1999-02-12 09:03:42 +00:00
/* packet-http.c
* Routines for HTTP packet disassembly
2004-07-09 23:37:40 +00:00
* RFC 1945 ( HTTP / 1.0 )
* RFC 2616 ( HTTP / 1.1 )
1999-02-12 09:03:42 +00:00
*
2000-01-22 06:22:44 +00:00
* Guy Harris < guy @ alum . mit . edu >
1999-02-12 09:03:42 +00:00
*
2004-04-29 20:26:54 +00:00
* Copyright 2004 , Jerry Talkington < jtalkington @ users . sourceforge . net >
2002-08-13 05:36:02 +00:00
* Copyright 2002 , Tim Potter < tpot @ samba . org >
* Copyright 1999 , Andrew Tridgell < tridge @ samba . org >
*
2006-05-21 04:49:01 +00:00
* Wireshark - Network traffic analyzer
* By Gerald Combs < gerald @ wireshark . org >
1999-02-12 09:03:42 +00:00
* Copyright 1998 Gerald Combs
2002-08-28 21:04:11 +00:00
*
1999-02-12 09:03:42 +00:00
* This program is free software ; you can redistribute it and / or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation ; either version 2
* of the License , or ( at your option ) any later version .
2002-08-28 21:04:11 +00:00
*
1999-02-12 09:03:42 +00:00
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
2002-08-28 21:04:11 +00:00
*
1999-02-12 09:03:42 +00:00
* You should have received a copy of the GNU General Public License
* along with this program ; if not , write to the Free Software
2012-06-28 22:56:06 +00:00
* Foundation , Inc . , 51 Franklin Street , Fifth Floor , Boston , MA 02110 - 1301 USA .
1999-02-12 09:03:42 +00:00
*/
# include "config.h"
2010-05-12 13:24:42 +00:00
# include <errno.h>
1999-02-12 09:03:42 +00:00
2002-01-21 07:37:49 +00:00
# include <epan/packet.h>
2014-12-20 21:23:59 +00:00
# include <epan/prefs.h>
# include <epan/expert.h>
# include <epan/uat.h>
2002-01-21 07:37:49 +00:00
# include <epan/strutil.h>
2005-07-24 01:42:41 +00:00
# include <epan/stats_tree.h>
2013-12-21 17:23:17 +00:00
# include <epan/to_str.h>
2004-09-29 00:25:05 +00:00
# include <epan/req_resp_hdrs.h>
2014-12-20 21:23:59 +00:00
# include <wsutil/base64.h>
2001-01-11 06:30:54 +00:00
# include "packet-http.h"
2006-08-14 21:46:05 +00:00
# include "packet-tcp.h"
2007-07-16 12:51:42 +00:00
# include "packet-ssl.h"
2001-01-11 06:30:54 +00:00
2000-02-23 19:47:14 +00:00
typedef enum _http_type {
2000-02-23 20:55:33 +00:00
HTTP_REQUEST ,
HTTP_RESPONSE ,
2001-01-03 03:40:29 +00:00
HTTP_NOTIFICATION ,
2000-02-23 20:55:33 +00:00
HTTP_OTHERS
2000-02-23 19:47:14 +00:00
} http_type_t ;
2003-09-02 22:47:59 +00:00
2013-12-15 23:44:12 +00:00
void proto_register_http ( void ) ;
void proto_reg_handoff_http ( void ) ;
void proto_register_message_http ( void ) ;
void proto_reg_handoff_message_http ( void ) ;
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
2003-09-02 22:47:59 +00:00
static int http_tap = - 1 ;
2007-03-13 20:42:04 +00:00
static int http_eo_tap = - 1 ;
2003-09-02 22:47:59 +00:00
1999-07-29 05:47:07 +00:00
static int proto_http = - 1 ;
2001-01-03 03:40:29 +00:00
static int hf_http_notification = - 1 ;
1999-10-16 20:30:14 +00:00
static int hf_http_response = - 1 ;
static int hf_http_request = - 1 ;
2013-10-17 01:23:12 +00:00
static int hf_http_response_line = - 1 ;
static int hf_http_request_line = - 1 ;
2003-05-30 03:11:45 +00:00
static int hf_http_basic = - 1 ;
2015-01-12 15:26:39 +00:00
static int hf_http_citrix = - 1 ;
static int hf_http_citrix_user = - 1 ;
static int hf_http_citrix_domain = - 1 ;
static int hf_http_citrix_passwd = - 1 ;
static int hf_http_citrix_session = - 1 ;
2003-06-10 22:07:18 +00:00
static int hf_http_request_method = - 1 ;
2005-02-23 05:47:17 +00:00
static int hf_http_request_uri = - 1 ;
2010-09-21 02:12:21 +00:00
static int hf_http_request_full_uri = - 1 ;
2005-03-01 11:37:26 +00:00
static int hf_http_version = - 1 ;
2003-09-02 23:09:11 +00:00
static int hf_http_response_code = - 1 ;
2010-10-30 14:29:20 +00:00
static int hf_http_response_phrase = - 1 ;
2003-11-06 08:54:31 +00:00
static int hf_http_authorization = - 1 ;
static int hf_http_proxy_authenticate = - 1 ;
static int hf_http_proxy_authorization = - 1 ;
2007-04-28 23:52:12 +00:00
static int hf_http_proxy_connect_host = - 1 ;
static int hf_http_proxy_connect_port = - 1 ;
2003-11-06 08:54:31 +00:00
static int hf_http_www_authenticate = - 1 ;
2003-11-07 03:47:20 +00:00
static int hf_http_content_type = - 1 ;
2008-10-23 06:57:31 +00:00
static int hf_http_content_length_header = - 1 ;
2003-12-23 01:42:48 +00:00
static int hf_http_content_length = - 1 ;
2004-02-21 01:31:56 +00:00
static int hf_http_content_encoding = - 1 ;
static int hf_http_transfer_encoding = - 1 ;
2012-04-20 15:31:15 +00:00
static int hf_http_upgrade = - 1 ;
2004-12-07 17:59:58 +00:00
static int hf_http_user_agent = - 1 ;
static int hf_http_host = - 1 ;
static int hf_http_connection = - 1 ;
static int hf_http_cookie = - 1 ;
2014-04-17 16:33:02 +00:00
static int hf_http_cookie_pair = - 1 ;
2004-12-07 17:59:58 +00:00
static int hf_http_accept = - 1 ;
static int hf_http_referer = - 1 ;
static int hf_http_accept_language = - 1 ;
static int hf_http_accept_encoding = - 1 ;
static int hf_http_date = - 1 ;
static int hf_http_cache_control = - 1 ;
static int hf_http_server = - 1 ;
static int hf_http_location = - 1 ;
2012-04-20 15:32:45 +00:00
static int hf_http_sec_websocket_accept = - 1 ;
static int hf_http_sec_websocket_extensions = - 1 ;
static int hf_http_sec_websocket_key = - 1 ;
static int hf_http_sec_websocket_protocol = - 1 ;
static int hf_http_sec_websocket_version = - 1 ;
2004-12-07 17:59:58 +00:00
static int hf_http_set_cookie = - 1 ;
static int hf_http_last_modified = - 1 ;
2006-02-20 06:25:02 +00:00
static int hf_http_x_forwarded_for = - 1 ;
2013-02-16 14:59:00 +00:00
static int hf_http_request_in = - 1 ;
static int hf_http_response_in = - 1 ;
static int hf_http_next_request_in = - 1 ;
static int hf_http_next_response_in = - 1 ;
static int hf_http_prev_request_in = - 1 ;
static int hf_http_prev_response_in = - 1 ;
2013-05-30 07:16:04 +00:00
static int hf_http_time = - 1 ;
2014-11-28 14:52:07 +00:00
static int hf_http_chunked_trailer_part = - 1 ;
1999-10-16 20:30:14 +00:00
1999-11-16 11:44:20 +00:00
static gint ett_http = - 1 ;
2002-08-13 05:36:02 +00:00
static gint ett_http_ntlmssp = - 1 ;
2010-10-25 02:17:41 +00:00
static gint ett_http_kerberos = - 1 ;
2003-06-10 22:07:18 +00:00
static gint ett_http_request = - 1 ;
2004-04-26 17:10:40 +00:00
static gint ett_http_chunked_response = - 1 ;
static gint ett_http_chunk_data = - 1 ;
static gint ett_http_encoded_entity = - 1 ;
2008-10-23 06:57:31 +00:00
static gint ett_http_header_item = - 1 ;
1999-11-16 11:44:20 +00:00
2013-05-26 03:29:07 +00:00
static expert_field ei_http_chat = EI_INIT ;
2013-09-05 16:05:32 +00:00
static expert_field ei_http_chunked_and_length = EI_INIT ;
2013-05-26 03:29:07 +00:00
static expert_field ei_http_subdissector_failed = EI_INIT ;
2014-06-29 12:50:21 +00:00
static expert_field ei_http_ssl_port = EI_INIT ;
2014-07-03 11:46:32 +00:00
static expert_field ei_http_leading_crlf = EI_INIT ;
2013-05-26 03:29:07 +00:00
2013-08-05 18:09:43 +00:00
static dissector_handle_t http_handle ;
2001-11-26 04:52:51 +00:00
static dissector_handle_t data_handle ;
2004-04-30 17:07:21 +00:00
static dissector_handle_t media_handle ;
2012-04-20 15:31:15 +00:00
static dissector_handle_t websocket_handle ;
2013-08-30 11:14:18 +00:00
static dissector_handle_t http2_handle ;
2001-11-26 04:52:51 +00:00
2009-05-19 00:17:23 +00:00
/* Stuff for generation/handling of fields for custom HTTP headers */
typedef struct _header_field_t {
gchar * header_name ;
gchar * header_desc ;
} header_field_t ;
static header_field_t * header_fields = NULL ;
static guint num_header_fields = 0 ;
static GHashTable * header_fields_hash = NULL ;
2010-09-21 02:12:21 +00:00
static void
2015-01-13 20:13:45 +00:00
header_fields_update_cb ( void * r , char * * err )
2010-09-21 02:12:21 +00:00
{
2013-03-12 06:41:00 +00:00
header_field_t * rec = ( header_field_t * ) r ;
2012-03-27 01:43:20 +00:00
char c ;
2009-05-19 00:17:23 +00:00
if ( rec - > header_name = = NULL ) {
2013-10-25 22:14:25 +00:00
* err = g_strdup ( " Header name can't be empty " ) ;
2012-03-27 01:43:20 +00:00
return ;
2009-05-19 00:17:23 +00:00
}
2012-03-27 01:43:20 +00:00
g_strstrip ( rec - > header_name ) ;
if ( rec - > header_name [ 0 ] = = 0 ) {
2013-10-25 22:14:25 +00:00
* err = g_strdup ( " Header name can't be empty " ) ;
2012-03-27 01:43:20 +00:00
return ;
}
/* Check for invalid characters (to avoid asserting out when
* registering the field ) .
*/
c = proto_check_field_name ( rec - > header_name ) ;
if ( c ) {
2013-10-25 22:14:25 +00:00
* err = g_strdup_printf ( " Header name can't contain '%c' " , c ) ;
2012-03-27 01:43:20 +00:00
return ;
}
* err = NULL ;
2009-05-19 00:17:23 +00:00
}
2010-09-21 02:12:21 +00:00
static void *
2010-10-29 21:11:33 +00:00
header_fields_copy_cb ( void * n , const void * o , size_t siz _U_ )
2010-09-21 02:12:21 +00:00
{
2013-12-12 20:09:33 +00:00
header_field_t * new_rec = ( header_field_t * ) n ;
const header_field_t * old_rec = ( const header_field_t * ) o ;
if ( old_rec - > header_name ) {
new_rec - > header_name = g_strdup ( old_rec - > header_name ) ;
} else {
new_rec - > header_name = NULL ;
}
if ( old_rec - > header_desc ) {
new_rec - > header_desc = g_strdup ( old_rec - > header_desc ) ;
} else {
new_rec - > header_desc = NULL ;
}
return new_rec ;
2009-05-19 00:17:23 +00:00
}
2010-09-21 02:12:21 +00:00
static void
header_fields_free_cb ( void * r )
{
2013-12-12 20:09:33 +00:00
header_field_t * rec = ( header_field_t * ) r ;
2009-05-19 00:17:23 +00:00
2013-12-12 20:09:33 +00:00
if ( rec - > header_name )
g_free ( rec - > header_name ) ;
if ( rec - > header_desc )
g_free ( rec - > header_desc ) ;
2009-05-19 00:17:23 +00:00
}
UAT_CSTRING_CB_DEF ( header_fields , header_name , header_field_t )
UAT_CSTRING_CB_DEF ( header_fields , header_desc , header_field_t )
2003-10-27 09:17:21 +00:00
/*
* desegmentation of HTTP headers
* ( when we are over TCP or another protocol providing the desegmentation API )
*/
2005-09-28 22:15:38 +00:00
static gboolean http_desegment_headers = TRUE ;
2003-10-27 09:17:21 +00:00
/*
* desegmentation of HTTP bodies
* ( when we are over TCP or another protocol providing the desegmentation API )
* TODO let the user filter on content - type the bodies he wants desegmented
*/
2005-09-28 22:15:38 +00:00
static gboolean http_desegment_body = TRUE ;
2003-10-27 09:17:21 +00:00
2004-05-05 06:55:09 +00:00
/*
* De - chunking of content - encoding : chunk entity bodies .
*/
static gboolean http_dechunk_body = TRUE ;
/*
* Decompression of zlib encoded entities .
*/
# ifdef HAVE_LIBZ
static gboolean http_decompress_body = TRUE ;
# else
static gboolean http_decompress_body = FALSE ;
# endif
2011-09-07 09:02:09 +00:00
/* Simple Service Discovery Protocol
2001-01-11 06:30:54 +00:00
* SSDP is implemented atop HTTP ( yes , it really * does * run over UDP ) .
2011-10-21 02:10:19 +00:00
* SSDP is the discovery protocol of Universal Plug and Play
2011-09-07 09:02:09 +00:00
* UPnP http : //www.upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf
2001-01-11 05:41:47 +00:00
*/
2001-01-03 03:40:29 +00:00
# define TCP_PORT_SSDP 1900
# define UDP_PORT_SSDP 1900
2006-08-24 22:05:26 +00:00
/*
2007-07-16 12:51:42 +00:00
* tcp and ssl ports
2011-07-10 18:34:15 +00:00
*
* 2710 is the XBT BitTorrent tracker
2005-03-06 21:32:13 +00:00
*/
2007-07-16 12:51:42 +00:00
2011-07-10 18:34:15 +00:00
# define TCP_DEFAULT_RANGE "80,3128,3132,5985,8080,8088,11371,1900,2869,2710"
2007-07-16 12:51:42 +00:00
# define SSL_DEFAULT_RANGE "443"
2012-11-02 20:35:24 +00:00
# define UPGRADE_WEBSOCKET 1
2013-08-30 11:14:18 +00:00
# define UPGRADE_HTTP2 2
2012-11-02 20:35:24 +00:00
2007-07-16 12:51:42 +00:00
static range_t * global_http_tcp_range = NULL ;
static range_t * global_http_ssl_range = NULL ;
static range_t * http_tcp_range = NULL ;
static range_t * http_ssl_range = NULL ;
2005-03-13 00:49:33 +00:00
typedef void ( * ReqRespDissector ) ( tvbuff_t * , proto_tree * , int , const guchar * ,
2007-03-13 20:42:04 +00:00
const guchar * , http_conv_t * ) ;
2003-06-10 22:07:18 +00:00
2003-11-18 07:49:52 +00:00
/*
2003-12-23 02:29:11 +00:00
* Structure holding information from headers needed by main
2003-11-18 07:49:52 +00:00
* HTTP dissector code .
*/
typedef struct {
char * content_type ;
2004-01-16 01:32:20 +00:00
char * content_type_parameters ;
2005-01-13 07:47:26 +00:00
gboolean have_content_length ;
2010-04-09 01:42:12 +00:00
gint64 content_length ;
2004-02-21 01:31:56 +00:00
char * content_encoding ;
char * transfer_encoding ;
2012-11-02 20:35:24 +00:00
guint8 upgrade ;
2003-12-23 02:29:11 +00:00
} headers_t ;
2003-11-18 07:49:52 +00:00
2005-03-13 00:49:33 +00:00
static int is_http_request_or_reply ( const gchar * data , int linelen ,
2007-03-13 20:42:04 +00:00
http_type_t * type , ReqRespDissector
* reqresp_dissector , http_conv_t * conv_data ) ;
2014-11-28 14:52:07 +00:00
static guint chunked_encoding_dissector ( tvbuff_t * * tvb_ptr , packet_info * pinfo ,
proto_tree * tree , int offset ) ;
2003-12-23 02:29:11 +00:00
static void process_header ( tvbuff_t * tvb , int offset , int next_offset ,
2010-09-21 02:12:21 +00:00
const guchar * line , int linelen , int colon_offset ,
packet_info * pinfo , proto_tree * tree ,
2013-10-17 01:23:12 +00:00
headers_t * eh_ptr , http_conv_t * conv_data ,
int http_type ) ;
2003-11-06 08:54:31 +00:00
static gint find_header_hf_value ( tvbuff_t * tvb , int offset , guint header_len ) ;
static gboolean check_auth_ntlmssp ( proto_item * hdr_item , tvbuff_t * tvb ,
2010-09-21 02:12:21 +00:00
packet_info * pinfo , gchar * value ) ;
2003-11-06 08:54:31 +00:00
static gboolean check_auth_basic ( proto_item * hdr_item , tvbuff_t * tvb ,
2010-09-21 02:12:21 +00:00
gchar * value ) ;
2015-01-12 15:26:39 +00:00
static gboolean check_auth_citrixbasic ( proto_item * hdr_item , tvbuff_t * tvb ,
gchar * value , int offset ) ;
2010-10-25 02:17:41 +00:00
static gboolean check_auth_kerberos ( proto_item * hdr_item , tvbuff_t * tvb ,
packet_info * pinfo , const gchar * value ) ;
1999-02-12 09:03:42 +00:00
2003-11-18 07:49:52 +00:00
static dissector_table_t port_subdissector_table ;
2003-12-07 03:21:22 +00:00
static dissector_table_t media_type_subdissector_table ;
2001-11-18 02:28:15 +00:00
static heur_dissector_list_t heur_subdissector_list ;
2000-11-15 08:27:14 +00:00
2008-09-26 20:06:40 +00:00
static dissector_handle_t ntlmssp_handle ;
static dissector_handle_t gssapi_handle ;
2002-08-13 05:36:02 +00:00
2012-05-01 02:42:51 +00:00
/* --- HTTP Status Codes */
/* Note: The reference for uncommented entries is RFC 2616 */
2005-07-24 01:42:41 +00:00
static const value_string vals_status_code [ ] = {
{ 100 , " Continue " } ,
{ 101 , " Switching Protocols " } ,
2012-05-01 02:42:51 +00:00
{ 102 , " Processing " } , /* RFC 2518 */
2005-07-24 01:42:41 +00:00
{ 199 , " Informational - Others " } ,
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
{ 200 , " OK " } ,
{ 201 , " Created " } ,
{ 202 , " Accepted " } ,
{ 203 , " Non-authoritative Information " } ,
{ 204 , " No Content " } ,
{ 205 , " Reset Content " } ,
{ 206 , " Partial Content " } ,
2012-05-01 02:42:51 +00:00
{ 207 , " Multi-Status " } , /* RFC 4918 */
2013-12-12 20:09:33 +00:00
{ 226 , " IM Used " } , /* RFC 3229 */
2005-07-24 01:42:41 +00:00
{ 299 , " Success - Others " } ,
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
{ 300 , " Multiple Choices " } ,
{ 301 , " Moved Permanently " } ,
2006-03-30 10:16:35 +00:00
{ 302 , " Found " } ,
2005-07-24 01:42:41 +00:00
{ 303 , " See Other " } ,
{ 304 , " Not Modified " } ,
{ 305 , " Use Proxy " } ,
2006-03-30 10:16:35 +00:00
{ 307 , " Temporary Redirect " } ,
2005-07-24 01:42:41 +00:00
{ 399 , " Redirection - Others " } ,
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
{ 400 , " Bad Request " } ,
{ 401 , " Unauthorized " } ,
{ 402 , " Payment Required " } ,
{ 403 , " Forbidden " } ,
{ 404 , " Not Found " } ,
{ 405 , " Method Not Allowed " } ,
{ 406 , " Not Acceptable " } ,
{ 407 , " Proxy Authentication Required " } ,
{ 408 , " Request Time-out " } ,
{ 409 , " Conflict " } ,
{ 410 , " Gone " } ,
{ 411 , " Length Required " } ,
{ 412 , " Precondition Failed " } ,
{ 413 , " Request Entity Too Large " } ,
2006-03-30 10:16:35 +00:00
{ 414 , " Request-URI Too Long " } ,
2005-07-24 01:42:41 +00:00
{ 415 , " Unsupported Media Type " } ,
2006-03-30 10:16:35 +00:00
{ 416 , " Requested Range Not Satisfiable " } ,
{ 417 , " Expectation Failed " } ,
2012-05-01 02:42:51 +00:00
{ 418 , " I'm a teapot " } , /* RFC 2324 */
{ 422 , " Unprocessable Entity " } , /* RFC 4918 */
{ 423 , " Locked " } , /* RFC 4918 */
{ 424 , " Failed Dependency " } , /* RFC 4918 */
2013-12-12 20:09:33 +00:00
{ 426 , " Upgrade Required " } , /* RFC 2817 */
{ 428 , " Precondition Required " } , /* RFC 6585 */
{ 429 , " Too Many Requests " } , /* RFC 6585 */
{ 431 , " Request Header Fields Too Large " } , /* RFC 6585 */
2005-07-24 01:42:41 +00:00
{ 499 , " Client Error - Others " } ,
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
{ 500 , " Internal Server Error " } ,
{ 501 , " Not Implemented " } ,
{ 502 , " Bad Gateway " } ,
{ 503 , " Service Unavailable " } ,
{ 504 , " Gateway Time-out " } ,
{ 505 , " HTTP Version not supported " } ,
2012-05-01 02:42:51 +00:00
{ 507 , " Insufficient Storage " } , /* RFC 4918 */
2013-12-12 20:09:33 +00:00
{ 511 , " Network Authentication Required " } , /* RFC 6585 */
2005-07-24 01:42:41 +00:00
{ 599 , " Server Error - Others " } ,
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
{ 0 , NULL }
} ;
static const gchar * st_str_reqs = " HTTP Requests by Server " ;
static const gchar * st_str_reqs_by_srv_addr = " HTTP Requests by Server Address " ;
static const gchar * st_str_reqs_by_http_host = " HTTP Requests by HTTP Host " ;
static const gchar * st_str_resps_by_srv_addr = " HTTP Responses by Server Address " ;
static int st_node_reqs = - 1 ;
static int st_node_reqs_by_srv_addr = - 1 ;
static int st_node_reqs_by_http_host = - 1 ;
static int st_node_resps_by_srv_addr = - 1 ;
2007-02-19 05:21:12 +00:00
/* HTTP/Load Distribution stats init function */
2008-07-11 21:13:39 +00:00
static void
http_reqs_stats_tree_init ( stats_tree * st )
{
2005-07-24 01:42:41 +00:00
st_node_reqs = stats_tree_create_node ( st , st_str_reqs , 0 , TRUE ) ;
st_node_reqs_by_srv_addr = stats_tree_create_node ( st , st_str_reqs_by_srv_addr , st_node_reqs , TRUE ) ;
st_node_reqs_by_http_host = stats_tree_create_node ( st , st_str_reqs_by_http_host , st_node_reqs , TRUE ) ;
st_node_resps_by_srv_addr = stats_tree_create_node ( st , st_str_resps_by_srv_addr , 0 , TRUE ) ;
}
2007-02-19 05:21:12 +00:00
/* HTTP/Load Distribution stats packet function */
2008-07-11 21:13:39 +00:00
static int
http_reqs_stats_tree_packet ( stats_tree * st , packet_info * pinfo , epan_dissect_t * edt _U_ , const void * p )
{
2013-03-12 06:41:00 +00:00
const http_info_value_t * v = ( const http_info_value_t * ) p ;
2005-07-24 01:42:41 +00:00
int reqs_by_this_host ;
int reqs_by_this_addr ;
int resps_by_this_addr ;
int i = v - > response_code ;
2011-03-26 01:21:43 +00:00
gchar * ip_str ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( v - > request_method ) {
2014-06-19 18:58:21 +00:00
ip_str = address_to_str ( NULL , & pinfo - > dst ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
tick_stat_node ( st , st_str_reqs , 0 , FALSE ) ;
