1999-02-12 09:03:42 +00:00
|
|
|
/* packet-http.c
|
|
|
|
* Routines for HTTP packet disassembly
|
2004-07-09 23:37:40 +00:00
|
|
|
* RFC 1945 (HTTP/1.0)
|
|
|
|
* RFC 2616 (HTTP/1.1)
|
1999-02-12 09:03:42 +00:00
|
|
|
*
|
2000-01-22 06:22:44 +00:00
|
|
|
* Guy Harris <guy@alum.mit.edu>
|
1999-02-12 09:03:42 +00:00
|
|
|
*
|
2004-04-29 20:26:54 +00:00
|
|
|
* Copyright 2004, Jerry Talkington <jtalkington@users.sourceforge.net>
|
2002-08-13 05:36:02 +00:00
|
|
|
* Copyright 2002, Tim Potter <tpot@samba.org>
|
|
|
|
* Copyright 1999, Andrew Tridgell <tridge@samba.org>
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
1999-02-12 09:03:42 +00:00
|
|
|
*
|
2006-05-21 04:49:01 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
1999-02-12 09:03:42 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-02-12 09:03:42 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-02-12 09:03:42 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-02-12 09:03:42 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
1999-07-13 02:53:26 +00:00
|
|
|
#ifdef HAVE_CONFIG_H
|
1999-02-12 09:03:42 +00:00
|
|
|
#include "config.h"
|
1999-07-13 02:53:26 +00:00
|
|
|
#endif
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2009-08-26 19:27:49 +00:00
|
|
|
#include <stdlib.h>
|
1999-03-23 03:14:46 +00:00
|
|
|
#include <string.h>
|
|
|
|
#include <ctype.h>
|
2010-05-12 13:24:42 +00:00
|
|
|
#include <errno.h>
|
1999-02-12 09:03:42 +00:00
|
|
|
|
1999-03-23 03:14:46 +00:00
|
|
|
#include <glib.h>
|
2006-08-14 21:46:05 +00:00
|
|
|
#include <epan/conversation.h>
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
|
|
|
#include <epan/strutil.h>
|
2004-09-10 23:16:00 +00:00
|
|
|
#include <epan/base64.h>
|
2005-07-24 01:42:41 +00:00
|
|
|
#include <epan/emem.h>
|
|
|
|
#include <epan/stats_tree.h>
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2004-09-29 00:25:05 +00:00
|
|
|
#include <epan/req_resp_hdrs.h>
|
2001-01-11 06:30:54 +00:00
|
|
|
#include "packet-http.h"
|
2006-08-14 21:46:05 +00:00
|
|
|
#include "packet-tcp.h"
|
2007-07-16 12:51:42 +00:00
|
|
|
#include "packet-ssl.h"
|
2004-09-27 22:55:15 +00:00
|
|
|
#include <epan/prefs.h>
|
2005-09-11 16:55:34 +00:00
|
|
|
#include <epan/expert.h>
|
2009-05-19 00:17:23 +00:00
|
|
|
#include <epan/uat.h>
|
2001-01-11 06:30:54 +00:00
|
|
|
|
2000-02-23 19:47:14 +00:00
|
|
|
typedef enum _http_type {
|
2000-02-23 20:55:33 +00:00
|
|
|
HTTP_REQUEST,
|
|
|
|
HTTP_RESPONSE,
|
2001-01-03 03:40:29 +00:00
|
|
|
HTTP_NOTIFICATION,
|
2000-02-23 20:55:33 +00:00
|
|
|
HTTP_OTHERS
|
2000-02-23 19:47:14 +00:00
|
|
|
} http_type_t;
|
|
|
|
|
2004-09-29 00:06:36 +00:00
|
|
|
#include <epan/tap.h>
|
2003-09-02 22:47:59 +00:00
|
|
|
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
|
2003-09-02 22:47:59 +00:00
|
|
|
static int http_tap = -1;
|
2007-03-13 20:42:04 +00:00
|
|
|
static int http_eo_tap = -1;
|
2003-09-02 22:47:59 +00:00
|
|
|
|
1999-07-29 05:47:07 +00:00
|
|
|
static int proto_http = -1;
|
2001-01-03 03:40:29 +00:00
|
|
|
static int hf_http_notification = -1;
|
1999-10-16 20:30:14 +00:00
|
|
|
static int hf_http_response = -1;
|
|
|
|
static int hf_http_request = -1;
|
2003-05-30 03:11:45 +00:00
|
|
|
static int hf_http_basic = -1;
|
2003-06-10 22:07:18 +00:00
|
|
|
static int hf_http_request_method = -1;
|
2005-02-23 05:47:17 +00:00
|
|
|
static int hf_http_request_uri = -1;
|
2010-09-21 02:12:21 +00:00
|
|
|
static int hf_http_request_full_uri = -1;
|
2005-03-01 11:37:26 +00:00
|
|
|
static int hf_http_version = -1;
|
2003-09-02 23:09:11 +00:00
|
|
|
static int hf_http_response_code = -1;
|
2010-10-30 14:29:20 +00:00
|
|
|
static int hf_http_response_phrase = -1;
|
2003-11-06 08:54:31 +00:00
|
|
|
static int hf_http_authorization = -1;
|
|
|
|
static int hf_http_proxy_authenticate = -1;
|
|
|
|
static int hf_http_proxy_authorization = -1;
|
2007-04-28 23:52:12 +00:00
|
|
|
static int hf_http_proxy_connect_host = -1;
|
|
|
|
static int hf_http_proxy_connect_port = -1;
|
2003-11-06 08:54:31 +00:00
|
|
|
static int hf_http_www_authenticate = -1;
|
2003-11-07 03:47:20 +00:00
|
|
|
static int hf_http_content_type = -1;
|
2008-10-23 06:57:31 +00:00
|
|
|
static int hf_http_content_length_header = -1;
|
2003-12-23 01:42:48 +00:00
|
|
|
static int hf_http_content_length = -1;
|
2004-02-21 01:31:56 +00:00
|
|
|
static int hf_http_content_encoding = -1;
|
|
|
|
static int hf_http_transfer_encoding = -1;
|
2004-12-07 17:59:58 +00:00
|
|
|
static int hf_http_user_agent = -1;
|
|
|
|
static int hf_http_host = -1;
|
|
|
|
static int hf_http_connection = -1;
|
|
|
|
static int hf_http_cookie = -1;
|
|
|
|
static int hf_http_accept = -1;
|
|
|
|
static int hf_http_referer = -1;
|
|
|
|
static int hf_http_accept_language = -1;
|
|
|
|
static int hf_http_accept_encoding = -1;
|
|
|
|
static int hf_http_date = -1;
|
|
|
|
static int hf_http_cache_control = -1;
|
|
|
|
static int hf_http_server = -1;
|
|
|
|
static int hf_http_location = -1;
|
|
|
|
static int hf_http_set_cookie = -1;
|
|
|
|
static int hf_http_last_modified = -1;
|
2006-02-20 06:25:02 +00:00
|
|
|
static int hf_http_x_forwarded_for = -1;
|
1999-10-16 20:30:14 +00:00
|
|
|
|
1999-11-16 11:44:20 +00:00
|
|
|
static gint ett_http = -1;
|
2002-08-13 05:36:02 +00:00
|
|
|
static gint ett_http_ntlmssp = -1;
|
2010-10-25 02:17:41 +00:00
|
|
|
static gint ett_http_kerberos = -1;
|
2003-06-10 22:07:18 +00:00
|
|
|
static gint ett_http_request = -1;
|
2004-04-26 17:10:40 +00:00
|
|
|
static gint ett_http_chunked_response = -1;
|
|
|
|
static gint ett_http_chunk_data = -1;
|
|
|
|
static gint ett_http_encoded_entity = -1;
|
2008-10-23 06:57:31 +00:00
|
|
|
static gint ett_http_header_item = -1;
|
1999-11-16 11:44:20 +00:00
|
|
|
|
2001-11-26 04:52:51 +00:00
|
|
|
static dissector_handle_t data_handle;
|
2004-04-30 17:07:21 +00:00
|
|
|
static dissector_handle_t media_handle;
|
2001-12-03 04:00:26 +00:00
|
|
|
static dissector_handle_t http_handle;
|
2001-11-26 04:52:51 +00:00
|
|
|
|
2009-05-19 00:17:23 +00:00
|
|
|
/* Stuff for generation/handling of fields for custom HTTP headers */
|
|
|
|
typedef struct _header_field_t {
|
|
|
|
gchar* header_name;
|
|
|
|
gchar* header_desc;
|
|
|
|
} header_field_t;
|
|
|
|
|
|
|
|
static header_field_t* header_fields = NULL;
|
|
|
|
static guint num_header_fields = 0;
|
|
|
|
|
|
|
|
static GHashTable* header_fields_hash = NULL;
|
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void
|
|
|
|
header_fields_update_cb(void* r, const char** err)
|
|
|
|
{
|
2009-05-19 00:17:23 +00:00
|
|
|
header_field_t* rec = r;
|
|
|
|
|
|
|
|
if (rec->header_name == NULL) {
|
|
|
|
*err = ep_strdup_printf("Header name can't be empty");
|
|
|
|
} else {
|
|
|
|
g_strstrip(rec->header_name);
|
|
|
|
if (rec->header_name[0] != 0) {
|
|
|
|
*err = NULL;
|
|
|
|
} else {
|
|
|
|
*err = ep_strdup_printf("Header name can't be empty");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void *
|
2010-10-29 21:11:33 +00:00
|
|
|
header_fields_copy_cb(void* n, const void* o, size_t siz _U_)
|
2010-09-21 02:12:21 +00:00
|
|
|
{
|
2009-05-19 00:17:23 +00:00
|
|
|
header_field_t* new_rec = n;
|
|
|
|
const header_field_t* old_rec = o;
|
|
|
|
|
|
|
|
if (old_rec->header_name) {
|
|
|
|
new_rec->header_name = g_strdup(old_rec->header_name);
|
|
|
|
} else {
|
2010-09-21 02:12:21 +00:00
|
|
|
new_rec->header_name = NULL;
|
2009-05-19 00:17:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (old_rec->header_desc) {
|
|
|
|
new_rec->header_desc = g_strdup(old_rec->header_desc);
|
|
|
|
} else {
|
2010-09-21 02:12:21 +00:00
|
|
|
new_rec->header_desc = NULL;
|
2009-05-19 00:17:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return new_rec;
|
|
|
|
}
|
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void
|
|
|
|
header_fields_free_cb(void*r)
|
|
|
|
{
|
2009-05-19 00:17:23 +00:00
|
|
|
header_field_t* rec = r;
|
|
|
|
|
|
|
|
if (rec->header_name) g_free(rec->header_name);
|
|
|
|
if (rec->header_desc) g_free(rec->header_desc);
|
|
|
|
}
|
|
|
|
|
|
|
|
UAT_CSTRING_CB_DEF(header_fields, header_name, header_field_t)
|
|
|
|
UAT_CSTRING_CB_DEF(header_fields, header_desc, header_field_t)
|
|
|
|
|
2003-10-27 09:17:21 +00:00
|
|
|
/*
|
|
|
|
* desegmentation of HTTP headers
|
|
|
|
* (when we are over TCP or another protocol providing the desegmentation API)
|
|
|
|
*/
|
2005-09-28 22:15:38 +00:00
|
|
|
static gboolean http_desegment_headers = TRUE;
|
2003-10-27 09:17:21 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* desegmentation of HTTP bodies
|
|
|
|
* (when we are over TCP or another protocol providing the desegmentation API)
|
|
|
|
* TODO let the user filter on content-type the bodies he wants desegmented
|
|
|
|
*/
|
2005-09-28 22:15:38 +00:00
|
|
|
static gboolean http_desegment_body = TRUE;
|
2003-10-27 09:17:21 +00:00
|
|
|
|
2004-05-05 06:55:09 +00:00
|
|
|
/*
|
|
|
|
* De-chunking of content-encoding: chunk entity bodies.
|
|
|
|
*/
|
|
|
|
static gboolean http_dechunk_body = TRUE;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Decompression of zlib encoded entities.
|
|
|
|
*/
|
|
|
|
#ifdef HAVE_LIBZ
|
|
|
|
static gboolean http_decompress_body = TRUE;
|
|
|
|
#else
|
|
|
|
static gboolean http_decompress_body = FALSE;
|
|
|
|
#endif
|
|
|
|
|
2004-08-22 03:04:54 +00:00
|
|
|
#define TCP_PORT_DAAP 3689
|
2006-08-14 21:46:05 +00:00
|
|
|
|
2001-01-11 05:41:47 +00:00
|
|
|
/*
|
2001-01-11 06:30:54 +00:00
|
|
|
* SSDP is implemented atop HTTP (yes, it really *does* run over UDP).
|
2001-01-11 05:41:47 +00:00
|
|
|
*/
|
2001-01-03 03:40:29 +00:00
|
|
|
#define TCP_PORT_SSDP 1900
|
|
|
|
#define UDP_PORT_SSDP 1900
|
|
|
|
|
2006-08-24 22:05:26 +00:00
|
|
|
/*
|
2007-07-16 12:51:42 +00:00
|
|
|
* tcp and ssl ports
|
2005-03-06 21:32:13 +00:00
|
|
|
*/
|
2007-07-16 12:51:42 +00:00
|
|
|
|
2011-01-10 20:23:21 +00:00
|
|
|
#define TCP_DEFAULT_RANGE "80,3128,3132,5985,8080,8088,11371,1900,2869"
|
2007-07-16 12:51:42 +00:00
|
|
|
#define SSL_DEFAULT_RANGE "443"
|
|
|
|
|
|
|
|
static range_t *global_http_tcp_range = NULL;
|
|
|
|
static range_t *global_http_ssl_range = NULL;
|
|
|
|
|
|
|
|
static range_t *http_tcp_range = NULL;
|
|
|
|
static range_t *http_ssl_range = NULL;
|
|
|
|
|
2005-03-13 00:49:33 +00:00
|
|
|
typedef void (*ReqRespDissector)(tvbuff_t*, proto_tree*, int, const guchar*,
|
2007-03-13 20:42:04 +00:00
|
|
|
const guchar*, http_conv_t *);
|
2003-06-10 22:07:18 +00:00
|
|
|
|
2003-11-18 07:49:52 +00:00
|
|
|
/*
|
2003-12-23 02:29:11 +00:00
|
|
|
* Structure holding information from headers needed by main
|
2003-11-18 07:49:52 +00:00
|
|
|
* HTTP dissector code.
