--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/pcap-study/rtp-gsmfr-dump.c	Wed May 15 01:44:46 2024 +0000
@@ -0,0 +1,276 @@
+/*
+ * This program is a combination of rtp-gsmfr-extr and gsmrec-dump into
+ * one step: it reads a pcap file, extracts packets belonging to a
+ * particular RTP stream as identified by a source or destination
+ * IP:port, verifies that an unbroken RTP stream is present, which is
+ * expected to be in GSM FR or EFR codec, but instead of writing this
+ * FR/EFR frame stream to a gsmx file, decodes it like gsmrec-dump.
+ *
+ * The advantage of this program over running rtp-gsmfr-extr followed
+ * by gsmrec-dump is that TRAUlike Extension Headers (if present) are
+ * dumped for analysis, rather than discarded.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <pcap/pcap.h>
+#include <gsm.h>
+#include <gsm_efr.h>
+
+static pcap_t *pcap;
+static in_addr_t match_ip_addr;
+static u_short match_udp_port;
+static unsigned iphdr_addr_offset, udphdr_port_offset;
+static unsigned link_hdr_len, ethertype_offset;
+static int stream_init_flag;
+static unsigned last_seq, last_tstamp, stream_ssrc;
+static gsm dummy_state;
+
+static void
+check_dl_type()
+{
+	int dltype;
+
+	dltype = pcap_datalink(pcap);
+	switch (dltype) {
+	case DLT_EN10MB:
+		link_hdr_len = 14;
+		ethertype_offset = 12;
+		break;
+	case DLT_RAW:
+		link_hdr_len = 0;
+		break;
+	case DLT_LINUX_SLL:
+		link_hdr_len = 16;
+		ethertype_offset = 14;
+		break;
+	default:
+		fprintf(stderr, "error: unsupported data link type %d\n",
+			dltype);
+		exit(1);
+	}
+}
+
+static void
+rtp_stream_logic(rtp_hdr, pkt_idx)
+	u_char *rtp_hdr;
+	unsigned pkt_idx;
+{
+	unsigned cur_seq, cur_tstamp, cur_ssrc;
+
+	cur_seq = (rtp_hdr[2] << 8) | rtp_hdr[3];
+	cur_tstamp = (rtp_hdr[4] << 24) | (rtp_hdr[5] << 16) |
+			(rtp_hdr[6] << 8) | rtp_hdr[7];
+	cur_ssrc = (rtp_hdr[8] << 24) | (rtp_hdr[9] << 16) |
+			(rtp_hdr[10] << 8) | rtp_hdr[11];
+	if (stream_init_flag) {
+		if (cur_ssrc != stream_ssrc) {
+			printf(
+		"error in packet #%u: SSRC change from 0x%08X to 0x%08X\n",
+				pkt_idx, stream_ssrc, cur_ssrc);
+		} else if (cur_seq != last_seq + 1 &&
+			   (cur_seq != 0 || last_seq != 0xFFFF)) {
+			printf(
+		"error in packet #%u: seq break from 0x%04X to 0x%04X\n",
+				pkt_idx, last_seq, cur_seq);
+		} else if (cur_tstamp != last_tstamp + 160) {
+			printf(
+		"error in packet #%u: timestamp break from 0x%08X to 0x%08X\n",
+				pkt_idx, last_tstamp, cur_tstamp);
+		}
+	} else
+		stream_init_flag = 1;
+	last_seq = cur_seq;
+	last_tstamp = cur_tstamp;
+	stream_ssrc = cur_ssrc;
+}
+
+static void
+process_payload(payload, payload_len)
+	u_char *payload;
+	unsigned payload_len;
+{
+	gsm_signal params[76];
+	int i, j, n;
+
+	printf("seq 0x%04X ts 0x%08X: ", last_seq, last_tstamp);
+	switch (payload_len) {
+	case 0:
+		printf("zero-length payload\n");
+		return;
+	case 1:
+		if ((payload[0] & 0xF6) != 0xE6)
+			break;
+		printf("TEH 0x%02X\n", payload[0]);
+		return;
+	case 2:
+		if (payload[0] != 0xBF)
+			break;
+		printf("old BFI TAF=%u\n", payload[1] & 1);
+		return;
+	case 31:
+		if ((payload[0] & 0xF0) != 0xC0)
+			break;
+		printf("std EFR SID=%d LPC", EFR_sid_classify(payload));
+		EFR_frame2params(payload, params);
+	print_efr:
+		n = 0;
+		for (i = 0; i < 5; i++)
+			printf(" %d", params[n++]);
+		putchar('\n');
+		for (i = 0; i < 4; i++) {
+			putchar(' ');
+			for (j = 0; j < 13; j++)
+				printf(" %d", params[n++]);