tick_stat_node ( st , st_str_reqs_by_srv_addr , st_node_reqs , TRUE ) ;
tick_stat_node ( st , st_str_reqs_by_http_host , st_node_reqs , TRUE ) ;
reqs_by_this_addr = tick_stat_node ( st , ip_str , st_node_reqs_by_srv_addr , TRUE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( v - > http_host ) {
reqs_by_this_host = tick_stat_node ( st , v - > http_host , st_node_reqs_by_http_host , TRUE ) ;
tick_stat_node ( st , ip_str , reqs_by_this_host , FALSE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
tick_stat_node ( st , v - > http_host , reqs_by_this_addr , FALSE ) ;
}
2006-08-24 22:05:26 +00:00
2014-06-19 18:58:21 +00:00
wmem_free ( NULL , ip_str ) ;
2005-07-24 01:42:41 +00:00
return 1 ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
} else if ( i ! = 0 ) {
2014-06-19 18:58:21 +00:00
ip_str = address_to_str ( NULL , & pinfo - > src ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
tick_stat_node ( st , st_str_resps_by_srv_addr , 0 , FALSE ) ;
resps_by_this_addr = tick_stat_node ( st , ip_str , st_node_resps_by_srv_addr , TRUE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( ( i > 100 ) & & ( i < 400 ) ) {
tick_stat_node ( st , " OK " , resps_by_this_addr , FALSE ) ;
} else {
tick_stat_node ( st , " KO " , resps_by_this_addr , FALSE ) ;
}
2006-08-24 22:05:26 +00:00
2014-06-19 18:58:21 +00:00
wmem_free ( NULL , ip_str ) ;
2005-07-24 01:42:41 +00:00
return 1 ;
}
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
return 0 ;
}
static int st_node_requests_by_host = - 1 ;
2008-07-11 21:13:39 +00:00
static const gchar * st_str_requests_by_host = " HTTP Requests by HTTP Host " ;
2005-07-24 01:42:41 +00:00
2007-02-19 05:21:12 +00:00
/* HTTP/Requests stats init function */
2008-07-11 21:13:39 +00:00
static void
http_req_stats_tree_init ( stats_tree * st )
{
2005-07-24 01:42:41 +00:00
st_node_requests_by_host = stats_tree_create_node ( st , st_str_requests_by_host , 0 , TRUE ) ;
}
2007-02-19 05:21:12 +00:00
/* HTTP/Requests stats packet function */
2008-07-11 21:13:39 +00:00
static int
http_req_stats_tree_packet ( stats_tree * st , packet_info * pinfo _U_ , epan_dissect_t * edt _U_ , const void * p )
{
2013-03-12 06:41:00 +00:00
const http_info_value_t * v = ( const http_info_value_t * ) p ;
2005-07-24 01:42:41 +00:00
int reqs_by_this_host ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( v - > request_method ) {
tick_stat_node ( st , st_str_requests_by_host , 0 , FALSE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( v - > http_host ) {
reqs_by_this_host = tick_stat_node ( st , v - > http_host , st_node_requests_by_host , TRUE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( v - > request_uri ) {
tick_stat_node ( st , v - > request_uri , reqs_by_this_host , TRUE ) ;
}
}
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
return 1 ;
}
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
return 0 ;
}
2008-07-11 21:13:39 +00:00
static const gchar * st_str_packets = " Total HTTP Packets " ;
static const gchar * st_str_requests = " HTTP Request Packets " ;
static const gchar * st_str_responses = " HTTP Response Packets " ;
static const gchar * st_str_resp_broken = " ???: broken " ;
static const gchar * st_str_resp_100 = " 1xx: Informational " ;
static const gchar * st_str_resp_200 = " 2xx: Success " ;
static const gchar * st_str_resp_300 = " 3xx: Redirection " ;
static const gchar * st_str_resp_400 = " 4xx: Client Error " ;
static const gchar * st_str_resp_500 = " 5xx: Server Error " ;
static const gchar * st_str_other = " Other HTTP Packets " ;
2005-07-24 01:42:41 +00:00
static int st_node_packets = - 1 ;
static int st_node_requests = - 1 ;
static int st_node_responses = - 1 ;
static int st_node_resp_broken = - 1 ;
static int st_node_resp_100 = - 1 ;
static int st_node_resp_200 = - 1 ;
static int st_node_resp_300 = - 1 ;
static int st_node_resp_400 = - 1 ;
static int st_node_resp_500 = - 1 ;
static int st_node_other = - 1 ;
2007-02-19 05:21:12 +00:00
/* HTTP/Packet Counter stats init function */
2008-07-11 21:13:39 +00:00
static void
http_stats_tree_init ( stats_tree * st )
{
2006-08-24 22:05:26 +00:00
st_node_packets = stats_tree_create_node ( st , st_str_packets , 0 , TRUE ) ;
2005-07-24 01:42:41 +00:00
st_node_requests = stats_tree_create_pivot ( st , st_str_requests , st_node_packets ) ;
st_node_responses = stats_tree_create_node ( st , st_str_responses , st_node_packets , TRUE ) ;
st_node_resp_broken = stats_tree_create_node ( st , st_str_resp_broken , st_node_responses , TRUE ) ;
st_node_resp_100 = stats_tree_create_node ( st , st_str_resp_100 , st_node_responses , TRUE ) ;
st_node_resp_200 = stats_tree_create_node ( st , st_str_resp_200 , st_node_responses , TRUE ) ;
st_node_resp_300 = stats_tree_create_node ( st , st_str_resp_300 , st_node_responses , TRUE ) ;
st_node_resp_400 = stats_tree_create_node ( st , st_str_resp_400 , st_node_responses , TRUE ) ;
st_node_resp_500 = stats_tree_create_node ( st , st_str_resp_500 , st_node_responses , TRUE ) ;
st_node_other = stats_tree_create_node ( st , st_str_other , st_node_packets , FALSE ) ;
}
2007-02-19 05:21:12 +00:00
/* HTTP/Packet Counter stats packet function */
2008-07-11 21:13:39 +00:00
static int
http_stats_tree_packet ( stats_tree * st , packet_info * pinfo _U_ , epan_dissect_t * edt _U_ , const void * p )
{
2013-03-12 06:41:00 +00:00
const http_info_value_t * v = ( const http_info_value_t * ) p ;
2005-07-24 01:42:41 +00:00
guint i = v - > response_code ;
int resp_grp ;
2008-07-12 01:48:24 +00:00
const gchar * resp_str ;
2011-03-26 01:21:43 +00:00
gchar str [ 64 ] ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
tick_stat_node ( st , st_str_packets , 0 , FALSE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( i ) {
tick_stat_node ( st , st_str_responses , st_node_packets , FALSE ) ;
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
if ( ( i < 100 ) | | ( i > = 600 ) ) {
resp_grp = st_node_resp_broken ;
resp_str = st_str_resp_broken ;
} else if ( i < 200 ) {
resp_grp = st_node_resp_100 ;
resp_str = st_str_resp_100 ;
} else if ( i < 300 ) {
resp_grp = st_node_resp_200 ;
resp_str = st_str_resp_200 ;
} else if ( i < 400 ) {
resp_grp = st_node_resp_300 ;
resp_str = st_str_resp_300 ;
} else if ( i < 500 ) {
resp_grp = st_node_resp_400 ;
resp_str = st_str_resp_400 ;
} else {
resp_grp = st_node_resp_500 ;
resp_str = st_str_resp_500 ;
}
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
tick_stat_node ( st , resp_str , st_node_responses , FALSE ) ;
2006-08-24 22:05:26 +00:00
2011-03-26 01:21:43 +00:00
g_snprintf ( str , sizeof ( str ) , " %u %s " , i ,
val_to_str ( i , vals_status_code , " Unknown (%d) " ) ) ;
2005-07-24 01:42:41 +00:00
tick_stat_node ( st , str , resp_grp , FALSE ) ;
} else if ( v - > request_method ) {
stats_tree_tick_pivot ( st , st_node_requests , v - > request_method ) ;
} else {
2006-08-24 22:05:26 +00:00
tick_stat_node ( st , st_str_other , st_node_packets , FALSE ) ;
2005-07-24 01:42:41 +00:00
}
2006-08-24 22:05:26 +00:00
2005-07-24 01:42:41 +00:00
return 1 ;
}
2003-09-02 22:47:59 +00:00
2013-03-12 19:15:39 +00:00
2002-08-13 05:36:02 +00:00
static void
2002-10-15 22:28:35 +00:00
dissect_http_ntlmssp ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree ,
2010-09-21 02:12:21 +00:00
const char * line )
2002-08-13 05:36:02 +00:00
{
tvbuff_t * ntlmssp_tvb ;
2009-05-13 19:46:11 +00:00
ntlmssp_tvb = base64_to_tvb ( tvb , line ) ;
2004-10-29 08:01:11 +00:00
add_new_data_source ( pinfo , ntlmssp_tvb , " NTLMSSP / GSSAPI Data " ) ;
if ( tvb_strneql ( ntlmssp_tvb , 0 , " NTLMSSP " , 7 ) = = 0 )
call_dissector ( ntlmssp_handle , ntlmssp_tvb , pinfo , tree ) ;
else
call_dissector ( gssapi_handle , ntlmssp_tvb , pinfo , tree ) ;
2002-08-13 05:36:02 +00:00
}
2010-10-25 02:17:41 +00:00
static void
dissect_http_kerberos ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree ,
const char * line )
{
tvbuff_t * kerberos_tvb ;
kerberos_tvb = base64_to_tvb ( tvb , line + 9 ) ; /* skip 'Kerberos ' which is 9 chars */
add_new_data_source ( pinfo , kerberos_tvb , " Kerberos Data " ) ;
call_dissector ( gssapi_handle , kerberos_tvb , pinfo , tree ) ;
}
2007-12-26 18:28:31 +00:00
static http_conv_t *
get_http_conversation_data ( packet_info * pinfo )
{
conversation_t * conversation ;
http_conv_t * conv_data ;
2010-05-13 18:28:34 +00:00
conversation = find_or_create_conversation ( pinfo ) ;
2007-12-26 18:28:31 +00:00
/* Retrieve information from conversation
* or add it if it isn ' t there yet
*/
2013-03-12 06:41:00 +00:00
conv_data = ( http_conv_t * ) conversation_get_proto_data ( conversation , proto_http ) ;
2007-12-26 18:28:31 +00:00
if ( ! conv_data ) {
/* Setup the conversation structure itself */
2013-03-12 06:41:00 +00:00
conv_data = ( http_conv_t * ) wmem_alloc0 ( wmem_file_scope ( ) , sizeof ( http_conv_t ) ) ;
2007-12-26 18:28:31 +00:00
conversation_add_proto_data ( conversation , proto_http ,
conv_data ) ;
}
return conv_data ;
}
2013-02-16 14:59:00 +00:00
/**
* create a new http_req_res_t and add it to the conversation .
* @ return the new allocated object which is already added to the linked list
*/
static http_req_res_t * push_req_res ( http_conv_t * conv_data )
{
2013-03-12 06:41:00 +00:00
http_req_res_t * req_res = ( http_req_res_t * ) wmem_alloc0 ( wmem_file_scope ( ) , sizeof ( http_req_res_t ) ) ;
2013-02-16 14:59:00 +00:00
nstime_set_unset ( & ( req_res - > req_ts ) ) ;
req_res - > number = + + conv_data - > req_res_num ;
if ( ! conv_data - > req_res_tail ) {
conv_data - > req_res_tail = req_res ;
} else {
req_res - > prev = conv_data - > req_res_tail ;
conv_data - > req_res_tail - > next = req_res ;
conv_data - > req_res_tail = req_res ;
}
return req_res ;
}
/**
* push a request frame number and its time stamp to the conversation data .
*/
static void push_req ( http_conv_t * conv_data , packet_info * pinfo )
{
/* a request will always create a new http_req_res_t object */
http_req_res_t * req_res = push_req_res ( conv_data ) ;
req_res - > req_framenum = pinfo - > fd - > num ;
req_res - > req_ts = pinfo - > fd - > abs_ts ;
2013-11-23 02:20:13 +00:00
p_add_proto_data ( wmem_file_scope ( ) , pinfo , proto_http , 0 , req_res ) ;
2013-02-16 14:59:00 +00:00
}
/**
* push a response frame number to the conversation data .
*/
static void push_res ( http_conv_t * conv_data , packet_info * pinfo )
{
/* a response will create a new http_req_res_t object: if no
object exists , or if one exists for another response . In
both cases the corresponding request was not
detected / included in the conversation . In all other cases
the http_req_res_t object created by the request is
used . */
http_req_res_t * req_res = conv_data - > req_res_tail ;
if ( ! req_res | | req_res - > res_framenum > 0 ) {
req_res = push_req_res ( conv_data ) ;
}
req_res - > res_framenum = pinfo - > fd - > num ;
2013-11-23 02:20:13 +00:00
p_add_proto_data ( wmem_file_scope ( ) , pinfo , proto_http , 0 , req_res ) ;
2013-02-16 14:59:00 +00:00
}
2003-12-23 02:02:09 +00:00
/*
* TODO : remove this ugly global variable .
2005-03-13 00:49:33 +00:00
* XXX : do we really want to have to pass this from one function to another ?
2003-12-23 02:02:09 +00:00
*/
static http_info_value_t * stat_info ;
static int
dissect_http_message ( tvbuff_t * tvb , int offset , packet_info * pinfo ,
2010-09-21 02:12:21 +00:00
proto_tree * tree , http_conv_t * conv_data )
1999-02-12 09:03:42 +00:00
{
2005-07-30 16:34:38 +00:00
const char * proto_tag ;
2000-11-09 10:56:33 +00:00
proto_tree * http_tree = NULL ;
proto_item * ti = NULL ;
2008-05-13 01:23:37 +00:00
proto_item * hidden_item ;
2014-04-25 15:10:15 +00:00
const guchar * line , * firstline ;
2000-11-09 10:56:33 +00:00
gint next_offset ;
2002-08-02 23:36:07 +00:00
const guchar * linep , * lineend ;
2003-12-23 02:02:09 +00:00
int orig_offset ;
2003-10-27 09:17:21 +00:00
int first_linelen , linelen ;
2014-06-29 12:50:21 +00:00
gboolean is_request_or_reply , is_ssl = FALSE ;
2003-12-28 08:39:10 +00:00
gboolean saw_req_resp_or_header ;
2002-08-02 23:36:07 +00:00
guchar c ;
2000-11-09 10:56:33 +00:00
http_type_t http_type ;
2005-03-20 00:07:07 +00:00
proto_item * hdr_item = NULL ;
2005-03-13 00:49:33 +00:00
ReqRespDissector reqresp_dissector ;
2003-10-27 09:17:21 +00:00
proto_tree * req_tree ;
2003-11-06 08:54:31 +00:00
int colon_offset ;
2003-12-23 02:29:11 +00:00
headers_t headers ;
2003-12-23 01:42:48 +00:00
int datalen ;
2004-12-25 13:49:30 +00:00
int reported_datalen = - 1 ;
2003-11-18 07:49:52 +00:00
dissector_handle_t handle ;
2011-03-24 02:49:05 +00:00
gboolean dissected = FALSE ;
2014-04-25 00:39:17 +00:00
gboolean first_loop = TRUE ;
2005-07-25 01:22:03 +00:00
/*guint i;*/
/*http_info_value_t *si;*/
2007-03-13 20:42:04 +00:00
http_eo_t * eo_info ;
2014-05-20 10:54:20 +00:00
heur_dtbl_entry_t * hdtbl_entry ;
2014-07-03 11:46:32 +00:00
int reported_length ;
guint16 word ;
gboolean leading_crlf = FALSE ;
2007-03-13 20:42:04 +00:00
2014-07-03 11:46:32 +00:00
reported_length = tvb_reported_length_remaining ( tvb , offset ) ;
if ( reported_length < 1 ) {
return - 1 ;
}
/* RFC 2616
* In the interest of robustness , servers SHOULD ignore any empty
* line ( s ) received where a Request - Line is expected . In other words , if
* the server is reading the protocol stream at the beginning of a
* message and receives a CRLF first , it should ignore the CRLF .
*/
if ( reported_length > 3 ) {
word = tvb_get_ntohs ( tvb , offset ) ;
if ( word = = 0x0d0a ) {
leading_crlf = TRUE ;
offset + = 2 ;
}
}
2015-01-16 02:46:52 +00:00
/*
* If this should be a request or response , do this quick check to see if
* it begins with a string . . .
* Otherwise , looking for the end of line in a binary file can take a long time
* and this probably isn ' t HTTP
*/
2014-07-03 11:46:32 +00:00
if ( ! g_ascii_isprint ( tvb_get_guint8 ( tvb , offset ) ) ) {
2014-04-27 12:25:41 +00:00
return - 1 ;
}
2003-10-27 09:17:21 +00:00
/*
* Is this a request or response ?
*
* Note that " tvb_find_line_end() " will return a value that
* is not longer than what ' s in the buffer , so the
* " tvb_get_ptr() " call won ' t throw an exception .
*/
2003-12-24 09:50:54 +00:00
first_linelen = tvb_find_line_end ( tvb , offset ,
2014-07-03 08:53:40 +00:00
tvb_ensure_captured_length_remaining ( tvb , offset ) , & next_offset ,
2012-08-19 23:52:37 +00:00
TRUE ) ;
2013-09-11 21:44:13 +00:00
2012-08-19 23:52:37 +00:00
if ( first_linelen = = - 1 ) {
/* No complete line was found in this segment, do
* desegmentation if we ' re told to .
*/
if ( ! req_resp_hdrs_do_reassembly ( tvb , offset , pinfo ,
http_desegment_headers , http_desegment_body ) ) {
/*
* More data needed for desegmentation .
*/
return - 1 ;
}
}
2003-12-27 01:42:56 +00:00
/*
* Is the first line a request or response ?
2014-04-25 20:08:14 +00:00
*
* Note that " tvb_find_line_end() " will return a value that
* is not longer than what ' s in the buffer , so the
* " tvb_get_ptr() " call won ' t throw an exception .
2003-12-27 01:42:56 +00:00
*/
2014-04-25 20:12:51 +00:00
firstline = tvb_get_ptr ( tvb , offset , first_linelen ) ;
2003-10-27 09:17:21 +00:00
http_type = HTTP_OTHERS ; /* type not known yet */
2014-04-25 20:12:51 +00:00
is_request_or_reply = is_http_request_or_reply ( ( const gchar * ) firstline ,
2007-03-13 20:42:04 +00:00
first_linelen , & http_type , NULL , conv_data ) ;
2003-10-27 09:17:21 +00:00
if ( is_request_or_reply ) {
2004-01-16 01:32:20 +00:00
/*
2003-10-27 09:17:21 +00:00
* Yes , it ' s a request or response .
2003-12-22 00:57:34 +00:00
* Do header desegmentation if we ' ve been told to ,
* and do body desegmentation if we ' ve been told to and
2014-09-28 23:39:32 +00:00
* we find a Content - Length header . Responses to HEAD MUST NOT
* contain a message body , so ignore the Content - Length header
* which is done by disabling body desegmentation .
2003-10-27 09:17:21 +00:00
*/
2014-09-28 23:39:32 +00:00
gboolean try_desegment_body = http_desegment_body & &
! ( conv_data - > request_method & &
g_str_equal ( conv_data - > request_method , " HEAD " ) ) ;
2005-01-20 04:37:03 +00:00
if ( ! req_resp_hdrs_do_reassembly ( tvb , offset , pinfo ,
2014-09-28 23:39:32 +00:00
http_desegment_headers , try_desegment_body ) ) {
2003-12-22 00:57:34 +00:00
/*
* More data needed for desegmentation .
*/
2003-12-23 02:02:09 +00:00
return - 1 ;
2003-10-27 09:17:21 +00:00
}
}
2014-12-18 21:31:43 +00:00
is_ssl = proto_is_frame_protocol ( pinfo - > layers , " ssl " ) ;
2014-06-29 12:50:21 +00:00
2013-09-15 10:29:49 +00:00
stat_info = wmem_new ( wmem_packet_scope ( ) , http_info_value_t ) ;
2007-03-13 20:42:04 +00:00
stat_info - > framenum = pinfo - > fd - > num ;
stat_info - > response_code = 0 ;
stat_info - > request_method = NULL ;
stat_info - > request_uri = NULL ;
stat_info - > http_host = NULL ;
2005-02-28 22:27:24 +00:00
2010-12-20 05:35:29 +00:00
switch ( pinfo - > match_uint ) {
2001-01-03 03:40:29 +00:00
2001-01-11 05:36:09 +00:00
case TCP_PORT_SSDP : /* TCP_PORT_SSDP = UDP_PORT_SSDP */
2001-01-03 03:40:29 +00:00
proto_tag = " SSDP " ;
break ;
default :
proto_tag = " HTTP " ;
break ;
}
2002-08-28 21:04:11 +00:00
2003-12-23 02:02:09 +00:00
orig_offset = offset ;
1999-02-12 09:03:42 +00:00
2001-01-11 06:30:54 +00:00
/*
* Process the packet data , a line at a time .
*/
http_type = HTTP_OTHERS ; /* type not known yet */
2003-12-23 02:29:11 +00:00
headers . content_type = NULL ; /* content type not known yet */
2004-01-16 01:32:20 +00:00
headers . content_type_parameters = NULL ; /* content type parameters too */
2005-01-13 07:47:26 +00:00
headers . have_content_length = FALSE ; /* content length not known yet */
2007-03-22 15:19:49 +00:00
headers . content_length = 0 ; /* content length set to 0 (avoid a gcc warning) */
2004-02-21 01:31:56 +00:00
headers . content_encoding = NULL ; /* content encoding not known yet */
headers . transfer_encoding = NULL ; /* transfer encoding not known yet */
2012-11-02 20:35:24 +00:00
headers . upgrade = 0 ; /* assume we're not upgrading */
2003-12-28 08:39:10 +00:00
saw_req_resp_or_header = FALSE ; /* haven't seen anything yet */
2013-09-11 21:44:13 +00:00
while ( tvb_reported_length_remaining ( tvb , offset ) > 0 ) {
2000-11-09 10:56:33 +00:00
/*
2001-01-11 06:30:54 +00:00
* Find the end of the line .
2005-03-13 00:49:33 +00:00
* XXX - what if we don ' t find it because the packet
* is cut short by a snapshot length or the header is
* split across TCP segments ? How much dissection should
* we do on it ?
2000-11-09 10:56:33 +00:00
*/
2003-12-24 09:50:54 +00:00
linelen = tvb_find_line_end ( tvb , offset ,
2014-07-03 08:53:40 +00:00
tvb_ensure_captured_length_remaining ( tvb , offset ) , & next_offset ,
2002-07-17 06:55:29 +00:00
FALSE ) ;
2003-12-24 09:50:54 +00:00
if ( linelen < 0 )
return - 1 ;
2000-11-09 10:56:33 +00:00
2001-01-11 06:30:54 +00:00
/*
* Get a buffer that refers to the line .
2014-04-25 20:08:14 +00:00
*
* Note that " tvb_find_line_end() " will return a value that
* is not longer than what ' s in the buffer , so the
* " tvb_get_ptr() " call won ' t throw an exception .
2001-01-11 06:30:54 +00:00
*/
line = tvb_get_ptr ( tvb , offset , linelen ) ;
lineend = line + linelen ;
2003-11-06 08:54:31 +00:00
colon_offset = - 1 ;
1999-02-12 09:03:42 +00:00
2001-01-11 06:30:54 +00:00
/*
* OK , does it look like an HTTP request or response ?