|
|
|
|
*/
|
|
|
|
typedef struct {
|
|
|
|
char *content_type;
|
2004-01-16 01:32:20 +00:00
|
|
|
char *content_type_parameters;
|
2005-01-13 07:47:26 +00:00
|
|
|
gboolean have_content_length;
|
2010-04-09 01:42:12 +00:00
|
|
|
gint64 content_length;
|
2004-02-21 01:31:56 +00:00
|
|
|
char *content_encoding;
|
|
|
|
char *transfer_encoding;
|
2003-12-23 02:29:11 +00:00
|
|
|
} headers_t;
|
2003-11-18 07:49:52 +00:00
|
|
|
|
2005-03-13 00:49:33 +00:00
|
|
|
static int is_http_request_or_reply(const gchar *data, int linelen,
|
2007-03-13 20:42:04 +00:00
|
|
|
http_type_t *type, ReqRespDissector
|
|
|
|
*reqresp_dissector, http_conv_t *conv_data);
|
2009-09-14 17:36:15 +00:00
|
|
|
static int chunked_encoding_dissector(tvbuff_t **tvb_ptr, packet_info *pinfo,
|
2010-09-21 02:12:21 +00:00
|
|
|
proto_tree *tree, int offset);
|
2003-12-23 02:29:11 +00:00
|
|
|
static void process_header(tvbuff_t *tvb, int offset, int next_offset,
|
2010-09-21 02:12:21 +00:00
|
|
|
const guchar *line, int linelen, int colon_offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree,
|
|
|
|
headers_t *eh_ptr, http_conv_t *conv_data);
|
2003-11-06 08:54:31 +00:00
|
|
|
static gint find_header_hf_value(tvbuff_t *tvb, int offset, guint header_len);
|
|
|
|
static gboolean check_auth_ntlmssp(proto_item *hdr_item, tvbuff_t *tvb,
|
2010-09-21 02:12:21 +00:00
|
|
|
packet_info *pinfo, gchar *value);
|
2003-11-06 08:54:31 +00:00
|
|
|
static gboolean check_auth_basic(proto_item *hdr_item, tvbuff_t *tvb,
|
2010-09-21 02:12:21 +00:00
|
|
|
gchar *value);
|
2010-10-25 02:17:41 +00:00
|
|
|
static gboolean check_auth_kerberos(proto_item *hdr_item, tvbuff_t *tvb,
|
|
|
|
packet_info *pinfo, const gchar *value);
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2003-11-18 07:49:52 +00:00
|
|
|
static dissector_table_t port_subdissector_table;
|
2003-12-07 03:21:22 +00:00
|
|
|
static dissector_table_t media_type_subdissector_table;
|
2001-11-18 02:28:15 +00:00
|
|
|
static heur_dissector_list_t heur_subdissector_list;
|
2000-11-15 08:27:14 +00:00
|
|
|
|
2008-09-26 20:06:40 +00:00
|
|
|
static dissector_handle_t ntlmssp_handle;
|
|
|
|
static dissector_handle_t gssapi_handle;
|
2002-08-13 05:36:02 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
static const value_string vals_status_code[] = {
|
|
|
|
{ 100, "Continue" },
|
|
|
|
{ 101, "Switching Protocols" },
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 102, "Processing" },
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 199, "Informational - Others" },
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 200, "OK"},
|
|
|
|
{ 201, "Created"},
|
|
|
|
{ 202, "Accepted"},
|
|
|
|
{ 203, "Non-authoritative Information"},
|
|
|
|
{ 204, "No Content"},
|
|
|
|
{ 205, "Reset Content"},
|
|
|
|
{ 206, "Partial Content"},
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 207, "Multi-Status"},
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 299, "Success - Others"},
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 300, "Multiple Choices"},
|
|
|
|
{ 301, "Moved Permanently"},
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 302, "Found"},
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 303, "See Other"},
|
|
|
|
{ 304, "Not Modified"},
|
|
|
|
{ 305, "Use Proxy"},
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 307, "Temporary Redirect"},
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 399, "Redirection - Others"},
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 400, "Bad Request"},
|
|
|
|
{ 401, "Unauthorized"},
|
|
|
|
{ 402, "Payment Required"},
|
|
|
|
{ 403, "Forbidden"},
|
|
|
|
{ 404, "Not Found"},
|
|
|
|
{ 405, "Method Not Allowed"},
|
|
|
|
{ 406, "Not Acceptable"},
|
|
|
|
{ 407, "Proxy Authentication Required"},
|
|
|
|
{ 408, "Request Time-out"},
|
|
|
|
{ 409, "Conflict"},
|
|
|
|
{ 410, "Gone"},
|
|
|
|
{ 411, "Length Required"},
|
|
|
|
{ 412, "Precondition Failed"},
|
|
|
|
{ 413, "Request Entity Too Large"},
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 414, "Request-URI Too Long"},
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 415, "Unsupported Media Type"},
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 416, "Requested Range Not Satisfiable"},
|
|
|
|
{ 417, "Expectation Failed"},
|
2010-09-21 02:12:21 +00:00
|
|
|
{ 418, "I'm a teapot"}, /* RFC 2324 */
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 422, "Unprocessable Entity"},
|
|
|
|
{ 423, "Locked"},
|
|
|
|
{ 424, "Failed Dependency"},
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 499, "Client Error - Others"},
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 500, "Internal Server Error"},
|
|
|
|
{ 501, "Not Implemented"},
|
|
|
|
{ 502, "Bad Gateway"},
|
|
|
|
{ 503, "Service Unavailable"},
|
|
|
|
{ 504, "Gateway Time-out"},
|
|
|
|
{ 505, "HTTP Version not supported"},
|
2006-03-30 10:16:35 +00:00
|
|
|
{ 507, "Insufficient Storage"},
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 599, "Server Error - Others"},
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
{ 0, NULL}
|
|
|
|
};
|
|
|
|
|
|
|
|
static const gchar* st_str_reqs = "HTTP Requests by Server";
|
|
|
|
static const gchar* st_str_reqs_by_srv_addr = "HTTP Requests by Server Address";
|
|
|
|
static const gchar* st_str_reqs_by_http_host = "HTTP Requests by HTTP Host";
|
|
|
|
static const gchar* st_str_resps_by_srv_addr = "HTTP Responses by Server Address";
|
|
|
|
|
|
|
|
static int st_node_reqs = -1;
|
|
|
|
static int st_node_reqs_by_srv_addr = -1;
|
|
|
|
static int st_node_reqs_by_http_host = -1;
|
|
|
|
static int st_node_resps_by_srv_addr = -1;
|
|
|
|
|
2007-02-19 05:21:12 +00:00
|
|
|
/* HTTP/Load Distribution stats init function */
|
2008-07-11 21:13:39 +00:00
|
|
|
static void
|
|
|
|
http_reqs_stats_tree_init(stats_tree* st)
|
|
|
|
{
|
2005-07-24 01:42:41 +00:00
|
|
|
st_node_reqs = stats_tree_create_node(st, st_str_reqs, 0, TRUE);
|
|
|
|
st_node_reqs_by_srv_addr = stats_tree_create_node(st, st_str_reqs_by_srv_addr, st_node_reqs, TRUE);
|
|
|
|
st_node_reqs_by_http_host = stats_tree_create_node(st, st_str_reqs_by_http_host, st_node_reqs, TRUE);
|
|
|
|
st_node_resps_by_srv_addr = stats_tree_create_node(st, st_str_resps_by_srv_addr, 0, TRUE);
|
|
|
|
}
|
|
|
|
|
2007-02-19 05:21:12 +00:00
|
|
|
/* HTTP/Load Distribution stats packet function */
|
2008-07-11 21:13:39 +00:00
|
|
|
static int
|
|
|
|
http_reqs_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t* edt _U_, const void* p)
|
|
|
|
{
|
2005-07-24 01:42:41 +00:00
|
|
|
const http_info_value_t* v = p;
|
|
|
|
int reqs_by_this_host;
|
|
|
|
int reqs_by_this_addr;
|
|
|
|
int resps_by_this_addr;
|
|
|
|
int i = v->response_code;
|
2011-03-26 01:21:43 +00:00
|
|
|
gchar *ip_str;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if (v->request_method) {
|
2011-03-26 01:21:43 +00:00
|
|
|
ip_str = ep_address_to_str(&pinfo->dst);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
tick_stat_node(st, st_str_reqs, 0, FALSE);
|
|
|
|
tick_stat_node(st, st_str_reqs_by_srv_addr, st_node_reqs, TRUE);
|
|
|
|
tick_stat_node(st, st_str_reqs_by_http_host, st_node_reqs, TRUE);
|
|
|
|
reqs_by_this_addr = tick_stat_node(st, ip_str, st_node_reqs_by_srv_addr, TRUE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if (v->http_host) {
|
|
|
|
reqs_by_this_host = tick_stat_node(st, v->http_host, st_node_reqs_by_http_host, TRUE);
|
|
|
|
tick_stat_node(st, ip_str, reqs_by_this_host, FALSE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
tick_stat_node(st, v->http_host, reqs_by_this_addr, FALSE);
|
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
return 1;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
} else if (i != 0) {
|
2011-03-26 01:21:43 +00:00
|
|
|
ip_str = ep_address_to_str(&pinfo->src);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
tick_stat_node(st, st_str_resps_by_srv_addr, 0, FALSE);
|
|
|
|
resps_by_this_addr = tick_stat_node(st, ip_str, st_node_resps_by_srv_addr, TRUE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if ( (i>100)&&(i<400) ) {
|
|
|
|
tick_stat_node(st, "OK", resps_by_this_addr, FALSE);
|
|
|
|
} else {
|
|
|
|
tick_stat_node(st, "KO", resps_by_this_addr, FALSE);
|
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int st_node_requests_by_host = -1;
|
2008-07-11 21:13:39 +00:00
|
|
|
static const gchar *st_str_requests_by_host = "HTTP Requests by HTTP Host";
|
2005-07-24 01:42:41 +00:00
|
|
|
|
2007-02-19 05:21:12 +00:00
|
|
|
/* HTTP/Requests stats init function */
|
2008-07-11 21:13:39 +00:00
|
|
|
static void
|
|
|
|
http_req_stats_tree_init(stats_tree* st)
|
|
|
|
{
|
2005-07-24 01:42:41 +00:00
|
|
|
st_node_requests_by_host = stats_tree_create_node(st, st_str_requests_by_host, 0, TRUE);
|
|
|
|
}
|
|
|
|
|
2007-02-19 05:21:12 +00:00
|
|
|
/* HTTP/Requests stats packet function */
|
2008-07-11 21:13:39 +00:00
|
|
|
static int
|
|
|
|
http_req_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p)
|
|
|
|
{
|
2005-07-24 01:42:41 +00:00
|
|
|
const http_info_value_t* v = p;
|
|
|
|
int reqs_by_this_host;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if (v->request_method) {
|
|
|
|
tick_stat_node(st, st_str_requests_by_host, 0, FALSE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if (v->http_host) {
|
|
|
|
reqs_by_this_host = tick_stat_node(st, v->http_host, st_node_requests_by_host, TRUE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if (v->request_uri) {
|
|
|
|
tick_stat_node(st, v->request_uri, reqs_by_this_host, TRUE);
|
|
|
|
}
|
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-07-11 21:13:39 +00:00
|
|
|
static const gchar *st_str_packets = "Total HTTP Packets";
|
|
|
|
static const gchar *st_str_requests = "HTTP Request Packets";
|
|
|
|
static const gchar *st_str_responses = "HTTP Response Packets";
|
|
|
|
static const gchar *st_str_resp_broken = "???: broken";
|
|
|
|
static const gchar *st_str_resp_100 = "1xx: Informational";
|
|
|
|
static const gchar *st_str_resp_200 = "2xx: Success";
|
|
|
|
static const gchar *st_str_resp_300 = "3xx: Redirection";
|
|
|
|
static const gchar *st_str_resp_400 = "4xx: Client Error";
|
|
|
|
static const gchar *st_str_resp_500 = "5xx: Server Error";
|
|
|
|
static const gchar *st_str_other = "Other HTTP Packets";
|
2005-07-24 01:42:41 +00:00
|
|
|
|
|
|
|
static int st_node_packets = -1;
|
|
|
|
static int st_node_requests = -1;
|
|
|
|
static int st_node_responses = -1;
|
|
|
|
static int st_node_resp_broken = -1;
|
|
|
|
static int st_node_resp_100 = -1;
|
|
|
|
static int st_node_resp_200 = -1;
|
|
|
|
static int st_node_resp_300 = -1;
|
|
|
|
static int st_node_resp_400 = -1;
|
|
|
|
static int st_node_resp_500 = -1;
|
|
|
|
static int st_node_other = -1;
|
|
|
|
|
|
|
|
|
2007-02-19 05:21:12 +00:00
|
|
|
/* HTTP/Packet Counter stats init function */
|
2008-07-11 21:13:39 +00:00
|
|
|
static void
|
|
|
|
http_stats_tree_init(stats_tree* st)
|
|
|
|
{
|
2006-08-24 22:05:26 +00:00
|
|
|
st_node_packets = stats_tree_create_node(st, st_str_packets, 0, TRUE);
|
2005-07-24 01:42:41 +00:00
|
|
|
st_node_requests = stats_tree_create_pivot(st, st_str_requests, st_node_packets);
|
|
|
|
st_node_responses = stats_tree_create_node(st, st_str_responses, st_node_packets, TRUE);
|
|
|
|
st_node_resp_broken = stats_tree_create_node(st, st_str_resp_broken, st_node_responses, TRUE);
|
|
|
|
st_node_resp_100 = stats_tree_create_node(st, st_str_resp_100, st_node_responses, TRUE);
|
|
|
|
st_node_resp_200 = stats_tree_create_node(st, st_str_resp_200, st_node_responses, TRUE);
|
|
|
|
st_node_resp_300 = stats_tree_create_node(st, st_str_resp_300, st_node_responses, TRUE);
|
|
|
|
st_node_resp_400 = stats_tree_create_node(st, st_str_resp_400, st_node_responses, TRUE);
|
|
|
|
st_node_resp_500 = stats_tree_create_node(st, st_str_resp_500, st_node_responses, TRUE);
|
|
|
|
st_node_other = stats_tree_create_node(st, st_str_other, st_node_packets,FALSE);
|
|
|
|
}
|
|
|
|
|
2007-02-19 05:21:12 +00:00
|
|
|
/* HTTP/Packet Counter stats packet function */
|
2008-07-11 21:13:39 +00:00
|
|
|
static int
|
|
|
|
http_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p)
|
|
|
|
{
|
2005-07-24 01:42:41 +00:00
|
|
|
const http_info_value_t* v = p;
|
|
|
|
guint i = v->response_code;
|
|
|
|
int resp_grp;
|
2008-07-12 01:48:24 +00:00
|
|
|
const gchar *resp_str;
|
2011-03-26 01:21:43 +00:00
|
|
|
gchar str[64];
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
tick_stat_node(st, st_str_packets, 0, FALSE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if (i) {
|
|
|
|
tick_stat_node(st, st_str_responses, st_node_packets, FALSE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
if ( (i<100)||(i>=600) ) {
|
|
|
|
resp_grp = st_node_resp_broken;
|
|
|
|
resp_str = st_str_resp_broken;
|
|
|
|
} else if (i<200) {
|
|
|
|
resp_grp = st_node_resp_100;
|
|
|
|
resp_str = st_str_resp_100;
|
|
|
|
} else if (i<300) {
|
|
|
|
resp_grp = st_node_resp_200;
|
|
|
|
resp_str = st_str_resp_200;
|
|
|
|
} else if (i<400) {
|
|
|
|
resp_grp = st_node_resp_300;
|
|
|
|
resp_str = st_str_resp_300;
|
|
|
|
} else if (i<500) {
|
|
|
|
resp_grp = st_node_resp_400;
|
|
|
|
resp_str = st_str_resp_400;
|
|
|
|
} else {
|
|
|
|
resp_grp = st_node_resp_500;
|
|
|
|
resp_str = st_str_resp_500;
|
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
tick_stat_node(st, resp_str, st_node_responses, FALSE);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2011-03-26 01:21:43 +00:00
|
|
|
g_snprintf(str, sizeof(str), "%u %s", i,
|
|
|
|
val_to_str(i, vals_status_code, "Unknown (%d)"));
|
2005-07-24 01:42:41 +00:00
|
|
|
tick_stat_node(st, str, resp_grp, FALSE);
|
|
|
|
} else if (v->request_method) {
|
|
|
|
stats_tree_tick_pivot(st,st_node_requests,v->request_method);
|
|
|
|
} else {
|
2006-08-24 22:05:26 +00:00
|
|
|
tick_stat_node(st, st_str_other, st_node_packets, FALSE);
|
2005-07-24 01:42:41 +00:00
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
return 1;
|
|
|
|
}
|
2003-09-02 22:47:59 +00:00
|
|
|
|
2002-08-13 05:36:02 +00:00
|
|
|
static void
|
2002-10-15 22:28:35 +00:00
|
|
|
dissect_http_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
|
2010-09-21 02:12:21 +00:00
|
|
|
const char *line)
|
2002-08-13 05:36:02 +00:00
|
|
|
{
|
|
|
|
tvbuff_t *ntlmssp_tvb;
|
|
|
|
|
2009-05-13 19:46:11 +00:00
|
|
|
ntlmssp_tvb = base64_to_tvb(tvb, line);
|
2004-10-29 08:01:11 +00:00
|
|
|
add_new_data_source(pinfo, ntlmssp_tvb, "NTLMSSP / GSSAPI Data");
|
|
|
|
if (tvb_strneql(ntlmssp_tvb, 0, "NTLMSSP", 7) == 0)
|
|
|
|
call_dissector(ntlmssp_handle, ntlmssp_tvb, pinfo, tree);
|
|
|
|
else
|
|
|
|
call_dissector(gssapi_handle, ntlmssp_tvb, pinfo, tree);
|
2002-08-13 05:36:02 +00:00
|
|
|
}
|
|
|
|
|
2010-10-25 02:17:41 +00:00
|
|
|
static void
|
|
|
|
dissect_http_kerberos(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
|
|
|
|
const char *line)
|
|
|
|
{
|
|
|
|
tvbuff_t *kerberos_tvb;
|
|
|
|
|
|
|
|
kerberos_tvb = base64_to_tvb(tvb, line + 9); /* skip 'Kerberos ' which is 9 chars */
|
|
|
|
add_new_data_source(pinfo, kerberos_tvb, "Kerberos Data");
|
|
|
|
call_dissector(gssapi_handle, kerberos_tvb, pinfo, tree);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
static http_conv_t *
|
|
|
|
get_http_conversation_data(packet_info *pinfo)
|
|
|
|
{
|
|
|
|
conversation_t *conversation;
|
|
|
|
http_conv_t *conv_data;
|
|
|
|
|
2010-05-13 18:28:34 +00:00
|
|
|
conversation = find_or_create_conversation(pinfo);
|
2007-12-26 18:28:31 +00:00
|
|
|
|
|
|
|
/* Retrieve information from conversation
|
|
|
|
* or add it if it isn't there yet
|
|
|
|
*/
|
|
|
|
conv_data = conversation_get_proto_data(conversation, proto_http);
|
|
|
|
if(!conv_data) {
|
|
|
|
/* Setup the conversation structure itself */
|
2009-05-19 00:17:23 +00:00
|
|
|
conv_data = se_alloc0(sizeof(http_conv_t));
|
2007-12-26 18:28:31 +00:00
|
|
|
|
|
|
|
conversation_add_proto_data(conversation, proto_http,
|
|
|
|
conv_data);
|
|
|
|
}
|
|
|
|
|
|
|
|
return conv_data;
|
|
|
|
}
|
|
|
|
|
2003-12-23 02:02:09 +00:00
|
|
|
/*
|
|
|
|
* TODO: remove this ugly global variable.
|
2005-03-13 00:49:33 +00:00
|
|
|
* XXX: do we really want to have to pass this from one function to another?
|
2003-12-23 02:02:09 +00:00
|
|
|
*/
|
|
|
|
static http_info_value_t *stat_info;
|
|
|
|
|
|
|
|
static int
|
|
|
|
dissect_http_message(tvbuff_t *tvb, int offset, packet_info *pinfo,
|
2010-09-21 02:12:21 +00:00
|
|
|
proto_tree *tree, http_conv_t *conv_data)
|
1999-02-12 09:03:42 +00:00
|
|
|
{
|
2005-07-30 16:34:38 +00:00
|
|
|
const char *proto_tag;
|
2000-11-09 10:56:33 +00:00
|
|
|
proto_tree *http_tree = NULL;
|
|
|
|
proto_item *ti = NULL;
|
2008-05-13 01:23:37 +00:00
|
|
|
proto_item *hidden_item;
|
2002-08-02 23:36:07 +00:00
|
|
|
const guchar *line;
|
2000-11-09 10:56:33 +00:00
|
|
|
gint next_offset;
|
2002-08-02 23:36:07 +00:00
|
|
|
const guchar *linep, *lineend;
|
2003-12-23 02:02:09 +00:00
|
|
|
int orig_offset;
|
2003-10-27 09:17:21 +00:00
|
|
|
int first_linelen, linelen;
|
|
|
|
gboolean is_request_or_reply;
|
2003-12-28 08:39:10 +00:00
|
|
|
gboolean saw_req_resp_or_header;
|
2002-08-02 23:36:07 +00:00
|
|
|
guchar c;
|
2000-11-09 10:56:33 +00:00
|
|
|
http_type_t http_type;
|
2005-03-20 00:07:07 +00:00
|
|
|
proto_item *hdr_item = NULL;
|
2005-03-13 00:49:33 +00:00
|
|
|
ReqRespDissector reqresp_dissector;
|
2003-10-27 09:17:21 +00:00
|
|
|
proto_tree *req_tree;
|
2003-11-06 08:54:31 +00:00
|
|
|
int colon_offset;
|
2003-12-23 02:29:11 +00:00
|
|
|
headers_t headers;
|
2003-12-23 01:42:48 +00:00
|
|
|
int datalen;
|
2004-12-25 13:49:30 +00:00
|
|
|
int reported_datalen = -1;
|
2003-11-18 07:49:52 +00:00
|
|
|
dissector_handle_t handle;
|
2011-03-24 02:49:05 +00:00
|
|
|
gboolean dissected = FALSE;
|
2005-07-25 01:22:03 +00:00
|
|
|
/*guint i;*/
|
|
|
|
/*http_info_value_t *si;*/
|
2007-03-13 20:42:04 +00:00
|
|
|
http_eo_t *eo_info;
|
|
|
|
|
2003-10-27 09:17:21 +00:00
|
|
|
/*
|
|
|
|
* Is this a request or response?
|
|
|
|
*
|
|
|
|
* Note that "tvb_find_line_end()" will return a value that
|
|
|
|
* is not longer than what's in the buffer, so the
|
|
|
|
* "tvb_get_ptr()" call won't throw an exception.
|
|
|
|
*/
|
2003-12-24 09:50:54 +00:00
|
|
|
first_linelen = tvb_find_line_end(tvb, offset,
|
|
|
|
tvb_ensure_length_remaining(tvb, offset), &next_offset,
|
2003-12-27 01:42:56 +00:00
|
|
|
FALSE);
|
|
|
|
/*
|
|
|
|
* Is the first line a request or response?
|
|
|
|
*/
|
2003-10-27 09:17:21 +00:00
|
|
|
line = tvb_get_ptr(tvb, offset, first_linelen);
|
|
|
|
http_type = HTTP_OTHERS; /* type not known yet */
|
2004-01-16 01:32:20 +00:00
|
|
|
is_request_or_reply = is_http_request_or_reply((const gchar *)line,
|
2007-03-13 20:42:04 +00:00
|
|
|
first_linelen, &http_type, NULL, conv_data);
|
2003-10-27 09:17:21 +00:00
|
|
|
if (is_request_or_reply) {
|
2004-01-16 01:32:20 +00:00
|
|
|
/*
|
2003-10-27 09:17:21 +00:00
|
|
|
* Yes, it's a request or response.
|
2003-12-22 00:57:34 +00:00
|
|
|
* Do header desegmentation if we've been told to,
|
|
|
|
* and do body desegmentation if we've been told to and
|
|
|
|
* we find a Content-Length header.
|
2003-10-27 09:17:21 +00:00
|
|
|
*/
|
2005-01-20 04:37:03 +00:00
|
|
|
if (!req_resp_hdrs_do_reassembly(tvb, offset, pinfo,
|
2003-12-23 02:29:11 +00:00
|
|
|
http_desegment_headers, http_desegment_body)) {
|
2003-12-22 00:57:34 +00:00
|
|
|
/*
|
|
|
|
* More data needed for desegmentation.