+			putchar('\n');
+		}
+		return;
+	case 32:
+		if ((payload[0] & 0xF4) != 0xE0)
+			break;
+		if ((payload[1] & 0xF0) != 0xC0)
+			break;
+		printf("TEH 0x%02X EFR SID=%d LPC", payload[0],
+			EFR_sid_classify(payload+1));
+		EFR_frame2params(payload+1, params);
+		goto print_efr;
+	case 33:
+		if ((payload[0] & 0xF0) != 0xD0)
+			break;
+		fputs("std FR", stdout);
+		gsm_explode(dummy_state, payload, params);
+	print_fr:
+		n = 0;
+		for (i = 0; i < 8; i++)
+			printf(" %d", params[n++]);
+		putchar('\n');
+		for (i = 0; i < 4; i++) {
+			putchar(' ');
+			for (j = 0; j < 17; j++)
+				printf(" %d", params[n++]);
+			putchar('\n');
+		}
+		return;
+	case 34:
+		if ((payload[0] & 0xF4) != 0xE0)
+			break;
+		if ((payload[1] & 0xF0) != 0xD0)
+			break;
+		printf("TEH 0x%02X FR", payload[0]);
+		gsm_explode(dummy_state, payload+1, params);
+		goto print_fr;
+	}
+	printf("unknown payload format, length=%u\n", payload_len);
+}
+
+static void
+process_packet(pkt, caplen, pkt_idx)
+	u_char *pkt;
+	unsigned caplen, pkt_idx;
+{
+	unsigned udplen, payload_len;
+
+	if (caplen < link_hdr_len + 28)
+		return;
+	if (link_hdr_len) {
+		if (pkt[ethertype_offset] != 0x08)
+			return;
+		if (pkt[ethertype_offset+1] != 0x00)
+			return;
+		pkt += link_hdr_len;
+		caplen -= link_hdr_len;
+	}
+	/* check IP header */
+	if (pkt[0] != 0x45)
+		return;
+	if (pkt[9] != 17)	/* UDP */
+		return;
+	if (bcmp(pkt + iphdr_addr_offset, &match_ip_addr, 4))
+		return;
+	/* check UDP header */
+	if (bcmp(pkt + 20 + udphdr_port_offset, &match_udp_port, 2))
+		return;
+	/* it is our target - now scrutinize it */
+	udplen = (pkt[24] << 8) | pkt[25];
+	if (caplen < udplen + 20) {
+		fprintf(stderr,
+			"error: packet #%u is truncated in the capture\n",
+			pkt_idx);
+		exit(1);
+	}
+	if (udplen < 20) {
+		fprintf(stderr,
+		"error in packet #%u: UDP length is too short for RTP header\n",
+			pkt_idx);
+		exit(1);
+	}
+	if (pkt[28] != 0x80) {
+		fprintf(stderr,
+		"error in packet #%u: unsupported RTP header structure\n",
+			pkt_idx);
+		exit(1);
+	}
+	rtp_stream_logic(pkt + 28, pkt_idx);
+	process_payload(pkt + 40, udplen - 20);
+}
+
+main(argc, argv)
+	char **argv;
+{
+	char errbuf[PCAP_ERRBUF_SIZE];
+	u_char *pkt;
+	struct pcap_pkthdr pkthdr;
+	unsigned pkt_idx;
+
+	if (argc != 5) {
+		fprintf(stderr,
+			"usage: %s pcap-file src|dest ip-addr udp-port\n",
+			argv[0]);
+		exit(1);
+	}
+	pcap = pcap_open_offline(argv[1], errbuf);
+	if (!pcap) {
+		fprintf(stderr, "%s: %s\n", argv[1], errbuf);
+		exit(1);
+	}
+	check_dl_type();
+	if (!strcmp(argv[2], "src")) {
+		iphdr_addr_offset = 12;
+		udphdr_port_offset = 0;
+	} else if (!strcmp(argv[2], "dest")) {
+		iphdr_addr_offset = 16;
+		udphdr_port_offset = 2;
+	} else {
+		fprintf(stderr,
+		"error: direction argument must be \"src\" or \"dest\"\n");
+		exit(1);
+	}
+	match_ip_addr = inet_addr(argv[3]);
+	if (match_ip_addr == INADDR_NONE) {
+		fprintf(stderr, "error: IP address argument is invalid\n");
+		exit(1);
+	}
+	match_udp_port = htons(strtoul(argv[4], 0, 0));
+	dummy_state = gsm_create();
+	if (!dummy_state) {
+		fprintf(stderr, "gsm_create() failed!\n");
+		exit(1);
+	}
+	for (pkt_idx = 0; ; pkt_idx++) {
+		pkt = pcap_next(pcap, &pkthdr);
+		if (!pkt)
+			break;
+		process_packet(pkt, (unsigned) pkthdr.caplen, pkt_idx);
+	}
+	if (!stream_init_flag) {
+		fprintf(stderr, "error: specified RTP stream not found\n");
+		exit(1);
+	}
+	exit(0);
+}