*/
2005-03-13 00:49:33 +00:00
reqresp_dissector = NULL ;
is_request_or_reply =
is_http_request_or_reply ( ( const gchar * ) line ,
2007-03-13 20:42:04 +00:00
linelen , & http_type , & reqresp_dissector , conv_data ) ;
2003-11-06 08:54:31 +00:00
if ( is_request_or_reply )
2001-01-11 06:30:54 +00:00
goto is_http ;
1999-02-12 09:03:42 +00:00
2001-01-11 06:30:54 +00:00
/*
* No . Does it look like a blank line ( as would appear
* at the end of an HTTP request ) ?
*/
if ( linelen = = 0 )
2003-12-27 08:35:08 +00:00
goto is_http ; /* Yes. */
1999-02-12 09:03:42 +00:00
2001-01-11 06:30:54 +00:00
/*
2003-12-23 02:29:11 +00:00
* No . Does it look like a header ?
2001-01-11 06:30:54 +00:00
*/
linep = line ;
2003-11-06 08:54:31 +00:00
colon_offset = offset ;
2001-01-11 06:30:54 +00:00
while ( linep < lineend ) {
c = * linep + + ;
2003-02-24 01:17:45 +00:00
/*
2014-10-20 07:45:26 +00:00
* This must be a CHAR , and must not be a CTL ,
* to be part of a token ; that means it must
* be printable ASCII .
2003-12-23 02:29:11 +00:00
*
* XXX - what about leading LWS on continuation
* lines of a header ?
2003-02-24 01:17:45 +00:00
*/
2014-10-20 06:14:50 +00:00
if ( ! g_ascii_isprint ( c ) )
2014-10-20 07:45:26 +00:00
break ;
2003-02-24 01:17:45 +00:00
/*
* This mustn ' t be a SEP to be part of a token ;
* a ' : ' ends the token , everything else is an
* indication that this isn ' t a header .
*/
2001-01-11 06:30:54 +00:00
switch ( c ) {
case ' ( ' :
case ' ) ' :
case ' < ' :
case ' > ' :
case ' @ ' :
case ' , ' :
case ' ; ' :
case ' \\ ' :
case ' " ' :
case ' / ' :
case ' [ ' :
case ' ] ' :
case ' ? ' :
case ' = ' :
case ' { ' :
case ' } ' :
2003-02-24 01:17:45 +00:00
case ' ' :
2001-01-11 06:30:54 +00:00
/*
2003-02-24 01:17:45 +00:00
* It ' s a separator , so it ' s not part of a
2001-01-11 06:30:54 +00:00
* token , so it ' s not a field name for the
2003-12-23 02:29:11 +00:00
* beginning of a header .
2003-02-24 01:17:45 +00:00
*
* ( We don ' t have to check for HT ; that ' s
2004-07-09 23:37:40 +00:00
* already been ruled out by " iscntrl() " . )
2001-01-11 06:30:54 +00:00
*/
goto not_http ;
case ' : ' :
/*
* This ends the token ; we consider this
2003-12-23 02:29:11 +00:00
* to be a header .
2001-01-11 06:30:54 +00:00
*/
goto is_http ;
2003-11-06 08:54:31 +00:00
default :
colon_offset + + ;
break ;
1999-02-12 09:03:42 +00:00
}
2001-01-11 06:30:54 +00:00
}
1999-02-12 09:03:42 +00:00
2003-12-28 08:39:10 +00:00
/*
* We haven ' t seen the colon , but everything else looks
* OK for a header line .
*
* If we ' ve already seen an HTTP request or response
* line , or a header line , and we ' re at the end of
* the tvbuff , we assume this is an incomplete header
* line . ( We quit this loop after seeing a blank line ,
* so if we ' ve seen a request or response line , or a
* header line , this is probably more of the request
* or response we ' re presumably seeing . There is some
* risk of false positives , but the same applies for
* full request or response lines or header lines ,
* although that ' s less likely . )
*
* We throw an exception in that case , by checking for
* the existence of the next byte after the last one
* in the line . If it exists , " tvb_ensure_bytes_exist() "
* throws no exception , and we fall through to the
* " not HTTP " case . If it doesn ' t exist ,
* " tvb_ensure_bytes_exist() " will throw the appropriate
* exception .
*/
if ( saw_req_resp_or_header )
tvb_ensure_bytes_exist ( tvb , offset , linelen + 1 ) ;
2001-01-11 06:30:54 +00:00
not_http :
/*
* We don ' t consider this part of an HTTP request or
* reply , so we don ' t display it .
* ( Yeah , that means we don ' t display , say , a text / http
* page , but you can get that from the data pane . )
*/
break ;
1999-02-12 09:03:42 +00:00
2001-01-11 06:30:54 +00:00
is_http :
2014-04-25 20:03:45 +00:00
if ( first_loop ) {
2014-04-25 00:39:17 +00:00
col_set_str ( pinfo - > cinfo , COL_PROTOCOL , proto_tag ) ;
2014-04-25 20:08:14 +00:00
/*
* Put the first line from the buffer into the summary
* if it ' s an HTTP request or reply ( but leave out the
* line terminator ) .
* Otherwise , just call it a continuation .
*/
2014-04-25 20:03:45 +00:00
if ( is_request_or_reply )
col_add_fstr ( pinfo - > cinfo , COL_INFO , " %s " , format_text ( firstline , first_linelen ) ) ;
else
col_set_str ( pinfo - > cinfo , COL_INFO , " Continuation " ) ;
}
2014-04-25 00:39:17 +00:00
if ( ( tree ) & & ( http_tree = = NULL ) ) {
ti = proto_tree_add_item ( tree , proto_http , tvb , orig_offset , - 1 , ENC_NA ) ;
http_tree = proto_item_add_subtree ( ti , ett_http ) ;
2014-07-03 11:46:32 +00:00
if ( leading_crlf ) {
2014-08-04 17:09:10 +00:00
proto_tree_add_expert ( http_tree , pinfo , & ei_http_leading_crlf , tvb , orig_offset - 2 , 2 ) ;
2014-07-03 11:46:32 +00:00
}
2014-04-25 00:39:17 +00:00
}
2014-06-29 12:50:21 +00:00
if ( first_loop & & ! is_ssl & & pinfo - > ptype = = PT_TCP & &
( pinfo - > srcport = = 443 | | pinfo - > destport = = 443 ) ) {
expert_add_info ( pinfo , ti , & ei_http_ssl_port ) ;
}
first_loop = FALSE ;
2001-01-11 06:30:54 +00:00
/*
2003-11-06 08:54:31 +00:00
* Process this line .
2001-01-11 06:30:54 +00:00
*/
2014-04-25 00:39:17 +00:00
2004-01-01 23:34:06 +00:00
if ( linelen = = 0 ) {
/*
* This is a blank line , which means that
* whatever follows it isn ' t part of this
* request or reply .
*/
2014-05-18 07:56:20 +00:00
proto_tree_add_format_text ( http_tree , tvb , offset , next_offset - offset ) ;
2004-01-01 23:34:06 +00:00
offset = next_offset ;
break ;
}
/*
* Not a blank line - either a request , a reply , or a header
* line .
2004-05-09 09:07:33 +00:00
*/
2004-01-01 23:34:06 +00:00
saw_req_resp_or_header = TRUE ;
2003-11-06 08:54:31 +00:00
if ( is_request_or_reply ) {
2014-06-27 02:51:11 +00:00
char * text = tvb_format_text ( tvb , offset , next_offset - offset ) ;
req_tree = proto_tree_add_subtree ( http_tree , tvb ,
offset , next_offset - offset , ett_http_request , & hdr_item , text ) ;
2013-09-09 00:44:09 +00:00
expert_add_info_format ( pinfo , hdr_item , & ei_http_chat , " %s " , text ) ;
2005-03-20 00:07:07 +00:00
if ( reqresp_dissector ) {
2007-03-13 20:42:04 +00:00
reqresp_dissector ( tvb , req_tree , offset , line ,
lineend , conv_data ) ;
2003-06-10 22:07:18 +00:00
}
2004-01-01 23:34:06 +00:00
} else {
2003-11-06 08:54:31 +00:00
/*
2003-12-23 02:29:11 +00:00
* Header .
2003-11-06 08:54:31 +00:00
*/
2003-12-23 02:29:11 +00:00
process_header ( tvb , offset , next_offset , line , linelen ,
2013-10-17 01:23:12 +00:00
colon_offset , pinfo , http_tree , & headers , conv_data ,
http_type ) ;
2003-11-06 08:54:31 +00:00
}
2001-01-11 06:30:54 +00:00
offset = next_offset ;
}
1999-02-12 09:03:42 +00:00
2010-09-21 02:12:21 +00:00
if ( tree & & stat_info - > http_host & & stat_info - > request_uri ) {
proto_item * e_ti ;
2013-12-24 13:53:09 +00:00
gchar * uri ;
uri = wmem_strdup_printf ( wmem_packet_scope ( ) , " %s://%s%s " ,
is_ssl ? " https " : " http " ,
2013-09-15 10:29:49 +00:00
g_strstrip ( wmem_strdup ( wmem_packet_scope ( ) , stat_info - > http_host ) ) , stat_info - > request_uri ) ;
2010-09-21 02:12:21 +00:00
e_ti = proto_tree_add_string ( http_tree ,
hf_http_request_full_uri , tvb , 0 ,
0 , uri ) ;
PROTO_ITEM_SET_URL ( e_ti ) ;
PROTO_ITEM_SET_GENERATED ( e_ti ) ;
}
2013-02-16 14:59:00 +00:00
if ( ! PINFO_FD_VISITED ( pinfo ) ) {
if ( http_type = = HTTP_REQUEST ) {
push_req ( conv_data , pinfo ) ;
} else if ( http_type = = HTTP_RESPONSE ) {
push_res ( conv_data , pinfo ) ;
}
}
2001-01-11 06:30:54 +00:00
if ( tree ) {
2013-02-16 14:59:00 +00:00
proto_item * pi ;
2013-11-23 02:20:13 +00:00
http_req_res_t * curr = ( http_req_res_t * ) p_get_proto_data ( wmem_file_scope ( ) , pinfo , proto_http , 0 ) ;
2013-02-16 14:59:00 +00:00
http_req_res_t * prev = curr ? curr - > prev : NULL ;
http_req_res_t * next = curr ? curr - > next : NULL ;
2000-02-23 19:47:14 +00:00
switch ( http_type ) {
2000-02-23 20:55:33 +00:00
2001-01-03 03:40:29 +00:00
case HTTP_NOTIFICATION :
2008-05-13 01:23:37 +00:00
hidden_item = proto_tree_add_boolean ( http_tree ,
hf_http_notification , tvb , 0 , 0 , 1 ) ;
2010-09-21 02:12:21 +00:00
PROTO_ITEM_SET_HIDDEN ( hidden_item ) ;
2001-01-03 03:40:29 +00:00
break ;
2000-02-23 20:55:33 +00:00
case HTTP_RESPONSE :
2008-05-13 01:23:37 +00:00
hidden_item = proto_tree_add_boolean ( http_tree ,
hf_http_response , tvb , 0 , 0 , 1 ) ;
PROTO_ITEM_SET_HIDDEN ( hidden_item ) ;
2013-02-16 14:59:00 +00:00
if ( curr ) {
nstime_t delta ;
pi = proto_tree_add_text ( http_tree , tvb , 0 , 0 , " HTTP response %u/%u " , curr - > number , conv_data - > req_res_num ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
if ( ! nstime_is_unset ( & ( curr - > req_ts ) ) ) {
nstime_delta ( & delta , & pinfo - > fd - > abs_ts , & ( curr - > req_ts ) ) ;
2013-05-30 07:16:04 +00:00
pi = proto_tree_add_time ( http_tree , hf_http_time , tvb , 0 , 0 , & delta ) ;
2013-02-16 14:59:00 +00:00
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
}
if ( prev & & prev - > req_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_prev_request_in , tvb , 0 , 0 , prev - > req_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( prev & & prev - > res_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_prev_response_in , tvb , 0 , 0 , prev - > res_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( curr & & curr - > req_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_request_in , tvb , 0 , 0 , curr - > req_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( next & & next - > req_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_next_request_in , tvb , 0 , 0 , next - > req_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( next & & next - > res_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_next_response_in , tvb , 0 , 0 , next - > res_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
2000-02-23 20:55:33 +00:00
break ;
case HTTP_REQUEST :
2008-05-13 01:23:37 +00:00
hidden_item = proto_tree_add_boolean ( http_tree ,
hf_http_request , tvb , 0 , 0 , 1 ) ;
2010-09-21 02:12:21 +00:00
PROTO_ITEM_SET_HIDDEN ( hidden_item ) ;
2013-02-16 14:59:00 +00:00
if ( curr ) {
pi = proto_tree_add_text ( http_tree , tvb , 0 , 0 , " HTTP request %u/%u " , curr - > number , conv_data - > req_res_num ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( prev & & prev - > req_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_prev_request_in , tvb , 0 , 0 , prev - > req_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( curr & & curr - > res_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_response_in , tvb , 0 , 0 , curr - > res_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
if ( next & & next - > req_framenum ) {
pi = proto_tree_add_uint ( http_tree , hf_http_next_request_in , tvb , 0 , 0 , next - > req_framenum ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
2000-02-23 20:55:33 +00:00
break ;
case HTTP_OTHERS :
default :
break ;
2000-02-23 19:47:14 +00:00
}
2000-11-09 10:56:33 +00:00
}
2013-09-11 21:44:13 +00:00
2012-11-02 20:35:24 +00:00
reported_datalen = tvb_reported_length_remaining ( tvb , offset ) ;
2014-07-03 08:53:40 +00:00
datalen = tvb_captured_length_remaining ( tvb , offset ) ;
2000-02-23 19:47:14 +00:00
2003-12-23 01:22:52 +00:00
/*
2003-12-23 01:42:48 +00:00
* If a content length was supplied , the amount of data to be
2003-12-27 08:35:08 +00:00
* processed as HTTP payload is the minimum of the content
2003-12-23 01:42:48 +00:00
* length and the amount of data remaining in the frame .
*
2012-04-13 13:10:38 +00:00
* If a message is received with both a Transfer - Encoding
* header field and a Content - Length header field , the latter
* MUST be ignored .
*
2003-12-23 01:42:48 +00:00
* If no content length was supplied ( or if a bad content length
* was supplied ) , the amount of data to be processed is the amount
* of data remaining in the frame .
2003-12-23 01:22:52 +00:00
*
* If there was no Content - Length entity header , we should
* accumulate all data until the end of the connection .
* That ' d require that the TCP dissector call subdissectors
* for all frames with FIN , even if they contain no data ,
* which would require subdissectors to deal intelligently
* with empty segments .
2003-12-27 18:45:48 +00:00
*
2012-02-01 02:05:19 +00:00
* According to RFC 2616 , however , 1 xx responses , 204 responses ,
2003-12-27 18:45:48 +00:00
* and 304 responses MUST NOT include a message body ; if no
* content length is specified for them , we don ' t attempt to
* dissect the body .
*
* XXX - it says the same about responses to HEAD requests ;
* unless there ' s a way to determine from the response
* whether it ' s a response to a HEAD request , we have to
* keep information about the request and associate that with
* the response in order to handle that .
2003-12-23 01:22:52 +00:00
*/
2012-04-13 13:10:38 +00:00
if ( headers . have_content_length & &
headers . content_length ! = - 1 & &
headers . transfer_encoding = = NULL ) {
2003-12-23 02:29:11 +00:00
if ( datalen > headers . content_length )
2010-04-09 02:00:07 +00:00
datalen = ( int ) headers . content_length ;
2003-12-23 01:42:48 +00:00
/*
* XXX - limit the reported length in the tvbuff we ' ll
* hand to a subdissector to be no greater than the
* content length .
*
* We really need both unreassembled and " how long it'd
* be if it were reassembled " lengths for tvbuffs, so
* that we throw the appropriate exceptions for
* " not enough data captured " ( running past the length ) ,
* " packet needed reassembly " ( within the length but
* running past the unreassembled length ) , and
* " packet is malformed " ( running past the reassembled
* length ) .
*/
2003-12-23 02:29:11 +00:00
if ( reported_datalen > headers . content_length )
2010-04-09 02:00:07 +00:00
reported_datalen = ( int ) headers . content_length ;
2003-12-27 18:45:48 +00:00
} else {
2005-01-13 07:47:26 +00:00
switch ( http_type ) {
case HTTP_REQUEST :
/*
* Requests have no content if there ' s no
* Content - Length header and no Transfer - Encoding
* header .
*/
if ( headers . transfer_encoding = = NULL )
datalen = 0 ;
else
reported_datalen = - 1 ;
break ;
case HTTP_RESPONSE :
if ( ( stat_info - > response_code / 100 ) = = 1 | |
stat_info - > response_code = = 204 | |
stat_info - > response_code = = 304 )
datalen = 0 ; /* no content! */
else {
/*
* XXX - responses to HEAD requests ,
* and possibly other responses ,
* " MUST NOT " include a
* message - body .
*/
reported_datalen = - 1 ;
}
break ;
default :
/*
* XXX - what about HTTP_NOTIFICATION ?
*/
2003-12-27 18:45:48 +00:00
reported_datalen = - 1 ;
2005-01-13 07:47:26 +00:00
break ;
}
2003-12-27 18:45:48 +00:00
}
2003-12-23 01:42:48 +00:00
2000-11-09 10:56:33 +00:00
if ( datalen > 0 ) {
2003-12-23 01:42:48 +00:00
/*
* There ' s stuff left over ; process it .
*/
tvbuff_t * next_tvb ;
2014-11-28 14:52:07 +00:00
guint chunked_datalen = 0 ;
2014-11-22 23:17:20 +00:00
char * media_str = NULL ;
2003-12-23 01:42:48 +00:00
/*
* Create a tvbuff for the payload .
*
* The amount of data to be processed that ' s
* available in the tvbuff is " datalen " , which
* is the minimum of the amount of data left in
* the tvbuff and any specified content length .
*
* The amount of data to be processed that ' s in
* this frame , regardless of whether it was
* captured or not , is " reported_datalen " ,
* which , if no content length was specified ,
* is - 1 , i . e . " to the end of the frame.
*/
next_tvb = tvb_new_subset ( tvb , offset , datalen ,
reported_datalen ) ;
2000-11-16 07:35:43 +00:00
2004-04-26 17:10:40 +00:00
/*
2004-05-09 09:07:33 +00:00
* Handle * transfer * encodings other than " identity " .
2004-04-26 17:10:40 +00:00
*/
if ( headers . transfer_encoding ! = NULL & &
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
g_ascii_strcasecmp ( headers . transfer_encoding , " identity " ) ! = 0 ) {
2004-05-05 06:55:09 +00:00
if ( http_dechunk_body & &
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
( g_ascii_strncasecmp ( headers . transfer_encoding , " chunked " , 7 )
2004-05-05 06:55:09 +00:00
= = 0 ) ) {
2004-04-26 17:10:40 +00:00
2014-11-28 14:52:07 +00:00
chunked_datalen = chunked_encoding_dissector (
2004-04-29 20:26:54 +00:00
& next_tvb , pinfo , http_tree , 0 ) ;
2004-04-26 17:10:40 +00:00
2014-11-28 14:52:07 +00:00
if ( chunked_datalen = = 0 ) {
2004-05-09 09:07:33 +00:00
/*
2004-04-26 17:10:40 +00:00
* The chunks weren ' t reassembled ,
* or there was a single zero
* length chunk .
*/
goto body_dissected ;
2004-05-09 09:07:33 +00:00
} else {
/*
* Add a new data source for the
* de - chunked data .
*/
2011-12-18 18:31:30 +00:00
#if 0 /* Handled in chunked_encoding_dissector() */
2009-09-14 17:36:15 +00:00
tvb_set_child_real_data_tvbuff ( tvb ,
next_tvb ) ;
2011-12-18 18:31:30 +00:00
# endif
2004-05-09 09:07:33 +00:00
add_new_data_source ( pinfo , next_tvb ,
" De-chunked entity body " ) ;
2014-11-28 14:52:07 +00:00
/* chunked-body might be smaller than
* datalen . */
datalen = chunked_datalen ;
2004-04-26 17:10:40 +00:00
}
} else {
/*
2004-05-09 09:07:33 +00:00
* We currently can ' t handle , for example ,
* " gzip " , " compress " , or " deflate " as
* * transfer * encodings ; just handle them
2004-04-26 17:10:40 +00:00
* as data for now .
*/
call_dissector ( data_handle , next_tvb , pinfo ,
http_tree ) ;
goto body_dissected ;
}
}
2004-02-21 01:31:56 +00:00
/*
2004-05-09 09:07:33 +00:00
* At this point , any chunked * transfer * coding has been removed
* ( the entity body has been dechunked ) so it can be presented
* for the following operation ( * content * encoding ) , or it has
* been been handed off to the data dissector .
*
* Handle * content * encodings other than " identity " ( which
2004-02-21 01:31:56 +00:00
* shouldn ' t appear in a Content - Encoding header , but
* we handle it in any case ) .
*/
if ( headers . content_encoding ! = NULL & &
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
g_ascii_strcasecmp ( headers . content_encoding , " identity " ) ! = 0 ) {
2004-02-21 01:31:56 +00:00
/*
2004-05-05 06:55:09 +00:00
* We currently can ' t handle , for example , " compress " ;
* just handle them as data for now .
2004-05-09 09:07:33 +00:00
*
2004-05-05 06:55:09 +00:00
* After July 7 , 2004 the LZW patent expires , so support
* might be added then . However , I don ' t think that
* anybody ever really implemented " compress " , due to
2004-05-09 09:07:33 +00:00
* the aforementioned patent .
2004-02-21 01:31:56 +00:00
*/
2004-05-05 06:55:09 +00:00
tvbuff_t * uncomp_tvb = NULL ;
2004-05-08 10:28:47 +00:00
proto_item * e_ti = NULL ;
proto_tree * e_tree = NULL ;
2004-05-05 06:55:09 +00:00
if ( http_decompress_body & &
strcasecmp(), strncasecmp(), g_strcasecmp(), and g_strncasecmp() delenda
est. Use g_ascii_strcasecmp() and g_ascii_strncasecmp(), and supply our
own versions if they're missing from GLib (as is the case with GLib
1.x).
In the code to build the list of named fields for Diameter, don't use
g_strdown(); do our own g_ascii_-style upper-case to lower-case mapping
in the hash function and use g_ascii_strcasecmp() in the compare
function.
We do this because there is no guarantee that toupper(), tolower(), and
functions that use them will, for example, map between "I" and "i" in
all locales; in Turkish locales, for example, there are, in both
upper case and lower case, versions of "i" with and without a dot, and
the upper-case version of "i" is "I"-with-a-dot and the lower-case
version of "I" is "i"-without-a-dot. This causes strings that should
match not to match.
This finishes fixing bug 2010 - an earlier checkin prevented the crash
(as there are other ways to produce the same crash, e.g. a bogus
dictionary.xml file), but didn't fix the case-insensitive string matching.
svn path=/trunk/; revision=23623
2007-11-27 18:52:51 +00:00
( g_ascii_strcasecmp ( headers . content_encoding , " gzip " ) = = 0 | |
2011-05-02 14:06:33 +00:00
g_ascii_strcasecmp ( headers . content_encoding , " deflate " ) = = 0 | |
g_ascii_strcasecmp ( headers . content_encoding , " x-gzip " ) = = 0 | |
g_ascii_strcasecmp ( headers . content_encoding , " x-deflate " ) = = 0 ) )
{
2009-05-13 19:46:11 +00:00
uncomp_tvb = tvb_child_uncompress ( tvb , next_tvb , 0 ,
2014-07-03 08:53:40 +00:00
tvb_captured_length ( next_tvb ) ) ;
2004-05-05 06:55:09 +00:00
}
2004-05-08 10:28:47 +00:00
/*
* Add the encoded entity to the protocol tree
*/
2014-06-27 02:51:11 +00:00
e_tree = proto_tree_add_subtree_format ( http_tree , next_tvb ,
2014-07-03 08:53:40 +00:00
0 , tvb_captured_length ( next_tvb ) , ett_http_encoded_entity , & e_ti ,
2005-06-02 20:03:15 +00:00
" Content-encoded entity body (%s): %u bytes " ,
headers . content_encoding ,
2014-07-03 08:53:40 +00:00
tvb_captured_length ( next_tvb ) ) ;
2004-05-08 10:28:47 +00:00
2004-05-05 06:55:09 +00:00
if ( uncomp_tvb ! = NULL ) {
/*
* Decompression worked
*/
2004-05-08 12:54:24 +00:00
/* XXX - Don't free this, since it's possible
* that the data was only partially
* decompressed , such as when desegmentation
* isn ' t enabled .