|
|
|
|
*/
|
2003-12-23 02:02:09 +00:00
|
|
|
return -1;
|
2003-10-27 09:17:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-13 20:42:04 +00:00
|
|
|
stat_info = ep_alloc(sizeof(http_info_value_t));
|
|
|
|
stat_info->framenum = pinfo->fd->num;
|
|
|
|
stat_info->response_code = 0;
|
|
|
|
stat_info->request_method = NULL;
|
|
|
|
stat_info->request_uri = NULL;
|
|
|
|
stat_info->http_host = NULL;
|
2005-02-28 22:27:24 +00:00
|
|
|
|
2010-12-20 05:35:29 +00:00
|
|
|
switch (pinfo->match_uint) {
|
2001-01-03 03:40:29 +00:00
|
|
|
|
2001-01-11 05:36:09 +00:00
|
|
|
case TCP_PORT_SSDP: /* TCP_PORT_SSDP = UDP_PORT_SSDP */
|
2001-01-03 03:40:29 +00:00
|
|
|
proto_tag = "SSDP";
|
|
|
|
break;
|
|
|
|
|
2006-08-24 22:05:26 +00:00
|
|
|
case TCP_PORT_DAAP:
|
2004-08-22 03:04:54 +00:00
|
|
|
proto_tag = "DAAP";
|
|
|
|
break;
|
|
|
|
|
2001-01-03 03:40:29 +00:00
|
|
|
default:
|
|
|
|
proto_tag = "HTTP";
|
|
|
|
break;
|
|
|
|
}
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2009-09-14 17:36:15 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL))
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, proto_tag);
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_INFO)) {
|
1999-02-12 09:03:42 +00:00
|
|
|
/*
|
2000-11-09 10:56:33 +00:00
|
|
|
* Put the first line from the buffer into the summary
|
2000-09-30 05:37:07 +00:00
|
|
|
* if it's an HTTP request or reply (but leave out the
|
2000-11-09 10:56:33 +00:00
|
|
|
* line terminator).
|
1999-02-12 09:03:42 +00:00
|
|
|
* Otherwise, just call it a continuation.
|
2001-01-22 08:54:08 +00:00
|
|
|
*
|
|
|
|
* Note that "tvb_find_line_end()" will return a value that
|
|
|
|
* is not longer than what's in the buffer, so the
|
|
|
|
* "tvb_get_ptr()" call won't throw an exception.
|
1999-02-12 09:03:42 +00:00
|
|
|
*/
|
2007-11-27 21:24:39 +00:00
|
|
|
if (is_request_or_reply) {
|
|
|
|
line = tvb_get_ptr(tvb, offset, first_linelen);
|
2008-03-08 21:17:43 +00:00
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "%s ", format_text(line, first_linelen));
|
2007-11-27 21:24:39 +00:00
|
|
|
}
|
1999-02-12 09:03:42 +00:00
|
|
|
else
|
2004-12-15 09:10:07 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_INFO, "Continuation or non-HTTP traffic");
|
1999-02-12 09:03:42 +00:00
|
|
|
}
|
|
|
|
|
2003-12-23 02:02:09 +00:00
|
|
|
orig_offset = offset;
|
1999-02-12 09:03:42 +00:00
|
|
|
if (tree) {
|
2002-01-24 09:20:54 +00:00
|
|
|
ti = proto_tree_add_item(tree, proto_http, tvb, offset, -1,
|
|
|
|
FALSE);
|
1999-11-16 11:44:20 +00:00
|
|
|
http_tree = proto_item_add_subtree(ti, ett_http);
|
2001-01-11 06:30:54 +00:00
|
|
|
}
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
|
|
|
* Process the packet data, a line at a time.
|
|
|
|
*/
|
|
|
|
http_type = HTTP_OTHERS; /* type not known yet */
|
2003-12-23 02:29:11 +00:00
|
|
|
headers.content_type = NULL; /* content type not known yet */
|
2004-01-16 01:32:20 +00:00
|
|
|
headers.content_type_parameters = NULL; /* content type parameters too */
|
2005-01-13 07:47:26 +00:00
|
|
|
headers.have_content_length = FALSE; /* content length not known yet */
|
2007-03-22 15:19:49 +00:00
|
|
|
headers.content_length = 0; /* content length set to 0 (avoid a gcc warning) */
|
2004-02-21 01:31:56 +00:00
|
|
|
headers.content_encoding = NULL; /* content encoding not known yet */
|
|
|
|
headers.transfer_encoding = NULL; /* transfer encoding not known yet */
|
2003-12-28 08:39:10 +00:00
|
|
|
saw_req_resp_or_header = FALSE; /* haven't seen anything yet */
|
2003-12-24 09:50:54 +00:00
|
|
|
while (tvb_reported_length_remaining(tvb, offset) != 0) {
|
2000-11-09 10:56:33 +00:00
|
|
|
/*
|
2001-01-11 06:30:54 +00:00
|
|
|
* Find the end of the line.
|
2005-03-13 00:49:33 +00:00
|
|
|
* XXX - what if we don't find it because the packet
|
|
|
|
* is cut short by a snapshot length or the header is
|
|
|
|
* split across TCP segments? How much dissection should
|
|
|
|
* we do on it?
|
2000-11-09 10:56:33 +00:00
|
|
|
*/
|
2003-12-24 09:50:54 +00:00
|
|
|
linelen = tvb_find_line_end(tvb, offset,
|
|
|
|
tvb_ensure_length_remaining(tvb, offset), &next_offset,
|
2002-07-17 06:55:29 +00:00
|
|
|
FALSE);
|
2003-12-24 09:50:54 +00:00
|
|
|
if (linelen < 0)
|
|
|
|
return -1;
|
2000-11-09 10:56:33 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
|
|
|
* Get a buffer that refers to the line.
|
|
|
|
*/
|
|
|
|
line = tvb_get_ptr(tvb, offset, linelen);
|
|
|
|
lineend = line + linelen;
|
2003-11-06 08:54:31 +00:00
|
|
|
colon_offset = -1;
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
|
|
|
* OK, does it look like an HTTP request or response?
|
|
|
|
*/
|
2005-03-13 00:49:33 +00:00
|
|
|
reqresp_dissector = NULL;
|
|
|
|
is_request_or_reply =
|
|
|
|
is_http_request_or_reply((const gchar *)line,
|
2007-03-13 20:42:04 +00:00
|
|
|
linelen, &http_type, &reqresp_dissector, conv_data);
|
2003-11-06 08:54:31 +00:00
|
|
|
if (is_request_or_reply)
|
2001-01-11 06:30:54 +00:00
|
|
|
goto is_http;
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
|
|
|
* No. Does it look like a blank line (as would appear
|
|
|
|
* at the end of an HTTP request)?
|
|
|
|
*/
|
|
|
|
if (linelen == 0)
|
2003-12-27 08:35:08 +00:00
|
|
|
goto is_http; /* Yes. */
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
2003-12-23 02:29:11 +00:00
|
|
|
* No. Does it look like a header?
|
2001-01-11 06:30:54 +00:00
|
|
|
*/
|
|
|
|
linep = line;
|
2003-11-06 08:54:31 +00:00
|
|
|
colon_offset = offset;
|
2001-01-11 06:30:54 +00:00
|
|
|
while (linep < lineend) {
|
|
|
|
c = *linep++;
|
2003-02-24 01:17:45 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This must be a CHAR to be part of a token; that
|
|
|
|
* means it must be ASCII.
|
|
|
|
*/
|
|
|
|
if (!isascii(c))
|
|
|
|
break; /* not ASCII, thus not a CHAR */
|
|
|
|
|
|
|
|
/*
|
2004-07-09 23:37:40 +00:00
|
|
|
* This mustn't be a CTL to be part of a token.
|
2003-12-23 02:29:11 +00:00
|
|
|
*
|
|
|
|
* XXX - what about leading LWS on continuation
|
|
|
|
* lines of a header?
|
2003-02-24 01:17:45 +00:00
|
|
|
*/
|
2004-07-09 23:37:40 +00:00
|
|
|
if (iscntrl(c))
|
|
|
|
break; /* CTL, not part of a header */
|
2003-02-24 01:17:45 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This mustn't be a SEP to be part of a token;
|
|
|
|
* a ':' ends the token, everything else is an
|
|
|
|
* indication that this isn't a header.
|
|
|
|
*/
|
2001-01-11 06:30:54 +00:00
|
|
|
switch (c) {
|
|
|
|
|
|
|
|
case '(':
|
|
|
|
case ')':
|
|
|
|
case '<':
|
|
|
|
case '>':
|
|
|
|
case '@':
|
|
|
|
case ',':
|
|
|
|
case ';':
|
|
|
|
case '\\':
|
|
|
|
case '"':
|
|
|
|
case '/':
|
|
|
|
case '[':
|
|
|
|
case ']':
|
|
|
|
case '?':
|
|
|
|
case '=':
|
|
|
|
case '{':
|
|
|
|
case '}':
|
2003-02-24 01:17:45 +00:00
|
|
|
case ' ':
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
2003-02-24 01:17:45 +00:00
|
|
|
* It's a separator, so it's not part of a
|
2001-01-11 06:30:54 +00:00
|
|
|
* token, so it's not a field name for the
|
2003-12-23 02:29:11 +00:00
|
|
|
* beginning of a header.
|
2003-02-24 01:17:45 +00:00
|
|
|
*
|
|
|
|
* (We don't have to check for HT; that's
|
2004-07-09 23:37:40 +00:00
|
|
|
* already been ruled out by "iscntrl()".)
|
2001-01-11 06:30:54 +00:00
|
|
|
*/
|
|
|
|
goto not_http;
|
|
|
|
|
|
|
|
case ':':
|
|
|
|
/*
|
|
|
|
* This ends the token; we consider this
|
2003-12-23 02:29:11 +00:00
|
|
|
* to be a header.
|
2001-01-11 06:30:54 +00:00
|
|
|
*/
|
|
|
|
goto is_http;
|
2003-11-06 08:54:31 +00:00
|
|
|
|
|
|
|
default:
|
|
|
|
colon_offset++;
|
|
|
|
break;
|
1999-02-12 09:03:42 +00:00
|
|
|
}
|
2001-01-11 06:30:54 +00:00
|
|
|
}
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2003-12-28 08:39:10 +00:00
|
|
|
/*
|
|
|
|
* We haven't seen the colon, but everything else looks
|
|
|
|
* OK for a header line.
|
|
|
|
*
|
|
|
|
* If we've already seen an HTTP request or response
|
|
|
|
* line, or a header line, and we're at the end of
|
|
|
|
* the tvbuff, we assume this is an incomplete header
|
|
|
|
* line. (We quit this loop after seeing a blank line,
|
|
|
|
* so if we've seen a request or response line, or a
|
|
|
|
* header line, this is probably more of the request
|
|
|
|
* or response we're presumably seeing. There is some
|
|
|
|
* risk of false positives, but the same applies for
|
|
|
|
* full request or response lines or header lines,
|
|
|
|
* although that's less likely.)
|
|
|
|
*
|
|
|
|
* We throw an exception in that case, by checking for
|
|
|
|
* the existence of the next byte after the last one
|
|
|
|
* in the line. If it exists, "tvb_ensure_bytes_exist()"
|
|
|
|
* throws no exception, and we fall through to the
|
|
|
|
* "not HTTP" case. If it doesn't exist,
|
|
|
|
* "tvb_ensure_bytes_exist()" will throw the appropriate
|
|
|
|
* exception.
|
|
|
|
*/
|
|
|
|
if (saw_req_resp_or_header)
|
|
|
|
tvb_ensure_bytes_exist(tvb, offset, linelen + 1);
|
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
not_http:
|
|
|
|
/*
|
|
|
|
* We don't consider this part of an HTTP request or
|
|
|
|
* reply, so we don't display it.
|
|
|
|
* (Yeah, that means we don't display, say, a text/http
|
|
|
|
* page, but you can get that from the data pane.)
|
|
|
|
*/
|
|
|
|
break;
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
is_http:
|
|
|
|
/*
|
2003-11-06 08:54:31 +00:00
|
|
|
* Process this line.
|
2001-01-11 06:30:54 +00:00
|
|
|
*/
|
2004-01-01 23:34:06 +00:00
|
|
|
if (linelen == 0) {
|
|
|
|
/*
|
|
|
|
* This is a blank line, which means that
|
|
|
|
* whatever follows it isn't part of this
|
|
|
|
* request or reply.
|
|
|
|
*/
|
|
|
|
proto_tree_add_text(http_tree, tvb, offset,
|
|
|
|
next_offset - offset, "%s",
|
|
|
|
tvb_format_text(tvb, offset, next_offset - offset));
|
|
|
|
offset = next_offset;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Not a blank line - either a request, a reply, or a header
|
|
|
|
* line.
|
2004-05-09 09:07:33 +00:00
|
|
|
*/
|
2004-01-01 23:34:06 +00:00
|
|
|
saw_req_resp_or_header = TRUE;
|
2003-11-06 08:54:31 +00:00
|
|
|
if (is_request_or_reply) {
|
2007-11-27 21:24:39 +00:00
|
|
|
char *text = tvb_format_text(tvb, offset, next_offset - offset);
|
2003-11-06 08:54:31 +00:00
|
|
|
if (tree) {
|
|
|
|
hdr_item = proto_tree_add_text(http_tree, tvb,
|
2007-11-27 21:24:39 +00:00
|
|
|
offset, next_offset - offset, "%s", text);
|
2005-03-20 00:07:07 +00:00
|
|
|
}
|
2007-11-27 21:24:39 +00:00
|
|
|
expert_add_info_format(pinfo, hdr_item, PI_SEQUENCE, PI_CHAT, "%s", text);
|
2005-03-20 00:07:07 +00:00
|
|
|
if (reqresp_dissector) {
|
|
|
|
if (tree) req_tree = proto_item_add_subtree(hdr_item, ett_http_request);
|
|
|
|
else req_tree = NULL;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2007-03-13 20:42:04 +00:00
|
|
|
reqresp_dissector(tvb, req_tree, offset, line,
|
|
|
|
lineend, conv_data);
|
2003-06-10 22:07:18 +00:00
|
|
|
}
|
2007-03-13 20:42:04 +00:00
|
|
|
|
2004-01-01 23:34:06 +00:00
|
|
|
} else {
|
2003-11-06 08:54:31 +00:00
|
|
|
/*
|
2003-12-23 02:29:11 +00:00
|
|
|
* Header.
|
2003-11-06 08:54:31 +00:00
|
|
|
*/
|
2003-12-23 02:29:11 +00:00
|
|
|
process_header(tvb, offset, next_offset, line, linelen,
|
2007-03-13 20:42:04 +00:00
|
|
|
colon_offset, pinfo, http_tree, &headers, conv_data);
|
2003-11-06 08:54:31 +00:00
|
|
|
}
|
2001-01-11 06:30:54 +00:00
|
|
|
offset = next_offset;
|
|
|
|
}
|
1999-02-12 09:03:42 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
if (tree && stat_info->http_host && stat_info->request_uri) {
|
|
|
|
proto_item *e_ti;
|
2010-09-21 02:41:29 +00:00
|
|
|
size_t size = strlen("http://") + strlen(stat_info->http_host)
|
2010-09-21 02:12:21 +00:00
|
|
|
+ strlen(stat_info->request_uri) + 1;
|
|
|
|
char *uri = ep_alloc(size);
|
|
|
|
|
2010-09-21 03:06:54 +00:00
|
|
|
g_snprintf(uri, (gulong)size, "%s://%s%s",
|
2010-09-21 02:12:21 +00:00
|
|
|
"http", /* XXX, https? */
|
|
|
|
stat_info->http_host, stat_info->request_uri);
|
|
|
|
|
|
|
|
e_ti = proto_tree_add_string(http_tree,
|
|
|
|
hf_http_request_full_uri, tvb, 0,
|
|
|
|
0, uri);
|
|
|
|
|
|
|
|
PROTO_ITEM_SET_URL(e_ti);
|
|
|
|
PROTO_ITEM_SET_GENERATED(e_ti);
|
|
|
|
}
|
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
if (tree) {
|
2000-02-23 19:47:14 +00:00
|
|
|
switch (http_type) {
|
2000-02-23 20:55:33 +00:00
|
|
|
|
2001-01-03 03:40:29 +00:00
|
|
|
case HTTP_NOTIFICATION:
|
2008-05-13 01:23:37 +00:00
|
|
|
hidden_item = proto_tree_add_boolean(http_tree,
|
|
|
|
hf_http_notification, tvb, 0, 0, 1);
|
2010-09-21 02:12:21 +00:00
|
|
|
PROTO_ITEM_SET_HIDDEN(hidden_item);
|
2001-01-03 03:40:29 +00:00
|
|
|
break;
|
|
|
|
|
2000-02-23 20:55:33 +00:00
|
|
|
case HTTP_RESPONSE:
|
2008-05-13 01:23:37 +00:00
|
|
|
hidden_item = proto_tree_add_boolean(http_tree,
|
|
|
|
hf_http_response, tvb, 0, 0, 1);
|
|
|
|
PROTO_ITEM_SET_HIDDEN(hidden_item);
|
2000-02-23 20:55:33 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case HTTP_REQUEST:
|
2008-05-13 01:23:37 +00:00
|
|
|
hidden_item = proto_tree_add_boolean(http_tree,
|
|
|
|
hf_http_request, tvb, 0, 0, 1);
|
2010-09-21 02:12:21 +00:00
|
|
|
PROTO_ITEM_SET_HIDDEN(hidden_item);
|
2000-02-23 20:55:33 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case HTTP_OTHERS:
|
|
|
|
default:
|
|
|
|
break;
|
2000-02-23 19:47:14 +00:00
|
|
|
}
|
2000-11-09 10:56:33 +00:00
|
|
|
}
|
2000-02-23 19:47:14 +00:00
|
|
|
|
2003-12-23 01:22:52 +00:00
|
|
|
/*
|
2003-12-23 01:42:48 +00:00
|
|
|
* If a content length was supplied, the amount of data to be
|
2003-12-27 08:35:08 +00:00
|
|
|
* processed as HTTP payload is the minimum of the content
|
2003-12-23 01:42:48 +00:00
|
|
|
* length and the amount of data remaining in the frame.
|
|
|
|
*
|
|
|
|
* If no content length was supplied (or if a bad content length
|
|
|
|
* was supplied), the amount of data to be processed is the amount
|
|
|
|
* of data remaining in the frame.
|
2003-12-23 01:22:52 +00:00
|
|
|
*
|
|
|
|
* If there was no Content-Length entity header, we should
|
|
|
|
* accumulate all data until the end of the connection.
|
|
|
|
* That'd require that the TCP dissector call subdissectors
|
|
|
|
* for all frames with FIN, even if they contain no data,
|
|
|
|
* which would require subdissectors to deal intelligently
|
|
|
|
* with empty segments.
|
2003-12-27 18:45:48 +00:00
|
|
|
*
|
|
|
|
* Acccording to RFC 2616, however, 1xx responses, 204 responses,
|
|
|
|
* and 304 responses MUST NOT include a message body; if no
|
|
|
|
* content length is specified for them, we don't attempt to
|
|
|
|
* dissect the body.
|
|
|
|
*
|
|
|
|
* XXX - it says the same about responses to HEAD requests;
|
|
|
|
* unless there's a way to determine from the response
|
|
|
|
* whether it's a response to a HEAD request, we have to
|
|
|
|
* keep information about the request and associate that with
|
|
|
|
* the response in order to handle that.
|
2003-12-23 01:22:52 +00:00
|
|
|
*/
|
2000-11-09 10:56:33 +00:00
|
|
|
datalen = tvb_length_remaining(tvb, offset);
|
2005-01-13 07:47:26 +00:00
|
|
|
if (headers.have_content_length && headers.content_length != -1) {
|
2003-12-23 02:29:11 +00:00
|
|
|
if (datalen > headers.content_length)
|
2010-04-09 02:00:07 +00:00
|
|
|
datalen = (int)headers.content_length;
|
2003-12-23 01:42:48 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* XXX - limit the reported length in the tvbuff we'll
|
|
|
|
* hand to a subdissector to be no greater than the
|
|
|
|
* content length.
