2002-06-28 21:02:55 +00:00
|
|
|
/* packet-ajp13.c
|
|
|
|
* Routines for AJP13 dissection
|
|
|
|
* Copyright 2002, Christopher K. St. John <cks@distributopia.com>
|
|
|
|
*
|
2004-07-18 00:24:25 +00:00
|
|
|
* $Id$
|
2002-06-28 23:58:06 +00:00
|
|
|
*
|
2006-05-21 04:49:01 +00:00
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
2002-06-28 21:02:55 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
2002-06-28 21:02:55 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
2002-06-28 21:02:55 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
2012-06-28 23:18:38 +00:00
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
2002-06-28 21:02:55 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
2011-05-20 19:00:09 +00:00
|
|
|
#include <stdlib.h>
|
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
#include <glib.h>
|
|
|
|
|
|
|
|
#include <epan/packet.h>
|
2005-08-12 23:34:59 +00:00
|
|
|
#include <epan/emem.h>
|
2002-06-28 23:55:27 +00:00
|
|
|
#include <epan/conversation.h>
|
|
|
|
#include "packet-tcp.h"
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* IMPORTANT IMPLEMENTATION NOTES
|
|
|
|
*
|
2011-09-22 03:10:30 +00:00
|
|
|
* You need to be looking at:
|
|
|
|
*
|
|
|
|
* http://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html
|
2002-06-28 21:02:55 +00:00
|
|
|
*
|
2007-01-02 13:25:36 +00:00
|
|
|
* If you're a wireshark dissector guru, then you can skip the rest of
|
2002-06-28 21:02:55 +00:00
|
|
|
* this. I'm writing it all down because I've written 3 dissectors so
|
|
|
|
* far and every time I've forgotten it all and had to re-learn it
|
|
|
|
* from scratch. Not this time, damnit.
|
|
|
|
*
|
|
|
|
* Dissector routines get called in two phases:
|
|
|
|
*
|
|
|
|
* The first phase is an in-order traversal of every incoming
|
|
|
|
* frame. Since we know it's in-order, we can set up a "conversational
|
|
|
|
* state" that records context-sensitive stuff like "was there a
|
|
|
|
* content-length in the previous request". During this first pass
|
|
|
|
* through the data, the "tree" parameter might be null, or not. For
|
2006-05-28 19:49:07 +00:00
|
|
|
* the regular gui-based Wireshark, it's null, which means we don't
|
2002-06-28 21:02:55 +00:00
|
|
|
* actually display the dissected data in the gui quite yet. For the
|
|
|
|
* text based interface, we might do the parsing and display both in
|
|
|
|
* this first pass.
|
|
|
|
*
|
|
|
|
* The second phase happens when the data is actually displayed. In
|
|
|
|
* this pase the "tree" param is non-null, so you've got a hook to
|
|
|
|
* hang the parsed-out display data on. Since there might be gigabytes
|
|
|
|
* worth of capture data, the display code only calls the dissector
|
|
|
|
* for the stuff the user actually clicks on. So you have to assume
|
|
|
|
* the dissector is getting called on random frames, you can't depend
|
|
|
|
* on ordering anymore.
|
|
|
|
*
|
|
|
|
* But some parts of the AJP13 capture stream are context sensitive.
|
|
|
|
* That's no big deal during the first in-order pass, but the second
|
|
|
|
* phase requires us to display any random frame correctly. So during
|
|
|
|
* the first in-order phase we create a per-frame user data structure
|
|
|
|
* and attach it to the frame using p_add_proto_data.