*
2013-12-12 20:09:33 +00:00
tvb_free ( next_tvb ) ;
2004-05-08 12:54:24 +00:00
*/
2014-07-03 08:53:40 +00:00
proto_item_append_text ( e_ti , " -> %u bytes " , tvb_captured_length ( uncomp_tvb ) ) ;
2004-05-05 06:55:09 +00:00
next_tvb = uncomp_tvb ;
2004-05-09 09:07:33 +00:00
add_new_data_source ( pinfo , next_tvb ,
2004-05-07 17:36:46 +00:00
" Uncompressed entity body " ) ;
2004-05-05 06:55:09 +00:00
} else {
2008-07-08 22:36:35 +00:00
proto_item_append_text ( e_ti , " [Error: Decompression failed] " ) ;
2004-05-05 06:55:09 +00:00
call_dissector ( data_handle , next_tvb , pinfo ,
e_tree ) ;
2004-05-09 09:07:33 +00:00
2004-05-05 06:55:09 +00:00
goto body_dissected ;
}
2004-02-21 01:31:56 +00:00
}
2004-05-09 09:07:33 +00:00
/*
* Note that a new data source is added for the entity body
* only if it was content - encoded and / or transfer - encoded .
*/
2004-02-21 01:31:56 +00:00
2007-03-06 00:36:25 +00:00
/* Save values for the Export Object GUI feature if we have
* an active listener to process it ( which happens when
2007-03-13 20:42:04 +00:00
* the export object window is open ) . */
if ( have_tap_listener ( http_eo_tap ) ) {
2013-09-15 10:29:49 +00:00
eo_info = wmem_new ( wmem_packet_scope ( ) , http_eo_t ) ;
2007-03-13 20:42:04 +00:00
eo_info - > hostname = conv_data - > http_host ;
eo_info - > filename = conv_data - > request_uri ;
eo_info - > content_type = headers . content_type ;
2014-07-03 08:53:40 +00:00
eo_info - > payload_len = tvb_captured_length ( next_tvb ) ;
2011-05-27 01:57:33 +00:00
eo_info - > payload_data = tvb_get_ptr ( next_tvb , 0 , eo_info - > payload_len ) ;
2007-03-13 20:42:04 +00:00
tap_queue_packet ( http_eo_tap , pinfo , eo_info ) ;
2007-03-06 00:36:25 +00:00
}
2001-01-11 06:30:54 +00:00
/*
2003-11-18 07:49:52 +00:00
* Do subdissector checks .
*
To quote section "7.2.1 Type" of RFC 2068, "Hypertext Transfer Protocol
-- HTTP/1.1":
Any HTTP/1.1 message containing an entity-body SHOULD include a
Content-Type header field defining the media type of that body. If
and only if the media type is not given by a Content-Type field, the
recipient MAY attempt to guess the media type via inspection of its
content and/or the name extension(s) of the URL used to identify the
resource. If the media type remains unknown, the recipient SHOULD
treat it as type "application/octet-stream".
To quote section "4. Encoding of Transport Layer" of RFC 2565, "Internet
Printing Protocol/1.0: Encoding and Transport":
HTTP/1.1 [RFC2068] is the transport layer for this protocol.
...
Note: even though port 631 is the IPP default, port 80 remains the
default for an HTTP URI. Thus a URI for a printer using port 631
MUST contain an explicit port, e.g. "http://forest:631/pinetree". An
HTTP URI for IPP with no explicit port implicitly reference port 80,
which is consistent with the rules for HTTP/1.1. Each HTTP operation
MUST use the POST method where the request-URI is the object target
of the operation, and where the "Content-Type" of the message-body in
each request and response MUST be "application/ipp". The message-body
MUST contain the operation layer and MUST have the syntax described
in section 3.2 "Syntax of Encoding". A client implementation MUST
adhere to the rules for a client described for HTTP1.1 [RFC2068]. A
printer (server) implementation MUST adhere the rules for an origin
server described for HTTP1.1 [RFC2068].
So, when choosing a subdissector for HTTP request bodies, search based
on the media type first, and only if we *don't* find a dissector for the
media type, do other stuff such as heuristics or choosing a subdissector
based on the port number.
This fixes a number of problems; in particular, it fixes bug 6765
"non-IPP packets to or from port 631 are dissected as IPP" without
requiring the IPP dissector to attempt to determine whether an entity
body looks like IPP. It also ensures that the default dissector for
HTTP entity bodies, the "media" dissector, will get the media type
passed to it in pinfo->match_string.
Don't use "!str*cmp()" while we're at it - it's valid C, but the "!" can
make it look as if it's checking for something not being the case when,
in fact, you're checking for equality rather than inequality. (The
str*cmp() routines don't return Boolean results.)
svn path=/trunk/; revision=41025
2012-02-14 06:00:14 +00:00
* First , if we have a Content - Type value , check whether
* there ' s a subdissector for that media type .
2001-01-11 06:30:54 +00:00
*/
To quote section "7.2.1 Type" of RFC 2068, "Hypertext Transfer Protocol
-- HTTP/1.1":
Any HTTP/1.1 message containing an entity-body SHOULD include a
Content-Type header field defining the media type of that body. If
and only if the media type is not given by a Content-Type field, the
recipient MAY attempt to guess the media type via inspection of its
content and/or the name extension(s) of the URL used to identify the
resource. If the media type remains unknown, the recipient SHOULD
treat it as type "application/octet-stream".
To quote section "4. Encoding of Transport Layer" of RFC 2565, "Internet
Printing Protocol/1.0: Encoding and Transport":
HTTP/1.1 [RFC2068] is the transport layer for this protocol.
...
Note: even though port 631 is the IPP default, port 80 remains the
default for an HTTP URI. Thus a URI for a printer using port 631
MUST contain an explicit port, e.g. "http://forest:631/pinetree". An
HTTP URI for IPP with no explicit port implicitly reference port 80,
which is consistent with the rules for HTTP/1.1. Each HTTP operation
MUST use the POST method where the request-URI is the object target
of the operation, and where the "Content-Type" of the message-body in
each request and response MUST be "application/ipp". The message-body
MUST contain the operation layer and MUST have the syntax described
in section 3.2 "Syntax of Encoding". A client implementation MUST
adhere to the rules for a client described for HTTP1.1 [RFC2068]. A
printer (server) implementation MUST adhere the rules for an origin
server described for HTTP1.1 [RFC2068].
So, when choosing a subdissector for HTTP request bodies, search based
on the media type first, and only if we *don't* find a dissector for the
media type, do other stuff such as heuristics or choosing a subdissector
based on the port number.
This fixes a number of problems; in particular, it fixes bug 6765
"non-IPP packets to or from port 631 are dissected as IPP" without
requiring the IPP dissector to attempt to determine whether an entity
body looks like IPP. It also ensures that the default dissector for
HTTP entity bodies, the "media" dissector, will get the media type
passed to it in pinfo->match_string.
Don't use "!str*cmp()" while we're at it - it's valid C, but the "!" can
make it look as if it's checking for something not being the case when,
in fact, you're checking for equality rather than inequality. (The
str*cmp() routines don't return Boolean results.)
svn path=/trunk/; revision=41025
2012-02-14 06:00:14 +00:00
handle = NULL ;
if ( headers . content_type ! = NULL ) {
2000-11-09 10:56:33 +00:00
/*
2003-11-18 07:49:52 +00:00
* We didn ' t find any subdissector that
* registered for the port , and we have a
* Content - Type value . Is there any subdissector
* for that content type ?
2000-11-09 10:56:33 +00:00
*/
2014-11-23 01:47:59 +00:00
if ( headers . content_type_parameters )
media_str = wmem_strdup ( wmem_packet_scope ( ) , headers . content_type_parameters ) ;
2005-07-24 01:42:41 +00:00
2004-01-16 01:32:20 +00:00
/*
* Calling the string handle for the media type
* dissector table will set pinfo - > match_string
* to headers . content_type for us .
*/
pinfo - > match_string = headers . content_type ;
2003-11-18 07:49:52 +00:00
handle = dissector_get_string_handle (
2003-12-07 03:21:22 +00:00
media_type_subdissector_table ,
2003-12-23 02:29:11 +00:00
headers . content_type ) ;
2010-10-27 06:49:18 +00:00
if ( handle = = NULL & &
To quote section "7.2.1 Type" of RFC 2068, "Hypertext Transfer Protocol
-- HTTP/1.1":
Any HTTP/1.1 message containing an entity-body SHOULD include a
Content-Type header field defining the media type of that body. If
and only if the media type is not given by a Content-Type field, the
recipient MAY attempt to guess the media type via inspection of its
content and/or the name extension(s) of the URL used to identify the
resource. If the media type remains unknown, the recipient SHOULD
treat it as type "application/octet-stream".
To quote section "4. Encoding of Transport Layer" of RFC 2565, "Internet
Printing Protocol/1.0: Encoding and Transport":
HTTP/1.1 [RFC2068] is the transport layer for this protocol.
...
Note: even though port 631 is the IPP default, port 80 remains the
default for an HTTP URI. Thus a URI for a printer using port 631
MUST contain an explicit port, e.g. "http://forest:631/pinetree". An
HTTP URI for IPP with no explicit port implicitly reference port 80,
which is consistent with the rules for HTTP/1.1. Each HTTP operation
MUST use the POST method where the request-URI is the object target
of the operation, and where the "Content-Type" of the message-body in
each request and response MUST be "application/ipp". The message-body
MUST contain the operation layer and MUST have the syntax described
in section 3.2 "Syntax of Encoding". A client implementation MUST
adhere to the rules for a client described for HTTP1.1 [RFC2068]. A
printer (server) implementation MUST adhere the rules for an origin
server described for HTTP1.1 [RFC2068].
So, when choosing a subdissector for HTTP request bodies, search based
on the media type first, and only if we *don't* find a dissector for the
media type, do other stuff such as heuristics or choosing a subdissector
based on the port number.
This fixes a number of problems; in particular, it fixes bug 6765
"non-IPP packets to or from port 631 are dissected as IPP" without
requiring the IPP dissector to attempt to determine whether an entity
body looks like IPP. It also ensures that the default dissector for
HTTP entity bodies, the "media" dissector, will get the media type
passed to it in pinfo->match_string.
Don't use "!str*cmp()" while we're at it - it's valid C, but the "!" can
make it look as if it's checking for something not being the case when,
in fact, you're checking for equality rather than inequality. (The
str*cmp() routines don't return Boolean results.)
svn path=/trunk/; revision=41025
2012-02-14 06:00:14 +00:00
strncmp ( headers . content_type , " multipart/ " , sizeof ( " multipart/ " ) - 1 ) = = 0 ) {
2010-10-27 06:49:18 +00:00
/* Try to decode the unknown multipart subtype anyway */
handle = dissector_get_string_handle (
media_type_subdissector_table ,
" multipart/ " ) ;
}
2003-11-18 07:49:52 +00:00
}
2011-03-24 02:49:05 +00:00
To quote section "7.2.1 Type" of RFC 2068, "Hypertext Transfer Protocol
-- HTTP/1.1":
Any HTTP/1.1 message containing an entity-body SHOULD include a
Content-Type header field defining the media type of that body. If
and only if the media type is not given by a Content-Type field, the
recipient MAY attempt to guess the media type via inspection of its
content and/or the name extension(s) of the URL used to identify the
resource. If the media type remains unknown, the recipient SHOULD
treat it as type "application/octet-stream".
To quote section "4. Encoding of Transport Layer" of RFC 2565, "Internet
Printing Protocol/1.0: Encoding and Transport":
HTTP/1.1 [RFC2068] is the transport layer for this protocol.
...
Note: even though port 631 is the IPP default, port 80 remains the
default for an HTTP URI. Thus a URI for a printer using port 631
MUST contain an explicit port, e.g. "http://forest:631/pinetree". An
HTTP URI for IPP with no explicit port implicitly reference port 80,
which is consistent with the rules for HTTP/1.1. Each HTTP operation
MUST use the POST method where the request-URI is the object target
of the operation, and where the "Content-Type" of the message-body in
each request and response MUST be "application/ipp". The message-body
MUST contain the operation layer and MUST have the syntax described
in section 3.2 "Syntax of Encoding". A client implementation MUST
adhere to the rules for a client described for HTTP1.1 [RFC2068]. A
printer (server) implementation MUST adhere the rules for an origin
server described for HTTP1.1 [RFC2068].
So, when choosing a subdissector for HTTP request bodies, search based
on the media type first, and only if we *don't* find a dissector for the
media type, do other stuff such as heuristics or choosing a subdissector
based on the port number.
This fixes a number of problems; in particular, it fixes bug 6765
"non-IPP packets to or from port 631 are dissected as IPP" without
requiring the IPP dissector to attempt to determine whether an entity
body looks like IPP. It also ensures that the default dissector for
HTTP entity bodies, the "media" dissector, will get the media type
passed to it in pinfo->match_string.
Don't use "!str*cmp()" while we're at it - it's valid C, but the "!" can
make it look as if it's checking for something not being the case when,
in fact, you're checking for equality rather than inequality. (The
str*cmp() routines don't return Boolean results.)
svn path=/trunk/; revision=41025
2012-02-14 06:00:14 +00:00
/*
* Now , if we didn ' t find such a subdissector , check
* whether some subdissector asked that they be called
* if HTTP traffic was on some particular port . This
* handles protocols that use HTTP syntax but don ' t have
* a media type and instead use a specified port .
*/
if ( handle = = NULL ) {
handle = dissector_get_uint_handle ( port_subdissector_table ,
pinfo - > match_uint ) ;
}
2003-11-18 07:49:52 +00:00
if ( handle ! = NULL ) {
/*
* We have a subdissector - call it .
*/
2014-11-23 01:47:59 +00:00
dissected = call_dissector_only ( handle , next_tvb , pinfo , tree , media_str ) ;
2011-03-24 02:49:05 +00:00
if ( ! dissected )
2013-05-26 03:29:07 +00:00
expert_add_info ( pinfo , http_tree , & ei_http_subdissector_failed ) ;
2011-03-24 02:49:05 +00:00
}
if ( ! dissected ) {
2001-11-18 02:28:15 +00:00
/*
2011-03-24 02:49:05 +00:00
* We don ' t have a subdissector or we have one and it did not
* dissect the payload - try the heuristic subdissectors .
2003-11-18 07:49:52 +00:00
*/
2011-03-24 02:49:05 +00:00
dissected = dissector_try_heuristic ( heur_subdissector_list ,
2014-05-20 10:54:20 +00:00
next_tvb , pinfo , tree , & hdtbl_entry , NULL ) ;
2003-11-18 07:49:52 +00:00
}
2011-03-24 02:49:05 +00:00
2003-11-18 07:49:52 +00:00
if ( dissected ) {
/*
* The subdissector dissected the body .
* Fix up the top - level item so that it doesn ' t
* include the stuff for that protocol .
2001-11-18 02:28:15 +00:00
*/
if ( ti ! = NULL )
proto_item_set_len ( ti , offset ) ;
2002-05-30 01:56:55 +00:00
} else {
2006-09-12 11:39:51 +00:00
if ( headers . content_type ! = NULL ) {
/*
* Calling the default media handle if there is a content - type that
* wasn ' t handled above .
*/
2014-11-22 23:17:20 +00:00
call_dissector_with_data ( media_handle , next_tvb , pinfo , tree , media_str ) ;
2006-09-12 11:39:51 +00:00
} else {
2007-12-26 18:28:31 +00:00
/* Call the default data dissector */
call_dissector ( data_handle , next_tvb , pinfo , http_tree ) ;
2006-09-12 11:39:51 +00:00
}
2002-05-30 01:56:55 +00:00
}
2003-12-23 02:02:09 +00:00
2004-02-21 01:31:56 +00:00
body_dissected :
2003-12-23 02:02:09 +00:00
/*
* We ' ve processed " datalen " bytes worth of data
* ( which may be no data at all ) ; advance the
* offset past whatever data we ' ve processed .
*/
offset + = datalen ;
1999-02-12 09:03:42 +00:00
}
2003-09-02 22:47:59 +00:00
2012-11-02 20:35:24 +00:00
if ( http_type = = HTTP_RESPONSE & & pinfo - > desegment_offset < = 0 & & pinfo - > desegment_len < = 0 ) {
conv_data - > upgrade = headers . upgrade ;
conv_data - > startframe = pinfo - > fd - > num + 1 ;
2015-01-12 02:32:53 +00:00
WMEM_COPY_ADDRESS ( wmem_file_scope ( ) , & conv_data - > server_addr , & pinfo - > src ) ;
2014-04-27 08:39:23 +00:00
conv_data - > server_port = pinfo - > srcport ;
2012-11-02 20:35:24 +00:00
}
2003-11-04 08:16:02 +00:00
tap_queue_packet ( http_tap , pinfo , stat_info ) ;
2003-12-23 02:02:09 +00:00
return offset - orig_offset ;
1999-02-12 09:03:42 +00:00
}
2003-06-10 22:07:18 +00:00
/* This can be used to dissect an HTTP request until such time
* that a more complete dissector is written for that HTTP request .
2005-03-13 00:49:33 +00:00
* This simple dissector only puts the request method , URI , and
* protocol version into a sub - tree .
2003-06-10 22:07:18 +00:00
*/
static void
2005-03-13 00:49:33 +00:00
basic_request_dissector ( tvbuff_t * tvb , proto_tree * tree , int offset ,
2007-03-13 20:42:04 +00:00
const guchar * line , const guchar * lineend ,
http_conv_t * conv_data )
2003-06-10 22:07:18 +00:00
{
2005-03-13 00:49:33 +00:00
const guchar * next_token ;
2012-12-26 05:57:06 +00:00
const gchar * request_uri ;
2005-03-13 00:49:33 +00:00
int tokenlen ;
2006-08-24 22:05:26 +00:00
2005-03-13 00:49:33 +00:00
/* The first token is the method. */
tokenlen = get_token_len ( line , lineend , & next_token ) ;
if ( tokenlen = = 0 )
return ;
proto_tree_add_item ( tree , hf_http_request_method , tvb , offset , tokenlen ,
2011-10-15 18:46:26 +00:00
ENC_ASCII | ENC_NA ) ;
2010-09-05 12:16:14 +00:00
if ( ( next_token - line ) > 2 & & next_token [ - 1 ] = = ' ' & & next_token [ - 2 ] = = ' ' ) {
/* Two spaces in a now indicates empty URI, so roll back one here */
next_token - - ;
}
2009-03-30 18:40:33 +00:00
offset + = ( int ) ( next_token - line ) ;
2005-03-13 00:49:33 +00:00
line = next_token ;
/* The next token is the URI. */
tokenlen = get_token_len ( line , lineend , & next_token ) ;
2007-03-13 20:42:04 +00:00
/* Save the request URI for various later uses */
2014-06-17 15:30:58 +00:00
request_uri = tvb_get_string_enc ( wmem_packet_scope ( ) , tvb , offset , tokenlen , ENC_ASCII ) ;
2013-09-15 10:29:49 +00:00
stat_info - > request_uri = wmem_strdup ( wmem_packet_scope ( ) , request_uri ) ;
2013-12-12 20:09:33 +00:00
conv_data - > request_uri = wmem_strdup ( wmem_file_scope ( ) , request_uri ) ;
2007-03-24 10:07:20 +00:00
2005-03-13 00:49:33 +00:00
proto_tree_add_string ( tree , hf_http_request_uri , tvb , offset , tokenlen ,
2007-03-13 20:42:04 +00:00
request_uri ) ;
2009-03-30 18:40:33 +00:00
offset + = ( int ) ( next_token - line ) ;
2005-03-13 00:49:33 +00:00
line = next_token ;
/* Everything to the end of the line is the version. */
2009-03-30 18:40:33 +00:00
tokenlen = ( int ) ( lineend - line ) ;
2005-03-13 00:49:33 +00:00
proto_tree_add_item ( tree , hf_http_version , tvb , offset , tokenlen ,
2011-10-15 18:46:26 +00:00
ENC_ASCII | ENC_NA ) ;
2003-06-10 22:07:18 +00:00
}
2003-09-02 23:09:11 +00:00
2003-09-02 22:47:59 +00:00
static void
2005-03-13 00:49:33 +00:00
basic_response_dissector ( tvbuff_t * tvb , proto_tree * tree , int offset ,
2007-03-13 20:42:04 +00:00
const guchar * line , const guchar * lineend ,
http_conv_t * conv_data _U_ )
2003-09-02 22:47:59 +00:00
{
2005-03-13 00:49:33 +00:00
const guchar * next_token ;
int tokenlen ;
2010-10-30 14:29:20 +00:00
gchar response_code_chars [ 4 ] ;
2006-08-24 22:05:26 +00:00
2010-10-30 14:29:20 +00:00
/*
* The first token is the HTTP Version .
*/
2005-03-13 00:49:33 +00:00
tokenlen = get_token_len ( line , lineend , & next_token ) ;
if ( tokenlen = = 0 )
return ;
proto_tree_add_item ( tree , hf_http_version , tvb , offset , tokenlen ,
2011-10-15 18:46:26 +00:00
ENC_ASCII | ENC_NA ) ;
2010-10-30 14:29:20 +00:00
/* Advance to the start of the next token. */
2009-03-30 18:40:33 +00:00
offset + = ( int ) ( next_token - line ) ;
2005-03-13 00:49:33 +00:00
line = next_token ;
2010-10-30 14:29:20 +00:00
/*
* The second token is the Status Code .
*/
2005-03-13 00:49:33 +00:00
tokenlen = get_token_len ( line , lineend , & next_token ) ;
if ( tokenlen < 3 )
return ;
2010-10-30 14:29:20 +00:00
/* The Status Code characters must be copied into a null-terminated
* buffer for strtoul ( ) to parse them into an unsigned integer value .
*/
memcpy ( response_code_chars , line , 3 ) ;
response_code_chars [ 3 ] = ' \0 ' ;
2006-08-24 22:05:26 +00:00
2007-03-24 10:07:20 +00:00
stat_info - > response_code = conv_data - > response_code =
2012-12-26 05:57:06 +00:00
( guint ) strtoul ( response_code_chars , NULL , 10 ) ;
2006-08-24 22:05:26 +00:00
2005-03-13 00:49:33 +00:00
proto_tree_add_uint ( tree , hf_http_response_code , tvb , offset , 3 ,
2010-05-12 13:24:42 +00:00
stat_info - > response_code ) ;
2010-10-30 14:29:20 +00:00
/* Advance to the start of the next token. */
offset + = ( int ) ( next_token - line ) ;
line = next_token ;
/*
* The remaining tokens in the line comprise the Reason Phrase .
*/
tokenlen = ( int ) ( lineend - line ) ;
if ( tokenlen < 1 )
return ;
proto_tree_add_item ( tree , hf_http_response_phrase , tvb , offset ,
2011-10-15 18:46:26 +00:00
tokenlen , ENC_ASCII | ENC_NA ) ;
2010-10-30 14:29:20 +00:00
2003-09-02 22:47:59 +00:00
}
2003-06-10 22:07:18 +00:00
2011-12-18 18:31:30 +00:00
#if 0 /* XXX: Replaced by code creating the "Dechunked" tvb O(N) rather tan O(N^2) */
2004-04-26 17:10:40 +00:00
/*
* Dissect the http data chunks and add them to the tree .