|
|
|
|
*
|
|
|
|
* We really need both unreassembled and "how long it'd
|
|
|
|
* be if it were reassembled" lengths for tvbuffs, so
|
|
|
|
* that we throw the appropriate exceptions for
|
|
|
|
* "not enough data captured" (running past the length),
|
|
|
|
* "packet needed reassembly" (within the length but
|
|
|
|
* running past the unreassembled length), and
|
|
|
|
* "packet is malformed" (running past the reassembled
|
|
|
|
* length).
|
|
|
|
*/
|
|
|
|
reported_datalen = tvb_reported_length_remaining(tvb, offset);
|
2003-12-23 02:29:11 +00:00
|
|
|
if (reported_datalen > headers.content_length)
|
2010-04-09 02:00:07 +00:00
|
|
|
reported_datalen = (int)headers.content_length;
|
2003-12-27 18:45:48 +00:00
|
|
|
} else {
|
2005-01-13 07:47:26 +00:00
|
|
|
switch (http_type) {
|
|
|
|
|
|
|
|
case HTTP_REQUEST:
|
|
|
|
/*
|
|
|
|
* Requests have no content if there's no
|
|
|
|
* Content-Length header and no Transfer-Encoding
|
|
|
|
* header.
|
|
|
|
*/
|
|
|
|
if (headers.transfer_encoding == NULL)
|
|
|
|
datalen = 0;
|
|
|
|
else
|
|
|
|
reported_datalen = -1;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case HTTP_RESPONSE:
|
|
|
|
if ((stat_info->response_code/100) == 1 ||
|
|
|
|
stat_info->response_code == 204 ||
|
|
|
|
stat_info->response_code == 304)
|
|
|
|
datalen = 0; /* no content! */
|
|
|
|
else {
|
|
|
|
/*
|
|
|
|
* XXX - responses to HEAD requests,
|
|
|
|
* and possibly other responses,
|
|
|
|
* "MUST NOT" include a
|
|
|
|
* message-body.
|
|
|
|
*/
|
|
|
|
reported_datalen = -1;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
/*
|
|
|
|
* XXX - what about HTTP_NOTIFICATION?
|
|
|
|
*/
|
2003-12-27 18:45:48 +00:00
|
|
|
reported_datalen = -1;
|
2005-01-13 07:47:26 +00:00
|
|
|
break;
|
|
|
|
}
|
2003-12-27 18:45:48 +00:00
|
|
|
}
|
2003-12-23 01:42:48 +00:00
|
|
|
|
2000-11-09 10:56:33 +00:00
|
|
|
if (datalen > 0) {
|
2003-12-23 01:42:48 +00:00
|
|
|
/*
|
|
|
|
* There's stuff left over; process it.
|
|
|
|
*/
|
|
|
|
tvbuff_t *next_tvb;
|
2004-01-10 02:38:39 +00:00
|
|
|
void *save_private_data = NULL;
|
2009-05-19 17:16:14 +00:00
|
|
|
gboolean private_data_changed = FALSE;
|
2004-04-26 17:10:40 +00:00
|
|
|
gint chunks_decoded = 0;
|
2003-12-23 01:42:48 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Create a tvbuff for the payload.
|
|
|
|
*
|
|
|
|
* The amount of data to be processed that's
|
|
|
|
* available in the tvbuff is "datalen", which
|
|
|
|
* is the minimum of the amount of data left in
|
|
|
|
* the tvbuff and any specified content length.
|
|
|
|
*
|
|
|
|
* The amount of data to be processed that's in
|
|
|
|
* this frame, regardless of whether it was
|
|
|
|
* captured or not, is "reported_datalen",
|
|
|
|
* which, if no content length was specified,
|
|
|
|
* is -1, i.e. "to the end of the frame.
|
|
|
|
*/
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset, datalen,
|
|
|
|
reported_datalen);
|
2004-05-08 10:28:47 +00:00
|
|
|
/*
|
|
|
|
* BEWARE - next_tvb is a subset of another tvb,
|
|
|
|
* so we MUST NOT attempt tvb_free(next_tvb);
|
|
|
|
*/
|
2000-11-16 07:35:43 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
/*
|
2004-05-09 09:07:33 +00:00
|
|
|
* Handle *transfer* encodings other than "identity".
|
2004-04-26 17:10:40 +00:00
|
|
|
*/
|
|
|
|
if (headers.transfer_encoding != NULL &&
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
g_ascii_strcasecmp(headers.transfer_encoding, "identity") != 0) {
|
2004-05-05 06:55:09 +00:00
|
|
|
if (http_dechunk_body &&
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
(g_ascii_strncasecmp(headers.transfer_encoding, "chunked", 7)
|
2004-05-05 06:55:09 +00:00
|
|
|
== 0)) {
|
2004-04-26 17:10:40 +00:00
|
|
|
|
2009-09-14 17:36:15 +00:00
|
|
|
chunks_decoded = chunked_encoding_dissector(
|
2004-04-29 20:26:54 +00:00
|
|
|
&next_tvb, pinfo, http_tree, 0);
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
if (chunks_decoded <= 0) {
|
2004-05-09 09:07:33 +00:00
|
|
|
/*
|
2004-04-26 17:10:40 +00:00
|
|
|
* The chunks weren't reassembled,
|
|
|
|
* or there was a single zero
|
|
|
|
* length chunk.
|
|
|
|
*/
|
|
|
|
goto body_dissected;
|
2004-05-09 09:07:33 +00:00
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Add a new data source for the
|
|
|
|
* de-chunked data.
|
|
|
|
*/
|
2009-09-14 17:36:15 +00:00
|
|
|
tvb_set_child_real_data_tvbuff(tvb,
|
|
|
|
next_tvb);
|
2004-05-09 09:07:33 +00:00
|
|
|
add_new_data_source(pinfo, next_tvb,
|
|
|
|
"De-chunked entity body");
|
2004-04-26 17:10:40 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/*
|
2004-05-09 09:07:33 +00:00
|
|
|
* We currently can't handle, for example,
|
|
|
|
* "gzip", "compress", or "deflate" as
|
|
|
|
* *transfer* encodings; just handle them
|
2004-04-26 17:10:40 +00:00
|
|
|
* as data for now.
|
|
|
|
*/
|
|
|
|
call_dissector(data_handle, next_tvb, pinfo,
|
|
|
|
http_tree);
|
|
|
|
goto body_dissected;
|
|
|
|
}
|
|
|
|
}
|
2004-02-21 01:31:56 +00:00
|
|
|
/*
|
2004-05-09 09:07:33 +00:00
|
|
|
* At this point, any chunked *transfer* coding has been removed
|
|
|
|
* (the entity body has been dechunked) so it can be presented
|
|
|
|
* for the following operation (*content* encoding), or it has
|
|
|
|
* been been handed off to the data dissector.
|
|
|
|
*
|
|
|
|
* Handle *content* encodings other than "identity" (which
|
2004-02-21 01:31:56 +00:00
|
|
|
* shouldn't appear in a Content-Encoding header, but
|
|
|
|
* we handle it in any case).
|
|
|
|
*/
|
|
|
|
if (headers.content_encoding != NULL &&
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
g_ascii_strcasecmp(headers.content_encoding, "identity") != 0) {
|
2004-02-21 01:31:56 +00:00
|
|
|
/*
|
2004-05-05 06:55:09 +00:00
|
|
|
* We currently can't handle, for example, "compress";
|
|
|
|
* just handle them as data for now.
|
2004-05-09 09:07:33 +00:00
|
|
|
*
|
2004-05-05 06:55:09 +00:00
|
|
|
* After July 7, 2004 the LZW patent expires, so support
|
|
|
|
* might be added then. However, I don't think that
|
|
|
|
* anybody ever really implemented "compress", due to
|
2004-05-09 09:07:33 +00:00
|
|
|
* the aforementioned patent.
|
2004-02-21 01:31:56 +00:00
|
|
|
*/
|
2004-05-05 06:55:09 +00:00
|
|
|
tvbuff_t *uncomp_tvb = NULL;
|
2004-05-08 10:28:47 +00:00
|
|
|
proto_item *e_ti = NULL;
|
|
|
|
proto_tree *e_tree = NULL;
|
2004-05-05 06:55:09 +00:00
|
|
|
|
|
|
|
if (http_decompress_body &&
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
(g_ascii_strcasecmp(headers.content_encoding, "gzip") == 0 ||
|
2011-05-02 14:06:33 +00:00
|
|
|
g_ascii_strcasecmp(headers.content_encoding, "deflate") == 0 ||
|
|
|
|
g_ascii_strcasecmp(headers.content_encoding, "x-gzip") == 0 ||
|
|
|
|
g_ascii_strcasecmp(headers.content_encoding, "x-deflate") == 0))
|
|
|
|
{
|
2009-05-13 19:46:11 +00:00
|
|
|
uncomp_tvb = tvb_child_uncompress(tvb, next_tvb, 0,
|
2004-05-05 06:55:09 +00:00
|
|
|
tvb_length(next_tvb));
|
|
|
|
}
|
|
|
|
|
2004-05-08 10:28:47 +00:00
|
|
|
/*
|
|
|
|
* Add the encoded entity to the protocol tree
|
|
|
|
*/
|
|
|
|
e_ti = proto_tree_add_text(http_tree, next_tvb,
|
|
|
|
0, tvb_length(next_tvb),
|
2005-06-02 20:03:15 +00:00
|
|
|
"Content-encoded entity body (%s): %u bytes",
|
|
|
|
headers.content_encoding,
|
2008-07-08 22:36:35 +00:00
|
|
|
tvb_length(next_tvb));
|
2004-05-08 10:28:47 +00:00
|
|
|
e_tree = proto_item_add_subtree(e_ti,
|
|
|
|
ett_http_encoded_entity);
|
|
|
|
|
2004-05-05 06:55:09 +00:00
|
|
|
if (uncomp_tvb != NULL) {
|
|
|
|
/*
|
|
|
|
* Decompression worked
|
|
|
|
*/
|
2004-05-08 12:54:24 +00:00
|
|
|
|
|
|
|
/* XXX - Don't free this, since it's possible
|
|
|
|
* that the data was only partially
|
|
|
|
* decompressed, such as when desegmentation
|
|
|
|
* isn't enabled.
|
|
|
|
*
|
|
|
|
tvb_free(next_tvb);
|
|
|
|
*/
|
2008-07-08 22:36:35 +00:00
|
|
|
proto_item_append_text(e_ti, " -> %u bytes", tvb_length(uncomp_tvb));
|
2004-05-05 06:55:09 +00:00
|
|
|
next_tvb = uncomp_tvb;
|
2004-05-09 09:07:33 +00:00
|
|
|
add_new_data_source(pinfo, next_tvb,
|
2004-05-07 17:36:46 +00:00
|
|
|
"Uncompressed entity body");
|
2004-05-05 06:55:09 +00:00
|
|
|
} else {
|
2008-07-08 22:36:35 +00:00
|
|
|
proto_item_append_text(e_ti, " [Error: Decompression failed]");
|
2004-05-05 06:55:09 +00:00
|
|
|
call_dissector(data_handle, next_tvb, pinfo,
|
|
|
|
e_tree);
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-05-05 06:55:09 +00:00
|
|
|
goto body_dissected;
|
|
|
|
}
|
2004-02-21 01:31:56 +00:00
|
|
|
}
|
2004-05-09 09:07:33 +00:00
|
|
|
/*
|
|
|
|
* Note that a new data source is added for the entity body
|
|
|
|
* only if it was content-encoded and/or transfer-encoded.
|
|
|
|
*/
|
2004-02-21 01:31:56 +00:00
|
|
|
|
2007-03-06 00:36:25 +00:00
|
|
|
/* Save values for the Export Object GUI feature if we have
|
|
|
|
* an active listener to process it (which happens when
|
2007-03-13 20:42:04 +00:00
|
|
|
* the export object window is open). */
|
|
|
|
if(have_tap_listener(http_eo_tap)) {
|
|
|
|
eo_info = ep_alloc(sizeof(http_eo_t));
|
|
|
|
|
|
|
|
eo_info->hostname = conv_data->http_host;
|
|
|
|
eo_info->filename = conv_data->request_uri;
|
|
|
|
eo_info->content_type = headers.content_type;
|
2011-05-27 01:57:33 +00:00
|
|
|
eo_info->payload_len = tvb_length(next_tvb);
|
|
|
|
eo_info->payload_data = tvb_get_ptr(next_tvb, 0, eo_info->payload_len);
|
2007-03-13 20:42:04 +00:00
|
|
|
|
|
|
|
tap_queue_packet(http_eo_tap, pinfo, eo_info);
|
2007-03-06 00:36:25 +00:00
|
|
|
}
|
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
2003-11-18 07:49:52 +00:00
|
|
|
* Do subdissector checks.
|
|
|
|
*
|
|
|
|
* First, check whether some subdissector asked that they
|
|
|
|
* be called if something was on some particular port.
|
2001-01-11 06:30:54 +00:00
|
|
|
*/
|
2007-02-19 22:37:45 +00:00
|
|
|
|
2010-12-20 05:35:29 +00:00
|
|
|
handle = dissector_get_uint_handle(port_subdissector_table,
|
|
|
|
pinfo->match_uint);
|
2003-12-23 02:29:11 +00:00
|
|
|
if (handle == NULL && headers.content_type != NULL) {
|
2000-11-09 10:56:33 +00:00
|
|
|
/*
|
2003-11-18 07:49:52 +00:00
|
|
|
* We didn't find any subdissector that
|
|
|
|
* registered for the port, and we have a
|
|
|
|
* Content-Type value. Is there any subdissector
|
|
|
|
* for that content type?
|
2000-11-09 10:56:33 +00:00
|
|
|
*/
|
2004-01-10 02:38:39 +00:00
|
|
|
save_private_data = pinfo->private_data;
|
2009-05-19 17:16:14 +00:00
|
|
|
private_data_changed = TRUE;
|
2005-07-24 01:42:41 +00:00
|
|
|
|
2004-01-16 01:32:20 +00:00
|
|
|
if (headers.content_type_parameters)
|
2005-07-24 01:42:41 +00:00
|
|
|
pinfo->private_data = ep_strdup(headers.content_type_parameters);
|
2004-01-16 01:32:20 +00:00
|
|
|
else
|
|
|
|
pinfo->private_data = NULL;
|
|
|
|
/*
|
|
|
|
* Calling the string handle for the media type
|
|
|
|
* dissector table will set pinfo->match_string
|
|
|
|
* to headers.content_type for us.
|
|
|
|
*/
|
|
|
|
pinfo->match_string = headers.content_type;
|
2003-11-18 07:49:52 +00:00
|
|
|
handle = dissector_get_string_handle(
|
2003-12-07 03:21:22 +00:00
|
|
|
media_type_subdissector_table,
|
2003-12-23 02:29:11 +00:00
|
|
|
headers.content_type);
|
2010-10-27 06:49:18 +00:00
|
|
|
if (handle == NULL &&
|
|
|
|
!strncmp(headers.content_type, "multipart/", sizeof("multipart/")-1)) {
|
|
|
|
/* Try to decode the unknown multipart subtype anyway */
|
|
|
|
handle = dissector_get_string_handle(
|
|
|
|
media_type_subdissector_table,
|
|
|
|
"multipart/");
|
|
|
|
}
|
2003-11-18 07:49:52 +00:00
|
|
|
}
|
2011-03-24 02:49:05 +00:00
|
|
|
|
2003-11-18 07:49:52 +00:00
|
|
|
if (handle != NULL) {
|
|
|
|
/*
|
|
|
|
* We have a subdissector - call it.
|
|
|
|
*/
|
2011-03-24 02:49:05 +00:00
|
|
|
dissected = call_dissector_only(handle, next_tvb, pinfo, tree);
|
|
|
|
if (!dissected)
|
|
|
|
expert_add_info_format(pinfo, http_tree, PI_MALFORMED, PI_NOTE,
|
|
|
|
"HTTP body subdissector failed, trying heuristic subdissector");
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!dissected) {
|
2001-11-18 02:28:15 +00:00
|
|
|
/*
|
2011-03-24 02:49:05 +00:00
|
|
|
* We don't have a subdissector or we have one and it did not
|
|
|
|
* dissect the payload - try the heuristic subdissectors.
|
2003-11-18 07:49:52 +00:00
|
|
|
*/
|
2011-03-24 02:49:05 +00:00
|
|
|
dissected = dissector_try_heuristic(heur_subdissector_list,
|
|
|
|
next_tvb, pinfo, tree);
|
2003-11-18 07:49:52 +00:00
|
|
|
}
|
2011-03-24 02:49:05 +00:00
|
|
|
|
2003-11-18 07:49:52 +00:00
|
|
|
if (dissected) {
|
|
|
|
/*
|
|
|
|
* The subdissector dissected the body.
|
|
|
|
* Fix up the top-level item so that it doesn't
|
|
|
|
* include the stuff for that protocol.
|
2001-11-18 02:28:15 +00:00
|
|
|
*/
|
|
|
|
if (ti != NULL)
|
|
|
|
proto_item_set_len(ti, offset);
|
2002-05-30 01:56:55 +00:00
|
|
|
} else {
|
2006-09-12 11:39:51 +00:00
|
|
|
if (headers.content_type != NULL) {
|
|
|
|
/*
|
|
|
|
* Calling the default media handle if there is a content-type that
|
|
|
|
* wasn't handled above.
|
|
|
|
*/
|
|
|
|
call_dissector(media_handle, next_tvb, pinfo, tree);
|
|
|
|
} else {
|
2007-12-26 18:28:31 +00:00
|
|
|
/* Call the default data dissector */
|
|
|
|
call_dissector(data_handle, next_tvb, pinfo, http_tree);
|
2006-09-12 11:39:51 +00:00
|
|
|
}
|
2002-05-30 01:56:55 +00:00
|
|
|
}
|
2003-12-23 02:02:09 +00:00
|
|
|
|
2004-02-21 01:31:56 +00:00
|
|
|
body_dissected:
|
2004-01-16 01:32:20 +00:00
|
|
|
/*
|
|
|
|
* Do *not* attempt at freeing the private data;
|
2004-02-21 01:31:56 +00:00
|
|
|
* it may be in use by subdissectors.
|
2004-01-16 01:32:20 +00:00
|
|
|
*/
|
2009-05-19 17:16:14 +00:00
|
|
|
if (private_data_changed) /*restore even NULL value*/
|
2004-01-10 02:38:39 +00:00
|
|
|
pinfo->private_data = save_private_data;
|
2003-12-23 02:02:09 +00:00
|
|
|
/*
|
|
|
|
* We've processed "datalen" bytes worth of data
|
|
|
|
* (which may be no data at all); advance the
|
|
|
|
* offset past whatever data we've processed.
|
|
|
|
*/
|
|
|
|
offset += datalen;
|
1999-02-12 09:03:42 +00:00
|
|
|
}
|
2003-09-02 22:47:59 +00:00
|
|
|
|
2003-11-04 08:16:02 +00:00
|
|
|
tap_queue_packet(http_tap, pinfo, stat_info);
|
2003-12-23 02:02:09 +00:00
|
|
|
|
|
|
|
return offset - orig_offset;
|
1999-02-12 09:03:42 +00:00
|
|
|
}
|
|
|
|
|
2003-06-10 22:07:18 +00:00
|
|
|
/* This can be used to dissect an HTTP request until such time
|
|
|
|
* that a more complete dissector is written for that HTTP request.
|
2005-03-13 00:49:33 +00:00
|
|
|
* This simple dissector only puts the request method, URI, and
|
|
|
|
* protocol version into a sub-tree.