|
|
|
|
*
|
|
|
|
* Since AJP13 is a TCP/IP based protocol, writing a dissector for it
|
|
|
|
* requires addressing several other issues:
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
2002-06-28 21:02:55 +00:00
|
|
|
* 1) TCP/IP segments can get retransmitted or be sent out of
|
|
|
|
* order. Users don't normally care, because the low-level kernel
|
|
|
|
* networking code takes care of reassembling them properly. But we're
|
|
|
|
* looking at raw network packets, aren't we? The stuff on the
|
2006-05-21 04:49:01 +00:00
|
|
|
* wire. Wireshark has been getting better and better at helping
|
2002-06-28 21:02:55 +00:00
|
|
|
* dissectors with this. I'm a little fuzzy on the details, but my
|
2006-05-21 04:49:01 +00:00
|
|
|
* uderstanding is that wireshark now contains a fairly substantial
|
2002-06-28 21:02:55 +00:00
|
|
|
* user-space TCP/IP stack so it can re-assemble the data. But I might
|
|
|
|
* be wrong. Since AJP13 is going to be used either on the loopback
|
|
|
|
* interface or on a LAN, it isn't likely to be a big issues anyway.
|
|
|
|
*
|
|
|
|
* 2) AJP13 packets (PDU's or protocol data unit's in
|
|
|
|
* networking-speak) don't necessarily line up with TCP segments. That
|
|
|
|
* is, one TCP segment can have more than one AJP13 PDU, or one AJP13
|
|
|
|
* PDU can stretch across multiple TCP segments. Assembling them is
|
|
|
|
* obviously possible, but a royal pain. During the "phase one"
|
|
|
|
* in-order pass you have to keep track of a bunch of offsets and
|
|
|
|
* store which PDU goes with which TCP segment. Luckly, recent
|
2006-05-21 04:49:01 +00:00
|
|
|
* (0.9.4+) versions of wireshark provide the "tcp_dissect_pdus()"
|
2002-06-28 21:02:55 +00:00
|
|
|
* function that takes care of much of the work. See the comments in
|
|
|
|
* packet-tcp.c, the example code in packet-dns.c, or check the
|
2006-05-28 19:49:07 +00:00
|
|
|
* wireshark-dev archives for details.
|
2002-06-28 21:02:55 +00:00
|
|
|
*
|
2006-05-21 04:49:01 +00:00
|
|
|
* 3) Wireshark isn't guaranteed to see all the data. I'm a little
|
2002-06-28 21:02:55 +00:00
|
|
|
* unclear on all the possible failure modes, but it comes down to: a)
|
|
|
|
* Not your fault: it's an imperfect world, we're eavesdroppers, and
|
|
|
|
* stuff happens. We might totally miss packets or get garbled
|
|
|
|
* data. Or b) Totally your fault: you turn on the capture during the
|
|
|
|
* middle of an AJP13 conversation and the capture starts out with
|
|
|
|
* half an AJP13 PDU. This code doesn't currently handle either case
|
|
|
|
* very well, but you can get arbitrarily clever. Like: put in tests
|
|
|
|
* to see if this packet has reasonable field values, and if it
|
|
|
|
* doesn't, walk the offset ahead until we see a matching magic number
|
|
|
|
* field, then re-test. But we don't do that now, and since we're
|
|
|
|
* using tcp_dissect_pdu's, I'm not sure how to do it.