*/
static int
2009-09-14 17:36:15 +00:00
chunked_encoding_dissector ( tvbuff_t * * tvb_ptr , packet_info * pinfo ,
2010-09-21 02:12:21 +00:00
proto_tree * tree , int offset )
2004-04-26 17:10:40 +00:00
{
guint8 * chunk_string = NULL ;
2004-11-03 20:01:53 +00:00
guint32 chunk_size = 0 ;
2004-04-26 17:10:40 +00:00
gint chunk_offset = 0 ;
2004-11-03 20:01:53 +00:00
guint32 datalen = 0 ;
2004-04-26 17:10:40 +00:00
gint linelen = 0 ;
gint chunks_decoded = 0 ;
tvbuff_t * tvb = NULL ;
tvbuff_t * new_tvb = NULL ;
gint chunked_data_size = 0 ;
2014-06-27 02:51:11 +00:00
proto_tree * subtree ;
proto_item * ti ;
2004-05-09 09:07:33 +00:00
2004-04-26 17:10:40 +00:00
if ( tvb_ptr = = NULL | | * tvb_ptr = = NULL ) {
return 0 ;
}
tvb = * tvb_ptr ;
datalen = tvb_reported_length_remaining ( tvb , offset ) ;
2014-06-27 02:51:11 +00:00
subtree = proto_tree_add_subtree ( tree , tvb , offset , datalen ,
ett_http_chunked_response , NULL , " HTTP chunked response " ) ;
2004-04-26 17:10:40 +00:00
2013-09-11 21:44:13 +00:00
while ( datalen > 0 ) {
2004-04-26 17:10:40 +00:00
proto_item * chunk_ti = NULL ;
proto_tree * chunk_subtree = NULL ;
2011-12-18 18:31:30 +00:00
tvbuff_t * data_tvb = NULL ; /* */
2004-04-26 17:10:40 +00:00
gchar * c = NULL ;
2009-09-14 17:36:15 +00:00
guint8 * raw_data ;
2006-06-24 00:01:33 +00:00
gint raw_len = 0 ;
2004-04-26 17:10:40 +00:00
linelen = tvb_find_line_end ( tvb , offset , - 1 , & chunk_offset , TRUE ) ;
if ( linelen < = 0 ) {
/* Can't get the chunk size line */
2004-05-08 12:54:24 +00:00
break ;
2004-04-26 17:10:40 +00:00
}
2014-06-17 15:30:58 +00:00
chunk_string = tvb_get_string_enc ( wmem_packet_scope ( ) , tvb , offset , linelen , ENC_ASCII ) ;
2004-04-26 17:10:40 +00:00
if ( chunk_string = = NULL ) {
/* Can't get the chunk size line */
2004-05-08 12:54:24 +00:00
break ;
2004-04-26 17:10:40 +00:00
}
2004-05-09 09:07:33 +00:00
2005-07-24 01:42:41 +00:00
c = ( gchar * ) chunk_string ;
2004-04-26 17:10:40 +00:00
/*
* We don ' t care about the extensions .
*/
if ( ( c = strchr ( c , ' ; ' ) ) ) {
* c = ' \0 ' ;
}
2013-12-19 19:29:44 +00:00
chunk_size = ( guint32 ) strtol ( ( gchar * ) chunk_string , NULL , 16 ) ;
2006-08-24 22:05:26 +00:00
2004-04-26 17:10:40 +00:00
if ( chunk_size > datalen ) {
/*
* The chunk size is more than what ' s in the tvbuff ,
* so either the user hasn ' t enabled decoding , or all
* of the segments weren ' t captured .
*/
chunk_size = datalen ;
2006-06-23 23:51:55 +00:00
}
#if 0
else if ( new_tvb = = NULL ) {
2004-04-26 17:10:40 +00:00
new_tvb = tvb_new_composite ( ) ;
}
if ( new_tvb ! = NULL & & chunk_size ! = 0 ) {
tvbuff_t * chunk_tvb = NULL ;
2004-05-09 09:07:33 +00:00
2004-04-26 17:10:40 +00:00
chunk_tvb = tvb_new_subset ( tvb , chunk_offset ,
chunk_size , datalen ) ;
tvb_composite_append ( new_tvb , chunk_tvb ) ;
}
2006-06-23 23:51:55 +00:00
# endif
2004-05-09 09:07:33 +00:00
2004-04-26 17:10:40 +00:00
chunked_data_size + = chunk_size ;
2009-09-14 17:36:15 +00:00
raw_data = g_malloc ( chunked_data_size ) ;
2006-06-24 00:01:33 +00:00
raw_len = 0 ;
2004-04-26 17:10:40 +00:00
2006-06-24 00:01:33 +00:00
if ( new_tvb ! = NULL ) {
2014-07-03 08:53:40 +00:00
raw_len = tvb_captured_length_remaining ( new_tvb , 0 ) ;
2009-09-14 17:36:15 +00:00
tvb_memcpy ( new_tvb , raw_data , 0 , raw_len ) ;
tvb_free ( new_tvb ) ;
2006-06-24 00:01:33 +00:00
}
2004-04-26 17:10:40 +00:00
2006-06-24 00:01:33 +00:00
tvb_memcpy ( tvb , ( guint8 * ) ( raw_data + raw_len ) ,
2004-04-26 17:10:40 +00:00
chunk_offset , chunk_size ) ;
2007-03-16 00:47:26 +00:00
/* Don't create a new tvb if we have a single chunk with
* a size of zero ( meaning it is the end of the chunks ) . */
2009-09-14 17:36:15 +00:00
if ( chunked_data_size > 0 ) {
new_tvb = tvb_new_real_data ( raw_data ,
chunked_data_size , chunked_data_size ) ;
2007-03-16 00:47:26 +00:00
tvb_set_free_cb ( new_tvb , g_free ) ;
}
2004-04-26 17:10:40 +00:00
2004-05-09 09:07:33 +00:00
2004-04-26 17:10:40 +00:00
if ( subtree ) {
2006-11-24 02:59:43 +00:00
if ( chunk_size = = 0 ) {
2014-06-27 02:51:11 +00:00
chunk_subtree = proto_tree_add_subtree ( subtree , tvb ,
offset , chunk_offset - offset + chunk_size + 2 ,
ett_http_chunk_data , NULL , " End of chunked encoding " ) ;
2006-11-24 02:59:43 +00:00
} else {
2014-06-27 02:51:11 +00:00
chunk_subtree = proto_tree_add_subtree_format ( subtree , tvb ,
2010-09-21 02:12:21 +00:00
offset ,
chunk_offset - offset + chunk_size + 2 ,
2014-06-27 02:51:11 +00:00
ett_http_chunk_data , NULL , " Data chunk (%u octets) " , chunk_size ) ;
2006-11-24 02:59:43 +00:00
}
2004-04-26 17:10:40 +00:00
proto_tree_add_text ( chunk_subtree , tvb , offset ,
chunk_offset - offset , " Chunk size: %u octets " ,
chunk_size ) ;
2014-06-06 14:35:50 +00:00
data_tvb = tvb_new_subset_length ( tvb , chunk_offset , chunk_size ) ;
2004-04-26 17:10:40 +00:00
2004-05-09 09:07:33 +00:00
2006-06-24 00:01:33 +00:00
/*
* XXX - just use " proto_tree_add_text() " ?
* This means that , in TShark , you get
* the entire chunk dumped out in hex ,
* in addition to whatever dissection is
* done on the reassembled data .
*/
call_dissector ( data_handle , data_tvb , pinfo ,
2004-04-26 17:10:40 +00:00
chunk_subtree ) ;
proto_tree_add_text ( chunk_subtree , tvb , chunk_offset +
chunk_size , 2 , " Chunk boundary " ) ;
}
chunks_decoded + + ;
offset = chunk_offset + chunk_size + 2 ;
datalen = tvb_reported_length_remaining ( tvb , offset ) ;
}
if ( new_tvb ! = NULL ) {
/* Placeholder for the day that composite tvbuffer's will work.
tvb_composite_finalize ( new_tvb ) ;
/ * tvb_set_reported_length ( new_tvb , chunked_data_size ) ; * /
*/
2004-05-08 12:54:24 +00:00
/*
* XXX - Don ' t free this , since the tvbuffer that was passed
* may be used if the data spans multiple frames and reassembly
* isn ' t enabled .
*
2004-04-26 17:10:40 +00:00
tvb_free ( * tvb_ptr ) ;
2004-05-08 12:54:24 +00:00
*/
2004-04-26 17:10:40 +00:00
* tvb_ptr = new_tvb ;
2004-05-09 09:07:33 +00:00
2004-04-26 17:10:40 +00:00
} else {
/*
* We didn ' t create a new tvb , so don ' t allow sub dissectors
2008-12-20 00:09:02 +00:00
* try to decode the non - existent entity body .
2004-04-26 17:10:40 +00:00
*/
chunks_decoded = - 1 ;
}
2004-05-09 09:07:33 +00:00
2004-04-26 17:10:40 +00:00
return chunks_decoded ;
}
2011-12-18 18:31:30 +00:00
# else
/*
* Dissect the http data chunks and add them to the tree .
*/
2014-11-28 14:52:07 +00:00
static guint
2011-12-18 18:31:30 +00:00
chunked_encoding_dissector ( tvbuff_t * * tvb_ptr , packet_info * pinfo ,
proto_tree * tree , int offset )
{
tvbuff_t * tvb ;
guint32 datalen ;
guint32 orig_datalen ;
gint chunked_data_size ;
proto_tree * subtree ;
2014-11-28 14:52:07 +00:00
proto_item * pi_chunked = NULL ;
2011-12-18 18:31:30 +00:00
guint8 * raw_data ;
gint raw_len ;
if ( ( tvb_ptr = = NULL ) | | ( * tvb_ptr = = NULL ) ) {
return 0 ;
}
tvb = * tvb_ptr ;
datalen = tvb_reported_length_remaining ( tvb , offset ) ;
2014-06-27 02:51:11 +00:00
subtree = proto_tree_add_subtree ( tree , tvb , offset , datalen ,
2014-11-28 14:52:07 +00:00
ett_http_chunked_response , & pi_chunked ,
" HTTP chunked response " ) ;
2011-12-18 18:31:30 +00:00
2013-12-12 20:09:33 +00:00
/* Dechunk the "chunked response" to a new memory buffer */
2011-12-18 18:31:30 +00:00
orig_datalen = datalen ;
2013-08-19 14:55:41 +00:00
raw_data = ( guint8 * ) wmem_alloc ( pinfo - > pool , datalen ) ;
2013-03-12 06:41:00 +00:00
raw_len = 0 ;
2011-12-18 18:31:30 +00:00
chunked_data_size = 0 ;
2013-09-11 21:44:13 +00:00
while ( datalen > 0 ) {
2011-12-18 18:31:30 +00:00
tvbuff_t * data_tvb ;
guint32 chunk_size ;
gint chunk_offset ;
guint8 * chunk_string ;
gint linelen ;
gchar * c ;
linelen = tvb_find_line_end ( tvb , offset , - 1 , & chunk_offset , TRUE ) ;
if ( linelen < = 0 ) {
/* Can't get the chunk size line */
break ;
}
2014-06-17 15:30:58 +00:00
chunk_string = tvb_get_string_enc ( wmem_packet_scope ( ) , tvb , offset , linelen , ENC_ASCII ) ;
2011-12-18 18:31:30 +00:00
if ( chunk_string = = NULL ) {
/* Can't get the chunk size line */
break ;
}
c = ( gchar * ) chunk_string ;
/*
* We don ' t care about the extensions .
*/
if ( ( c = strchr ( c , ' ; ' ) ) ) {
* c = ' \0 ' ;
}
2012-12-26 05:57:06 +00:00
chunk_size = ( guint32 ) strtol ( ( gchar * ) chunk_string , NULL , 16 ) ;
2011-12-18 18:31:30 +00:00
if ( chunk_size > datalen ) {
/*
* The chunk size is more than what ' s in the tvbuff ,
* so either the user hasn ' t enabled decoding , or all
* of the segments weren ' t captured .
*/
chunk_size = datalen ;
}
chunked_data_size + = chunk_size ;
DISSECTOR_ASSERT ( ( raw_len + chunk_size ) < = orig_datalen ) ;
tvb_memcpy ( tvb , ( guint8 * ) ( raw_data + raw_len ) , chunk_offset , chunk_size ) ;
raw_len + = chunk_size ;
if ( subtree ) {
proto_tree * chunk_subtree ;
if ( chunk_size = = 0 ) {
2014-06-27 02:51:11 +00:00
chunk_subtree = proto_tree_add_subtree ( subtree , tvb ,
2011-12-18 18:31:30 +00:00
offset ,
chunk_offset - offset + chunk_size + 2 ,
2014-06-27 02:51:11 +00:00
ett_http_chunk_data , NULL ,
2011-12-18 18:31:30 +00:00
" End of chunked encoding " ) ;
} else {
2014-06-27 02:51:11 +00:00
chunk_subtree = proto_tree_add_subtree_format ( subtree , tvb ,
2011-12-18 18:31:30 +00:00
offset ,
chunk_offset - offset + chunk_size + 2 ,
2014-06-27 02:51:11 +00:00
ett_http_chunk_data , NULL ,
2011-12-18 18:31:30 +00:00
" Data chunk (%u octets) " , chunk_size ) ;
}
proto_tree_add_text ( chunk_subtree , tvb , offset ,
chunk_offset - offset , " Chunk size: %u octets " ,
chunk_size ) ;
2014-11-28 14:52:07 +00:00
/* last-chunk does not have chunk-data CRLF. */
if ( chunk_size > 0 ) {
data_tvb = tvb_new_subset ( tvb , chunk_offset , chunk_size , datalen ) ;
2011-12-18 18:31:30 +00:00
2014-11-28 14:52:07 +00:00
/*
* XXX - just use " proto_tree_add_text() " ?
* This means that , in TShark , you get
* the entire chunk dumped out in hex ,
* in addition to whatever dissection is
* done on the reassembled data .
*/
call_dissector ( data_handle , data_tvb , pinfo ,
chunk_subtree ) ;
2011-12-18 18:31:30 +00:00
2014-11-28 14:52:07 +00:00
proto_tree_add_text ( chunk_subtree , tvb , chunk_offset +
chunk_size , 2 , " Chunk boundary " ) ;
}
2011-12-18 18:31:30 +00:00
}
2014-11-28 14:52:07 +00:00
offset = chunk_offset + chunk_size ; /* beginning of next chunk */
if ( chunk_size > 0 ) offset + = 2 ; /* CRLF of chunk */
2011-12-18 18:31:30 +00:00
datalen = tvb_reported_length_remaining ( tvb , offset ) ;
2014-11-28 14:52:07 +00:00
/* This is the last chunk */
if ( chunk_size = = 0 ) {
/* Check for: trailer-part CRLF.
* trailer - part = * ( header - field CRLF ) */
gint trailer_offset = offset , trailer_len ;
gint header_field_len ;
/* Skip all header-fields. */
do {
trailer_len = trailer_offset - offset ;
header_field_len = tvb_find_line_end ( tvb ,
trailer_offset ,
datalen - trailer_len ,
& trailer_offset , TRUE ) ;
} while ( header_field_len > 0 ) ;
if ( trailer_len > 0 ) {
proto_tree_add_item ( subtree ,
hf_http_chunked_trailer_part ,
tvb , offset , trailer_len , ENC_ASCII | ENC_NA ) ;
offset + = trailer_len ;
datalen - = trailer_len ;
}
/* last CRLF of chunked-body is found. */
if ( header_field_len = = 0 ) {
proto_tree_add_format_text ( subtree , tvb , offset ,
trailer_offset - offset ) ;
datalen - = trailer_offset - offset ;
}
break ;
}
2011-12-18 18:31:30 +00:00
}
2014-11-28 14:52:07 +00:00
/* datalen is the remaining bytes that are available for consumption. If
* smaller than orig_datalen , then bytes were consumed . */
if ( datalen < orig_datalen ) {
2011-12-18 18:31:30 +00:00
tvbuff_t * new_tvb ;
2014-11-28 14:52:07 +00:00
proto_item_set_len ( pi_chunked , orig_datalen - datalen ) ;
2011-12-18 18:31:30 +00:00
new_tvb = tvb_new_child_real_data ( tvb , raw_data , chunked_data_size , chunked_data_size ) ;
* tvb_ptr = new_tvb ;
}
2014-11-28 14:52:07 +00:00
/* Size of chunked-body or 0 if none was found. */
return orig_datalen - datalen ;
2011-12-18 18:31:30 +00:00
}
# endif
2004-04-26 17:10:40 +00:00
2007-12-26 18:28:31 +00:00
/* Call a subdissector to handle HTTP CONNECT's traffic */
2006-08-14 21:46:05 +00:00
static void
2007-12-26 18:28:31 +00:00
http_payload_subdissector ( tvbuff_t * tvb , proto_tree * tree ,
2013-11-02 00:36:30 +00:00
packet_info * pinfo , http_conv_t * conv_data , void * data )
2006-08-14 21:46:05 +00:00
{
2007-12-26 18:28:31 +00:00
guint32 * ptr = NULL ;
2013-12-12 20:09:33 +00:00
guint32 uri_port , saved_port , srcport , destport ;
2006-09-30 18:30:43 +00:00
gchar * * strings ; /* An array for splitting the request URI into hostname and port */
2007-04-28 23:52:12 +00:00
proto_item * item ;
2007-12-26 18:28:31 +00:00
proto_tree * proxy_tree ;
2013-05-29 22:43:20 +00:00
conversation_t * conv ;
2014-04-27 08:39:23 +00:00
gboolean from_server = pinfo - > srcport = = conv_data - > server_port & &
addresses_equal ( & conv_data - > server_addr , & pinfo - > src ) ;
2006-08-14 21:46:05 +00:00
2007-12-26 18:28:31 +00:00
/* Grab the destination port number from the request URI to find the right subdissector */
strings = g_strsplit ( conv_data - > request_uri , " : " , 2 ) ;
2006-08-24 22:05:26 +00:00
2007-12-26 18:28:31 +00:00
if ( strings [ 0 ] ! = NULL & & strings [ 1 ] ! = NULL ) {
/*
2012-02-01 02:05:19 +00:00
* The string was successfully split in two
2007-12-26 18:28:31 +00:00
* Create a proxy - connect subtree
*/
if ( tree ) {
2011-10-21 02:10:19 +00:00
item = proto_tree_add_item ( tree , proto_http , tvb , 0 , - 1 , ENC_NA ) ;
2007-12-26 18:28:31 +00:00
proxy_tree = proto_item_add_subtree ( item , ett_http ) ;
2008-03-04 21:05:21 +00:00
2007-12-26 18:28:31 +00:00
item = proto_tree_add_string ( proxy_tree , hf_http_proxy_connect_host ,
2010-05-12 13:24:42 +00:00
tvb , 0 , 0 , strings [ 0 ] ) ;
2007-04-28 23:52:12 +00:00
PROTO_ITEM_SET_GENERATED ( item ) ;
2008-03-04 21:05:21 +00:00
2007-12-26 18:28:31 +00:00
item = proto_tree_add_uint ( proxy_tree , hf_http_proxy_connect_port ,
2012-12-26 05:57:06 +00:00
tvb , 0 , 0 , ( guint32 ) strtol ( strings [ 1 ] , NULL , 10 ) ) ;
2007-04-28 23:52:12 +00:00
PROTO_ITEM_SET_GENERATED ( item ) ;
2006-08-14 21:46:05 +00:00
}
2006-08-24 22:05:26 +00:00
2013-05-29 22:43:20 +00:00
uri_port = ( int ) strtol ( strings [ 1 ] , NULL , 10 ) ; /* Convert string to a base-10 integer */
2006-08-24 22:05:26 +00:00
2014-04-27 08:39:23 +00:00
if ( ! from_server ) {
2013-05-29 22:43:20 +00:00
srcport = pinfo - > srcport ;
destport = uri_port ;
} else {
srcport = uri_port ;
destport = pinfo - > destport ;
}
conv = find_conversation ( PINFO_FD_NUM ( pinfo ) , & pinfo - > src , & pinfo - > dst , PT_TCP , srcport , destport , 0 ) ;
/* We may get stuck in a recursion loop if we let process_tcp_payload() call us.
* So , if the port in the URI is one we ' re registered for or we have set up a
* conversation ( e . g . , one we detected heuristically or via Decode - As ) call the data
* dissector directly .
*/
if ( value_is_in_range ( http_tcp_range , uri_port ) | | ( conv & & conv - > dissector_handle = = http_handle ) ) {
2007-12-26 18:28:31 +00:00
call_dissector ( data_handle , tvb , pinfo , tree ) ;
} else {
/* set pinfo->{src/dst port} and call the TCP sub-dissector lookup */
2014-04-27 08:39:23 +00:00
if ( ! from_server )
2007-12-26 18:28:31 +00:00
ptr = & pinfo - > destport ;
else
ptr = & pinfo - > srcport ;
2010-09-21 02:12:21 +00:00
/* Increase pinfo->can_desegment because we are traversing
* http and want to preserve desegmentation functionality for
2013-12-12 20:09:33 +00:00
* the proxied protocol
2010-09-21 02:12:21 +00:00
*/
2007-12-26 18:28:31 +00:00
if ( pinfo - > can_desegment > 0 )
pinfo - > can_desegment + + ;
saved_port = * ptr ;
2013-05-29 22:43:20 +00:00
* ptr = uri_port ;
2007-12-26 18:28:31 +00:00
decode_tcp_ports ( tvb , 0 , pinfo , tree ,
2013-11-02 00:50:24 +00:00
pinfo - > srcport , pinfo - > destport , NULL ,
( struct tcpinfo * ) data ) ;
2007-12-26 18:28:31 +00:00
* ptr = saved_port ;
}
2006-08-14 21:46:05 +00:00
}
2007-12-26 18:28:31 +00:00
g_strfreev ( strings ) ; /* Free the result of g_strsplit() above */
2006-08-14 21:46:05 +00:00
}
2006-08-24 22:05:26 +00:00
2006-08-14 21:46:05 +00:00
2004-04-26 17:10:40 +00:00
1999-02-12 09:03:42 +00:00
/*
* XXX - this won ' t handle HTTP 0.9 replies , but they ' re all data
* anyway .
*/
static int
2004-01-16 01:32:20 +00:00
is_http_request_or_reply ( const gchar * data , int linelen , http_type_t * type ,
2007-03-13 20:42:04 +00:00
ReqRespDissector * reqresp_dissector ,
http_conv_t * conv_data )
1999-02-12 09:03:42 +00:00
{
2002-04-01 21:12:31 +00:00
int isHttpRequestOrReply = FALSE ;
2001-01-03 03:40:29 +00:00
/*
* From RFC 2774 - An HTTP Extension Framework
*
* Support the command prefix that identifies the presence of
* a " mandatory " header .