|
2003-06-10 22:07:18 +00:00
|
|
|
*/
|
|
|
|
static void
|
2005-03-13 00:49:33 +00:00
|
|
|
basic_request_dissector(tvbuff_t *tvb, proto_tree *tree, int offset,
|
2007-03-13 20:42:04 +00:00
|
|
|
const guchar *line, const guchar *lineend,
|
|
|
|
http_conv_t *conv_data)
|
2003-06-10 22:07:18 +00:00
|
|
|
{
|
2005-03-13 00:49:33 +00:00
|
|
|
const guchar *next_token;
|
2007-03-13 20:42:04 +00:00
|
|
|
gchar *request_uri;
|
2005-03-13 00:49:33 +00:00
|
|
|
int tokenlen;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-03-13 00:49:33 +00:00
|
|
|
/* The first token is the method. */
|
|
|
|
tokenlen = get_token_len(line, lineend, &next_token);
|
|
|
|
if (tokenlen == 0)
|
|
|
|
return;
|
|
|
|
proto_tree_add_item(tree, hf_http_request_method, tvb, offset, tokenlen,
|
2010-05-12 13:24:42 +00:00
|
|
|
FALSE);
|
2010-09-05 12:16:14 +00:00
|
|
|
if ((next_token - line) > 2 && next_token[-1] == ' ' && next_token[-2] == ' ') {
|
|
|
|
/* Two spaces in a now indicates empty URI, so roll back one here */
|
|
|
|
next_token--;
|
|
|
|
}
|
2009-03-30 18:40:33 +00:00
|
|
|
offset += (int) (next_token - line);
|
2005-03-13 00:49:33 +00:00
|
|
|
line = next_token;
|
|
|
|
|
|
|
|
/* The next token is the URI. */
|
|
|
|
tokenlen = get_token_len(line, lineend, &next_token);
|
2007-03-13 20:42:04 +00:00
|
|
|
|
|
|
|
/* Save the request URI for various later uses */
|
2007-08-15 22:27:52 +00:00
|
|
|
request_uri = (gchar *)tvb_get_ephemeral_string(tvb, offset, tokenlen);
|
2007-03-13 20:42:04 +00:00
|
|
|
stat_info->request_uri = ep_strdup(request_uri);
|
|
|
|
conv_data->request_uri = se_strdup(request_uri);
|
2007-03-24 10:07:20 +00:00
|
|
|
|
2005-03-13 00:49:33 +00:00
|
|
|
proto_tree_add_string(tree, hf_http_request_uri, tvb, offset, tokenlen,
|
2007-03-13 20:42:04 +00:00
|
|
|
request_uri);
|
2009-03-30 18:40:33 +00:00
|
|
|
offset += (int) (next_token - line);
|
2005-03-13 00:49:33 +00:00
|
|
|
line = next_token;
|
|
|
|
|
|
|
|
/* Everything to the end of the line is the version. */
|
2009-03-30 18:40:33 +00:00
|
|
|
tokenlen = (int) (lineend - line);
|
2005-03-13 00:49:33 +00:00
|
|
|
proto_tree_add_item(tree, hf_http_version, tvb, offset, tokenlen,
|
|
|
|
FALSE);
|
2003-06-10 22:07:18 +00:00
|
|
|
}
|
2003-09-02 23:09:11 +00:00
|
|
|
|
2003-09-02 22:47:59 +00:00
|
|
|
static void
|
2005-03-13 00:49:33 +00:00
|
|
|
basic_response_dissector(tvbuff_t *tvb, proto_tree *tree, int offset,
|
2007-03-13 20:42:04 +00:00
|
|
|
const guchar *line, const guchar *lineend,
|
|
|
|
http_conv_t *conv_data _U_)
|
2003-09-02 22:47:59 +00:00
|
|
|
{
|
2005-03-13 00:49:33 +00:00
|
|
|
const guchar *next_token;
|
|
|
|
int tokenlen;
|
2010-10-30 14:29:20 +00:00
|
|
|
gchar response_code_chars[4];
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2010-10-30 14:29:20 +00:00
|
|
|
/*
|
|
|
|
* The first token is the HTTP Version.
|
|
|
|
*/
|
2005-03-13 00:49:33 +00:00
|
|
|
tokenlen = get_token_len(line, lineend, &next_token);
|
|
|
|
if (tokenlen == 0)
|
|
|
|
return;
|
|
|
|
proto_tree_add_item(tree, hf_http_version, tvb, offset, tokenlen,
|
2010-09-21 02:12:21 +00:00
|
|
|
FALSE);
|
2010-10-30 14:29:20 +00:00
|
|
|
/* Advance to the start of the next token. */
|
2009-03-30 18:40:33 +00:00
|
|
|
offset += (int) (next_token - line);
|
2005-03-13 00:49:33 +00:00
|
|
|
line = next_token;
|
|
|
|
|
2010-10-30 14:29:20 +00:00
|
|
|
/*
|
|
|
|
* The second token is the Status Code.
|
|
|
|
*/
|
2005-03-13 00:49:33 +00:00
|
|
|
tokenlen = get_token_len(line, lineend, &next_token);
|
|
|
|
if (tokenlen < 3)
|
|
|
|
return;
|
2010-10-30 14:29:20 +00:00
|
|
|
|
|
|
|
/* The Status Code characters must be copied into a null-terminated
|
|
|
|
* buffer for strtoul() to parse them into an unsigned integer value.
|
|
|
|
*/
|
|
|
|
memcpy(response_code_chars, line, 3);
|
|
|
|
response_code_chars[3] = '\0';
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2007-03-24 10:07:20 +00:00
|
|
|
stat_info->response_code = conv_data->response_code =
|
2010-10-30 14:29:20 +00:00
|
|
|
strtoul(response_code_chars, NULL, 10);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2005-03-13 00:49:33 +00:00
|
|
|
proto_tree_add_uint(tree, hf_http_response_code, tvb, offset, 3,
|
2010-05-12 13:24:42 +00:00
|
|
|
stat_info->response_code);
|
2010-10-30 14:29:20 +00:00
|
|
|
|
|
|
|
/* Advance to the start of the next token. */
|
|
|
|
offset += (int) (next_token - line);
|
|
|
|
line = next_token;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The remaining tokens in the line comprise the Reason Phrase.
|
|
|
|
*/
|
|
|
|
tokenlen = (int) (lineend - line);
|
|
|
|
if (tokenlen < 1)
|
|
|
|
return;
|
|
|
|
proto_tree_add_item(tree, hf_http_response_phrase, tvb, offset,
|
|
|
|
tokenlen, FALSE);
|
|
|
|
|
2003-09-02 22:47:59 +00:00
|
|
|
}
|
2003-06-10 22:07:18 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
/*
|
|
|
|
* Dissect the http data chunks and add them to the tree.
|
|
|
|
*/
|
|
|
|
static int
|
2009-09-14 17:36:15 +00:00
|
|
|
chunked_encoding_dissector(tvbuff_t **tvb_ptr, packet_info *pinfo,
|
2010-09-21 02:12:21 +00:00
|
|
|
proto_tree *tree, int offset)
|
2004-04-26 17:10:40 +00:00
|
|
|
{
|
|
|
|
guint8 *chunk_string = NULL;
|
2004-11-03 20:01:53 +00:00
|
|
|
guint32 chunk_size = 0;
|
2004-04-26 17:10:40 +00:00
|
|
|
gint chunk_offset = 0;
|
2004-11-03 20:01:53 +00:00
|
|
|
guint32 datalen = 0;
|
2004-04-26 17:10:40 +00:00
|
|
|
gint linelen = 0;
|
|
|
|
gint chunks_decoded = 0;
|
|
|
|
tvbuff_t *tvb = NULL;
|
|
|
|
tvbuff_t *new_tvb = NULL;
|
|
|
|
gint chunked_data_size = 0;
|
|
|
|
proto_tree *subtree = NULL;
|
|
|
|
proto_item *ti = NULL;
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
if (tvb_ptr == NULL || *tvb_ptr == NULL) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
tvb = *tvb_ptr;
|
|
|
|
|
|
|
|
datalen = tvb_reported_length_remaining(tvb, offset);
|
|
|
|
|
|
|
|
if (tree) {
|
|
|
|
ti = proto_tree_add_text(tree, tvb, offset, datalen,
|
2010-09-21 02:12:21 +00:00
|
|
|
"HTTP chunked response");
|
2004-04-26 17:10:40 +00:00
|
|
|
subtree = proto_item_add_subtree(ti, ett_http_chunked_response);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
while (datalen != 0) {
|
|
|
|
proto_item *chunk_ti = NULL;
|
|
|
|
proto_tree *chunk_subtree = NULL;
|
|
|
|
tvbuff_t *data_tvb = NULL;
|
|
|
|
gchar *c = NULL;
|
2009-09-14 17:36:15 +00:00
|
|
|
guint8 *raw_data;
|
2006-06-24 00:01:33 +00:00
|
|
|
gint raw_len = 0;
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
linelen = tvb_find_line_end(tvb, offset, -1, &chunk_offset, TRUE);
|
|
|
|
|
|
|
|
if (linelen <= 0) {
|
|
|
|
/* Can't get the chunk size line */
|
2004-05-08 12:54:24 +00:00
|
|
|
break;
|
2004-04-26 17:10:40 +00:00
|
|
|
}
|
|
|
|
|
2005-08-10 13:41:13 +00:00
|
|
|
chunk_string = tvb_get_ephemeral_string(tvb, offset, linelen);
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
if (chunk_string == NULL) {
|
|
|
|
/* Can't get the chunk size line */
|
2004-05-08 12:54:24 +00:00
|
|
|
break;
|
2004-04-26 17:10:40 +00:00
|
|
|
}
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2005-07-24 01:42:41 +00:00
|
|
|
c = (gchar*) chunk_string;
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* We don't care about the extensions.
|
|
|
|
*/
|
|
|
|
if ((c = strchr(c, ';'))) {
|
|
|
|
*c = '\0';
|
|
|
|
}
|
|
|
|
|
2006-11-24 02:59:43 +00:00
|
|
|
chunk_size = strtol((gchar*)chunk_string, NULL, 16);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
if (chunk_size > datalen) {
|
|
|
|
/*
|
|
|
|
* The chunk size is more than what's in the tvbuff,
|
|
|
|
* so either the user hasn't enabled decoding, or all
|
|
|
|
* of the segments weren't captured.
|
|
|
|
*/
|
|
|
|
chunk_size = datalen;
|
2006-06-23 23:51:55 +00:00
|
|
|
}
|
|
|
|
#if 0
|
|
|
|
else if (new_tvb == NULL) {
|
2004-04-26 17:10:40 +00:00
|
|
|
new_tvb = tvb_new_composite();
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (new_tvb != NULL && chunk_size != 0) {
|
|
|
|
tvbuff_t *chunk_tvb = NULL;
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
chunk_tvb = tvb_new_subset(tvb, chunk_offset,
|
|
|
|
chunk_size, datalen);
|
|
|
|
|
|
|
|
tvb_composite_append(new_tvb, chunk_tvb);
|
|
|
|
|
|
|
|
}
|
2006-06-23 23:51:55 +00:00
|
|
|
#endif
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
chunked_data_size += chunk_size;
|
|
|
|
|
2009-09-14 17:36:15 +00:00
|
|
|
raw_data = g_malloc(chunked_data_size);
|
2006-06-24 00:01:33 +00:00
|
|
|
raw_len = 0;
|
2004-04-26 17:10:40 +00:00
|
|
|
|
2006-06-24 00:01:33 +00:00
|
|
|
if (new_tvb != NULL) {
|
|
|
|
raw_len = tvb_length_remaining(new_tvb, 0);
|
2009-09-14 17:36:15 +00:00
|
|
|
tvb_memcpy(new_tvb, raw_data, 0, raw_len);
|
|
|
|
|
|
|
|
tvb_free(new_tvb);
|
2006-06-24 00:01:33 +00:00
|
|
|
}
|
2004-04-26 17:10:40 +00:00
|
|
|
|
2006-06-24 00:01:33 +00:00
|
|
|
tvb_memcpy(tvb, (guint8 *)(raw_data + raw_len),
|
2004-04-26 17:10:40 +00:00
|
|
|
chunk_offset, chunk_size);
|
|
|
|
|
2007-03-16 00:47:26 +00:00
|
|
|
/* Don't create a new tvb if we have a single chunk with
|
|
|
|
* a size of zero (meaning it is the end of the chunks). */
|
2009-09-14 17:36:15 +00:00
|
|
|
if(chunked_data_size > 0) {
|
|
|
|
new_tvb = tvb_new_real_data(raw_data,
|
|
|
|
chunked_data_size, chunked_data_size);
|
2007-03-16 00:47:26 +00:00
|
|
|
tvb_set_free_cb(new_tvb, g_free);
|
|
|
|
}
|
2004-04-26 17:10:40 +00:00
|
|
|
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
if (subtree) {
|
2006-11-24 02:59:43 +00:00
|
|
|
if(chunk_size == 0) {
|
|
|
|
chunk_ti = proto_tree_add_text(subtree, tvb,
|
|
|
|
offset,
|
|
|
|
chunk_offset - offset + chunk_size + 2,
|
|
|
|
"End of chunked encoding");
|
|
|
|
} else {
|
|
|
|
chunk_ti = proto_tree_add_text(subtree, tvb,
|
2010-09-21 02:12:21 +00:00
|
|
|
offset,
|
|
|
|
chunk_offset - offset + chunk_size + 2,
|
|
|
|
"Data chunk (%u octets)", chunk_size);
|
2006-11-24 02:59:43 +00:00
|
|
|
}
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
chunk_subtree = proto_item_add_subtree(chunk_ti,
|
|
|
|
ett_http_chunk_data);
|
|
|
|
|
|
|
|
proto_tree_add_text(chunk_subtree, tvb, offset,
|
|
|
|
chunk_offset - offset, "Chunk size: %u octets",
|
|
|
|
chunk_size);
|
|
|
|
|
|
|
|
data_tvb = tvb_new_subset(tvb, chunk_offset, chunk_size,
|
|
|
|
datalen);
|
|
|
|
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2006-06-24 00:01:33 +00:00
|
|
|
/*
|
|
|
|
* XXX - just use "proto_tree_add_text()"?
|
|
|
|
* This means that, in TShark, you get
|
|
|
|
* the entire chunk dumped out in hex,
|
|
|
|
* in addition to whatever dissection is
|
|
|
|
* done on the reassembled data.
|
|
|
|
*/
|
|
|
|
call_dissector(data_handle, data_tvb, pinfo,
|
2004-04-26 17:10:40 +00:00
|
|
|
chunk_subtree);
|
|
|
|
|
|
|
|
proto_tree_add_text(chunk_subtree, tvb, chunk_offset +
|
|
|
|
chunk_size, 2, "Chunk boundary");
|
|
|
|
}
|
|
|
|
|
|
|
|
chunks_decoded++;
|
|
|
|
offset = chunk_offset + chunk_size + 2;
|
|
|
|
datalen = tvb_reported_length_remaining(tvb, offset);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (new_tvb != NULL) {
|
|
|
|
|
|
|
|
/* Placeholder for the day that composite tvbuffer's will work.
|
|
|
|
tvb_composite_finalize(new_tvb);
|
|
|
|
/ * tvb_set_reported_length(new_tvb, chunked_data_size); * /
|
|
|
|
*/
|
|
|
|
|
2004-05-08 12:54:24 +00:00
|
|
|
/*
|
|
|
|
* XXX - Don't free this, since the tvbuffer that was passed
|
|
|
|
* may be used if the data spans multiple frames and reassembly
|
|
|
|
* isn't enabled.
|
|
|
|
*
|
2004-04-26 17:10:40 +00:00
|
|
|
tvb_free(*tvb_ptr);
|
2004-05-08 12:54:24 +00:00
|
|
|
*/
|
2004-04-26 17:10:40 +00:00
|
|
|
*tvb_ptr = new_tvb;
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* We didn't create a new tvb, so don't allow sub dissectors
|
2008-12-20 00:09:02 +00:00
|
|
|
* try to decode the non-existent entity body.
|
2004-04-26 17:10:40 +00:00
|
|
|
*/
|
|
|
|
chunks_decoded = -1;
|
|
|
|
}
|
2004-05-09 09:07:33 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
return chunks_decoded;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
/* Call a subdissector to handle HTTP CONNECT's traffic */
|
2006-08-14 21:46:05 +00:00
|
|
|
static void
|
2007-12-26 18:28:31 +00:00
|
|
|
http_payload_subdissector(tvbuff_t *tvb, proto_tree *tree,
|
|
|
|
packet_info *pinfo, http_conv_t *conv_data)
|
2006-08-14 21:46:05 +00:00
|
|
|
{
|
2007-12-26 18:28:31 +00:00
|
|
|
guint32 *ptr = NULL;
|
|
|
|
guint32 dissect_as, saved_port;
|
2006-09-30 18:30:43 +00:00
|
|
|
gchar **strings; /* An array for splitting the request URI into hostname and port */
|
2007-04-28 23:52:12 +00:00
|
|
|
proto_item *item;
|
2007-12-26 18:28:31 +00:00
|
|
|
proto_tree *proxy_tree;
|
2006-08-14 21:46:05 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
/* Grab the destination port number from the request URI to find the right subdissector */
|
|
|
|
strings = g_strsplit(conv_data->request_uri, ":", 2);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
if(strings[0] != NULL && strings[1] != NULL) {
|
|
|
|
/*
|
|
|
|
* The string was successfuly split in two
|
|
|
|
* Create a proxy-connect subtree
|
|
|
|
*/
|
|
|
|
if(tree) {
|
|
|
|
item = proto_tree_add_item(tree, proto_http, tvb, 0, -1, FALSE);
|
|
|
|
proxy_tree = proto_item_add_subtree(item, ett_http);
|
2008-03-04 21:05:21 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
item = proto_tree_add_string(proxy_tree, hf_http_proxy_connect_host,
|
2010-05-12 13:24:42 +00:00
|
|
|
tvb, 0, 0, strings[0]);
|
2007-04-28 23:52:12 +00:00
|
|
|
PROTO_ITEM_SET_GENERATED(item);
|
2008-03-04 21:05:21 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
item = proto_tree_add_uint(proxy_tree, hf_http_proxy_connect_port,
|
2010-09-21 02:12:21 +00:00
|
|
|
tvb, 0, 0, strtol(strings[1], NULL, 10) );
|
2007-04-28 23:52:12 +00:00
|
|
|
PROTO_ITEM_SET_GENERATED(item);
|
2006-08-14 21:46:05 +00:00
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
/* We're going to get stuck in a loop if we let process_tcp_payload call
|
|
|
|
us, so call the data dissector instead for proxy connections to http ports. */
|
|
|
|
dissect_as = (int)strtol(strings[1], NULL, 10); /* Convert string to a base-10 integer */
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
if (value_is_in_range(http_tcp_range, dissect_as)) {
|
|
|
|
call_dissector(data_handle, tvb, pinfo, tree);
|
|
|
|
} else {
|
|
|
|
/* set pinfo->{src/dst port} and call the TCP sub-dissector lookup */
|
2008-03-04 21:05:21 +00:00
|
|
|
if ( !ptr && value_is_in_range(http_tcp_range, pinfo->destport) )
|
2007-12-26 18:28:31 +00:00
|
|
|
ptr = &pinfo->destport;
|
|
|
|
else
|
|
|
|
ptr = &pinfo->srcport;
|
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
/* Increase pinfo->can_desegment because we are traversing
|
|
|
|
* http and want to preserve desegmentation functionality for
|
|
|
|
* the proxied protocol
|
|
|
|
*/
|
2007-12-26 18:28:31 +00:00
|
|
|
if( pinfo->can_desegment>0 )
|
|
|
|
pinfo->can_desegment++;
|
|
|
|
|
|
|
|
saved_port = *ptr;
|
|
|
|
*ptr = dissect_as;
|
|
|
|
decode_tcp_ports(tvb, 0, pinfo, tree,
|
|
|
|
pinfo->srcport, pinfo->destport, NULL);
|
|
|
|
*ptr = saved_port;
|
|
|
|
}
|
2006-08-14 21:46:05 +00:00
|
|
|
}
|
2007-12-26 18:28:31 +00:00
|
|
|
g_strfreev(strings); /* Free the result of g_strsplit() above */
|
2006-08-14 21:46:05 +00:00
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2006-08-14 21:46:05 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
|
1999-02-12 09:03:42 +00:00
|
|
|
/*
|
|
|
|
* XXX - this won't handle HTTP 0.9 replies, but they're all data
|
|
|
|
* anyway.
