# HG changeset patch # User Mychaela Falconia # Date 1681627398 0 # Node ID 50aa973a91ef3ca04d169c919cc07ce9ebe2e9b3 # Parent 210dfa39f57332dcd4a12be8b298b0dfaa0e5de3 new program rtp-gsmfr-dump diff -r 210dfa39f573 -r 50aa973a91ef .hgignore --- a/.hgignore Sun Apr 16 04:18:14 2023 +0000 +++ b/.hgignore Sun Apr 16 06:43:18 2023 +0000 @@ -4,6 +4,7 @@ ^rtp-cont-check$ ^rtp-g711-extr$ +^rtp-gsmfr-dump$ ^rtp-gsmfr-extr$ ^rtp-jitter-view$ ^rtp-tfo-trace$ diff -r 210dfa39f573 -r 50aa973a91ef Makefile --- a/Makefile Sun Apr 16 04:18:14 2023 +0000 +++ b/Makefile Sun Apr 16 06:43:18 2023 +0000 @@ -1,7 +1,7 @@ CC= gcc CFLAGS= -O2 -PROGS= rtp-cont-check rtp-g711-extr rtp-gsmfr-extr rtp-jitter-view \ - rtp-tfo-trace +PROGS= rtp-cont-check rtp-g711-extr rtp-gsmfr-dump rtp-gsmfr-extr \ + rtp-jitter-view rtp-tfo-trace INSTBIN=/opt/freecalypso/bin all: ${PROGS} @@ -12,6 +12,9 @@ rtp-g711-extr: rtp-g711-extr.c ${CC} ${CFLAGS} -o $@ $@.c -lpcap +rtp-gsmfr-dump: rtp-gsmfr-dump.c + ${CC} ${CFLAGS} -o $@ $@.c -lpcap -lgsmefr -lgsm + rtp-gsmfr-extr: rtp-gsmfr-extr.c ${CC} ${CFLAGS} -o $@ $@.c -lpcap diff -r 210dfa39f573 -r 50aa973a91ef rtp-gsmfr-dump.c --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/rtp-gsmfr-dump.c Sun Apr 16 06:43:18 2023 +0000 @@ -0,0 +1,282 @@ +/* + * This program is a combination of rtp-gsmfr-extr and gsmrec-dump into + * one step: it reads a pcap file, extracts packets belonging to a + * particular RTP stream as identified by a source or destination + * IP:port, verifies that an unbroken RTP stream is present, which is + * expected to be in GSM FR or EFR codec, but instead of writing this + * FR/EFR frame stream to a gsmx file, decodes it like gsmrec-dump. + * + * The advantage of this program over running rtp-gsmfr-extr followed + * by gsmrec-dump is that TRAUlike Extension Headers (if present) are + * dumped for analysis, rather than discarded. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static pcap_t *pcap; +static in_addr_t match_ip_addr; +static u_short match_udp_port; +static unsigned iphdr_addr_offset, udphdr_port_offset; +static unsigned link_hdr_len, ethertype_offset; +static int stream_init_flag; +static unsigned last_seq, last_tstamp, stream_ssrc; +static gsm dummy_state; + +static void +check_dl_type() +{ + int dltype; + + dltype = pcap_datalink(pcap); + switch (dltype) { + case DLT_EN10MB: + link_hdr_len = 14; + ethertype_offset = 12; + break; + case DLT_RAW: + link_hdr_len = 0; + break; + case DLT_LINUX_SLL: + link_hdr_len = 16; + ethertype_offset = 14; + break; + default: + fprintf(stderr, "error: unsupported data link type %d\n", + dltype); + exit(1); + } +} + +static void +rtp_stream_logic(rtp_hdr, pkt_idx) + u_char *rtp_hdr; + unsigned pkt_idx; +{ + unsigned cur_seq, cur_tstamp, cur_ssrc; + + cur_seq = (rtp_hdr[2] << 8) | rtp_hdr[3]; + cur_tstamp = (rtp_hdr[4] << 24) | (rtp_hdr[5] << 16) | + (rtp_hdr[6] << 8) | rtp_hdr[7]; + cur_ssrc = (rtp_hdr[8] << 24) | (rtp_hdr[9] << 16) | + (rtp_hdr[10] << 8) | rtp_hdr[11]; + if (stream_init_flag) { + if (cur_ssrc != stream_ssrc) { + fprintf(stderr, + "error in packet #%u: SSRC change from 0x%08X to 0x%08X\n", + pkt_idx, stream_ssrc, cur_ssrc); + exit(1); + } + if (cur_seq != last_seq + 1 && + (cur_seq != 0 || last_seq != 0xFFFF)) { + fprintf(stderr, + "error in packet #%u: seq break from 0x%04X to 0x%04X\n", + pkt_idx, last_seq, cur_seq); + exit(1); + } + if (cur_tstamp != last_tstamp + 160) { + fprintf(stderr, + "error in packet #%u: timestamp break from 0x%08X to 0x%08X\n", + pkt_idx, last_tstamp, cur_tstamp); + exit(1); + } + } else { + stream_init_flag = 1; + stream_ssrc = cur_ssrc; + } + last_seq = cur_seq; + last_tstamp = cur_tstamp; +} + +static void +process_payload(payload, payload_len) + u_char *payload; + unsigned payload_len; +{ + gsm_signal params[76]; + int i, j, n; + + printf("seq 0x%04X ts 0x%08X: ", last_seq, last_tstamp); + switch (payload_len) { + case 0: + printf("zero-length payload\n"); + return; + case 1: + if ((payload[0] & 0xF6) != 0xE6) + break; + printf("TEH 0x%02X\n", payload[0]); + return; + case 2: + if (payload[0] != 0xBF) + break; + printf("old BFI TAF=%u\n", payload[1] & 1); + return; + case 31: + if ((payload[0] & 0xF0) != 0xC0) + break; + printf("std EFR SID=%d LPC", EFR_sid_classify(payload)); + EFR_frame2params(payload, params); + print_efr: + n = 0; + for (i = 0; i < 5; i++) + printf(" %d", params[n++]); + putchar('\n'); + for (i = 0; i < 4; i++) { + putchar(' '); + for (j = 0; j < 13; j++) + printf(" %d", params[n++]); + putchar('\n'); + } + return; + case 32: + if ((payload[0] & 0xF4) != 0xE0) + break; + if ((payload[1] & 0xF0) != 0xC0) + break; + printf("TEH 0x%02X EFR SID=%d LPC", payload[0], + EFR_sid_classify(payload+1)); + EFR_frame2params(payload+1, params); + goto print_efr; + case 33: + if ((payload[0] & 0xF0) != 0xD0) + break; + fputs("std FR", stdout); + gsm_explode(dummy_state, payload, params); + print_fr: + n = 0; + for (i = 0; i < 8; i++) + printf(" %d", params[n++]); + putchar('\n'); + for (i = 0; i < 4; i++) { + putchar(' '); + for (j = 0; j < 17; j++) + printf(" %d", params[n++]); + putchar('\n'); + } + return; + case 34: + if ((payload[0] & 0xF4) != 0xE0) + break; + if ((payload[1] & 0xF0) != 0xD0) + break; + printf("TEH 0x%02X FR", payload[0]); + gsm_explode(dummy_state, payload+1, params); + goto print_fr; + } + printf("unknown payload format, length=%u\n", payload_len); +} + +static void +process_packet(pkt, caplen, pkt_idx) + u_char *pkt; + unsigned caplen, pkt_idx; +{ + unsigned udplen, payload_len; + + if (caplen < link_hdr_len + 28) + return; + if (link_hdr_len) { + if (pkt[ethertype_offset] != 0x08) + return; + if (pkt[ethertype_offset+1] != 0x00) + return; + pkt += link_hdr_len; + caplen -= link_hdr_len; + } + /* check IP header */ + if (pkt[0] != 0x45) + return; + if (pkt[9] != 17) /* UDP */ + return; + if (bcmp(pkt + iphdr_addr_offset, &match_ip_addr, 4)) + return; + /* check UDP header */ + if (bcmp(pkt + 20 + udphdr_port_offset, &match_udp_port, 2)) + return; + /* it is our target - now scrutinize it */ + udplen = (pkt[24] << 8) | pkt[25]; + if (caplen < udplen + 20) { + fprintf(stderr, + "error: packet #%u is truncated in the capture\n", + pkt_idx); + exit(1); + } + if (udplen < 20) { + fprintf(stderr, + "error in packet #%u: UDP length is too short for RTP header\n", + pkt_idx); + exit(1); + } + if (pkt[28] != 0x80) { + fprintf(stderr, + "error in packet #%u: unsupported RTP header structure\n", + pkt_idx); + exit(1); + } + rtp_stream_logic(pkt + 28, pkt_idx); + process_payload(pkt + 40, udplen - 20); +} + +main(argc, argv) + char **argv; +{ + char errbuf[PCAP_ERRBUF_SIZE]; + u_char *pkt; + struct pcap_pkthdr pkthdr; + unsigned pkt_idx; + + if (argc != 5) { + fprintf(stderr, + "usage: %s pcap-file src|dest ip-addr udp-port\n", + argv[0]); + exit(1); + } + pcap = pcap_open_offline(argv[1], errbuf); + if (!pcap) { + fprintf(stderr, "%s: %s\n", argv[1], errbuf); + exit(1); + } + check_dl_type(); + if (!strcmp(argv[2], "src")) { + iphdr_addr_offset = 12; + udphdr_port_offset = 0; + } else if (!strcmp(argv[2], "dest")) { + iphdr_addr_offset = 16; + udphdr_port_offset = 2; + } else { + fprintf(stderr, + "error: direction argument must be \"src\" or \"dest\"\n"); + exit(1); + } + match_ip_addr = inet_addr(argv[3]); + if (match_ip_addr == INADDR_NONE) { + fprintf(stderr, "error: IP address argument is invalid\n"); + exit(1); + } + match_udp_port = htons(strtoul(argv[4], 0, 0)); + dummy_state = gsm_create(); + if (!dummy_state) { + fprintf(stderr, "gsm_create() failed!\n"); + exit(1); + } + for (pkt_idx = 0; ; pkt_idx++) { + pkt = pcap_next(pcap, &pkthdr); + if (!pkt) + break; + process_packet(pkt, (unsigned) pkthdr.caplen, pkt_idx); + } + if (!stream_init_flag) { + fprintf(stderr, "error: specified RTP stream not found\n"); + exit(1); + } + exit(0); +}