2003-12-23 02:29:11 +00:00
|
|
|
/* req_resp_hdrs.c
|
|
|
|
* Routines handling protocols with a request/response line, headers,
|
2003-12-22 00:57:34 +00:00
|
|
|
* a blank line, and an optional body.
|
|
|
|
*
|
2006-05-21 05:12:17 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2003-12-22 00:57:34 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 22:56:06 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
2003-12-22 00:57:34 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
|
|
|
|
#include <glib.h>
|
2009-08-26 19:27:49 +00:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <string.h>
|
|
|
|
|
2003-12-22 00:57:34 +00:00
|
|
|
#include <epan/packet.h>
|
|
|
|
#include <epan/strutil.h>
|
|
|
|
|
2004-09-29 00:25:05 +00:00
|
|
|
#include <epan/req_resp_hdrs.h>
|
2003-12-22 00:57:34 +00:00
|
|
|
|
|
|
|
/*
|
2003-12-23 02:29:11 +00:00
|
|
|
* Optionally do reassembly of the request/response line, headers, and body.
|
2003-12-22 00:57:34 +00:00
|
|
|
*/
|
|
|
|
gboolean
|
2007-11-19 21:28:08 +00:00
|
|
|
req_resp_hdrs_do_reassembly(tvbuff_t *tvb, const int offset, packet_info *pinfo,
|
|
|
|
const gboolean desegment_headers, const gboolean desegment_body)
|
2003-12-22 00:57:34 +00:00
|
|
|
{
|
|
|
|
gint next_offset;
|
|
|
|
gint next_offset_sav;
|
2003-12-24 09:50:54 +00:00
|
|
|
gint length_remaining, reported_length_remaining;
|
2012-12-26 05:57:06 +00:00
|
|
|
int linelen;
|
2004-05-04 06:53:47 +00:00
|
|
|
gchar *header_val;
|
2012-12-26 05:57:06 +00:00
|
|
|
int content_length;
|
2003-12-22 00:57:34 +00:00
|
|
|
gboolean content_length_found = FALSE;
|
2006-09-10 14:03:08 +00:00
|
|
|
gboolean content_type_found = FALSE;
|
2004-04-26 17:10:40 +00:00
|
|
|
gboolean chunked_encoding = FALSE;
|
2006-11-10 20:53:42 +00:00
|
|
|
gboolean keepalive_found = FALSE;
|
2010-05-26 11:51:41 +00:00
|
|
|
gchar *line;
|
2012-05-22 06:23:36 +00:00
|
|
|
gchar *content_type = NULL;
|
2003-12-22 00:57:34 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Do header desegmentation if we've been told to.
|
|
|
|
*
|
|
|
|
* RFC 2616 defines HTTP messages as being either of the
|
|
|
|
* Request or the Response type
|
|
|
|
* (HTTP-message = Request | Response).
|
|
|
|
* Request and Response are defined as:
|
|
|
|
* Request = Request-Line
|
|
|
|
* *(( general-header
|
|
|
|
* | request-header
|
|
|
|
* | entity-header ) CRLF)
|
|
|
|
* CRLF
|
|
|
|
* [ message-body ]
|
|
|
|
* Response = Status-Line
|
|
|
|
* *(( general-header
|
|
|
|
* | response-header
|
|
|
|
* | entity-header ) CRLF)
|
|
|
|
* CRLF
|
|
|
|
* [ message-body ]
|
|
|
|
* that's why we can always assume two consecutive line
|
|
|
|
* endings (we allow CR, LF, or CRLF, as some clients
|
|
|
|
* or servers might not use a full CRLF) to mark the end
|
|
|
|
* of the headers. The worst thing that would happen
|
|
|
|
* otherwise would be the packet not being desegmented
|
|
|
|
* or being interpreted as only headers.