|
|
|
|
*/
|
|
|
|
static int
|
2004-01-16 01:32:20 +00:00
|
|
|
is_http_request_or_reply(const gchar *data, int linelen, http_type_t *type,
|
2007-03-13 20:42:04 +00:00
|
|
|
ReqRespDissector *reqresp_dissector,
|
|
|
|
http_conv_t *conv_data)
|
1999-02-12 09:03:42 +00:00
|
|
|
{
|
2002-04-01 21:12:31 +00:00
|
|
|
int isHttpRequestOrReply = FALSE;
|
|
|
|
|
2001-01-03 03:40:29 +00:00
|
|
|
/*
|
|
|
|
* From RFC 2774 - An HTTP Extension Framework
|
|
|
|
*
|
|
|
|
* Support the command prefix that identifies the presence of
|
|
|
|
* a "mandatory" header.
|
|
|
|
*/
|
2002-04-01 21:12:31 +00:00
|
|
|
if (linelen >= 2 && strncmp(data, "M-", 2) == 0) {
|
2001-01-03 03:40:29 +00:00
|
|
|
data += 2;
|
|
|
|
linelen -= 2;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* From draft-cohen-gena-client-01.txt, available from the uPnP forum:
|
|
|
|
* NOTIFY, SUBSCRIBE, UNSUBSCRIBE
|
|
|
|
*
|
|
|
|
* From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
|
|
|
|
* SEARCH
|
|
|
|
*/
|
2002-04-01 21:12:31 +00:00
|
|
|
if (linelen >= 5 && strncmp(data, "HTTP/", 5) == 0) {
|
|
|
|
*type = HTTP_RESPONSE;
|
|
|
|
isHttpRequestOrReply = TRUE; /* response */
|
2005-03-13 00:49:33 +00:00
|
|
|
if (reqresp_dissector)
|
|
|
|
*reqresp_dissector = basic_response_dissector;
|
2002-04-01 21:12:31 +00:00
|
|
|
} else {
|
2002-12-02 23:43:30 +00:00
|
|
|
const guchar * ptr = (const guchar *)data;
|
2008-06-28 21:09:57 +00:00
|
|
|
int indx = 0;
|
2002-04-01 21:12:31 +00:00
|
|
|
|
|
|
|
/* Look for the space following the Method */
|
2008-06-28 21:09:57 +00:00
|
|
|
while (indx < linelen) {
|
2002-04-01 21:12:31 +00:00
|
|
|
if (*ptr == ' ')
|
|
|
|
break;
|
|
|
|
else {
|
|
|
|
ptr++;
|
2008-06-28 21:09:57 +00:00
|
|
|
indx++;
|
2002-04-01 21:12:31 +00:00
|
|
|
}
|
1999-10-16 20:30:14 +00:00
|
|
|
}
|
2002-04-01 21:12:31 +00:00
|
|
|
|
|
|
|
/* Check the methods that have same length */
|
2008-06-28 21:09:57 +00:00
|
|
|
switch (indx) {
|
2002-04-01 21:12:31 +00:00
|
|
|
|
|
|
|
case 3:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "GET", indx) == 0 ||
|
|
|
|
strncmp(data, "PUT", indx) == 0) {
|
2000-02-23 20:55:33 +00:00
|
|
|
*type = HTTP_REQUEST;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
2008-06-28 21:09:57 +00:00
|
|
|
else if (strncmp(data, "ICY", indx) == 0) {
|
2004-01-19 23:57:11 +00:00
|
|
|
*type = HTTP_RESPONSE;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
2002-04-01 21:12:31 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case 4:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "COPY", indx) == 0 ||
|
|
|
|
strncmp(data, "HEAD", indx) == 0 ||
|
|
|
|
strncmp(data, "LOCK", indx) == 0 ||
|
|
|
|
strncmp(data, "MOVE", indx) == 0 ||
|
|
|
|
strncmp(data, "POLL", indx) == 0 ||
|
|
|
|
strncmp(data, "POST", indx) == 0) {
|
2000-02-23 20:55:33 +00:00
|
|
|
*type = HTTP_REQUEST;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 5:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "BCOPY", indx) == 0 ||
|
|
|
|
strncmp(data, "BMOVE", indx) == 0 ||
|
|
|
|
strncmp(data, "MKCOL", indx) == 0 ||
|
|
|
|
strncmp(data, "TRACE", indx) == 0 ||
|
|
|
|
strncmp(data, "LABEL", indx) == 0 || /* RFC 3253 8.2 */
|
|
|
|
strncmp(data, "MERGE", indx) == 0) { /* RFC 3253 11.2 */
|
2000-02-23 20:55:33 +00:00
|
|
|
*type = HTTP_REQUEST;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 6:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "DELETE", indx) == 0 ||
|
|
|
|
strncmp(data, "SEARCH", indx) == 0 ||
|
|
|
|
strncmp(data, "UNLOCK", indx) == 0 ||
|
|
|
|
strncmp(data, "REPORT", indx) == 0 || /* RFC 3253 3.6 */
|
|
|
|
strncmp(data, "UPDATE", indx) == 0) { /* RFC 3253 7.1 */
|
2002-04-01 21:12:31 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
2008-06-28 21:09:57 +00:00
|
|
|
else if (strncmp(data, "NOTIFY", indx) == 0) {
|
2001-01-03 03:40:29 +00:00
|
|
|
*type = HTTP_NOTIFICATION;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 7:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "BDELETE", indx) == 0 ||
|
|
|
|
strncmp(data, "CONNECT", indx) == 0 ||
|
|
|
|
strncmp(data, "OPTIONS", indx) == 0 ||
|
|
|
|
strncmp(data, "CHECKIN", indx) == 0) { /* RFC 3253 4.4, 9.4 */
|
2000-02-23 20:55:33 +00:00
|
|
|
*type = HTTP_REQUEST;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 8:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "PROPFIND", indx) == 0 ||
|
|
|
|
strncmp(data, "CHECKOUT", indx) == 0 || /* RFC 3253 4.3, 9.3 */
|
|
|
|
strncmp(data, "CCM_POST", indx) == 0) {
|
2002-04-01 21:12:31 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 9:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "SUBSCRIBE", indx) == 0) {
|
2001-01-03 03:40:29 +00:00
|
|
|
*type = HTTP_NOTIFICATION;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
2008-06-28 21:09:57 +00:00
|
|
|
} else if (strncmp(data, "PROPPATCH", indx) == 0 ||
|
|
|
|
strncmp(data, "BPROPFIND", indx) == 0) {
|
2002-04-01 21:12:31 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 10:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "BPROPPATCH", indx) == 0 ||
|
|
|
|
strncmp(data, "UNCHECKOUT", indx) == 0 || /* RFC 3253 4.5 */
|
|
|
|
strncmp(data, "MKACTIVITY", indx) == 0) { /* RFC 3253 13.5 */
|
2002-04-01 21:12:31 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 11:
|
2010-12-23 23:50:14 +00:00
|
|
|
if (strncmp(data, "MKWORKSPACE", indx) == 0 || /* RFC 3253 6.3 */
|
|
|
|
strncmp(data, "RPC_CONNECT", indx) == 0 || /* [MS-RPCH] 2.1.1.1.1 */
|
|
|
|
strncmp(data, "RPC_IN_DATA", indx) == 0) { /* [MS-RPCH] 2.1.2.1.1 */
|
2004-07-21 06:05:24 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
2008-06-28 21:09:57 +00:00
|
|
|
} else if (strncmp(data, "UNSUBSCRIBE", indx) == 0) {
|
2001-01-03 03:40:29 +00:00
|
|
|
*type = HTTP_NOTIFICATION;
|
2002-04-01 21:12:31 +00:00
|
|
|
isHttpRequestOrReply = TRUE;
|
2010-12-23 23:50:14 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 12:
|
|
|
|
if (strncmp(data, "RPC_OUT_DATA", indx) == 0) { /* [MS-RPCH] 2.1.2.1.2 */
|
2004-12-15 09:10:07 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
2002-04-01 21:12:31 +00:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2004-07-21 06:05:24 +00:00
|
|
|
case 15:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "VERSION-CONTROL", indx) == 0) { /* RFC 3253 3.5 */
|
2004-07-21 06:05:24 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 16:
|
2008-06-28 21:09:57 +00:00
|
|
|
if (strncmp(data, "BASELINE-CONTROL", indx) == 0) { /* RFC 3253 12.6 */
|
2004-07-21 06:05:24 +00:00
|
|
|
*type = HTTP_REQUEST;
|
|
|
|
isHttpRequestOrReply = TRUE;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2002-04-01 21:12:31 +00:00
|
|
|
default:
|
|
|
|
break;
|
2001-01-03 03:40:29 +00:00
|
|
|
}
|
2003-06-10 22:07:18 +00:00
|
|
|
|
2005-03-13 00:49:33 +00:00
|
|
|
if (isHttpRequestOrReply && reqresp_dissector) {
|
|
|
|
*reqresp_dissector = basic_request_dissector;
|
2007-03-24 10:07:20 +00:00
|
|
|
|
2008-06-28 21:09:57 +00:00
|
|
|
stat_info->request_method = ep_strndup(data, indx+1);
|
|
|
|
conv_data->request_method = se_strndup(data, indx+1);
|
2007-03-24 10:07:20 +00:00
|
|
|
}
|
|
|
|
|
2007-03-13 20:42:04 +00:00
|
|
|
|
|
|
|
|
2001-01-03 03:40:29 +00:00
|
|
|
}
|
2002-04-01 21:12:31 +00:00
|
|
|
|
|
|
|
return isHttpRequestOrReply;
|
1999-02-12 09:03:42 +00:00
|
|
|
}
|
1999-07-29 05:47:07 +00:00
|
|
|
|
2003-11-06 08:54:31 +00:00
|
|
|
/*
|
2003-12-23 02:29:11 +00:00
|
|
|
* Process headers.
|
2003-11-06 08:54:31 +00:00
|
|
|
*/
|
|
|
|
typedef struct {
|
2005-07-30 16:34:38 +00:00
|
|
|
const char *name;
|
|
|
|
gint *hf;
|
|
|
|
int special;
|
2003-12-23 02:29:11 +00:00
|
|
|
} header_info;
|
|
|
|
|
|
|
|
#define HDR_NO_SPECIAL 0
|
|
|
|
#define HDR_AUTHORIZATION 1
|
|
|
|
#define HDR_AUTHENTICATE 2
|
|
|
|
#define HDR_CONTENT_TYPE 3
|
|
|
|
#define HDR_CONTENT_LENGTH 4
|
2004-02-21 01:31:56 +00:00
|
|
|
#define HDR_CONTENT_ENCODING 5
|
|
|
|
#define HDR_TRANSFER_ENCODING 6
|
2005-02-28 22:27:24 +00:00
|
|
|
#define HDR_HOST 7
|
2003-12-23 02:29:11 +00:00
|
|
|
|
|
|
|
static const header_info headers[] = {
|
|
|
|
{ "Authorization", &hf_http_authorization, HDR_AUTHORIZATION },
|
|
|
|
{ "Proxy-Authorization", &hf_http_proxy_authorization, HDR_AUTHORIZATION },
|
|
|
|
{ "Proxy-Authenticate", &hf_http_proxy_authenticate, HDR_AUTHENTICATE },
|
|
|
|
{ "WWW-Authenticate", &hf_http_www_authenticate, HDR_AUTHENTICATE },
|
|
|
|
{ "Content-Type", &hf_http_content_type, HDR_CONTENT_TYPE },
|
2008-10-23 06:57:31 +00:00
|
|
|
{ "Content-Length", &hf_http_content_length_header, HDR_CONTENT_LENGTH },
|
2004-02-21 01:31:56 +00:00
|
|
|
{ "Content-Encoding", &hf_http_content_encoding, HDR_CONTENT_ENCODING },
|
|
|
|
{ "Transfer-Encoding", &hf_http_transfer_encoding, HDR_TRANSFER_ENCODING },
|
2004-12-07 17:59:58 +00:00
|
|
|
{ "User-Agent", &hf_http_user_agent, HDR_NO_SPECIAL },
|
2005-02-28 22:27:24 +00:00
|
|
|
{ "Host", &hf_http_host, HDR_HOST },
|
2004-12-07 17:59:58 +00:00
|
|
|
{ "Connection", &hf_http_connection, HDR_NO_SPECIAL },
|
|
|
|
{ "Cookie", &hf_http_cookie, HDR_NO_SPECIAL },
|
|
|
|
{ "Accept", &hf_http_accept, HDR_NO_SPECIAL },
|
|
|
|
{ "Referer", &hf_http_referer, HDR_NO_SPECIAL },
|
|
|
|
{ "Accept-Language", &hf_http_accept_language, HDR_NO_SPECIAL },
|
|
|
|
{ "Accept-Encoding", &hf_http_accept_encoding, HDR_NO_SPECIAL },
|
|
|
|
{ "Date", &hf_http_date, HDR_NO_SPECIAL },
|
|
|
|
{ "Cache-Control", &hf_http_cache_control, HDR_NO_SPECIAL },
|
|
|
|
{ "Server", &hf_http_server, HDR_NO_SPECIAL },
|
|
|
|
{ "Location", &hf_http_location, HDR_NO_SPECIAL },
|
|
|
|
{ "Set-Cookie", &hf_http_set_cookie, HDR_NO_SPECIAL },
|
|
|
|
{ "Last-Modified", &hf_http_last_modified, HDR_NO_SPECIAL },
|
2006-02-20 06:25:02 +00:00
|
|
|
{ "X-Forwarded-For", &hf_http_x_forwarded_for, HDR_NO_SPECIAL },
|
2003-11-06 08:54:31 +00:00
|
|
|
};
|
|
|
|
|
2009-05-19 00:17:23 +00:00
|
|
|
/*
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
static gint*
|
|
|
|
get_hf_for_header(char* header_name)
|
|
|
|
{
|
|
|
|
gint* hf_id = NULL;
|
|
|
|
|
|
|
|
if (header_fields_hash) {
|
|
|
|
hf_id = (gint*) g_hash_table_lookup(header_fields_hash, header_name);
|
|
|
|
} else {
|
|
|
|
hf_id = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return hf_id;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
static void
|
2009-06-15 02:34:53 +00:00
|
|
|
add_hf_info_for_headers(void)
|
2009-05-19 00:17:23 +00:00
|
|
|
{
|
|
|
|
hf_register_info* hf = NULL;
|
|
|
|
gint* hf_id = NULL;
|
|
|
|
guint i = 0;
|
|
|
|
gchar* header_name;
|
|
|
|
GPtrArray* array;
|
|
|
|
guint new_entries = 0;
|
|
|
|
header_field_t* tmp_hdr = NULL;
|
|
|
|
|
|
|
|
if (!header_fields_hash) {
|
|
|
|
header_fields_hash = g_hash_table_new(g_str_hash, g_str_equal);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (num_header_fields) {
|
|
|
|
array = g_ptr_array_new();
|
|
|
|
|
|
|
|
/* Make a list of fields which are not already added. This is useful only if
|
|
|
|
* preferences are reloaded and a new header field has been added. Perhaps unlikely
|
|
|
|
* to be used, but no harm in adding it...
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Not checking if the UAT has more or same number of entries as the hash table
|
|
|
|
* because it is possible that some entries are removed and some more added.
|
|
|
|
* WARNING: We will not de-register fields which have been removed from the UAT
|
|
|
|
*
|
|
|
|
* XXX: PS, it turns out that in case of change in UAT, the prefs apply callback is not
|
|
|
|
* called... so, some of this code will not work at the moment. However, I leave it
|
|
|
|
* in here for now because if the callback is called in future, it will work (at least
|
|
|
|
* in theory ;-).
|
|
|
|
*/
|
|
|
|
for (i = 0; i < num_header_fields; i++) {
|
|
|
|
if ((g_hash_table_lookup(header_fields_hash, header_fields[i].header_name)) == NULL) {
|
|
|
|
new_entries++;
|
|
|
|
g_ptr_array_add(array, &header_fields[i]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (new_entries) {
|
|
|
|
hf = g_malloc0(sizeof(hf_register_info) * new_entries);
|
|
|
|
for (i = 0; i < new_entries; i++) {
|
|
|
|
tmp_hdr = (header_field_t*) g_ptr_array_index(array, i);
|
|
|
|
hf_id = g_malloc(sizeof(gint));
|
|
|
|
*hf_id = -1;
|
|
|
|
header_name = g_strdup(tmp_hdr->header_name);
|
|
|
|
|
|
|
|
hf[i].p_id = hf_id;
|
|
|
|
hf[i].hfinfo.name = header_name;
|
|
|
|
hf[i].hfinfo.abbrev = g_strdup_printf("http.header.%s", header_name);
|
|
|
|
hf[i].hfinfo.type = FT_STRING;
|
|
|
|
hf[i].hfinfo.display = BASE_NONE;
|
|
|
|
hf[i].hfinfo.strings = NULL;
|
|
|
|
hf[i].hfinfo.blurb = g_strdup(tmp_hdr->header_desc);
|
|
|
|
hf[i].hfinfo.same_name_prev = NULL;
|
|
|
|
hf[i].hfinfo.same_name_next = NULL;
|
|
|
|
|
|
|
|
g_hash_table_insert(header_fields_hash, header_name, hf_id);
|
|
|
|
}
|
|
|
|
|
|
|
|
proto_register_field_array(proto_http, hf, num_header_fields);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-11-06 08:54:31 +00:00
|
|
|
static void
|
2003-12-23 02:29:11 +00:00
|
|
|
process_header(tvbuff_t *tvb, int offset, int next_offset,
|
2010-09-21 02:12:21 +00:00
|
|
|
const guchar *line, int linelen, int colon_offset,
|
|
|
|
packet_info *pinfo, proto_tree *tree, headers_t *eh_ptr,
|
|
|
|
http_conv_t *conv_data)
|
2003-11-06 08:54:31 +00:00
|
|
|
{
|
|
|
|
int len;
|
|
|
|
int line_end_offset;
|
|
|
|
int header_len;
|
|
|
|
gint hf_index;
|
|
|
|
guchar c;
|
|
|
|
int value_offset;
|
|
|
|
int value_len;
|
|
|
|
char *value;
|
2009-05-19 00:17:23 +00:00
|
|
|
char *header_name;
|
2003-12-23 01:42:48 +00:00
|
|
|
char *p;
|
|
|
|
guchar *up;
|
2003-11-06 08:54:31 +00:00
|
|
|
proto_item *hdr_item;
|
2003-11-18 08:04:39 +00:00
|
|
|
int i;
|
2009-05-19 00:17:23 +00:00
|
|
|
int* hf_id;
|
2003-11-06 08:54:31 +00:00
|
|
|
|
|
|
|
len = next_offset - offset;
|
|
|
|
line_end_offset = offset + linelen;
|
|
|
|
header_len = colon_offset - offset;
|
2009-05-19 00:17:23 +00:00
|
|
|
header_name = se_strndup(&line[0], header_len);
|
2003-11-06 08:54:31 +00:00
|
|
|
hf_index = find_header_hf_value(tvb, offset, header_len);
|
|
|
|
|
2009-05-19 00:17:23 +00:00
|
|
|
/*
|
|
|
|
* Skip whitespace after the colon.
|
|
|
|
*/
|
|
|
|
value_offset = colon_offset + 1;
|
|
|
|
while (value_offset < line_end_offset
|
|
|
|
&& ((c = line[value_offset - offset]) == ' ' || c == '\t'))
|
|
|
|
value_offset++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Fetch the value.