*/
2002-04-01 21:12:31 +00:00
if ( linelen > = 2 & & strncmp ( data , " M- " , 2 ) = = 0 ) {
2001-01-03 03:40:29 +00:00
data + = 2 ;
linelen - = 2 ;
}
/*
* From draft - cohen - gena - client - 01. txt , available from the uPnP forum :
* NOTIFY , SUBSCRIBE , UNSUBSCRIBE
*
* From draft - ietf - dasl - protocol - 00. txt , a now vanished Microsoft draft :
* SEARCH
*/
2002-04-01 21:12:31 +00:00
if ( linelen > = 5 & & strncmp ( data , " HTTP/ " , 5 ) = = 0 ) {
* type = HTTP_RESPONSE ;
isHttpRequestOrReply = TRUE ; /* response */
2005-03-13 00:49:33 +00:00
if ( reqresp_dissector )
* reqresp_dissector = basic_response_dissector ;
2002-04-01 21:12:31 +00:00
} else {
2002-12-02 23:43:30 +00:00
const guchar * ptr = ( const guchar * ) data ;
2008-06-28 21:09:57 +00:00
int indx = 0 ;
2002-04-01 21:12:31 +00:00
/* Look for the space following the Method */
2008-06-28 21:09:57 +00:00
while ( indx < linelen ) {
2002-04-01 21:12:31 +00:00
if ( * ptr = = ' ' )
break ;
else {
ptr + + ;
2008-06-28 21:09:57 +00:00
indx + + ;
2002-04-01 21:12:31 +00:00
}
1999-10-16 20:30:14 +00:00
}
2002-04-01 21:12:31 +00:00
/* Check the methods that have same length */
2008-06-28 21:09:57 +00:00
switch ( indx ) {
2002-04-01 21:12:31 +00:00
case 3 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " GET " , indx ) = = 0 | |
strncmp ( data , " PUT " , indx ) = = 0 ) {
2000-02-23 20:55:33 +00:00
* type = HTTP_REQUEST ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
}
2008-06-28 21:09:57 +00:00
else if ( strncmp ( data , " ICY " , indx ) = = 0 ) {
2004-01-19 23:57:11 +00:00
* type = HTTP_RESPONSE ;
isHttpRequestOrReply = TRUE ;
}
2002-04-01 21:12:31 +00:00
break ;
case 4 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " COPY " , indx ) = = 0 | |
strncmp ( data , " HEAD " , indx ) = = 0 | |
strncmp ( data , " LOCK " , indx ) = = 0 | |
strncmp ( data , " MOVE " , indx ) = = 0 | |
strncmp ( data , " POLL " , indx ) = = 0 | |
strncmp ( data , " POST " , indx ) = = 0 ) {
2000-02-23 20:55:33 +00:00
* type = HTTP_REQUEST ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
}
break ;
case 5 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " BCOPY " , indx ) = = 0 | |
strncmp ( data , " BMOVE " , indx ) = = 0 | |
strncmp ( data , " MKCOL " , indx ) = = 0 | |
strncmp ( data , " TRACE " , indx ) = = 0 | |
strncmp ( data , " LABEL " , indx ) = = 0 | | /* RFC 3253 8.2 */
strncmp ( data , " MERGE " , indx ) = = 0 ) { /* RFC 3253 11.2 */
2000-02-23 20:55:33 +00:00
* type = HTTP_REQUEST ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
}
break ;
case 6 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " DELETE " , indx ) = = 0 | |
strncmp ( data , " SEARCH " , indx ) = = 0 | |
strncmp ( data , " UNLOCK " , indx ) = = 0 | |
strncmp ( data , " REPORT " , indx ) = = 0 | | /* RFC 3253 3.6 */
strncmp ( data , " UPDATE " , indx ) = = 0 ) { /* RFC 3253 7.1 */
2002-04-01 21:12:31 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
}
2008-06-28 21:09:57 +00:00
else if ( strncmp ( data , " NOTIFY " , indx ) = = 0 ) {
2001-01-03 03:40:29 +00:00
* type = HTTP_NOTIFICATION ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
}
break ;
case 7 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " BDELETE " , indx ) = = 0 | |
strncmp ( data , " CONNECT " , indx ) = = 0 | |
strncmp ( data , " OPTIONS " , indx ) = = 0 | |
strncmp ( data , " CHECKIN " , indx ) = = 0 ) { /* RFC 3253 4.4, 9.4 */
2000-02-23 20:55:33 +00:00
* type = HTTP_REQUEST ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
}
break ;
case 8 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " PROPFIND " , indx ) = = 0 | |
strncmp ( data , " CHECKOUT " , indx ) = = 0 | | /* RFC 3253 4.3, 9.3 */
strncmp ( data , " CCM_POST " , indx ) = = 0 ) {
2002-04-01 21:12:31 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
}
break ;
case 9 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " SUBSCRIBE " , indx ) = = 0 ) {
2001-01-03 03:40:29 +00:00
* type = HTTP_NOTIFICATION ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
2008-06-28 21:09:57 +00:00
} else if ( strncmp ( data , " PROPPATCH " , indx ) = = 0 | |
strncmp ( data , " BPROPFIND " , indx ) = = 0 ) {
2002-04-01 21:12:31 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
}
break ;
case 10 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " BPROPPATCH " , indx ) = = 0 | |
strncmp ( data , " UNCHECKOUT " , indx ) = = 0 | | /* RFC 3253 4.5 */
strncmp ( data , " MKACTIVITY " , indx ) = = 0 ) { /* RFC 3253 13.5 */
2002-04-01 21:12:31 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
}
break ;
case 11 :
2010-12-23 23:50:14 +00:00
if ( strncmp ( data , " MKWORKSPACE " , indx ) = = 0 | | /* RFC 3253 6.3 */
strncmp ( data , " RPC_CONNECT " , indx ) = = 0 | | /* [MS-RPCH] 2.1.1.1.1 */
strncmp ( data , " RPC_IN_DATA " , indx ) = = 0 ) { /* [MS-RPCH] 2.1.2.1.1 */
2004-07-21 06:05:24 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
2008-06-28 21:09:57 +00:00
} else if ( strncmp ( data , " UNSUBSCRIBE " , indx ) = = 0 ) {
2001-01-03 03:40:29 +00:00
* type = HTTP_NOTIFICATION ;
2002-04-01 21:12:31 +00:00
isHttpRequestOrReply = TRUE ;
2010-12-23 23:50:14 +00:00
}
break ;
case 12 :
if ( strncmp ( data , " RPC_OUT_DATA " , indx ) = = 0 ) { /* [MS-RPCH] 2.1.2.1.2 */
2004-12-15 09:10:07 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
2002-04-01 21:12:31 +00:00
}
break ;
2004-07-21 06:05:24 +00:00
case 15 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " VERSION-CONTROL " , indx ) = = 0 ) { /* RFC 3253 3.5 */
2004-07-21 06:05:24 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
}
break ;
case 16 :
2008-06-28 21:09:57 +00:00
if ( strncmp ( data , " BASELINE-CONTROL " , indx ) = = 0 ) { /* RFC 3253 12.6 */
2004-07-21 06:05:24 +00:00
* type = HTTP_REQUEST ;
isHttpRequestOrReply = TRUE ;
}
break ;
2002-04-01 21:12:31 +00:00
default :
break ;
2001-01-03 03:40:29 +00:00
}
2003-06-10 22:07:18 +00:00
2005-03-13 00:49:33 +00:00
if ( isHttpRequestOrReply & & reqresp_dissector ) {
* reqresp_dissector = basic_request_dissector ;
2007-03-24 10:07:20 +00:00
2014-05-26 20:33:42 +00:00
stat_info - > request_method = wmem_strndup ( wmem_packet_scope ( ) , data , indx ) ;
conv_data - > request_method = wmem_strndup ( wmem_file_scope ( ) , data , indx ) ;
2007-03-24 10:07:20 +00:00
}
2007-03-13 20:42:04 +00:00
2001-01-03 03:40:29 +00:00
}
2002-04-01 21:12:31 +00:00
return isHttpRequestOrReply ;
1999-02-12 09:03:42 +00:00
}
1999-07-29 05:47:07 +00:00
2003-11-06 08:54:31 +00:00
/*
2003-12-23 02:29:11 +00:00
* Process headers .
2003-11-06 08:54:31 +00:00
*/
typedef struct {
2005-07-30 16:34:38 +00:00
const char * name ;
gint * hf ;
int special ;
2003-12-23 02:29:11 +00:00
} header_info ;
# define HDR_NO_SPECIAL 0
# define HDR_AUTHORIZATION 1
# define HDR_AUTHENTICATE 2
# define HDR_CONTENT_TYPE 3
# define HDR_CONTENT_LENGTH 4
2004-02-21 01:31:56 +00:00
# define HDR_CONTENT_ENCODING 5
# define HDR_TRANSFER_ENCODING 6
2012-04-20 15:31:15 +00:00
# define HDR_HOST 7
# define HDR_UPGRADE 8
2014-04-17 16:33:02 +00:00
# define HDR_COOKIE 9
2003-12-23 02:29:11 +00:00
static const header_info headers [ ] = {
{ " Authorization " , & hf_http_authorization , HDR_AUTHORIZATION } ,
{ " Proxy-Authorization " , & hf_http_proxy_authorization , HDR_AUTHORIZATION } ,
{ " Proxy-Authenticate " , & hf_http_proxy_authenticate , HDR_AUTHENTICATE } ,
{ " WWW-Authenticate " , & hf_http_www_authenticate , HDR_AUTHENTICATE } ,
{ " Content-Type " , & hf_http_content_type , HDR_CONTENT_TYPE } ,
2008-10-23 06:57:31 +00:00
{ " Content-Length " , & hf_http_content_length_header , HDR_CONTENT_LENGTH } ,
2004-02-21 01:31:56 +00:00
{ " Content-Encoding " , & hf_http_content_encoding , HDR_CONTENT_ENCODING } ,
{ " Transfer-Encoding " , & hf_http_transfer_encoding , HDR_TRANSFER_ENCODING } ,
2012-04-20 15:31:15 +00:00
{ " Upgrade " , & hf_http_upgrade , HDR_UPGRADE } ,
2004-12-07 17:59:58 +00:00
{ " User-Agent " , & hf_http_user_agent , HDR_NO_SPECIAL } ,
2005-02-28 22:27:24 +00:00
{ " Host " , & hf_http_host , HDR_HOST } ,
2004-12-07 17:59:58 +00:00
{ " Connection " , & hf_http_connection , HDR_NO_SPECIAL } ,
2014-04-17 16:33:02 +00:00
{ " Cookie " , & hf_http_cookie , HDR_COOKIE } ,
2004-12-07 17:59:58 +00:00
{ " Accept " , & hf_http_accept , HDR_NO_SPECIAL } ,
{ " Referer " , & hf_http_referer , HDR_NO_SPECIAL } ,
{ " Accept-Language " , & hf_http_accept_language , HDR_NO_SPECIAL } ,
{ " Accept-Encoding " , & hf_http_accept_encoding , HDR_NO_SPECIAL } ,
{ " Date " , & hf_http_date , HDR_NO_SPECIAL } ,
{ " Cache-Control " , & hf_http_cache_control , HDR_NO_SPECIAL } ,
{ " Server " , & hf_http_server , HDR_NO_SPECIAL } ,
{ " Location " , & hf_http_location , HDR_NO_SPECIAL } ,
2012-04-20 15:32:45 +00:00
{ " Sec-WebSocket-Accept " , & hf_http_sec_websocket_accept , HDR_NO_SPECIAL } ,
{ " Sec-WebSocket-Extensions " , & hf_http_sec_websocket_extensions , HDR_NO_SPECIAL } ,
{ " Sec-WebSocket-Key " , & hf_http_sec_websocket_key , HDR_NO_SPECIAL } ,
{ " Sec-WebSocket-Protocol " , & hf_http_sec_websocket_protocol , HDR_NO_SPECIAL } ,
{ " Sec-WebSocket-Version " , & hf_http_sec_websocket_version , HDR_NO_SPECIAL } ,
2004-12-07 17:59:58 +00:00
{ " Set-Cookie " , & hf_http_set_cookie , HDR_NO_SPECIAL } ,
{ " Last-Modified " , & hf_http_last_modified , HDR_NO_SPECIAL } ,
2006-02-20 06:25:02 +00:00
{ " X-Forwarded-For " , & hf_http_x_forwarded_for , HDR_NO_SPECIAL } ,
2003-11-06 08:54:31 +00:00
} ;
2009-05-19 00:17:23 +00:00
/*
*
*/
static gint *
get_hf_for_header ( char * header_name )
{
gint * hf_id = NULL ;
if ( header_fields_hash ) {
hf_id = ( gint * ) g_hash_table_lookup ( header_fields_hash , header_name ) ;
} else {
hf_id = NULL ;
}
return hf_id ;
}
/*
*
*/
static void
2011-10-04 18:40:56 +00:00
header_fields_initialize_cb ( void )
2009-05-19 00:17:23 +00:00
{
2011-10-04 21:06:20 +00:00
static hf_register_info * hf ;
gint * hf_id ;
2011-10-04 18:40:56 +00:00
guint i ;
2009-05-19 00:17:23 +00:00
gchar * header_name ;
2012-03-12 17:18:54 +00:00
if ( header_fields_hash & & hf ) {
2011-10-04 21:06:20 +00:00
guint hf_size = g_hash_table_size ( header_fields_hash ) ;
2011-10-04 18:40:56 +00:00
/* Unregister all fields */
2011-10-04 21:06:20 +00:00
for ( i = 0 ; i < hf_size ; i + + ) {
2011-10-05 11:44:29 +00:00
proto_unregister_field ( proto_http , * ( hf [ i ] . p_id ) ) ;
g_free ( hf [ i ] . p_id ) ;
2011-10-04 18:40:56 +00:00
}
g_hash_table_destroy ( header_fields_hash ) ;
2014-11-06 10:19:25 +00:00
proto_add_deregistered_data ( hf ) ;
2011-10-04 18:40:56 +00:00
header_fields_hash = NULL ;
2009-05-19 00:17:23 +00:00
}
if ( num_header_fields ) {
2011-10-04 18:40:56 +00:00
header_fields_hash = g_hash_table_new ( g_str_hash , g_str_equal ) ;
2013-03-12 06:41:00 +00:00
hf = g_new0 ( hf_register_info , num_header_fields ) ;
2009-05-19 00:17:23 +00:00
for ( i = 0 ; i < num_header_fields ; i + + ) {
2013-03-12 06:41:00 +00:00
hf_id = g_new ( gint , 1 ) ;
2011-10-04 18:40:56 +00:00
* hf_id = - 1 ;
header_name = g_strdup ( header_fields [ i ] . header_name ) ;
hf [ i ] . p_id = hf_id ;
hf [ i ] . hfinfo . name = header_name ;
hf [ i ] . hfinfo . abbrev = g_strdup_printf ( " http.header.%s " , header_name ) ;
hf [ i ] . hfinfo . type = FT_STRING ;
hf [ i ] . hfinfo . display = BASE_NONE ;
hf [ i ] . hfinfo . strings = NULL ;
hf [ i ] . hfinfo . blurb = g_strdup ( header_fields [ i ] . header_desc ) ;
2013-08-06 20:53:47 +00:00
hf [ i ] . hfinfo . same_name_prev_id = - 1 ;
2011-10-04 18:40:56 +00:00
hf [ i ] . hfinfo . same_name_next = NULL ;
g_hash_table_insert ( header_fields_hash , header_name , hf_id ) ;
2009-05-19 00:17:23 +00:00
}
2011-10-04 18:40:56 +00:00
proto_register_field_array ( proto_http , hf , num_header_fields ) ;
2009-05-19 00:17:23 +00:00
}
}
2003-11-06 08:54:31 +00:00
static void
2003-12-23 02:29:11 +00:00
process_header ( tvbuff_t * tvb , int offset , int next_offset ,
2010-09-21 02:12:21 +00:00
const guchar * line , int linelen , int colon_offset ,
packet_info * pinfo , proto_tree * tree , headers_t * eh_ptr ,
2013-10-17 01:23:12 +00:00
http_conv_t * conv_data , int http_type )
2003-11-06 08:54:31 +00:00
{
int len ;
int line_end_offset ;
int header_len ;
gint hf_index ;
guchar c ;
int value_offset ;
int value_len ;
char * value ;
2009-05-19 00:17:23 +00:00
char * header_name ;
2003-12-23 01:42:48 +00:00
char * p ;
guchar * up ;
2013-10-17 01:23:12 +00:00
proto_item * hdr_item , * it ;
2003-11-18 08:04:39 +00:00
int i ;
2009-05-19 00:17:23 +00:00
int * hf_id ;
2003-11-06 08:54:31 +00:00
len = next_offset - offset ;
line_end_offset = offset + linelen ;
header_len = colon_offset - offset ;
2015-01-13 22:18:37 +00:00
header_name = wmem_strndup ( wmem_packet_scope ( ) , & line [ 0 ] , header_len ) ;
2003-11-06 08:54:31 +00:00
hf_index = find_header_hf_value ( tvb , offset , header_len ) ;
2009-05-19 00:17:23 +00:00
/*
* Skip whitespace after the colon .
*/
value_offset = colon_offset + 1 ;
while ( value_offset < line_end_offset
& & ( ( c = line [ value_offset - offset ] ) = = ' ' | | c = = ' \t ' ) )
value_offset + + ;
/*
* Fetch the value .
Try to handle lines with NULs in them. They aren't valid lines, but at
least one fuzzed capture contains them, and using ep_strndup() to copy
the line means that the actual amount of memory allocated for the copy
will be less than the length of the line, and code that parses the line
assuming that there are value_len+1 bytes in the buffer (including the
terminating NUL), such as the current parsing code, will break.
We should really have code in Wireshark to handle counted strings, and
have those be what we extract from packets. (And we should handle
non-UTF-8/non-UTF-16 encodings, and octet sequences that aren't valid
strings for their encoding, and handle display of invalid strings and
non-printable characters, and....).
Use g_ascii_ versions of various isXXX() and to{upper,lower}(), so we
don't get surprised by the behavior of the user's locale.
svn path=/trunk/; revision=48490
2013-03-22 23:18:30 +00:00
*
* XXX - the line may well have a NUL in it . Wireshark should
* really treat strings extracted from packets as counted
* strings , so that NUL isn ' t any different from any other
* character . For now , we just allocate a buffer that ' s
* value_len + 1 bytes long , copy value_len bytes , and stick
* in a NUL terminator , so that the buffer for value actually
* has value_len bytes in it .
2009-05-19 00:17:23 +00:00
*/
value_len = line_end_offset - value_offset ;
2015-01-18 14:35:29 +00:00
value = ( char * ) wmem_alloc ( wmem_packet_scope ( ) , value_len + 1 ) ;
memcpy ( value , & line [ value_offset - offset ] , value_len ) ;
value [ value_len ] = ' \0 ' ;
2009-05-19 00:17:23 +00:00
2003-11-06 08:54:31 +00:00
if ( hf_index = = - 1 ) {
/*
2009-05-19 00:17:23 +00:00
* Not a header we know anything about .
* Check if a HF generated from UAT information exists .
2003-11-06 08:54:31 +00:00
*/
2009-05-19 00:17:23 +00:00
hf_id = get_hf_for_header ( header_name ) ;
2003-11-06 08:54:31 +00:00
if ( tree ) {
2009-05-19 00:17:23 +00:00
if ( ! hf_id ) {
2013-10-17 01:23:12 +00:00
if ( http_type = = HTTP_REQUEST | |
http_type = = HTTP_RESPONSE ) {
2013-10-30 02:09:34 +00:00
it = proto_tree_add_item ( tree ,
2013-10-17 01:23:12 +00:00
http_type = = HTTP_RESPONSE ?
hf_http_response_line :
hf_http_request_line ,
2013-10-30 02:09:34 +00:00
tvb , offset , len ,
ENC_NA | ENC_ASCII ) ;
proto_item_set_text ( it , " %s " ,
format_text ( line , len ) ) ;
2013-10-17 01:23:12 +00:00
} else {
proto_tree_add_text ( tree , tvb , offset ,
len , " %s " , format_text ( line , len ) ) ;
}
2009-05-19 00:17:23 +00:00
} else {
proto_tree_add_string_format ( tree ,
* hf_id , tvb , offset , len ,
2013-10-17 01:23:12 +00:00
value , " %s " , format_text ( line , len ) ) ;
if ( http_type = = HTTP_REQUEST | |
http_type = = HTTP_RESPONSE ) {
2013-10-30 02:09:34 +00:00
it = proto_tree_add_item ( tree ,
2013-10-17 01:23:12 +00:00
http_type = = HTTP_RESPONSE ?
hf_http_response_line :
hf_http_request_line ,
2013-10-30 02:09:34 +00:00
tvb , offset , len ,
ENC_NA | ENC_ASCII ) ;
proto_item_set_text ( it , " %s " ,
format_text ( line , len ) ) ;
2013-10-17 01:23:12 +00:00
PROTO_ITEM_SET_HIDDEN ( it ) ;
}
2009-05-19 00:17:23 +00:00
}
2003-11-06 08:54:31 +00:00
}
} else {
/*
* Add it to the protocol tree as a particular field ,
* but display the line as is .
*/
if ( tree ) {
2006-10-21 22:17:43 +00:00
header_field_info * hfinfo ;
guint32 tmp ;
hfinfo = proto_registrar_get_nth ( * headers [ hf_index ] . hf ) ;
switch ( hfinfo - > type ) {
case FT_UINT8 :
case FT_UINT16 :
case FT_UINT24 :
case FT_UINT32 :
case FT_INT8 :
case FT_INT16 :
case FT_INT24 :
case FT_INT32 :
2012-12-26 05:57:06 +00:00
tmp = ( guint32 ) strtol ( value , NULL , 10 ) ;
2006-10-21 22:17:43 +00:00
hdr_item = proto_tree_add_uint ( tree , * headers [ hf_index ] . hf , tvb , offset , len , tmp ) ;
2013-10-17 01:23:12 +00:00
if ( http_type = = HTTP_REQUEST | |
http_type = = HTTP_RESPONSE ) {
2013-10-30 02:09:34 +00:00
it = proto_tree_add_item ( tree ,
2013-10-17 01:23:12 +00:00
http_type = = HTTP_RESPONSE ?
hf_http_response_line :
hf_http_request_line ,
2013-10-30 02:09:34 +00:00
tvb , offset , len ,
ENC_NA | ENC_ASCII ) ;
proto_item_set_text ( it , " %d " , tmp ) ;
2013-10-17 01:23:12 +00:00
PROTO_ITEM_SET_HIDDEN ( it ) ;
}
2006-10-21 22:17:43 +00:00
break ;
default :
hdr_item = proto_tree_add_string_format ( tree ,
* headers [ hf_index ] . hf , tvb , offset , len ,
value , " %s " , format_text ( line , len ) ) ;
2013-10-17 01:23:12 +00:00
if ( http_type = = HTTP_REQUEST | |
http_type = = HTTP_RESPONSE ) {
2013-10-30 02:09:34 +00:00
it = proto_tree_add_item ( tree ,
2013-10-17 01:23:12 +00:00
http_type = = HTTP_RESPONSE ?
hf_http_response_line :
hf_http_request_line ,
2013-10-30 02:09:34 +00:00
tvb , offset , len ,
ENC_NA | ENC_ASCII ) ;
proto_item_set_text ( it , " %s " ,
format_text ( line , len ) ) ;
2013-10-17 01:23:12 +00:00
PROTO_ITEM_SET_HIDDEN ( it ) ;
}
2006-10-21 22:17:43 +00:00
}
2003-11-06 08:54:31 +00:00
} else
hdr_item = NULL ;
/*
* Do any special processing that particular headers
* require .
*/
switch ( headers [ hf_index ] . special ) {
2003-12-23 02:29:11 +00:00
case HDR_AUTHORIZATION :
2003-11-06 08:54:31 +00:00
if ( check_auth_ntlmssp ( hdr_item , tvb , pinfo , value ) )
break ; /* dissected NTLMSSP */
2010-10-25 02:17:41 +00:00
if ( check_auth_basic ( hdr_item , tvb , value ) )
break ; /* dissected basic auth */
2015-01-12 15:26:39 +00:00
if ( check_auth_citrixbasic ( hdr_item , tvb , value , offset ) )
break ; /* dissected citrix basic auth */
2010-10-25 02:17:41 +00:00
check_auth_kerberos ( hdr_item , tvb , pinfo , value ) ;
2003-11-06 08:54:31 +00:00
break ;
2003-12-23 02:29:11 +00:00
case HDR_AUTHENTICATE :
2010-10-25 02:17:41 +00:00
if ( check_auth_ntlmssp ( hdr_item , tvb , pinfo , value ) )
break ; /* dissected NTLMSSP */
check_auth_kerberos ( hdr_item , tvb , pinfo , value ) ;
2003-11-06 08:54:31 +00:00
break ;
2003-11-18 07:49:52 +00:00
2003-12-23 02:29:11 +00:00
case HDR_CONTENT_TYPE :
2013-09-15 10:29:49 +00:00
eh_ptr - > content_type = ( gchar * ) wmem_memdup ( wmem_packet_scope ( ) , ( guint8 * ) value , value_len + 1 ) ;
2005-07-24 01:42:41 +00:00
2003-11-18 08:04:39 +00:00
for ( i = 0 ; i < value_len ; i + + ) {
c = value [ i ] ;
Try to handle lines with NULs in them. They aren't valid lines, but at
least one fuzzed capture contains them, and using ep_strndup() to copy
the line means that the actual amount of memory allocated for the copy
will be less than the length of the line, and code that parses the line
assuming that there are value_len+1 bytes in the buffer (including the
terminating NUL), such as the current parsing code, will break.