|
|
|
|
*
|
|
|
|
* RFC 2326 says RTSP works the same way; RFC 3261 says SIP
|
|
|
|
* works the same way.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If header desegmentation is activated, check that all
|
|
|
|
* headers are in this tvbuff (search for an empty line
|
|
|
|
* marking end of headers) or request one more byte (we
|
|
|
|
* don't know how many bytes we'll need, so we just ask
|
|
|
|
* for one).
|
|
|
|
*/
|
|
|
|
if (desegment_headers && pinfo->can_desegment) {
|
|
|
|
next_offset = offset;
|
|
|
|
for (;;) {
|
|
|
|
next_offset_sav = next_offset;
|
|
|
|
|
2003-12-24 09:50:54 +00:00
|
|
|
reported_length_remaining =
|
|
|
|
tvb_reported_length_remaining(tvb, next_offset);
|
|
|
|
|
2003-12-22 00:57:34 +00:00
|
|
|
/*
|
|
|
|
* Request one more byte if there're no
|
2003-12-24 09:50:54 +00:00
|
|
|
* bytes left in the reported data (if there're
|
|
|
|
* bytes left in the reported data, but not in
|
|
|
|
* the available data, requesting more bytes
|
|
|
|
* won't help, as those bytes weren't captured).
|
2003-12-22 00:57:34 +00:00
|
|
|
*/
|
2003-12-24 09:50:54 +00:00
|
|
|
if (reported_length_remaining < 1) {
|
2003-12-22 00:57:34 +00:00
|
|
|
pinfo->desegment_offset = offset;
|
2006-11-07 13:19:31 +00:00
|
|
|
pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
|
2003-12-22 00:57:34 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2014-05-14 10:35:30 +00:00
|
|
|
length_remaining = tvb_captured_length_remaining(tvb,
|
2007-11-19 21:28:08 +00:00
|
|
|
next_offset);
|
|
|
|
|
2003-12-22 00:57:34 +00:00
|
|
|
/*
|
|
|
|
* Request one more byte if we cannot find a
|
|
|
|
* header (i.e. a line end).
|
|
|
|
*/
|
|
|
|
linelen = tvb_find_line_end(tvb, next_offset,
|
2014-05-14 10:35:30 +00:00
|
|
|
length_remaining, &next_offset, TRUE);
|
2003-12-24 09:50:54 +00:00
|
|
|
if (linelen == -1 &&
|
|
|
|
length_remaining >= reported_length_remaining) {
|
2003-12-22 00:57:34 +00:00
|
|
|
/*
|
|
|
|
* Not enough data; ask for one more
|
|
|
|
* byte.
|
|
|
|
*/
|
|
|
|
pinfo->desegment_offset = offset;
|
2006-11-07 13:19:31 +00:00
|
|
|
pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
|
2003-12-22 00:57:34 +00:00
|
|
|
return FALSE;
|
2009-10-03 03:09:53 +00:00
|
|
|
}
|
|
|
|
|
2007-11-19 21:28:08 +00:00
|
|
|
if (linelen == 0) {
|
2003-12-22 00:57:34 +00:00
|
|
|
/*
|
|
|
|
* We found the end of the headers.
|
|
|
|
*/
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2004-04-26 17:10:40 +00:00
|
|
|
* Is this a Content-Length or Transfer-Encoding
|
|
|
|
* header? If not, it either means that we are in
|
2003-12-22 00:57:34 +00:00
|
|
|
* a different header line, or that we are
|
|
|
|
* at the end of the headers, or that there
|
|
|
|
* isn't enough data; the two latter cases
|
|
|
|
* have already been handled above.
|
|
|
|
*/
|
|
|
|
if (desegment_body) {
|
2013-05-24 02:31:26 +00:00
|
|
|
/* Optimization to avoid fetching the whole (potentially very long)
|
|
|
|
* line and doing expensive string comparisons if the first
|
|
|
|
* character doesn't match. Shaves about 20% off the load time of
|
|
|
|
* one of my sample files that's HTTP-alike. */
|
|
|
|
guchar first_byte = tvb_get_guint8(tvb, next_offset_sav);
|
|
|
|
if (! (first_byte == 'c' || first_byte == 'C' ||
|
|
|
|
first_byte == 't' || first_byte == 'T')) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2003-12-22 00:57:34 +00:00
|
|
|
/*
|
|
|
|
* Check if we've found Content-Length.