|
|
|
|
*/
|
|
|
|
value_len = line_end_offset - value_offset;
|
|
|
|
value = ep_strndup(&line[value_offset - offset], value_len);
|
|
|
|
|
2003-11-06 08:54:31 +00:00
|
|
|
if (hf_index == -1) {
|
|
|
|
/*
|
2009-05-19 00:17:23 +00:00
|
|
|
* Not a header we know anything about.
|
|
|
|
* Check if a HF generated from UAT information exists.
|
2003-11-06 08:54:31 +00:00
|
|
|
*/
|
2009-05-19 00:17:23 +00:00
|
|
|
hf_id = get_hf_for_header(header_name);
|
|
|
|
|
2003-11-06 08:54:31 +00:00
|
|
|
if (tree) {
|
2009-05-19 00:17:23 +00:00
|
|
|
if (!hf_id) {
|
|
|
|
proto_tree_add_text(tree, tvb, offset, len,
|
|
|
|
"%s", format_text(line, len));
|
|
|
|
} else {
|
|
|
|
proto_tree_add_string_format(tree,
|
|
|
|
*hf_id, tvb, offset, len,
|
|
|
|
value, "%s", format_text(line, len));
|
|
|
|
}
|
2003-11-06 08:54:31 +00:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Skip whitespace after the colon.
|
|
|
|
*/
|
|
|
|
value_offset = colon_offset + 1;
|
|
|
|
while (value_offset < line_end_offset
|
|
|
|
&& ((c = line[value_offset - offset]) == ' ' || c == '\t'))
|
|
|
|
value_offset++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Fetch the value.
|
|
|
|
*/
|
|
|
|
value_len = line_end_offset - value_offset;
|
2005-07-24 01:42:41 +00:00
|
|
|
value = ep_strndup(&line[value_offset - offset], value_len);
|
2003-11-06 08:54:31 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Add it to the protocol tree as a particular field,
|
|
|
|
* but display the line as is.
|
|
|
|
*/
|
|
|
|
if (tree) {
|
2006-10-21 22:17:43 +00:00
|
|
|
header_field_info *hfinfo;
|
|
|
|
guint32 tmp;
|
|
|
|
|
|
|
|
hfinfo = proto_registrar_get_nth(*headers[hf_index].hf);
|
|
|
|
switch(hfinfo->type){
|
|
|
|
case FT_UINT8:
|
|
|
|
case FT_UINT16:
|
|
|
|
case FT_UINT24:
|
|
|
|
case FT_UINT32:
|
|
|
|
case FT_INT8:
|
|
|
|
case FT_INT16:
|
|
|
|
case FT_INT24:
|
|
|
|
case FT_INT32:
|
|
|
|
tmp=strtol(value, NULL, 10);
|
|
|
|
hdr_item = proto_tree_add_uint(tree, *headers[hf_index].hf, tvb, offset, len, tmp);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
hdr_item = proto_tree_add_string_format(tree,
|
|
|
|
*headers[hf_index].hf, tvb, offset, len,
|
|
|
|
value, "%s", format_text(line, len));
|
|
|
|
}
|
2003-11-06 08:54:31 +00:00
|
|
|
} else
|
|
|
|
hdr_item = NULL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Do any special processing that particular headers
|
|
|
|
* require.
|
|
|
|
*/
|
|
|
|
switch (headers[hf_index].special) {
|
|
|
|
|
2003-12-23 02:29:11 +00:00
|
|
|
case HDR_AUTHORIZATION:
|
2003-11-06 08:54:31 +00:00
|
|
|
if (check_auth_ntlmssp(hdr_item, tvb, pinfo, value))
|
|
|
|
break; /* dissected NTLMSSP */
|
2010-10-25 02:17:41 +00:00
|
|
|
if (check_auth_basic(hdr_item, tvb, value))
|
|
|
|
break; /* dissected basic auth */
|
|
|
|
check_auth_kerberos(hdr_item, tvb, pinfo, value);
|
2003-11-06 08:54:31 +00:00
|
|
|
break;
|
|
|
|
|
2003-12-23 02:29:11 +00:00
|
|
|
case HDR_AUTHENTICATE:
|
2010-10-25 02:17:41 +00:00
|
|
|
if (check_auth_ntlmssp(hdr_item, tvb, pinfo, value))
|
|
|
|
break; /* dissected NTLMSSP */
|
|
|
|
check_auth_kerberos(hdr_item, tvb, pinfo, value);
|
2003-11-06 08:54:31 +00:00
|
|
|
break;
|
2003-11-18 07:49:52 +00:00
|
|
|
|
2003-12-23 02:29:11 +00:00
|
|
|
case HDR_CONTENT_TYPE:
|
2005-07-24 01:42:41 +00:00
|
|
|
eh_ptr->content_type = (gchar*) ep_memdup((guint8*)value,value_len + 1);
|
|
|
|
|
2003-11-18 08:04:39 +00:00
|
|
|
for (i = 0; i < value_len; i++) {
|
|
|
|
c = value[i];
|
|
|
|
if (c == ';' || isspace(c)) {
|
|
|
|
/*
|
|
|
|
* End of subtype - either
|
|
|
|
* white space or a ";"
|
|
|
|
* separating the subtype from
|
|
|
|
* a parameter.
|
|
|
|
*/
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Map the character to lower case;
|
|
|
|
* content types are case-insensitive.
|
|
|
|
*/
|
2004-12-01 19:34:51 +00:00
|
|
|
eh_ptr->content_type[i] = tolower(eh_ptr->content_type[i]);
|
2003-11-18 08:04:39 +00:00
|
|
|
}
|
|
|
|
eh_ptr->content_type[i] = '\0';
|
2004-01-16 01:32:20 +00:00
|
|
|
/*
|
|
|
|
* Now find the start of the optional parameters;
|
|
|
|
* skip the optional white space and the semicolon
|
|
|
|
* if this has not been done before.
|
|
|
|
*/
|
|
|
|
i++;
|
|
|
|
while (i < value_len) {
|
2004-12-01 19:34:51 +00:00
|
|
|
c = eh_ptr->content_type[i];
|
2004-01-16 01:32:20 +00:00
|
|
|
if (c == ';' || isspace(c))
|
|
|
|
/* Skip till start of parameters */
|
|
|
|
i++;
|
|
|
|
else
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (i < value_len)
|
2004-12-01 19:34:51 +00:00
|
|
|
eh_ptr->content_type_parameters = eh_ptr->content_type + i;
|
2004-01-16 01:32:20 +00:00
|
|
|
else
|
|
|
|
eh_ptr->content_type_parameters = NULL;
|
2003-11-18 07:49:52 +00:00
|
|
|
break;
|
2003-12-23 01:42:48 +00:00
|
|
|
|
2003-12-23 02:29:11 +00:00
|
|
|
case HDR_CONTENT_LENGTH:
|
2010-05-12 13:24:42 +00:00
|
|
|
errno = 0;
|
2010-04-09 01:42:12 +00:00
|
|
|
#if GLIB_CHECK_VERSION(2,12,0)
|
|
|
|
eh_ptr->content_length = g_ascii_strtoll(value, &p, 10);
|
|
|
|
#elif defined(HAVE_STRTOLL)
|
|
|
|
eh_ptr->content_length = strtoll(value, &p, 10);
|
|
|
|
#else
|
|
|
|
/* Punt and grab a 32-bit value */
|
2003-12-23 01:42:48 +00:00
|
|
|
eh_ptr->content_length = strtol(value, &p, 10);
|
2010-04-09 01:42:12 +00:00
|
|
|
#endif
|
|
|
|
|
2004-01-16 01:32:20 +00:00
|
|
|
up = (guchar *)p;
|
2010-05-12 13:24:42 +00:00
|
|
|
if (eh_ptr->content_length < 0 ||
|
|
|
|
p == value ||
|
|
|
|
errno == ERANGE ||
|
2005-01-13 07:47:26 +00:00
|
|
|
(*up != '\0' && !isspace(*up))) {
|
|
|
|
/*
|
|
|
|
* Content length not valid; pretend
|
|
|
|
* we don't have it.
|
|
|
|
*/
|
|
|
|
eh_ptr->have_content_length = FALSE;
|
|
|
|
} else {
|
2008-10-23 06:57:31 +00:00
|
|
|
proto_tree *header_tree;
|
|
|
|
proto_item *tree_item;
|
2005-01-13 07:47:26 +00:00
|
|
|
/*
|
|
|
|
* We do have a valid content length.
|
|
|
|
*/
|
|
|
|
eh_ptr->have_content_length = TRUE;
|
2008-10-23 06:57:31 +00:00
|
|
|
header_tree = proto_item_add_subtree(hdr_item, ett_http_header_item);
|
2010-04-09 01:42:12 +00:00
|
|
|
tree_item = proto_tree_add_uint64(header_tree, hf_http_content_length,
|
2008-10-23 06:57:31 +00:00
|
|
|
tvb, offset, len, eh_ptr->content_length);
|
|
|
|
PROTO_ITEM_SET_GENERATED(tree_item);
|
2005-01-13 07:47:26 +00:00
|
|
|
}
|
2003-12-23 01:42:48 +00:00
|
|
|
break;
|
2004-02-21 01:31:56 +00:00
|
|
|
|
|
|
|
case HDR_CONTENT_ENCODING:
|
2005-07-24 01:42:41 +00:00
|
|
|
eh_ptr->content_encoding = ep_strndup(value, value_len);
|
2004-02-21 01:31:56 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case HDR_TRANSFER_ENCODING:
|
2005-07-24 01:42:41 +00:00
|
|
|
eh_ptr->transfer_encoding = ep_strndup(value, value_len);
|
2004-02-21 01:31:56 +00:00
|
|
|
break;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
|
|
|
case HDR_HOST:
|
2007-03-13 20:42:04 +00:00
|
|
|
stat_info->http_host = ep_strndup(value, value_len);
|
|
|
|
conv_data->http_host = se_strndup(value, value_len);
|
2005-02-28 22:27:24 +00:00
|
|
|
break;
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2003-11-06 08:54:31 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-12-23 02:29:11 +00:00
|
|
|
/* Returns index of header tag in headers */
|
2003-11-06 08:54:31 +00:00
|
|
|
static gint
|
|
|
|
find_header_hf_value(tvbuff_t *tvb, int offset, guint header_len)
|
|
|
|
{
|
2010-09-21 02:12:21 +00:00
|
|
|
guint i;
|
2003-11-06 08:54:31 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
for (i = 0; i < array_length(headers); i++) {
|
|
|
|
if (header_len == strlen(headers[i].name) &&
|
|
|
|
tvb_strncaseeql(tvb, offset,
|
|
|
|
headers[i].name, header_len) == 0)
|
|
|
|
return i;
|
|
|
|
}
|
2003-11-06 08:54:31 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
return -1;
|
2003-11-06 08:54:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Dissect Microsoft's abomination called NTLMSSP over HTTP.
|
|
|
|
*/
|
|
|
|
static gboolean
|
|
|
|
check_auth_ntlmssp(proto_item *hdr_item, tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
gchar *value)
|
|
|
|
{
|
|
|
|
static const char *ntlm_headers[] = {
|
|
|
|
"NTLM ",
|
|
|
|
"Negotiate ",
|
|
|
|
NULL
|
|
|
|
};
|
|
|
|
const char **header;
|
|
|
|
size_t hdrlen;
|
|
|
|
proto_tree *hdr_tree;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check for NTLM credentials and challenge; those can
|
|
|
|
* occur with WWW-Authenticate.
|
|
|
|
*/
|
|
|
|
for (header = &ntlm_headers[0]; *header != NULL; header++) {
|
|
|
|
hdrlen = strlen(*header);
|
|
|
|
if (strncmp(value, *header, hdrlen) == 0) {
|
|
|
|
if (hdr_item != NULL) {
|
|
|
|
hdr_tree = proto_item_add_subtree(hdr_item,
|
|
|
|
ett_http_ntlmssp);
|
|
|
|
} else
|
|
|
|
hdr_tree = NULL;
|
|
|
|
value += hdrlen;
|
|
|
|
dissect_http_ntlmssp(tvb, pinfo, hdr_tree, value);
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Dissect HTTP Basic authorization.
|
|
|
|
*/
|
|
|
|
static gboolean
|
|
|
|
check_auth_basic(proto_item *hdr_item, tvbuff_t *tvb, gchar *value)
|
|
|
|
{
|
|
|
|
static const char *basic_headers[] = {
|
|
|
|
"Basic ",
|
|
|
|
NULL
|
|
|
|
};
|
|
|
|
const char **header;
|
|
|
|
size_t hdrlen;
|
|
|
|
proto_tree *hdr_tree;
|
|
|
|
size_t len;
|
|
|
|
|
|
|
|
for (header = &basic_headers[0]; *header != NULL; header++) {
|
|
|
|
hdrlen = strlen(*header);
|
|
|
|
if (strncmp(value, *header, hdrlen) == 0) {
|
|
|
|
if (hdr_item != NULL) {
|
|
|
|
hdr_tree = proto_item_add_subtree(hdr_item,
|
|
|
|
ett_http_ntlmssp);
|
|
|
|
} else
|
|
|
|
hdr_tree = NULL;
|
|
|
|
value += hdrlen;
|
|
|
|
|
2004-05-10 22:20:24 +00:00
|
|
|
len = epan_base64_decode(value);
|
2003-11-06 08:54:31 +00:00
|
|
|
value[len] = '\0';
|
|
|
|
proto_tree_add_string(hdr_tree, hf_http_basic, tvb,
|
|
|
|
0, 0, value);
|
|
|
|
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2010-10-25 02:17:41 +00:00
|
|
|
static gboolean
|
|
|
|
check_auth_kerberos(proto_item *hdr_item, tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
const gchar *value)
|
|
|
|
{
|
|
|
|
proto_tree *hdr_tree;
|
|
|
|
|
|
|
|
if (strncmp(value, "Kerberos ", 9) == 0) {
|
|
|
|
if (hdr_item != NULL) {
|
|
|
|
hdr_tree = proto_item_add_subtree(hdr_item, ett_http_kerberos);
|
|
|
|
} else
|
|
|
|
hdr_tree = NULL;
|
|
|
|
|
|
|
|
dissect_http_kerberos(tvb, pinfo, hdr_tree, value);
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2003-12-23 02:02:09 +00:00
|
|
|
static void
|
|
|
|
dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
2007-12-26 18:28:31 +00:00
|
|
|
http_conv_t *conv_data;
|
2003-12-23 02:02:09 +00:00
|
|
|
int offset = 0;
|
|
|
|
int len;
|
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
/*
|
|
|
|
* Check if this is proxied connection and if so, hand of dissection to the
|
|
|
|
* payload-dissector.
|
|
|
|
* Response code 200 means "OK" and strncmp() == 0 means the strings match exactly */
|
|
|
|
conv_data = get_http_conversation_data(pinfo);
|
|
|
|
if(pinfo->fd->num >= conv_data->startframe &&
|
|
|
|
conv_data->response_code == 200 &&
|
|
|
|
conv_data->request_method &&
|
|
|
|
strncmp(conv_data->request_method, "CONNECT", 7) == 0 &&
|
|
|
|
conv_data->request_uri) {
|
|
|
|
if(conv_data->startframe == 0 && !pinfo->fd->flags.visited)
|
|
|
|
conv_data->startframe = pinfo->fd->num;
|
|
|
|
http_payload_subdissector(tvb, tree, pinfo, conv_data);
|
|
|
|
} else {
|
|
|
|
while (tvb_reported_length_remaining(tvb, offset) != 0) {
|
|
|
|
len = dissect_http_message(tvb, offset, pinfo, tree, conv_data);
|
|
|
|
if (len == -1)
|
|
|
|
break;
|
|
|
|
offset += len;
|
2008-03-04 21:05:21 +00:00
|
|
|
|
2007-12-26 18:28:31 +00:00
|
|
|
/*
|
|
|
|
* OK, we've set the Protocol and Info columns for the
|
2008-03-08 21:17:43 +00:00
|
|
|
* first HTTP message; set a fence so that subsequent
|
|
|
|
* HTTP messages don't overwrite the Info column.
|
2007-12-26 18:28:31 +00:00
|
|
|
*/
|
2009-09-14 17:36:15 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_INFO))
|
|
|
|
col_set_fence(pinfo->cinfo, COL_INFO);
|
2007-12-26 18:28:31 +00:00
|
|
|
}
|
2003-12-23 02:02:09 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
dissect_http_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
2007-12-26 18:28:31 +00:00
|
|
|
http_conv_t *conv_data;
|
|
|
|
|
|
|
|
conv_data = get_http_conversation_data(pinfo);
|
|
|
|
dissect_http_message(tvb, 0, pinfo, tree, conv_data);
|
2003-12-23 02:02:09 +00:00
|
|
|
}
|
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void
|
|
|
|
range_delete_http_tcp_callback(guint32 port) {
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_delete_uint("tcp.port", port, http_handle);
|
2007-07-16 12:51:42 +00:00
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void
|
|
|
|
range_add_http_tcp_callback(guint32 port) {
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("tcp.port", port, http_handle);
|
2007-07-16 12:51:42 +00:00
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void
|
|
|
|
range_delete_http_ssl_callback(guint32 port) {
|
|
|
|
ssl_dissector_delete(port, "http", TRUE);
|
2007-07-16 12:51:42 +00:00
|
|
|
}
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
static void
|
|
|
|
range_add_http_ssl_callback(guint32 port) {
|
|
|
|
ssl_dissector_add(port, "http", TRUE);
|
2007-07-16 12:51:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void reinit_http(void) {
|
|
|
|
range_foreach(http_tcp_range, range_delete_http_tcp_callback);
|
|
|
|
g_free(http_tcp_range);
|
|
|
|
http_tcp_range = range_copy(global_http_tcp_range);
|
|
|
|
range_foreach(http_tcp_range, range_add_http_tcp_callback);
|
|
|
|
|
|
|
|
range_foreach(http_ssl_range, range_delete_http_ssl_callback);
|
|
|
|
g_free(http_ssl_range);
|
|
|
|
http_ssl_range = range_copy(global_http_ssl_range);
|
|
|
|
range_foreach(http_ssl_range, range_add_http_ssl_callback);
|
2009-05-19 00:17:23 +00:00
|
|
|
|
|
|
|
/* Attempt to add additional headers that might have been added
|
2009-08-02 19:09:36 +00:00
|
|
|
* once the preferences are applied.
