst);

  ws_debug("++ iax_lookup_circuit_details: Looking up circuit for frame %u, "

          "from {%s:%u:%u} to {%s:%u:%u}", pinfo->num,

          srcstr, pinfo->srcport, scallno,

          dststr, pinfo->destport, dcallno);

  wmem_free(NULL, srcstr);

  wmem_free(NULL, dststr);

#endif

  src_circuit_id = iax_circuit_lookup(&pinfo->src, pinfo->ptype,

                                      pinfo->srcport, scallno);

  /* the most reliable indicator of call is the destination callno, if

     we have one */

  if (dcallno != 0) {

    unsigned dst_circuit_id;

#ifdef DEBUG_HASHING

    ws_debug("++ dcallno non-zero, looking up destination circuit");

#endif

    dst_circuit_id = iax_circuit_lookup(&pinfo->dst, pinfo->ptype,

                                        pinfo->destport, dcallno);

    iax_call = iax_lookup_call_from_dest(pinfo, NULL, src_circuit_id, dst_circuit_id,

                                         pinfo->num, &reversed);

  } else {

    conversation_t *src_conv;

    /* in all other circumstances, the source circuit should already

     * exist: its absence indicates that we missed the all-important NEW

     * packet.

     */

    src_conv = find_conversation_by_id(pinfo->num, CONVERSATION_IAX2, src_circuit_id);

    if (src_conv) {

      iax_call = (iax_call_data *)conversation_get_proto_data(src_conv, proto_iax2);

      /* there's no way we can create a CONVERSATION_IAX2 circuit without adding

         iax call data to it; assert this */

      DISSECTOR_ASSERT(iax_call);

      if (is_forward_circuit(src_circuit_id, iax_call))

        reversed = false;

      else if (is_reverse_circuit(src_circuit_id, iax_call))

        reversed = true;

      else {

        /* there's also no way we can attach an iax_call_data to a circuit

           without the circuit being either the forward or reverse circuit

           for that call; assert this too.

        */

        DISSECTOR_ASSERT_NOT_REACHED();

      }

    }

  }

  if (reversed_p)

    *reversed_p = reversed;

#ifdef DEBUG_HASHING

  if (iax_call) {

    ws_debug("++ Found call for packet: id %u, reversed=%c", iax_call->forward_circuit_ids[0], reversed?'1':'0');

  } else {

    ws_debug("++ Call not found. Must have missed the NEW packet?");

  }

#endif

  return iax_call;

}

/* initialize the per-direction parts of an iax_call_data structure */

static void init_dir_data(iax_call_dirdata *dirdata)

{

  dirdata -> current_frag_bytes=0;

  dirdata -> current_frag_minlen=0;

}

/* handles a NEW packet by creating a new iax call and forward circuit.

   the reverse circuit is not created until the ACK is received and

   is created by iax_lookup_circuit_details. */

static iax_call_data *iax_new_call( packet_info *pinfo,

                                    uint32_t scallno)

{

  iax_call_data         *call;

  unsigned               circuit_id;

  static const nstime_t  millisecond = NSTIME_INIT_SECS_MSECS(0, 1);

#ifdef DEBUG_HASHING

  ws_debug("+ new_circuit: Handling NEW packet, frame %u", pinfo->num);

#endif

  circuit_id = iax_circuit_lookup(&pinfo->src, pinfo->ptype,

                                  pinfo->srcport, scallno);

  call = wmem_new(wmem_file_scope(), iax_call_data);

  call -> dataformat = AST_DATAFORMAT_NULL;

  call -> src_codec = 0;

  call -> dst_codec = 0;

  call -> src_vformat = 0;

  call -> dst_vformat = 0;

  call -> n_forward_circuit_ids = 0;

  call -> n_reverse_circuit_ids = 0;

  call -> subdissector = NULL;

  call -> start_time = pinfo->abs_ts;

  call -> last_full_frame_ts = 0;

  nstime_delta(&call -> start_time, &call -> start_time, &millisecond);

  init_dir_data(&call->dirdata[0]);

  init_dir_data(&call->dirdata[1]);

  iax2_new_circuit_for_call(pinfo, NULL, circuit_id, pinfo->num, call, false);

  return call;

}

/* ************************************************************************* */

/* per-packet data */

typedef struct iax_packet_data {

  bool           first_time; /* we're dissecting this packet for the first time; so

                              * things like codec and transfer requests should be

                              * propagated into the call data */

  iax_call_data *call_data;

  uint32_t       codec;