|
|
|
|
*/
|
2014-03-31 15:55:28 +00:00
|
|
|
line = tvb_get_string_enc(wmem_packet_scope(), tvb, next_offset_sav, linelen, ENC_UTF_8|ENC_NA);
|
2010-05-26 11:51:41 +00:00
|
|
|
if (g_ascii_strncasecmp(line, "Content-Length:", 15) == 0) {
|
2012-12-26 05:57:06 +00:00
|
|
|
/* XXX - what if it doesn't fit in an int?
|
|
|
|
(Do not "fix" that by making this
|
|
|
|
a "long"; make it a gint64 or a
|
|
|
|
guint64.) */
|
|
|
|
if (sscanf(line+15,"%i", &content_length) == 1)
|
2003-12-22 00:57:34 +00:00
|
|
|
content_length_found = TRUE;
|
2010-05-26 11:51:41 +00:00
|
|
|
} else if (g_ascii_strncasecmp(line, "Content-Type:", 13) == 0) {
|
2006-09-10 14:03:08 +00:00
|
|
|
content_type_found = TRUE;
|
2012-05-22 06:23:36 +00:00
|
|
|
content_type = line+13;
|
|
|
|
while (*content_type == ' ') {
|
|
|
|
content_type++;
|
|
|
|
}
|
2010-05-26 11:51:41 +00:00
|
|
|
} else if (g_ascii_strncasecmp(line, "Connection:", 11) == 0) {
|
2006-11-10 20:53:42 +00:00
|
|
|
/* Check for keep-alive */
|
2010-05-26 11:51:41 +00:00
|
|
|
header_val = line+11;
|
2006-11-10 20:53:42 +00:00
|
|
|
if(header_val){
|
|
|
|
while(*header_val==' '){
|
|
|
|
header_val++;
|
|
|
|
}
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
if(!g_ascii_strncasecmp(header_val, "Keep-Alive", 10)){
|
2006-11-10 20:53:42 +00:00
|
|
|
keepalive_found = TRUE;
|
|
|
|
}
|
|
|
|
}
|
2010-05-26 11:51:41 +00:00
|
|
|
} else if (g_ascii_strncasecmp( line, "Transfer-Encoding:", 18) == 0) {
|
2004-04-26 17:10:40 +00:00
|
|
|
/*
|
|
|
|
* Find out if this Transfer-Encoding is
|
|
|
|
* chunked. It should be, since there
|
|
|
|
* really aren't any other types, but
|
|
|
|
* RFC 2616 allows for them.
|
|
|
|
*/
|
2004-05-04 06:53:47 +00:00
|
|
|
gchar *p;
|
2007-11-19 21:28:08 +00:00
|
|
|
guint len;
|
2004-04-26 17:10:40 +00:00
|
|
|
|
2010-05-26 11:51:41 +00:00
|
|
|
header_val = line+18;
|
2004-05-04 06:53:47 +00:00
|
|
|
p = header_val;
|
2009-04-08 16:50:20 +00:00
|
|
|
len = (guint) strlen(header_val);
|
2004-05-04 06:53:47 +00:00
|
|
|
/* Skip white space */
|
|
|
|
while (p < header_val + len &&
|
|
|
|
(*p == ' ' || *p == '\t'))
|
|
|
|
p++;
|
|
|
|
if (p <= header_val + len) {
|
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
|
|
|
if (g_ascii_strncasecmp(p, "chunked", 7)
|
2004-05-04 06:53:47 +00:00
|
|
|
== 0) {
|
|
|
|
/*
|
|
|
|
* Don't bother looking
|
|
|
|
* for extensions;
|
|
|
|
* since we don't
|
|
|
|
* understand them,
|
|
|
|
* they should be
|
|
|
|
* ignored.