We should really have code in Wireshark to handle counted strings, and
have those be what we extract from packets. (And we should handle
non-UTF-8/non-UTF-16 encodings, and octet sequences that aren't valid
strings for their encoding, and handle display of invalid strings and
non-printable characters, and....).
Use g_ascii_ versions of various isXXX() and to{upper,lower}(), so we
don't get surprised by the behavior of the user's locale.
svn path=/trunk/; revision=48490
2013-03-22 23:18:30 +00:00
if ( c = = ' ; ' | | g_ascii_isspace ( c ) ) {
2003-11-18 08:04:39 +00:00
/*
* End of subtype - either
* white space or a " ; "
* separating the subtype from
* a parameter .
*/
break ;
}
/*
* Map the character to lower case ;
* content types are case - insensitive .
*/
Try to handle lines with NULs in them. They aren't valid lines, but at
least one fuzzed capture contains them, and using ep_strndup() to copy
the line means that the actual amount of memory allocated for the copy
will be less than the length of the line, and code that parses the line
assuming that there are value_len+1 bytes in the buffer (including the
terminating NUL), such as the current parsing code, will break.
We should really have code in Wireshark to handle counted strings, and
have those be what we extract from packets. (And we should handle
non-UTF-8/non-UTF-16 encodings, and octet sequences that aren't valid
strings for their encoding, and handle display of invalid strings and
non-printable characters, and....).
Use g_ascii_ versions of various isXXX() and to{upper,lower}(), so we
don't get surprised by the behavior of the user's locale.
svn path=/trunk/; revision=48490
2013-03-22 23:18:30 +00:00
eh_ptr - > content_type [ i ] = g_ascii_tolower ( eh_ptr - > content_type [ i ] ) ;
2003-11-18 08:04:39 +00:00
}
eh_ptr - > content_type [ i ] = ' \0 ' ;
2004-01-16 01:32:20 +00:00
/*
* Now find the start of the optional parameters ;
* skip the optional white space and the semicolon
* if this has not been done before .
*/
i + + ;
while ( i < value_len ) {
2004-12-01 19:34:51 +00:00
c = eh_ptr - > content_type [ i ] ;
Try to handle lines with NULs in them. They aren't valid lines, but at
least one fuzzed capture contains them, and using ep_strndup() to copy
the line means that the actual amount of memory allocated for the copy
will be less than the length of the line, and code that parses the line
assuming that there are value_len+1 bytes in the buffer (including the
terminating NUL), such as the current parsing code, will break.
We should really have code in Wireshark to handle counted strings, and
have those be what we extract from packets. (And we should handle
non-UTF-8/non-UTF-16 encodings, and octet sequences that aren't valid
strings for their encoding, and handle display of invalid strings and
non-printable characters, and....).
Use g_ascii_ versions of various isXXX() and to{upper,lower}(), so we
don't get surprised by the behavior of the user's locale.
svn path=/trunk/; revision=48490
2013-03-22 23:18:30 +00:00
if ( c = = ' ; ' | | g_ascii_isspace ( c ) )
2004-01-16 01:32:20 +00:00
/* Skip till start of parameters */
i + + ;
else
break ;
}
if ( i < value_len )
2004-12-01 19:34:51 +00:00
eh_ptr - > content_type_parameters = eh_ptr - > content_type + i ;
2004-01-16 01:32:20 +00:00
else
eh_ptr - > content_type_parameters = NULL ;
2003-11-18 07:49:52 +00:00
break ;
2003-12-23 01:42:48 +00:00
2003-12-23 02:29:11 +00:00
case HDR_CONTENT_LENGTH :
2010-05-12 13:24:42 +00:00
errno = 0 ;
2010-04-09 01:42:12 +00:00
eh_ptr - > content_length = g_ascii_strtoll ( value , & p , 10 ) ;
2004-01-16 01:32:20 +00:00
up = ( guchar * ) p ;
2010-05-12 13:24:42 +00:00
if ( eh_ptr - > content_length < 0 | |
p = = value | |
errno = = ERANGE | |
2014-10-20 06:14:50 +00:00
( * up ! = ' \0 ' & & ! g_ascii_isspace ( * up ) ) ) {
2005-01-13 07:47:26 +00:00
/*
* Content length not valid ; pretend
* we don ' t have it .
*/
eh_ptr - > have_content_length = FALSE ;
} else {
2008-10-23 06:57:31 +00:00
proto_tree * header_tree ;
proto_item * tree_item ;
2005-01-13 07:47:26 +00:00
/*
* We do have a valid content length .
*/
eh_ptr - > have_content_length = TRUE ;
2008-10-23 06:57:31 +00:00
header_tree = proto_item_add_subtree ( hdr_item , ett_http_header_item ) ;
2010-04-09 01:42:12 +00:00
tree_item = proto_tree_add_uint64 ( header_tree , hf_http_content_length ,
2008-10-23 06:57:31 +00:00
tvb , offset , len , eh_ptr - > content_length ) ;
PROTO_ITEM_SET_GENERATED ( tree_item ) ;
2013-09-05 16:05:32 +00:00
if ( eh_ptr - > transfer_encoding ! = NULL & &
g_ascii_strncasecmp ( eh_ptr - > transfer_encoding , " chunked " , 7 ) = = 0 ) {
expert_add_info ( pinfo , hdr_item , & ei_http_chunked_and_length ) ;
}
2005-01-13 07:47:26 +00:00
}
2003-12-23 01:42:48 +00:00
break ;
2004-02-21 01:31:56 +00:00
case HDR_CONTENT_ENCODING :
2013-09-15 10:29:49 +00:00
eh_ptr - > content_encoding = wmem_strndup ( wmem_packet_scope ( ) , value , value_len ) ;
2004-02-21 01:31:56 +00:00
break ;
case HDR_TRANSFER_ENCODING :
2013-09-15 10:29:49 +00:00
eh_ptr - > transfer_encoding = wmem_strndup ( wmem_packet_scope ( ) , value , value_len ) ;
2013-09-05 16:05:32 +00:00
if ( eh_ptr - > have_content_length & &
g_ascii_strncasecmp ( eh_ptr - > transfer_encoding , " chunked " , 7 ) = = 0 ) {
expert_add_info ( pinfo , hdr_item , & ei_http_chunked_and_length ) ;
}
2004-02-21 01:31:56 +00:00
break ;
2006-08-24 22:05:26 +00:00
case HDR_HOST :
2013-09-15 10:29:49 +00:00
stat_info - > http_host = wmem_strndup ( wmem_packet_scope ( ) , value , value_len ) ;
conv_data - > http_host = wmem_strndup ( wmem_file_scope ( ) , value , value_len ) ;
2005-02-28 22:27:24 +00:00
break ;
2006-08-24 22:05:26 +00:00
2012-04-20 15:31:15 +00:00
case HDR_UPGRADE :
2013-08-30 11:14:18 +00:00
if ( g_ascii_strncasecmp ( value , " WebSocket " , value_len ) = = 0 ) {
2012-11-02 20:35:24 +00:00
eh_ptr - > upgrade = UPGRADE_WEBSOCKET ;
2013-08-30 11:14:18 +00:00
}
2014-04-28 10:00:18 +00:00
/* Check if upgrade is HTTP 2.0 (Start with h2...) */
if ( ( g_str_has_prefix ( value , " h2 " ) ) = = 1 ) {
2013-08-30 11:14:18 +00:00
eh_ptr - > upgrade = UPGRADE_HTTP2 ;
}
2012-04-20 15:31:15 +00:00
break ;
2014-04-17 16:33:02 +00:00
case HDR_COOKIE :
if ( hdr_item ) {
proto_tree * cookie_tree ;
char * part , * part_end ;
int part_len ;
cookie_tree = proto_item_add_subtree ( hdr_item , ett_http_header_item ) ;
for ( i = 0 ; i < value_len ; ) {
/* skip whitespace and ';' (terminates at '\0' or earlier) */
c = value [ i ] ;
while ( c = = ' ; ' | | g_ascii_isspace ( c ) )
c = value [ + + i ] ;
if ( i > = value_len )
break ;
/* find "cookie=foo " in "cookie=foo ; bar" */
part = value + i ;
part_end = ( char * ) memchr ( part , ' ; ' , value_len - i ) ;
if ( part_end )
2014-04-27 19:28:42 +00:00
part_len = ( int ) ( part_end - part ) ;
2014-04-17 16:33:02 +00:00
else
part_len = value_len - i ;
/* finally add cookie to tree */
2014-04-27 20:07:07 +00:00
proto_tree_add_item ( cookie_tree , hf_http_cookie_pair ,
2014-04-17 16:33:02 +00:00
tvb , value_offset + i , part_len , ENC_NA | ENC_ASCII ) ;
i + = part_len ;
}
}
break ;
2003-11-06 08:54:31 +00:00
}
}
}
2003-12-23 02:29:11 +00:00
/* Returns index of header tag in headers */
2003-11-06 08:54:31 +00:00
static gint
find_header_hf_value ( tvbuff_t * tvb , int offset , guint header_len )
{
2010-09-21 02:12:21 +00:00
guint i ;
2003-11-06 08:54:31 +00:00
2010-09-21 02:12:21 +00:00
for ( i = 0 ; i < array_length ( headers ) ; i + + ) {
if ( header_len = = strlen ( headers [ i ] . name ) & &
tvb_strncaseeql ( tvb , offset ,
headers [ i ] . name , header_len ) = = 0 )
return i ;
}
2003-11-06 08:54:31 +00:00
2010-09-21 02:12:21 +00:00
return - 1 ;
2003-11-06 08:54:31 +00:00
}
/*
* Dissect Microsoft ' s abomination called NTLMSSP over HTTP .
*/
static gboolean
2013-12-12 20:09:33 +00:00
check_auth_ntlmssp ( proto_item * hdr_item , tvbuff_t * tvb , packet_info * pinfo , gchar * value )
2003-11-06 08:54:31 +00:00
{
static const char * ntlm_headers [ ] = {
" NTLM " ,
" Negotiate " ,
NULL
} ;
const char * * header ;
size_t hdrlen ;
proto_tree * hdr_tree ;
/*
* Check for NTLM credentials and challenge ; those can
* occur with WWW - Authenticate .
*/
for ( header = & ntlm_headers [ 0 ] ; * header ! = NULL ; header + + ) {
hdrlen = strlen ( * header ) ;
if ( strncmp ( value , * header , hdrlen ) = = 0 ) {
if ( hdr_item ! = NULL ) {
hdr_tree = proto_item_add_subtree ( hdr_item ,
ett_http_ntlmssp ) ;
} else
hdr_tree = NULL ;
value + = hdrlen ;
dissect_http_ntlmssp ( tvb , pinfo , hdr_tree , value ) ;
return TRUE ;
}
}
return FALSE ;
}
/*
* Dissect HTTP Basic authorization .
*/
static gboolean
check_auth_basic ( proto_item * hdr_item , tvbuff_t * tvb , gchar * value )
{
static const char * basic_headers [ ] = {
" Basic " ,
NULL
} ;
const char * * header ;
size_t hdrlen ;
proto_tree * hdr_tree ;
for ( header = & basic_headers [ 0 ] ; * header ! = NULL ; header + + ) {
hdrlen = strlen ( * header ) ;
if ( strncmp ( value , * header , hdrlen ) = = 0 ) {
if ( hdr_item ! = NULL ) {
hdr_tree = proto_item_add_subtree ( hdr_item ,
ett_http_ntlmssp ) ;
} else
hdr_tree = NULL ;
value + = hdrlen ;
2013-12-21 14:38:51 +00:00
ws_base64_decode_inplace ( value ) ;
2003-11-06 08:54:31 +00:00
proto_tree_add_string ( hdr_tree , hf_http_basic , tvb ,
0 , 0 , value ) ;
return TRUE ;
}
}
return FALSE ;
}
2015-01-12 15:26:39 +00:00
/*
* Dissect HTTP CitrixAGBasic authorization .
*/
static gboolean
check_auth_citrixbasic ( proto_item * hdr_item , tvbuff_t * tvb , gchar * value , int offset )
{
static const char * basic_headers [ ] = {
" CitrixAGBasic " ,
NULL
} ;
const char * * header ;
size_t hdrlen ;
proto_tree * hdr_tree ;
char * ch_ptr ;
int data_len ;
char * data_val ;
proto_item * hidden_item ;
proto_item * pi ;
for ( header = & basic_headers [ 0 ] ; * header ! = NULL ; header + + ) {
hdrlen = strlen ( * header ) ;
if ( strncmp ( value , * header , hdrlen ) = = 0 ) {
if ( hdr_item ! = NULL ) {
hdr_tree = proto_item_add_subtree ( hdr_item ,
ett_http_ntlmssp ) ;
} else
hdr_tree = NULL ;
value + = hdrlen ;
2015-01-15 18:26:52 +00:00
offset + = ( int ) hdrlen + 15 ;
2015-01-12 15:26:39 +00:00
hidden_item = proto_tree_add_boolean ( hdr_tree ,
hf_http_citrix , tvb , 0 , 0 , 1 ) ;
PROTO_ITEM_SET_HIDDEN ( hidden_item ) ;
if ( strncmp ( value , " username= \" " , 10 ) = = 0 ) {
value + = 10 ;
offset + = 10 ;
ch_ptr = strchr ( value , ' " ' ) ;
if ( ch_ptr ! = NULL ) {
data_len = ( int ) ( ch_ptr - value + 1 ) ;
data_val = wmem_strndup ( wmem_packet_scope ( ) , value , data_len ) ;
ws_base64_decode_inplace ( data_val ) ;
pi = proto_tree_add_string ( hdr_tree , hf_http_citrix_user , tvb ,
offset , data_len - 1 , data_val ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
value + = data_len ;
offset + = data_len ;
}
}
if ( strncmp ( value , " ; domain= \" " , 10 ) = = 0 ) {
value + = 10 ;
offset + = 10 ;
ch_ptr = strchr ( value , ' " ' ) ;
if ( ch_ptr ! = NULL ) {
data_len = ( int ) ( ch_ptr - value + 1 ) ;
data_val = wmem_strndup ( wmem_packet_scope ( ) , value , data_len ) ;
ws_base64_decode_inplace ( data_val ) ;
pi = proto_tree_add_string ( hdr_tree , hf_http_citrix_domain , tvb ,
offset , data_len - 1 , data_val ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
value + = data_len ;
offset + = data_len ;
}
}
if ( strncmp ( value , " ; password= \" " , 12 ) = = 0 ) {
value + = 12 ;
offset + = 12 ;
ch_ptr = strchr ( value , ' " ' ) ;
if ( ch_ptr ! = NULL ) {
data_len = ( int ) ( ch_ptr - value + 1 ) ;
data_val = wmem_strndup ( wmem_packet_scope ( ) , value , data_len ) ;
ws_base64_decode_inplace ( data_val ) ;
pi = proto_tree_add_string ( hdr_tree , hf_http_citrix_passwd , tvb ,
offset , data_len - 1 , data_val ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
value + = data_len ;
offset + = data_len ;
}
}
if ( strncmp ( value , " ; AGESessionId= \" " , 16 ) = = 0 ) {
value + = 16 ;
offset + = 16 ;
ch_ptr = strchr ( value , ' " ' ) ;
if ( ch_ptr ! = NULL ) {
data_len = ( int ) ( ch_ptr - value + 1 ) ;
data_val = wmem_strndup ( wmem_packet_scope ( ) , value , data_len ) ;
ws_base64_decode_inplace ( data_val ) ;
pi = proto_tree_add_string ( hdr_tree , hf_http_citrix_session , tvb ,
offset , data_len - 1 , data_val ) ;
PROTO_ITEM_SET_GENERATED ( pi ) ;
}
}
return TRUE ;
}
}
return FALSE ;
}
2010-10-25 02:17:41 +00:00
static gboolean
2013-12-12 20:09:33 +00:00
check_auth_kerberos ( proto_item * hdr_item , tvbuff_t * tvb , packet_info * pinfo , const gchar * value )
2010-10-25 02:17:41 +00:00
{
proto_tree * hdr_tree ;
if ( strncmp ( value , " Kerberos " , 9 ) = = 0 ) {
if ( hdr_item ! = NULL ) {
hdr_tree = proto_item_add_subtree ( hdr_item , ett_http_kerberos ) ;
} else
hdr_tree = NULL ;
dissect_http_kerberos ( tvb , pinfo , hdr_tree , value ) ;
return TRUE ;
}
return FALSE ;
}
2013-11-02 00:36:30 +00:00
static int
dissect_http ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree , void * data )
2003-12-23 02:02:09 +00:00
{
2007-12-26 18:28:31 +00:00
http_conv_t * conv_data ;
2003-12-23 02:02:09 +00:00
int offset = 0 ;
int len ;
2007-12-26 18:28:31 +00:00
/*
* Check if this is proxied connection and if so , hand of dissection to the
* payload - dissector .
* Response code 200 means " OK " and strncmp ( ) = = 0 means the strings match exactly */
conv_data = get_http_conversation_data ( pinfo ) ;
if ( pinfo - > fd - > num > = conv_data - > startframe & &
conv_data - > response_code = = 200 & &
conv_data - > request_method & &
strncmp ( conv_data - > request_method , " CONNECT " , 7 ) = = 0 & &
conv_data - > request_uri ) {
if ( conv_data - > startframe = = 0 & & ! pinfo - > fd - > flags . visited )
conv_data - > startframe = pinfo - > fd - > num ;
2013-11-02 00:36:30 +00:00
http_payload_subdissector ( tvb , tree , pinfo , conv_data , data ) ;
2007-12-26 18:28:31 +00:00
} else {
2013-09-11 21:44:13 +00:00
while ( tvb_reported_length_remaining ( tvb , offset ) > 0 ) {
2012-11-02 20:35:24 +00:00
if ( conv_data - > upgrade = = UPGRADE_WEBSOCKET & & pinfo - > fd - > num > = conv_data - > startframe ) {
call_dissector_only ( websocket_handle , tvb_new_subset_remaining ( tvb , offset ) , pinfo , tree , NULL ) ;
break ;
}
2013-08-30 11:14:18 +00:00
if ( conv_data - > upgrade = = UPGRADE_HTTP2 & & pinfo - > fd - > num > = conv_data - > startframe ) {
call_dissector_only ( http2_handle , tvb_new_subset_remaining ( tvb , offset ) , pinfo , tree , NULL ) ;
break ;
}
2007-12-26 18:28:31 +00:00
len = dissect_http_message ( tvb , offset , pinfo , tree , conv_data ) ;
if ( len = = - 1 )
break ;
offset + = len ;
2008-03-04 21:05:21 +00:00
2007-12-26 18:28:31 +00:00
/*
* OK , we ' ve set the Protocol and Info columns for the
2008-03-08 21:17:43 +00:00
* first HTTP message ; set a fence so that subsequent
* HTTP messages don ' t overwrite the Info column .