|
2009-05-19 00:17:23 +00:00
|
|
|
*/
|
|
|
|
add_hf_info_for_headers();
|
2005-03-06 21:32:13 +00:00
|
|
|
}
|
|
|
|
|
1999-07-29 05:47:07 +00:00
|
|
|
void
|
|
|
|
proto_register_http(void)
|
|
|
|
{
|
2000-11-09 10:56:33 +00:00
|
|
|
static hf_register_info hf[] = {
|
2001-01-03 03:40:29 +00:00
|
|
|
{ &hf_http_notification,
|
2002-08-28 21:04:11 +00:00
|
|
|
{ "Notification", "http.notification",
|
2001-01-03 03:40:29 +00:00
|
|
|
FT_BOOLEAN, BASE_NONE, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"TRUE if HTTP notification", HFILL }},
|
2000-11-09 10:56:33 +00:00
|
|
|
{ &hf_http_response,
|
2002-08-28 21:04:11 +00:00
|
|
|
{ "Response", "http.response",
|
2000-11-09 10:56:33 +00:00
|
|
|
FT_BOOLEAN, BASE_NONE, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"TRUE if HTTP response", HFILL }},
|
2000-11-09 10:56:33 +00:00
|
|
|
{ &hf_http_request,
|
|
|
|
{ "Request", "http.request",
|
|
|
|
FT_BOOLEAN, BASE_NONE, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"TRUE if HTTP request", HFILL }},
|
2003-05-30 03:11:45 +00:00
|
|
|
{ &hf_http_basic,
|
|
|
|
{ "Credentials", "http.authbasic",
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
|
2003-06-10 22:07:18 +00:00
|
|
|
{ &hf_http_request_method,
|
|
|
|
{ "Request Method", "http.request.method",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Request Method", HFILL }},
|
2005-02-23 05:47:17 +00:00
|
|
|
{ &hf_http_request_uri,
|
|
|
|
{ "Request URI", "http.request.uri",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Request-URI", HFILL }},
|
2005-03-01 11:37:26 +00:00
|
|
|
{ &hf_http_version,
|
2005-02-23 05:47:17 +00:00
|
|
|
{ "Request Version", "http.request.version",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Request HTTP-Version", HFILL }},
|
2010-09-21 02:12:21 +00:00
|
|
|
{ &hf_http_request_full_uri,
|
|
|
|
{ "Full request URI", "http.request.full_uri",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"The full requested URI (including host name)", HFILL }},
|
2003-09-02 23:09:11 +00:00
|
|
|
{ &hf_http_response_code,
|
2010-10-30 14:29:20 +00:00
|
|
|
{ "Status Code", "http.response.code",
|
2003-09-02 22:47:59 +00:00
|
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
2010-10-30 14:29:20 +00:00
|
|
|
"HTTP Response Status Code", HFILL }},
|
|
|
|
{ &hf_http_response_phrase,
|
|
|
|
{ "Response Phrase", "http.response.phrase",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Response Reason Phrase", HFILL }},
|
2003-11-06 08:54:31 +00:00
|
|
|
{ &hf_http_authorization,
|
|
|
|
{ "Authorization", "http.authorization",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Authorization header", HFILL }},
|
|
|
|
{ &hf_http_proxy_authenticate,
|
|
|
|
{ "Proxy-Authenticate", "http.proxy_authenticate",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Proxy-Authenticate header", HFILL }},
|
|
|
|
{ &hf_http_proxy_authorization,
|
|
|
|
{ "Proxy-Authorization", "http.proxy_authorization",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Proxy-Authorization header", HFILL }},
|
2007-04-28 23:52:12 +00:00
|
|
|
{ &hf_http_proxy_connect_host,
|
|
|
|
{ "Proxy-Connect-Hostname", "http.proxy_connect_host",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Proxy Connect Hostname", HFILL }},
|
|
|
|
{ &hf_http_proxy_connect_port,
|
|
|
|
{ "Proxy-Connect-Port", "http.proxy_connect_port",
|
|
|
|
FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
|
|
"HTTP Proxy Connect Port", HFILL }},
|
2003-11-06 08:54:31 +00:00
|
|
|
{ &hf_http_www_authenticate,
|
|
|
|
{ "WWW-Authenticate", "http.www_authenticate",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP WWW-Authenticate header", HFILL }},
|
2003-11-07 03:47:20 +00:00
|
|
|
{ &hf_http_content_type,
|
|
|
|
{ "Content-Type", "http.content_type",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Content-Type header", HFILL }},
|
2008-10-23 06:57:31 +00:00
|
|
|
{ &hf_http_content_length_header,
|
|
|
|
{ "Content-Length", "http.content_length_header",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Content-Length header", HFILL }},
|
2003-12-23 01:42:48 +00:00
|
|
|
{ &hf_http_content_length,
|
2008-10-23 06:57:31 +00:00
|
|
|
{ "Content length", "http.content_length",
|
2010-04-09 01:42:12 +00:00
|
|
|
FT_UINT64, BASE_DEC, NULL, 0x0,
|
2008-10-23 06:57:31 +00:00
|
|
|
NULL, HFILL }},
|
2004-02-21 01:31:56 +00:00
|
|
|
{ &hf_http_content_encoding,
|
|
|
|
{ "Content-Encoding", "http.content_encoding",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Content-Encoding header", HFILL }},
|
|
|
|
{ &hf_http_transfer_encoding,
|
|
|
|
{ "Transfer-Encoding", "http.transfer_encoding",
|
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Transfer-Encoding header", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_user_agent,
|
|
|
|
{ "User-Agent", "http.user_agent",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP User-Agent header", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_host,
|
|
|
|
{ "Host", "http.host",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Host", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_connection,
|
|
|
|
{ "Connection", "http.connection",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Connection", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_cookie,
|
|
|
|
{ "Cookie", "http.cookie",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Cookie", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_accept,
|
|
|
|
{ "Accept", "http.accept",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Accept", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_referer,
|
|
|
|
{ "Referer", "http.referer",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Referer", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_accept_language,
|
|
|
|
{ "Accept-Language", "http.accept_language",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Accept Language", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_accept_encoding,
|
|
|
|
{ "Accept Encoding", "http.accept_encoding",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Accept Encoding", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_date,
|
|
|
|
{ "Date", "http.date",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Date", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_cache_control,
|
|
|
|
{ "Cache-Control", "http.cache_control",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Cache Control", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_server,
|
|
|
|
{ "Server", "http.server",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Server", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_location,
|
|
|
|
{ "Location", "http.location",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Location", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_set_cookie,
|
|
|
|
{ "Set-Cookie", "http.set_cookie",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Set Cookie", HFILL }},
|
2004-12-07 17:59:58 +00:00
|
|
|
{ &hf_http_last_modified,
|
|
|
|
{ "Last-Modified", "http.last_modified",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP Last Modified", HFILL }},
|
2006-02-20 06:25:02 +00:00
|
|
|
{ &hf_http_x_forwarded_for,
|
|
|
|
{ "X-Forwarded-For", "http.x_forwarded_for",
|
2010-09-21 02:12:21 +00:00
|
|
|
FT_STRING, BASE_NONE, NULL, 0x0,
|
|
|
|
"HTTP X-Forwarded-For", HFILL }}
|
2000-11-09 10:56:33 +00:00
|
|
|
};
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_http,
|
2002-08-13 05:36:02 +00:00
|
|
|
&ett_http_ntlmssp,
|
2010-10-25 02:17:41 +00:00
|
|
|
&ett_http_kerberos,
|
2003-06-10 22:07:18 +00:00
|
|
|
&ett_http_request,
|
2004-04-26 17:10:40 +00:00
|
|
|
&ett_http_chunked_response,
|
|
|
|
&ett_http_chunk_data,
|
|
|
|
&ett_http_encoded_entity,
|
2008-10-23 06:57:31 +00:00
|
|
|
&ett_http_header_item
|
2000-11-09 10:56:33 +00:00
|
|
|
};
|
2009-05-19 00:17:23 +00:00
|
|
|
/* UAT for header fields */
|
|
|
|
static uat_field_t custom_header_uat_fields[] = {
|
|
|
|
UAT_FLD_CSTRING(header_fields, header_name, "Header name", "HTTP header name"),
|
|
|
|
UAT_FLD_CSTRING(header_fields, header_desc, "Field desc", "Description of the value contained in the header"),
|
|
|
|
UAT_END_FIELDS
|
|
|
|
};
|
|
|
|
|
2003-11-04 08:16:02 +00:00
|
|
|
module_t *http_module;
|
2009-05-19 00:17:23 +00:00
|
|
|
uat_t* headers_uat;
|
|
|
|
char* uat_load_err;
|
2000-11-09 10:56:33 +00:00
|
|
|
|
|
|
|
proto_http = proto_register_protocol("Hypertext Transfer Protocol",
|
2001-01-03 06:56:03 +00:00
|
|
|
"HTTP", "http");
|
2000-11-09 10:56:33 +00:00
|
|
|
proto_register_field_array(proto_http, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2006-05-23 05:48:00 +00:00
|
|
|
register_dissector("http", dissect_http, proto_http);
|
2005-03-06 21:32:13 +00:00
|
|
|
http_module = prefs_register_protocol(proto_http, reinit_http);
|
2003-12-31 09:58:56 +00:00
|
|
|
prefs_register_bool_preference(http_module, "desegment_headers",
|
2004-08-21 09:02:52 +00:00
|
|
|
"Reassemble HTTP headers spanning multiple TCP segments",
|
|
|
|
"Whether the HTTP dissector should reassemble headers "
|
|
|
|
"of a request spanning multiple TCP segments. "
|
|
|
|
"To use this option, you must also enable "
|
2010-09-21 02:12:21 +00:00
|
|
|
"\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
|
2003-11-04 08:16:02 +00:00
|
|
|
&http_desegment_headers);
|
2003-12-31 09:58:56 +00:00
|
|
|
prefs_register_bool_preference(http_module, "desegment_body",
|
2004-08-21 09:02:52 +00:00
|
|
|
"Reassemble HTTP bodies spanning multiple TCP segments",
|
2003-11-04 08:16:02 +00:00
|
|
|
"Whether the HTTP dissector should use the "
|
2004-08-21 09:02:52 +00:00
|
|
|
"\"Content-length:\" value, if present, to reassemble "
|
2004-05-04 07:12:03 +00:00
|
|
|
"the body of a request spanning multiple TCP segments, "
|
2004-08-21 09:02:52 +00:00
|
|
|
"and reassemble chunked data spanning multiple TCP segments. "
|
|
|
|
"To use this option, you must also enable "
|
2010-09-21 02:12:21 +00:00
|
|
|
"\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
|
2003-11-04 08:16:02 +00:00
|
|
|
&http_desegment_body);
|
2004-05-05 06:55:09 +00:00
|
|
|
prefs_register_bool_preference(http_module, "dechunk_body",
|
|
|
|
"Reassemble chunked transfer-coded bodies",
|
|
|
|
"Whether to reassemble bodies of entities that are transfered "
|
|
|
|
"using the \"Transfer-Encoding: chunked\" method",
|
|
|
|
&http_dechunk_body);
|
|
|
|
#ifdef HAVE_LIBZ
|
|
|
|
prefs_register_bool_preference(http_module, "decompress_body",
|
|
|
|
"Uncompress entity bodies",
|
|
|
|
"Whether to uncompress entity bodies that are compressed "
|
|
|
|
"using \"Content-Encoding: \"",
|
|
|
|
&http_decompress_body);
|
|
|
|
#endif
|
2007-07-16 12:51:42 +00:00
|
|
|
prefs_register_obsolete_preference(http_module, "tcp_alternate_port");
|
|
|
|
|
|
|
|
range_convert_str(&global_http_tcp_range, TCP_DEFAULT_RANGE, 65535);
|
|
|
|
http_tcp_range = range_empty();
|
|
|
|
prefs_register_range_preference(http_module, "tcp.port", "TCP Ports",
|
2010-09-21 02:12:21 +00:00
|
|
|
"TCP Ports range",
|
|
|
|
&global_http_tcp_range, 65535);
|
2007-07-16 12:51:42 +00:00
|
|
|
|
|
|
|
range_convert_str(&global_http_ssl_range, SSL_DEFAULT_RANGE, 65535);
|
|
|
|
http_ssl_range = range_empty();
|
|
|
|
prefs_register_range_preference(http_module, "ssl.port", "SSL/TLS Ports",
|
2010-09-21 02:12:21 +00:00
|
|
|
"SSL/TLS Ports range",
|
|
|
|
&global_http_ssl_range, 65535);
|
2009-05-19 00:17:23 +00:00
|
|
|
/* UAT */
|
|
|
|
headers_uat = uat_new("Custom HTTP headers fields Table",
|
2010-09-21 02:12:21 +00:00
|
|
|
sizeof(header_field_t),
|
|
|
|
"custom_http_header_fields",
|
|
|
|
TRUE,
|
|
|
|
(void*) &header_fields,
|
|
|
|
&num_header_fields,
|
|
|
|
UAT_CAT_GENERAL,
|
|
|
|
NULL,
|
|
|
|
header_fields_copy_cb,
|
|
|
|
header_fields_update_cb,
|
|
|
|
header_fields_free_cb,
|
|
|
|
NULL,
|
|
|
|
custom_header_uat_fields
|
2009-05-19 00:17:23 +00:00
|
|
|
);
|
|
|
|
|
|
|
|
prefs_register_uat_preference(http_module, "custom_http_header_fields", "Custom HTTP headers fields",
|
|
|
|
"A table to define custom HTTP header for which fields can be setup and used for filtering/data extraction etc.",
|
|
|
|
headers_uat);
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2003-12-23 02:02:09 +00:00
|
|
|
http_handle = create_dissector_handle(dissect_http, proto_http);
|
2001-09-04 01:01:48 +00:00
|
|
|
|
2001-01-11 06:30:54 +00:00
|
|
|
/*
|
|
|
|
* Dissectors shouldn't register themselves in this table;
|
|
|
|
* instead, they should call "http_dissector_add()", and
|
|
|
|
* we'll register the port number they specify as a port
|
|
|
|
* for HTTP, and register them in our subdissector table.
|
|
|
|
*
|
|
|
|
* This only works for protocols such as IPP that run over
|
|
|
|
* HTTP on a specific non-HTTP port.
|
|
|
|
*/
|
2003-11-18 07:49:52 +00:00
|
|
|
port_subdissector_table = register_dissector_table("http.port",
|
2001-12-08 06:41:48 +00:00
|
|
|
"TCP port for protocols using HTTP", FT_UINT16, BASE_DEC);
|
2001-11-18 02:28:15 +00:00
|
|
|
|
2003-11-18 07:49:52 +00:00
|
|
|
/*
|
|
|
|
* Dissectors can register themselves in this table.
|
2003-12-07 03:17:42 +00:00
|
|
|
* It's just "media_type", not "http.content_type", because
|
|
|
|
* it's an Internet media type, usable by other protocols as well.
|
2003-11-18 07:49:52 +00:00
|
|
|
*/
|
2003-12-07 03:21:22 +00:00
|
|
|
media_type_subdissector_table =
|
2003-12-07 03:17:42 +00:00
|
|
|
register_dissector_table("media_type",
|
|
|
|
"Internet media type", FT_STRING, BASE_NONE);
|
2003-11-18 07:49:52 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
/*
|
|
|
|
* Heuristic dissectors SHOULD register themselves in
|
|
|
|
* this table using the standard heur_dissector_add()
|
2001-11-18 02:28:15 +00:00
|
|
|
* function.
|
|
|
|
*/
|
2003-10-27 09:17:21 +00:00
|
|
|
register_heur_dissector_list("http", &heur_subdissector_list);
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2003-09-02 22:47:59 +00:00
|
|
|
/*
|
|
|
|
* Register for tapping
|
|
|
|
*/
|
2007-03-13 20:42:04 +00:00
|
|
|
http_tap = register_tap("http"); /* HTTP statistics tap */
|
|
|
|
http_eo_tap = register_tap("http_eo"); /* HTTP Export Object tap */
|
2009-05-19 00:17:23 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Add additional HFs for HTTP headers from the UAT (which is loaded manually first).
|
|
|
|
*/
|
|
|
|
if (uat_load(headers_uat, &uat_load_err)) {
|
|
|
|
add_hf_info_for_headers();
|
|
|
|
}
|
2001-01-11 06:30:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Called by dissectors for protocols that run atop HTTP/TCP.
|
|
|
|
*/
|
|
|
|
void
|
2001-12-03 04:00:26 +00:00
|
|
|
http_dissector_add(guint32 port, dissector_handle_t handle)
|
2001-01-11 06:30:54 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Register ourselves as the handler for that port number
|
|
|
|
* over TCP.
|
|
|
|
*/
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("tcp.port", port, http_handle);
|
2001-01-11 06:30:54 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* And register them in *our* table for that port.
|
|
|
|
*/
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("http.port", port, handle);
|
1999-07-29 05:47:07 +00:00
|
|
|
}
|
2000-04-08 07:07:42 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_http(void)
|
|
|
|
{
|
2003-12-23 02:02:09 +00:00
|
|
|
dissector_handle_t http_udp_handle;
|
|
|
|
|
2003-11-04 08:16:02 +00:00
|
|
|
data_handle = find_dissector("data");
|
2004-04-30 17:07:21 +00:00
|
|
|
media_handle = find_dissector("media");
|
2003-11-04 08:16:02 +00:00
|
|
|
|
2001-01-11 05:36:09 +00:00
|
|
|
/*
|
|
|
|
* XXX - is there anything to dissect in the body of an SSDP
|
|
|
|
* request or reply? I.e., should there be an SSDP dissector?
|
|
|
|
*/
|
2003-12-23 02:02:09 +00:00
|
|
|
http_udp_handle = create_dissector_handle(dissect_http_udp, proto_http);
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("udp.port", UDP_PORT_SSDP, http_udp_handle);
|
2002-08-13 05:36:02 +00:00
|
|
|
|
|
|
|
ntlmssp_handle = find_dissector("ntlmssp");
|
2004-10-29 08:01:11 +00:00
|
|
|
gssapi_handle = find_dissector("gssapi");
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2010-09-21 02:12:21 +00:00
|
|
|
stats_tree_register("http", "http", "HTTP/Packet Counter", 0, http_stats_tree_packet, http_stats_tree_init, NULL );
|
|
|
|
stats_tree_register("http", "http_req", "HTTP/Requests", 0, http_req_stats_tree_packet, http_req_stats_tree_init, NULL );
|
|
|
|
stats_tree_register("http", "http_srv", "HTTP/Load Distribution",0, http_reqs_stats_tree_packet, http_reqs_stats_tree_init, NULL );
|
2006-08-24 22:05:26 +00:00
|
|
|
|
2000-04-08 07:07:42 +00:00
|
|
|
}
|
2004-01-09 21:45:29 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Content-Type: message/http
|
|
|
|
*/
|
|
|
|
|
|
|
|
static gint proto_message_http = -1;
|
|
|
|
static gint ett_message_http = -1;
|
|
|
|
|
|
|
|
static void
|
|
|
|
dissect_message_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
proto_tree *subtree;
|
|
|
|
proto_item *ti;
|
|
|
|
gint offset = 0, next_offset;
|
|
|
|
gint len;
|
|
|
|
|
2009-09-24 20:21:23 +00:00
|
|
|
col_append_str(pinfo->cinfo, COL_INFO, " (message/http)");
|
2004-01-09 21:45:29 +00:00
|
|
|
if (tree) {
|
|
|
|
ti = proto_tree_add_item(tree, proto_message_http,
|
|
|
|
tvb, 0, -1, FALSE);
|
|
|
|
subtree = proto_item_add_subtree(ti, ett_message_http);
|
|
|
|
while (tvb_reported_length_remaining(tvb, offset) != 0) {
|
|
|
|
len = tvb_find_line_end(tvb, offset,
|
|
|
|
tvb_ensure_length_remaining(tvb, offset),
|
|
|
|
&next_offset, FALSE);
|
|
|
|
if (len == -1)
|
|
|
|
break;
|
|
|
|
proto_tree_add_text(subtree, tvb, offset, next_offset - offset,
|
|
|
|
"%s", tvb_format_text(tvb, offset, len));
|
|
|
|
offset = next_offset;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_register_message_http(void)
|
|
|
|
{
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_message_http,
|
|
|
|
};
|
|
|
|
|
|
|
|
proto_message_http = proto_register_protocol(
|
|
|
|
"Media Type: message/http",
|
|
|
|
"message/http",
|
|
|
|
"message-http"
|
|
|
|
);
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_message_http(void)
|
|
|
|
{
|
2008-09-26 20:06:40 +00:00
|
|
|
dissector_handle_t message_http_handle;
|
|
|
|
|
2004-01-09 21:45:29 +00:00
|
|
|
message_http_handle = create_dissector_handle(dissect_message_http,
|
|
|
|
proto_message_http);
|
|
|
|
|
|
|
|
dissector_add_string("media_type", "message/http", message_http_handle);
|
2007-08-08 14:01:28 +00:00
|
|
|
|
|
|
|
reinit_http();
|
2004-01-09 21:45:29 +00:00
|
|
|
}
|