|
|
|
|
*/
|
|
|
|
chunked_encoding = TRUE;
|
2004-04-26 17:10:40 +00:00
|
|
|
}
|
|
|
|
}
|
2003-12-22 00:57:34 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The above loop ends when we reached the end of the headers, so
|
2004-04-26 17:10:40 +00:00
|
|
|
* there should be content_length bytes after the 4 terminating bytes
|
2003-12-22 00:57:34 +00:00
|
|
|
* and next_offset points to after the end of the headers.
|
|
|
|
*/
|
2004-04-26 17:10:40 +00:00
|
|
|
if (desegment_body) {
|
2013-09-05 15:48:50 +00:00
|
|
|
if (chunked_encoding) {
|
2004-04-26 17:10:40 +00:00
|
|
|
/*
|
|
|
|
* This data is chunked, so we need to keep pulling
|
|
|
|
* data until we reach the end of the stream, or a
|
|
|
|
* zero sized chunk.
|
|
|
|
*
|
|
|
|
* XXX
|
|
|
|
* This doesn't bother with trailing headers; I don't
|
|
|
|
* think they are really used, and we'd have to use
|
|
|
|
* is_http_request_or_reply() to determine if it was
|
|
|
|
* a trailing header, or the start of a new response.
|
|
|
|
*/
|
|
|
|
gboolean done_chunking = FALSE;
|
|
|
|
|
|
|
|
while (!done_chunking) {
|
2009-10-01 14:38:37 +00:00
|
|
|
guint chunk_size = 0;
|
|
|
|
gint chunk_offset = 0;
|
2004-04-26 17:10:40 +00:00
|
|
|
gchar *chunk_string = NULL;
|
|
|
|
gchar *c = NULL;
|
|
|
|
|
|
|
|
reported_length_remaining =
|
|
|
|
tvb_reported_length_remaining(tvb,
|
|
|
|
next_offset);
|
|
|
|
|
|
|
|
if (reported_length_remaining < 1) {
|
|
|
|
pinfo->desegment_offset = offset;
|
2007-08-21 20:57:52 +00:00
|
|
|
pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
|
2004-04-26 17:10:40 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
2014-05-14 10:35:30 +00:00
|
|
|
length_remaining = tvb_captured_length_remaining(tvb,
|
2007-11-19 21:28:08 +00:00
|
|
|
next_offset);
|
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
linelen = tvb_find_line_end(tvb, next_offset,
|
2014-05-14 10:35:30 +00:00
|
|
|
length_remaining, &chunk_offset, TRUE);
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
if (linelen == -1 &&
|
|
|
|
length_remaining >=
|
|
|
|
reported_length_remaining) {
|
|
|
|
pinfo->desegment_offset = offset;
|
2007-08-21 20:57:52 +00:00
|
|
|
pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
|
2004-04-26 17:10:40 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
2009-10-03 03:09:53 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
/* We have a line with the chunk size in it.*/
|
2013-09-22 15:50:55 +00:00
|
|
|
chunk_string = tvb_get_string(wmem_packet_scope(), tvb, next_offset,
|
2004-04-26 17:10:40 +00:00
|
|
|
linelen);
|
|
|
|
c = chunk_string;
|
|
|
|
|
2003-12-24 09:50:54 +00:00
|
|
|
/*
|
2004-04-26 17:10:40 +00:00
|
|
|
* We don't care about the extensions.
|
2003-12-24 09:50:54 +00:00
|
|
|
*/
|
2004-04-26 17:10:40 +00:00
|
|
|
if ((c = strchr(c, ';'))) {
|
|
|
|
*c = '\0';
|
|
|
|
}
|
|
|
|
|
2009-10-01 14:38:37 +00:00
|
|
|
if (sscanf(chunk_string, "%x", &chunk_size) < 1) {
|
2004-04-26 17:10:40 +00:00
|
|
|
/* We couldn't get the chunk size,
|
|
|
|
* so stop trying.