2007-12-26 18:28:31 +00:00
*/
2013-06-14 01:02:11 +00:00
col_set_fence ( pinfo - > cinfo , COL_INFO ) ;
2007-12-26 18:28:31 +00:00
}
2003-12-23 02:02:09 +00:00
}
2013-11-02 00:36:30 +00:00
2014-07-03 08:53:40 +00:00
return tvb_captured_length ( tvb ) ;
2003-12-23 02:02:09 +00:00
}
2013-03-12 19:15:39 +00:00
static gboolean
2013-11-02 00:36:30 +00:00
dissect_http_heur_tcp ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree , void * data )
2013-03-12 19:15:39 +00:00
{
gint offset = 0 , next_offset , linelen ;
conversation_t * conversation ;
/* Check if we have a line terminated by CRLF
* Return the length of the line ( not counting the line terminator at
* the end ) , or , if we don ' t find a line terminator :
*
* if " deseg " is true , return - 1 ;
*/
linelen = tvb_find_line_end ( tvb , offset , - 1 , & next_offset , TRUE ) ;
if ( ( linelen = = - 1 ) | | ( linelen = = 8 ) ) {
return FALSE ;
}
/* Check if the line start or ends with the HTTP token */
if ( ( tvb_strncaseeql ( tvb , linelen - 8 , " HTTP/1.1 " , 8 ) = = 0 ) | | ( tvb_strncaseeql ( tvb , 0 , " HTTP/1.1 " , 8 ) = = 0 ) ) {
conversation = find_or_create_conversation ( pinfo ) ;
conversation_set_dissector ( conversation , http_handle ) ;
2013-11-02 00:36:30 +00:00
dissect_http ( tvb , pinfo , tree , data ) ;
2013-03-12 19:15:39 +00:00
return TRUE ;
}
return FALSE ;
}
2003-12-23 02:02:09 +00:00
static void
dissect_http_udp ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree )
{
2007-12-26 18:28:31 +00:00
http_conv_t * conv_data ;
conv_data = get_http_conversation_data ( pinfo ) ;
dissect_http_message ( tvb , 0 , pinfo , tree , conv_data ) ;
2003-12-23 02:02:09 +00:00
}
2006-08-24 22:05:26 +00:00
2010-09-21 02:12:21 +00:00
static void
range_delete_http_ssl_callback ( guint32 port ) {
ssl_dissector_delete ( port , " http " , TRUE ) ;
2007-07-16 12:51:42 +00:00
}
2006-08-24 22:05:26 +00:00
2010-09-21 02:12:21 +00:00
static void
range_add_http_ssl_callback ( guint32 port ) {
ssl_dissector_add ( port , " http " , TRUE ) ;
2007-07-16 12:51:42 +00:00
}
static void reinit_http ( void ) {
2013-08-28 19:10:33 +00:00
dissector_delete_uint_range ( " tcp.port " , http_tcp_range , http_handle ) ;
2007-07-16 12:51:42 +00:00
g_free ( http_tcp_range ) ;
http_tcp_range = range_copy ( global_http_tcp_range ) ;
2013-08-28 19:10:33 +00:00
dissector_add_uint_range ( " tcp.port " , http_tcp_range , http_handle ) ;
2007-07-16 12:51:42 +00:00
range_foreach ( http_ssl_range , range_delete_http_ssl_callback ) ;
g_free ( http_ssl_range ) ;
http_ssl_range = range_copy ( global_http_ssl_range ) ;
range_foreach ( http_ssl_range , range_add_http_ssl_callback ) ;
2005-03-06 21:32:13 +00:00
}
1999-07-29 05:47:07 +00:00
void
proto_register_http ( void )
{
2000-11-09 10:56:33 +00:00
static hf_register_info hf [ ] = {
2001-01-03 03:40:29 +00:00
{ & hf_http_notification ,
2002-08-28 21:04:11 +00:00
{ " Notification " , " http.notification " ,
2001-01-03 03:40:29 +00:00
FT_BOOLEAN , BASE_NONE , NULL , 0x0 ,
2001-06-18 02:18:27 +00:00
" TRUE if HTTP notification " , HFILL } } ,
2000-11-09 10:56:33 +00:00
{ & hf_http_response ,
2002-08-28 21:04:11 +00:00
{ " Response " , " http.response " ,
2000-11-09 10:56:33 +00:00
FT_BOOLEAN , BASE_NONE , NULL , 0x0 ,
2001-06-18 02:18:27 +00:00
" TRUE if HTTP response " , HFILL } } ,
2000-11-09 10:56:33 +00:00
{ & hf_http_request ,
{ " Request " , " http.request " ,
FT_BOOLEAN , BASE_NONE , NULL , 0x0 ,
2001-06-18 02:18:27 +00:00
" TRUE if HTTP request " , HFILL } } ,
2003-05-30 03:11:45 +00:00
{ & hf_http_basic ,
{ " Credentials " , " http.authbasic " ,
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
2015-01-12 15:26:39 +00:00
{ & hf_http_citrix ,
{ " Citrix AG Auth " , " http.authcitrix " ,
FT_BOOLEAN , BASE_NONE , NULL , 0x0 ,
" TRUE if CitrixAGBasic Auth " , HFILL } } ,
{ & hf_http_citrix_user ,
{ " Citrix AG Username " , " http.authcitrix.user " ,
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_http_citrix_domain ,
{ " Citrix AG Domain " , " http.authcitrix.domain " ,
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_http_citrix_passwd ,
{ " Citrix AG Password " , " http.authcitrix.password " ,
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_http_citrix_session ,
{ " Citrix AG Session ID " , " http.authcitrix.session " ,
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
2013-10-17 01:23:12 +00:00
{ & hf_http_response_line ,
{ " Response line " , " http.response.line " ,
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
{ & hf_http_request_line ,
{ " Request line " , " http.request.line " ,
FT_STRING , BASE_NONE , NULL , 0x0 , NULL , HFILL } } ,
2003-06-10 22:07:18 +00:00
{ & hf_http_request_method ,
{ " Request Method " , " http.request.method " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Request Method " , HFILL } } ,
2005-02-23 05:47:17 +00:00
{ & hf_http_request_uri ,
{ " Request URI " , " http.request.uri " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Request-URI " , HFILL } } ,
2005-03-01 11:37:26 +00:00
{ & hf_http_version ,
2005-02-23 05:47:17 +00:00
{ " Request Version " , " http.request.version " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Request HTTP-Version " , HFILL } } ,
2010-09-21 02:12:21 +00:00
{ & hf_http_request_full_uri ,
{ " Full request URI " , " http.request.full_uri " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" The full requested URI (including host name) " , HFILL } } ,
2003-09-02 23:09:11 +00:00
{ & hf_http_response_code ,
2010-10-30 14:29:20 +00:00
{ " Status Code " , " http.response.code " ,
2003-09-02 22:47:59 +00:00
FT_UINT16 , BASE_DEC , NULL , 0x0 ,
2010-10-30 14:29:20 +00:00
" HTTP Response Status Code " , HFILL } } ,
{ & hf_http_response_phrase ,
{ " Response Phrase " , " http.response.phrase " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Response Reason Phrase " , HFILL } } ,
2003-11-06 08:54:31 +00:00
{ & hf_http_authorization ,
{ " Authorization " , " http.authorization " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Authorization header " , HFILL } } ,
{ & hf_http_proxy_authenticate ,
{ " Proxy-Authenticate " , " http.proxy_authenticate " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Proxy-Authenticate header " , HFILL } } ,
{ & hf_http_proxy_authorization ,
{ " Proxy-Authorization " , " http.proxy_authorization " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Proxy-Authorization header " , HFILL } } ,
2007-04-28 23:52:12 +00:00
{ & hf_http_proxy_connect_host ,
{ " Proxy-Connect-Hostname " , " http.proxy_connect_host " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Proxy Connect Hostname " , HFILL } } ,
{ & hf_http_proxy_connect_port ,
{ " Proxy-Connect-Port " , " http.proxy_connect_port " ,
FT_UINT16 , BASE_DEC , NULL , 0x0 ,
" HTTP Proxy Connect Port " , HFILL } } ,
2003-11-06 08:54:31 +00:00
{ & hf_http_www_authenticate ,
{ " WWW-Authenticate " , " http.www_authenticate " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP WWW-Authenticate header " , HFILL } } ,
2003-11-07 03:47:20 +00:00
{ & hf_http_content_type ,
{ " Content-Type " , " http.content_type " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Content-Type header " , HFILL } } ,
2008-10-23 06:57:31 +00:00
{ & hf_http_content_length_header ,
{ " Content-Length " , " http.content_length_header " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Content-Length header " , HFILL } } ,
2003-12-23 01:42:48 +00:00
{ & hf_http_content_length ,
2008-10-23 06:57:31 +00:00
{ " Content length " , " http.content_length " ,
2010-04-09 01:42:12 +00:00
FT_UINT64 , BASE_DEC , NULL , 0x0 ,
2008-10-23 06:57:31 +00:00
NULL , HFILL } } ,
2004-02-21 01:31:56 +00:00
{ & hf_http_content_encoding ,
{ " Content-Encoding " , " http.content_encoding " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Content-Encoding header " , HFILL } } ,
{ & hf_http_transfer_encoding ,
{ " Transfer-Encoding " , " http.transfer_encoding " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Transfer-Encoding header " , HFILL } } ,
2012-04-20 15:31:15 +00:00
{ & hf_http_upgrade ,
{ " Upgrade " , " http.upgrade " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Upgrade header " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_user_agent ,
{ " User-Agent " , " http.user_agent " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP User-Agent header " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_host ,
{ " Host " , " http.host " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Host " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_connection ,
{ " Connection " , " http.connection " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Connection " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_cookie ,
{ " Cookie " , " http.cookie " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Cookie " , HFILL } } ,
2014-04-17 16:33:02 +00:00
{ & hf_http_cookie_pair ,
{ " Cookie pair " , " http.cookie_pair " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
" A name/value HTTP cookie pair " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_accept ,
{ " Accept " , " http.accept " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Accept " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_referer ,
{ " Referer " , " http.referer " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Referer " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_accept_language ,
{ " Accept-Language " , " http.accept_language " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Accept Language " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_accept_encoding ,
{ " Accept Encoding " , " http.accept_encoding " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Accept Encoding " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_date ,
{ " Date " , " http.date " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Date " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_cache_control ,
{ " Cache-Control " , " http.cache_control " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Cache Control " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_server ,
{ " Server " , " http.server " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Server " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_location ,
{ " Location " , " http.location " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Location " , HFILL } } ,
2012-04-20 15:32:45 +00:00
{ & hf_http_sec_websocket_accept ,
{ " Sec-WebSocket-Accept " , " http.sec_websocket_accept " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
{ & hf_http_sec_websocket_extensions ,
{ " Sec-WebSocket-Extensions " , " http.sec_websocket_extensions " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
{ & hf_http_sec_websocket_key ,
{ " Sec-WebSocket-Key " , " http.sec_websocket_key " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
{ & hf_http_sec_websocket_protocol ,
{ " Sec-WebSocket-Protocol " , " http.sec_websocket_protocol " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
{ & hf_http_sec_websocket_version ,
{ " Sec-WebSocket-Version " , " http.sec_websocket_version " ,
FT_STRING , BASE_NONE , NULL , 0x0 ,
NULL , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_set_cookie ,
{ " Set-Cookie " , " http.set_cookie " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Set Cookie " , HFILL } } ,
2004-12-07 17:59:58 +00:00
{ & hf_http_last_modified ,
{ " Last-Modified " , " http.last_modified " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
" HTTP Last Modified " , HFILL } } ,
2006-02-20 06:25:02 +00:00
{ & hf_http_x_forwarded_for ,
{ " X-Forwarded-For " , " http.x_forwarded_for " ,
2010-09-21 02:12:21 +00:00
FT_STRING , BASE_NONE , NULL , 0x0 ,
2013-02-16 14:59:00 +00:00
" HTTP X-Forwarded-For " , HFILL } } ,
{ & hf_http_request_in ,
{ " Request in frame " , " http.request_in " ,
FT_FRAMENUM , BASE_NONE , NULL , 0 ,
" This packet is a response to the packet with this number " , HFILL } } ,
{ & hf_http_response_in ,
{ " Response in frame " , " http.response_in " ,
FT_FRAMENUM , BASE_NONE , NULL , 0 ,
" This packet will be responded in the packet with this number " , HFILL } } ,
{ & hf_http_next_request_in ,
{ " Next request in frame " , " http.next_request_in " ,
FT_FRAMENUM , BASE_NONE , NULL , 0 ,
" The next HTTP request starts in packet number " , HFILL } } ,
{ & hf_http_next_response_in ,
{ " Next response in frame " , " http.next_response_in " ,
FT_FRAMENUM , BASE_NONE , NULL , 0 ,
" The next HTTP response starts in packet number " , HFILL } } ,
{ & hf_http_prev_request_in ,
{ " Prev request in frame " , " http.prev_request_in " ,
FT_FRAMENUM , BASE_NONE , NULL , 0 ,
" The previous HTTP request starts in packet number " , HFILL } } ,
{ & hf_http_prev_response_in ,
{ " Prev response in frame " , " http.prev_response_in " ,
FT_FRAMENUM , BASE_NONE , NULL , 0 ,
" The previous HTTP response starts in packet number " , HFILL } } ,
2013-05-30 07:16:04 +00:00
{ & hf_http_time ,
{ " Time since request " , " http.time " ,
2013-02-16 14:59:00 +00:00
FT_RELATIVE_TIME , BASE_NONE , NULL , 0 ,
" Time since the request was send " , HFILL } } ,
2014-11-28 14:52:07 +00:00
{ & hf_http_chunked_trailer_part ,
{ " trailer-part " , " http.chunked_trailer_part " ,
FT_STRING , BASE_NONE , NULL , 0 ,
" Optional trailer in a chunked body " , HFILL } } ,
2000-11-09 10:56:33 +00:00
} ;
static gint * ett [ ] = {
& ett_http ,
2002-08-13 05:36:02 +00:00
& ett_http_ntlmssp ,
2010-10-25 02:17:41 +00:00
& ett_http_kerberos ,
2003-06-10 22:07:18 +00:00
& ett_http_request ,
2004-04-26 17:10:40 +00:00
& ett_http_chunked_response ,
& ett_http_chunk_data ,
& ett_http_encoded_entity ,
2008-10-23 06:57:31 +00:00
& ett_http_header_item
2000-11-09 10:56:33 +00:00
} ;
2013-05-26 03:29:07 +00:00
static ei_register_info ei [ ] = {
{ & ei_http_chat , { " http.chat " , PI_SEQUENCE , PI_CHAT , " Formatted text " , EXPFILL } } ,
2013-09-05 16:05:32 +00:00
{ & ei_http_chunked_and_length , { " http.chunkd_and_length " , PI_MALFORMED , PI_WARN , " It is incorrect to specify a content-length header and chunked encoding together. " , EXPFILL } } ,
2013-05-26 03:29:07 +00:00
{ & ei_http_subdissector_failed , { " http.subdissector_failed " , PI_MALFORMED , PI_NOTE , " HTTP body subdissector failed, trying heuristic subdissector " , EXPFILL } } ,
2014-06-29 12:50:21 +00:00
{ & ei_http_ssl_port , { " http.ssl_port " , PI_SECURITY , PI_WARN , " Unencrypted HTTP protocol detected over encrypted port, could indicate a dangerous misconfiguration. " , EXPFILL } } ,
2014-07-03 11:46:32 +00:00
{ & ei_http_leading_crlf , { " http.leading_crlf " , PI_MALFORMED , PI_ERROR , " Leading CRLF previous message in the stream may have extra CRLF " , EXPFILL } } ,
2013-05-26 03:29:07 +00:00
} ;
2009-05-19 00:17:23 +00:00
/* UAT for header fields */
static uat_field_t custom_header_uat_fields [ ] = {
UAT_FLD_CSTRING ( header_fields , header_name , " Header name " , " HTTP header name " ) ,
UAT_FLD_CSTRING ( header_fields , header_desc , " Field desc " , " Description of the value contained in the header " ) ,
UAT_END_FIELDS
} ;
2003-11-04 08:16:02 +00:00
module_t * http_module ;
2013-05-26 03:29:07 +00:00
expert_module_t * expert_http ;
2009-05-19 00:17:23 +00:00
uat_t * headers_uat ;
2000-11-09 10:56:33 +00:00
proto_http = proto_register_protocol ( " Hypertext Transfer Protocol " ,
2001-01-03 06:56:03 +00:00
" HTTP " , " http " ) ;
2000-11-09 10:56:33 +00:00
proto_register_field_array ( proto_http , hf , array_length ( hf ) ) ;
proto_register_subtree_array ( ett , array_length ( ett ) ) ;
2013-05-26 03:29:07 +00:00
expert_http = expert_register_protocol ( proto_http ) ;
expert_register_field_array ( expert_http , ei , array_length ( ei ) ) ;
2013-08-05 18:09:43 +00:00
2013-11-02 00:36:30 +00:00
http_handle = new_register_dissector ( " http " , dissect_http , proto_http ) ;
2013-08-05 18:09:43 +00:00
2005-03-06 21:32:13 +00:00
http_module = prefs_register_protocol ( proto_http , reinit_http ) ;
2003-12-31 09:58:56 +00:00
prefs_register_bool_preference ( http_module , " desegment_headers " ,
2004-08-21 09:02:52 +00:00
" Reassemble HTTP headers spanning multiple TCP segments " ,
" Whether the HTTP dissector should reassemble headers "
" of a request spanning multiple TCP segments. "
" To use this option, you must also enable "
2010-09-21 02:12:21 +00:00
" \" Allow subdissectors to reassemble TCP streams \" in the TCP protocol settings. " ,
2003-11-04 08:16:02 +00:00
& http_desegment_headers ) ;
2003-12-31 09:58:56 +00:00
prefs_register_bool_preference ( http_module , " desegment_body " ,
2004-08-21 09:02:52 +00:00
" Reassemble HTTP bodies spanning multiple TCP segments " ,
2003-11-04 08:16:02 +00:00
" Whether the HTTP dissector should use the "
2004-08-21 09:02:52 +00:00
" \" Content-length: \" value, if present, to reassemble "
2004-05-04 07:12:03 +00:00
" the body of a request spanning multiple TCP segments, "
2004-08-21 09:02:52 +00:00
" and reassemble chunked data spanning multiple TCP segments. "
" To use this option, you must also enable "
2010-09-21 02:12:21 +00:00
" \" Allow subdissectors to reassemble TCP streams \" in the TCP protocol settings. " ,
2003-11-04 08:16:02 +00:00
& http_desegment_body ) ;
2004-05-05 06:55:09 +00:00
prefs_register_bool_preference ( http_module , " dechunk_body " ,
" Reassemble chunked transfer-coded bodies " ,
2012-02-01 02:05:19 +00:00
" Whether to reassemble bodies of entities that are transferred "
2004-05-05 06:55:09 +00:00
" using the \" Transfer-Encoding: chunked \" method " ,
& http_dechunk_body ) ;
# ifdef HAVE_LIBZ
prefs_register_bool_preference ( http_module , " decompress_body " ,
" Uncompress entity bodies " ,
" Whether to uncompress entity bodies that are compressed "
" using \" Content-Encoding: \" " ,
& http_decompress_body ) ;
# endif
2007-07-16 12:51:42 +00:00
prefs_register_obsolete_preference ( http_module , " tcp_alternate_port " ) ;
range_convert_str ( & global_http_tcp_range , TCP_DEFAULT_RANGE , 65535 ) ;
http_tcp_range = range_empty ( ) ;
prefs_register_range_preference ( http_module , " tcp.port " , " TCP Ports " ,
2010-09-21 02:12:21 +00:00
" TCP Ports range " ,
& global_http_tcp_range , 65535 ) ;
2007-07-16 12:51:42 +00:00
range_convert_str ( & global_http_ssl_range , SSL_DEFAULT_RANGE , 65535 ) ;
http_ssl_range = range_empty ( ) ;
prefs_register_range_preference ( http_module , " ssl.port " , " SSL/TLS Ports " ,
2010-09-21 02:12:21 +00:00
" SSL/TLS Ports range " ,
& global_http_ssl_range , 65535 ) ;
2009-05-19 00:17:23 +00:00
/* UAT */
headers_uat = uat_new ( " Custom HTTP headers fields Table " ,
2010-09-21 02:12:21 +00:00
sizeof ( header_field_t ) ,
" custom_http_header_fields " ,
TRUE ,
2014-01-30 17:43:52 +00:00
& header_fields ,
2010-09-21 02:12:21 +00:00
& num_header_fields ,
2013-12-12 20:09:33 +00:00
/* specifies named fields, so affects dissection
and the set of named fields */
UAT_AFFECTS_DISSECTION | UAT_AFFECTS_FIELDS ,
2010-09-21 02:12:21 +00:00
NULL ,
header_fields_copy_cb ,
header_fields_update_cb ,
header_fields_free_cb ,
2011-10-04 18:40:56 +00:00
header_fields_initialize_cb ,
2010-09-21 02:12:21 +00:00
custom_header_uat_fields
2009-05-19 00:17:23 +00:00
) ;
prefs_register_uat_preference ( http_module , " custom_http_header_fields " , " Custom HTTP headers fields " ,
" A table to define custom HTTP header for which fields can be setup and used for filtering/data extraction etc. " ,
headers_uat ) ;
2006-08-24 22:05:26 +00:00
2001-01-11 06:30:54 +00:00
/*
* Dissectors shouldn ' t register themselves in this table ;
* instead , they should call " http_dissector_add() " , and
* we ' ll register the port number they specify as a port
* for HTTP , and register them in our subdissector table .
*
* This only works for protocols such as IPP that run over
* HTTP on a specific non - HTTP port .
*/
2003-11-18 07:49:52 +00:00
port_subdissector_table = register_dissector_table ( " http.port " ,
2001-12-08 06:41:48 +00:00
" TCP port for protocols using HTTP " , FT_UINT16 , BASE_DEC ) ;
2001-11-18 02:28:15 +00:00
2003-11-18 07:49:52 +00:00
/*
* Dissectors can register themselves in this table .
2003-12-07 03:17:42 +00:00
* It ' s just " media_type " , not " http.content_type " , because
* it ' s an Internet media type , usable by other protocols as well .
2003-11-18 07:49:52 +00:00
*/
2003-12-07 03:21:22 +00:00
media_type_subdissector_table =
2003-12-07 03:17:42 +00:00
register_dissector_table ( " media_type " ,
" Internet media type " , FT_STRING , BASE_NONE ) ;
2003-11-18 07:49:52 +00:00
2002-08-28 21:04:11 +00:00
/*
* Heuristic dissectors SHOULD register themselves in
* this table using the standard heur_dissector_add ( )
2001-11-18 02:28:15 +00:00
* function .
*/
2014-12-21 04:13:28 +00:00
heur_subdissector_list = register_heur_dissector_list ( " http " ) ;
2002-08-28 21:04:11 +00:00
2003-09-02 22:47:59 +00:00
/*
* Register for tapping
*/
2007-03-13 20:42:04 +00:00
http_tap = register_tap ( " http " ) ; /* HTTP statistics tap */
2013-12-12 20:09:33 +00:00
http_eo_tap = register_tap ( " http_eo " ) ; /* HTTP Export Object tap */
2001-01-11 06:30:54 +00:00
}
/*
* Called by dissectors for protocols that run atop HTTP / TCP .
*/
void
2001-12-03 04:00:26 +00:00
http_dissector_add ( guint32 port , dissector_handle_t handle )
2001-01-11 06:30:54 +00:00
{
/*
* Register ourselves as the handler for that port number
* over TCP .
*/
2010-12-20 05:35:29 +00:00
dissector_add_uint ( " tcp.port " , port , http_handle ) ;
2001-01-11 06:30:54 +00:00
/*
* And register them in * our * table for that port .
*/
2010-12-20 05:35:29 +00:00
dissector_add_uint ( " http.port " , port , handle ) ;
1999-07-29 05:47:07 +00:00
}
2000-04-08 07:07:42 +00:00
2013-01-30 21:49:33 +00:00
void
http_port_add ( guint32 port )
{
/*
* Register ourselves as the handler for that port number
* over TCP . We rely on our caller having registered
* themselves for the appropriate media type .
*/
dissector_add_uint ( " tcp.port " , port , http_handle ) ;
}
2000-04-08 07:07:42 +00:00
void
proto_reg_handoff_http ( void )
{
2003-12-23 02:02:09 +00:00
dissector_handle_t http_udp_handle ;
2003-11-04 08:16:02 +00:00
data_handle = find_dissector ( " data " ) ;
2004-04-30 17:07:21 +00:00
media_handle = find_dissector ( " media " ) ;
2012-04-20 15:31:15 +00:00
websocket_handle = find_dissector ( " websocket " ) ;
2013-08-30 11:14:18 +00:00
http2_handle = find_dissector ( " http2 " ) ;
2001-01-11 05:36:09 +00:00
/*
* XXX - is there anything to dissect in the body of an SSDP
* request or reply ? I . e . , should there be an SSDP dissector ?
*/
2003-12-23 02:02:09 +00:00
http_udp_handle = create_dissector_handle ( dissect_http_udp , proto_http ) ;
2010-12-20 05:35:29 +00:00
dissector_add_uint ( " udp.port " , UDP_PORT_SSDP , http_udp_handle ) ;
2002-08-13 05:36:02 +00:00
ntlmssp_handle = find_dissector ( " ntlmssp " ) ;
2004-10-29 08:01:11 +00:00
gssapi_handle = find_dissector ( " gssapi " ) ;
2006-08-24 22:05:26 +00:00
2010-09-21 02:12:21 +00:00
stats_tree_register ( " http " , " http " , " HTTP/Packet Counter " , 0 , http_stats_tree_packet , http_stats_tree_init , NULL ) ;
stats_tree_register ( " http " , " http_req " , " HTTP/Requests " , 0 , http_req_stats_tree_packet , http_req_stats_tree_init , NULL ) ;
stats_tree_register ( " http " , " http_srv " , " HTTP/Load Distribution " , 0 , http_reqs_stats_tree_packet , http_reqs_stats_tree_init , NULL ) ;
2006-08-24 22:05:26 +00:00
2000-04-08 07:07:42 +00:00
}
2004-01-09 21:45:29 +00:00
/*
* Content - Type : message / http
*/
static gint proto_message_http = - 1 ;
static gint ett_message_http = - 1 ;
static void
dissect_message_http ( tvbuff_t * tvb , packet_info * pinfo , proto_tree * tree )
{
proto_tree * subtree ;
proto_item * ti ;
gint offset = 0 , next_offset ;
gint len ;
2009-09-24 20:21:23 +00:00
col_append_str ( pinfo - > cinfo , COL_INFO , " (message/http) " ) ;
2004-01-09 21:45:29 +00:00
if ( tree ) {
ti = proto_tree_add_item ( tree , proto_message_http ,
2011-10-21 02:10:19 +00:00
tvb , 0 , - 1 , ENC_NA ) ;
2004-01-09 21:45:29 +00:00
subtree = proto_item_add_subtree ( ti , ett_message_http ) ;
2013-09-11 21:44:13 +00:00
while ( tvb_reported_length_remaining ( tvb , offset ) > 0 ) {
2004-01-09 21:45:29 +00:00
len = tvb_find_line_end ( tvb , offset ,
2014-07-03 08:53:40 +00:00
tvb_ensure_captured_length_remaining ( tvb , offset ) ,
2004-01-09 21:45:29 +00:00
& next_offset , FALSE ) ;
if ( len = = - 1 )
break ;
proto_tree_add_text ( subtree , tvb , offset , next_offset - offset ,
" %s " , tvb_format_text ( tvb , offset , len ) ) ;
offset = next_offset ;
}
}
}
void
proto_register_message_http ( void )
{
static gint * ett [ ] = {
& ett_message_http ,
} ;
proto_message_http = proto_register_protocol (
" Media Type: message/http " ,
" message/http " ,
" message-http "
) ;
proto_register_subtree_array ( ett , array_length ( ett ) ) ;
}
void
proto_reg_handoff_message_http ( void )
{
2008-09-26 20:06:40 +00:00
dissector_handle_t message_http_handle ;
2004-01-09 21:45:29 +00:00
message_http_handle = create_dissector_handle ( dissect_message_http ,
proto_message_http ) ;
dissector_add_string ( " media_type " , " message/http " , message_http_handle ) ;
2007-08-08 14:01:28 +00:00
2013-03-12 19:15:39 +00:00
heur_dissector_add ( " tcp " , dissect_http_heur_tcp , proto_http ) ;
2007-08-08 14:01:28 +00:00
reinit_http ( ) ;
2004-01-09 21:45:29 +00:00
}
2013-02-16 14:59:00 +00:00
/*
* Editor modelines - http : //www.wireshark.org/tools/modelines.html
*
* Local variables :
* c - basic - offset : 8
* tab - width : 8
2013-12-16 20:22:50 +00:00
* indent - tabs - mode : t
2013-02-16 14:59:00 +00:00
* End :
*
2013-09-05 16:05:32 +00:00
* vi : set shiftwidth = 8 tabstop = 8 noexpandtab :
* : indentSize = 8 : tabSize = 8 : noTabs = false :
2013-02-16 14:59:00 +00:00
*/