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
#define MTYPE_FORWARD_REQUEST 2
|
|
|
|
#define MTYPE_SEND_BODY_CHUNK 3
|
|
|
|
#define MTYPE_SEND_HEADERS 4
|
|
|
|
#define MTYPE_END_RESPONSE 5
|
|
|
|
#define MTYPE_GET_BODY_CHUNK 6
|
|
|
|
#define MTYPE_SHUTDOWN 7
|
|
|
|
#define MTYPE_CPONG 9
|
|
|
|
#define MTYPE_CPING 10
|
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
static const value_string mtype_codes[] = {
|
2011-09-22 03:10:30 +00:00
|
|
|
{ MTYPE_FORWARD_REQUEST, "FORWARD REQUEST" },
|
|
|
|
{ MTYPE_SEND_BODY_CHUNK, "SEND BODY CHUNK" },
|
|
|
|
{ MTYPE_SEND_HEADERS, "SEND HEADERS" },
|
|
|
|
{ MTYPE_END_RESPONSE, "END RESPONSE" },
|
|
|
|
{ MTYPE_GET_BODY_CHUNK, "GET BODY CHUNK" },
|
|
|
|
{ MTYPE_SHUTDOWN, "SHUTDOWN" },
|
|
|
|
{ MTYPE_CPONG, "CPONG" },
|
|
|
|
{ MTYPE_CPING, "CPING" },
|
2005-08-20 22:06:31 +00:00
|
|
|
{ 0, NULL }
|
2002-06-28 21:02:55 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
static const value_string http_method_codes[] = {
|
|
|
|
{ 1, "OPTIONS" },
|
|
|
|
{ 2, "GET" },
|
|
|
|
{ 3, "HEAD" },
|
|
|
|
{ 4, "POST" },
|
|
|
|
{ 5, "PUT" },
|
|
|
|
{ 6, "DELETE" },
|
|
|
|
{ 7, "TRACE" },
|
|
|
|
{ 8, "PROPFIND" },
|
|
|
|
{ 9, "PROPPATCH" },
|
|
|
|
{ 10, "MKCOL" },
|
|
|
|
{ 11, "COPY" },
|
|
|
|
{ 12, "MOVE" },
|
|
|
|
{ 13, "LOCK" },
|
|
|
|
{ 14, "UNLOCK" },
|
|
|
|
{ 15, "ACL" },
|
|
|
|
{ 16, "REPORT" },
|
|
|
|
{ 17, "VERSION-CONTROL" },
|
|
|
|
{ 18, "CHECKIN" },
|
|
|
|
{ 19, "CHECKOUT" },
|
|
|
|
{ 20, "UNCHECKOUT" },
|
|
|
|
{ 21, "SEARCH" },
|
2005-08-20 22:06:31 +00:00
|
|
|
{ 0, NULL }
|
2002-06-28 21:02:55 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static int proto_ajp13 = -1;
|
|
|
|
static int hf_ajp13_magic = -1;
|
|
|
|
static int hf_ajp13_len = -1;
|
|
|
|
static int hf_ajp13_code = -1;
|
|
|
|
static int hf_ajp13_method = -1;
|
|
|
|
static int hf_ajp13_ver = -1;
|
|
|
|
static int hf_ajp13_uri = -1;
|
|
|
|
static int hf_ajp13_raddr = -1;
|
|
|
|
static int hf_ajp13_rhost = -1;
|
|
|
|
static int hf_ajp13_srv = -1;
|
|
|
|
static int hf_ajp13_port = -1;
|
|
|
|
static int hf_ajp13_sslp = -1;
|
|
|
|
static int hf_ajp13_nhdr = -1;
|
2011-10-14 07:52:11 +00:00
|
|
|
|
|
|
|
/* response headers */
|
|
|
|
static int hf_ajp13_unknown_header = -1;
|
|
|
|
static int hf_ajp13_additional_header = -1;
|
|
|
|
static int hf_ajp13_content_type = -1;
|
|
|
|
static int hf_ajp13_content_language = -1;
|
|
|
|
static int hf_ajp13_content_length = -1;
|
|
|
|
static int hf_ajp13_date = -1;
|
|
|
|
static int hf_ajp13_last_modified = -1;
|
|
|
|
static int hf_ajp13_location = -1;
|
|
|
|
static int hf_ajp13_set_cookie = -1;