|
|
|
|
*/
|
|
|
|
return TRUE;
|
|
|
|
}
|
2009-10-03 09:15:40 +00:00
|
|
|
if (chunk_size > (guint)1<<31) {
|
2009-10-03 03:09:53 +00:00
|
|
|
/* Chunk size is unreasonable. */
|
|
|
|
/* XXX What /is/ reasonable? */
|
|
|
|
return TRUE;
|
|
|
|
}
|
2004-04-26 17:10:40 +00:00
|
|
|
|
|
|
|
if (chunk_size == 0) {
|
|
|
|
/*
|
|
|
|
* This is the last chunk. Let's pull in the
|
|
|
|
* trailing CRLF.
|
|
|
|
*/
|
|
|
|
linelen = tvb_find_line_end(tvb,
|
2014-05-14 10:35:30 +00:00
|
|
|
chunk_offset, length_remaining, &chunk_offset, TRUE);
|
2009-10-03 03:09:53 +00:00
|
|
|
|
2004-04-26 17:10:40 +00:00
|
|
|
if (linelen == -1 &&
|
|
|
|
length_remaining >=
|
|
|
|
reported_length_remaining) {
|
|
|
|
pinfo->desegment_offset = offset;
|
2007-08-21 20:57:52 +00:00
|
|
|
pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
|
2004-04-26 17:10:40 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
pinfo->desegment_offset = chunk_offset;
|
|
|
|
pinfo->desegment_len = 0;
|
|
|
|
done_chunking = TRUE;
|
|
|
|
} else {
|
2009-10-03 03:09:53 +00:00
|
|
|
/*
|
2004-04-26 17:10:40 +00:00
|
|
|
* Skip to the next chunk if we
|
2009-10-03 03:09:53 +00:00
|
|
|
* already have it
|
2004-04-26 17:10:40 +00:00
|
|
|
*/
|
|
|
|
if (reported_length_remaining >
|
2009-10-01 15:03:02 +00:00
|
|
|
(gint) chunk_size) {
|
2009-10-03 03:09:53 +00:00
|
|
|
|
|
|
|
next_offset = chunk_offset
|
2004-04-26 17:10:40 +00:00
|
|
|
+ chunk_size + 2;
|
|
|
|
} else {
|
2009-10-03 03:09:53 +00:00
|
|
|
/*
|
2004-04-26 17:10:40 +00:00
|
|
|
* Fetch this chunk, plus the
|
|
|
|
* trailing CRLF.
|
2009-10-03 03:09:53 +00:00
|
|
|
*/
|
2004-04-26 17:10:40 +00:00
|
|
|
pinfo->desegment_offset = offset;
|
2007-10-03 17:07:19 +00:00
|
|
|
pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
|
2004-04-26 17:10:40 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-12-24 09:50:54 +00:00
|
|
|
}
|
2013-09-05 15:48:50 +00:00
|
|
|
} else if (content_length_found) {
|
|
|
|
if (content_length >= 128*1024) { /* MS-RPCH stipulate that the content-length must be between 128K and 2G */
|
|
|
|
gchar *tmp;
|
|
|
|
if (content_type_found &&
|
|
|
|
strncmp(content_type, "application/rpc", 15) == 0) {
|
|
|
|
/* It looks like a RPC_IN_DATA request or a RPC_OUT_DATA response
|
|
|
|
* in which the content-length is meaningless
|
|
|
|
*/
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
/* Following sizeof will return the length of the string + \0 we need to not count it*/
|
2013-09-22 15:50:55 +00:00
|
|
|
tmp = tvb_get_string(wmem_packet_scope(), tvb, 0, sizeof("RPC_OUT_DATA") - 1);
|
2013-09-05 15:48:50 +00:00
|
|
|
if ((strncmp(tmp, "RPC_IN_DATA", sizeof("RPC_IN_DATA") - 1) == 0) ||
|
|
|
|
(strncmp(tmp, "RPC_OUT_DATA", sizeof("RPC_OUT_DATA") - 1) == 0)) {
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* next_offset has been set to the end of the headers */
|
|
|
|
if (!tvb_bytes_exist(tvb, next_offset, content_length)) {
|
2014-05-14 10:35:30 +00:00
|
|
|
length_remaining = tvb_captured_length_remaining(tvb,
|
2013-09-05 15:48:50 +00:00
|
|
|
next_offset);
|
|
|
|
reported_length_remaining =
|
|
|
|
tvb_reported_length_remaining(tvb, next_offset);
|
|
|
|
if (length_remaining < reported_length_remaining) {
|
|
|
|
/*
|
|
|
|
* It's a waste of time asking for more
|
|
|
|
* data, because that data wasn't captured.