|
|
|
|
static int hf_ajp13_set_cookie2 = -1;
|
|
|
|
static int hf_ajp13_servlet_engine = -1;
|
|
|
|
static int hf_ajp13_status = -1;
|
|
|
|
static int hf_ajp13_www_authenticate = -1;
|
|
|
|
|
|
|
|
/* request headers */
|
|
|
|
static int hf_ajp13_accept = -1;
|
|
|
|
static int hf_ajp13_accept_charset = -1;
|
|
|
|
static int hf_ajp13_accept_encoding = -1;
|
|
|
|
static int hf_ajp13_accept_language = -1;
|
|
|
|
static int hf_ajp13_authorization = -1;
|
|
|
|
static int hf_ajp13_connection = -1;
|
|
|
|
/* content_type */
|
|
|
|
/* content_length */
|
|
|
|
static int hf_ajp13_cookie = -1;
|
|
|
|
static int hf_ajp13_cookie2 = -1;
|
|
|
|
static int hf_ajp13_host = -1;
|
|
|
|
static int hf_ajp13_pragma = -1;
|
|
|
|
static int hf_ajp13_referer = -1;
|
|
|
|
static int hf_ajp13_user_agent = -1;
|
|
|
|
|
2011-10-14 08:00:21 +00:00
|
|
|
/* request attributes */
|
|
|
|
static int hf_ajp13_unknown_attribute = -1;
|
|
|
|
static int hf_ajp13_req_attribute = -1;
|
|
|
|
static int hf_ajp13_context = -1;
|
|
|
|
static int hf_ajp13_servlet_path = -1;
|
|
|
|
static int hf_ajp13_remote_user = -1;
|
|
|
|
static int hf_ajp13_auth_type = -1;
|
|
|
|
static int hf_ajp13_query_string = -1;
|
|
|
|
static int hf_ajp13_route = -1;
|
|
|
|
static int hf_ajp13_ssl_cert = -1;
|
|
|
|
static int hf_ajp13_ssl_cipher = -1;
|
|
|
|
static int hf_ajp13_ssl_session = -1;
|
|
|
|
static int hf_ajp13_ssl_key_size = -1;
|
|
|
|
static int hf_ajp13_secret = -1;
|
|
|
|
static int hf_ajp13_stored_method = -1;
|
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
static int hf_ajp13_rlen = -1;
|
|
|
|
static int hf_ajp13_reusep = -1;
|
|
|
|
static int hf_ajp13_rstatus= -1;
|
|
|
|
static int hf_ajp13_rsmsg = -1;
|
|
|
|
static int hf_ajp13_data = -1;
|
|
|
|
static gint ett_ajp13 = -1;
|
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
/*
|
|
|
|
* Request/response header codes. Common headers are stored as ints in
|
|
|
|
* an effort to improve performance. Why can't we just have one big
|
|
|
|
* list?
|
|
|
|
*/
|
|
|
|
static const int* rsp_headers[] = {
|
|
|
|
&hf_ajp13_unknown_header,
|
|
|
|
&hf_ajp13_content_type,
|
|
|
|
&hf_ajp13_content_language,
|
|
|
|
&hf_ajp13_content_length,
|
|
|
|
&hf_ajp13_date,
|
|
|
|
&hf_ajp13_last_modified,
|
|
|
|
&hf_ajp13_location,
|
|
|
|
&hf_ajp13_set_cookie,
|
|
|
|
&hf_ajp13_set_cookie2,
|
|
|
|
&hf_ajp13_servlet_engine,
|
|
|
|
&hf_ajp13_status,
|
|
|
|
&hf_ajp13_www_authenticate
|
|
|
|
};
|
|
|
|
|
|
|
|
static const int* req_headers[] = {
|
|
|
|
&hf_ajp13_unknown_header,
|
|
|
|
&hf_ajp13_accept,
|
|
|
|
&hf_ajp13_accept_charset,
|
|
|
|
&hf_ajp13_accept_encoding,
|
|
|
|
&hf_ajp13_accept_language,
|
|
|
|
&hf_ajp13_authorization,
|
|
|
|
&hf_ajp13_connection,
|
|
|
|
&hf_ajp13_content_type,
|
|
|
|
&hf_ajp13_content_length,
|
|
|
|
&hf_ajp13_cookie,
|
|
|
|
&hf_ajp13_cookie2,
|
|
|
|
&hf_ajp13_host,
|
|
|
|
&hf_ajp13_pragma,
|
|
|
|
&hf_ajp13_referer,
|
|
|
|
&hf_ajp13_user_agent
|
|
|
|
};
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-10-14 08:00:21 +00:00
|
|
|
static const int* req_attributes[] = {
|
|
|
|
&hf_ajp13_unknown_attribute,
|
|
|
|
&hf_ajp13_context,
|
|
|
|
&hf_ajp13_servlet_path,
|
|
|
|
&hf_ajp13_remote_user,
|
|
|
|
&hf_ajp13_auth_type,
|
|
|
|
&hf_ajp13_query_string,
|
|
|
|
&hf_ajp13_route,
|
|
|
|
&hf_ajp13_ssl_cert,
|
|
|
|
&hf_ajp13_ssl_cipher,
|
|
|
|
&hf_ajp13_ssl_session,
|
|
|
|
&hf_ajp13_req_attribute, /* 0x0A - name and value follows */
|
|
|
|
&hf_ajp13_ssl_key_size,
|
|
|
|
&hf_ajp13_secret,
|
|
|
|
&hf_ajp13_stored_method
|
|
|
|
};
|
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
typedef struct ajp13_conv_data {
|
|
|
|
int content_length;
|
2010-05-10 15:54:57 +00:00
|
|
|
gboolean was_get_body_chunk; /* XXX - not used */
|
2002-06-28 21:02:55 +00:00
|
|
|
} ajp13_conv_data;
|
|
|
|
|
|
|
|
typedef struct ajp13_frame_data {
|
2003-03-26 21:47:34 +00:00
|
|
|
gboolean is_request_body;
|
2002-06-28 21:02:55 +00:00
|
|
|
} ajp13_frame_data;
|
|
|
|
|
|
|
|
/* ajp13, in sort of a belt-and-suspenders move, encodes strings with
|
|
|
|
* both a leading length field, and a trailing null. Mostly, see
|
2011-09-22 03:10:30 +00:00
|
|
|
* ajpv13a.html. The returned length _includes_ the trailing null, if
|
2002-06-28 21:02:55 +00:00
|
|
|
* there is one.
|
2002-06-28 22:35:26 +00:00
|
|
|
*
|
|
|
|
* XXX - is there a tvbuff routine to handle this?
|
2002-06-28 21:02:55 +00:00
|
|
|
*/
|
2011-02-17 19:28:30 +00:00
|
|
|
static const gchar *
|
|
|
|
ajp13_get_nstring(tvbuff_t *tvb, gint offset, guint16* ret_len)
|
2002-06-28 21:02:55 +00:00
|
|
|
{
|
|
|
|
guint16 len;
|
2002-06-28 22:35:26 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
len = tvb_get_ntohs(tvb, offset);
|
2011-04-04 16:54:02 +00:00
|
|
|
|
2011-02-17 19:28:30 +00:00
|
|
|
if (ret_len)
|
2011-10-12 17:53:58 +00:00
|
|
|
*ret_len = len+1;
|
2011-04-04 16:54:02 +00:00
|
|
|
|
2011-10-14 07:45:22 +00:00
|
|
|
/* a size of 0xFFFF indicates a null string - no data follows */
|
|
|
|
if (len == 0xFFFF)
|
|
|
|
len = 0;
|
|
|
|
|
2011-02-17 19:28:30 +00:00
|
|
|
return tvb_format_text(tvb, offset+2, MIN(len, ITEM_LABEL_LENGTH));
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* dissect a response. more work to do here.