|
|
|
|
*/
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
if (length_remaining == -1)
|
|
|
|
length_remaining = 0;
|
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len =
|
|
|
|
content_length - length_remaining;
|
|
|
|
return FALSE;
|
|
|
|
}
|
2006-09-10 14:03:08 +00:00
|
|
|
} else if (content_type_found && pinfo->can_desegment) {
|
|
|
|
/* We found a content-type but no content-length.
|
|
|
|
* This is probably a HTTP header for a session with
|
|
|
|
* only one HTTP PDU and where the content spans
|
2006-11-10 20:53:42 +00:00
|
|
|
* until the end of the tcp session, unless there
|
|
|
|
* is a keepalive header present in which case we
|
|
|
|
* assume there is no message body at all and thus
|
2014-09-16 15:25:17 +00:00
|
|
|
* we won't do any reassembly.
|
2006-09-10 14:03:08 +00:00
|
|
|
* Set up tcp reassembly until the end of this session.
|
|
|
|
*/
|
2014-05-14 10:35:30 +00:00
|
|
|
length_remaining = tvb_captured_length_remaining(tvb, next_offset);
|
2006-09-10 14:03:08 +00:00
|
|
|
reported_length_remaining = tvb_reported_length_remaining(tvb, next_offset);
|
|
|
|
if (length_remaining < reported_length_remaining) {
|
|
|
|
/*
|
|
|
|
* It's a waste of time asking for more
|
|
|
|
* data, because that data wasn't captured.
|
|
|
|
*/
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2006-11-10 20:53:42 +00:00
|
|
|
if (keepalive_found) {
|
|
|
|
/* We have a keep-alive but no content-length.
|
2014-09-16 15:25:17 +00:00
|
|
|
* Assume there is no message body and don't
|
2006-11-10 20:53:42 +00:00
|
|
|
* do any reassembly.
|
|
|
|
*/
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2006-09-10 14:03:08 +00:00
|
|
|
pinfo->desegment_offset = offset;
|
|
|
|
pinfo->desegment_len = DESEGMENT_UNTIL_FIN;
|
|
|
|
|
|
|
|
return FALSE;
|
2003-12-22 00:57:34 +00:00
|
|
|
}
|
2004-04-26 17:10:40 +00:00
|
|
|
|
2003-12-22 00:57:34 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* No further desegmentation needed.
|
|
|
|
*/
|
|
|
|
return TRUE;
|
|
|
|
}
|
2013-05-24 02:31:26 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Editor modelines - http://www.wireshark.org/tools/modelines.html
|
|
|
|
*
|
|
|
|
* Local variables:
|
|
|
|
* c-basic-offset: 8
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: t
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* vi: set shiftwidth=8 tabstop=8 noexpandtab:
|
|
|
|
* :indentSize=8:tabSize=8:noTabs=false:
|
|
|
|
*/
|