|
|
|
|
*/
|
|
|
|
static void
|
2009-12-09 23:14:31 +00:00
|
|
|
display_rsp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ajp13_tree, ajp13_conv_data* cd)
|
2002-06-28 21:02:55 +00:00
|
|
|
{
|
|
|
|
int pos = 0;
|
|
|
|
guint8 mcode = 0;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
/* MAGIC
|
|
|
|
*/
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_magic, tvb, pos, 2, ENC_NA);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
/* PDU LENGTH
|
|
|
|
*/
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_len, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
/* MESSAGE TYPE CODE
|
|
|
|
*/
|
|
|
|
mcode = tvb_get_guint8(tvb, pos);
|
2011-09-22 03:10:30 +00:00
|
|
|
col_append_str(pinfo->cinfo, COL_INFO, val_to_str(mcode, mtype_codes, "Unknown message code %u"));
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_code, tvb, pos, 1, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=1;
|
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
switch (mcode) {
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
case MTYPE_END_RESPONSE:
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_reusep, tvb, pos, 1, ENC_BIG_ENDIAN);
|
2012-04-30 21:15:17 +00:00
|
|
|
/*pos+=1;*/
|
2011-09-22 03:10:30 +00:00
|
|
|
break;
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
case MTYPE_SEND_HEADERS:
|
|
|
|
{
|
2011-02-17 19:28:30 +00:00
|
|
|
const gchar *rsmsg;
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 rsmsg_len;
|
|
|
|
guint16 nhdr;
|
|
|
|
guint16 rcode_num;
|
|
|
|
|
|
|
|
/* HTTP RESPONSE STATUS CODE
|
|
|
|
*/
|
|
|
|
rcode_num = tvb_get_ntohs(tvb, pos);
|
2011-09-22 03:10:30 +00:00
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, ":%d", rcode_num);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_rstatus, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
/* HTTP RESPONSE STATUS MESSAGE
|
|
|
|
*/
|
2011-02-17 19:28:30 +00:00
|
|
|
rsmsg = ajp13_get_nstring(tvb, pos, &rsmsg_len);
|
2011-09-22 03:10:30 +00:00
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, " %s", rsmsg);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-10-14 07:52:11 +00:00
|
|
|
proto_tree_add_string(ajp13_tree, hf_ajp13_rsmsg, tvb, pos, rsmsg_len+2, rsmsg);
|
|
|
|
pos+=rsmsg_len+2;
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
/* NUMBER OF HEADERS
|
|
|
|
*/
|
|
|
|
nhdr = tvb_get_ntohs(tvb, pos);
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_nhdr, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
/* HEADERS
|
|
|
|
*/
|
|
|
|
for(i=0; i<nhdr; i++) {
|
|
|
|
|
|
|
|
guint8 hcd;
|
|
|
|
guint8 hid;
|
2011-02-17 19:28:30 +00:00
|
|
|
const gchar *hval;
|
|
|
|
guint16 hval_len, hname_len;
|
2005-06-26 19:56:52 +00:00
|
|
|
const gchar* hname = NULL;
|
2011-10-14 07:52:11 +00:00
|
|
|
header_field_info *hfinfo;
|
|
|
|
int hpos = pos;
|
2011-04-27 16:25:05 +00:00
|
|
|
/* int cl = 0; TODO: Content-Length header (encoded by 0x08) is special */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* HEADER CODE/NAME
|
|
|
|
*/
|
|
|
|
hcd = tvb_get_guint8(tvb, pos);
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
if (hcd == 0xA0) {
|
|
|
|
pos+=1;
|
|
|
|
hid = tvb_get_guint8(tvb, pos);
|
|
|
|
pos+=1;
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
if (hid >= array_length(rsp_headers))
|
|
|
|
hid = 0;
|
|
|
|
|
|
|
|
hval = ajp13_get_nstring(tvb, pos, &hval_len);
|
|
|
|
|
|
|
|
if (ajp13_tree) {
|
|
|
|
hfinfo = proto_registrar_get_nth(*rsp_headers[hid]);
|
|
|
|
proto_tree_add_string_format(ajp13_tree, *rsp_headers[hid],
|
|
|
|
tvb, hpos, 2+hval_len+2, hval,
|
|
|
|
"%s: %s", hfinfo->name, hval);
|
|
|
|
}
|
|
|
|
pos+=hval_len+2;
|
2011-04-27 16:25:05 +00:00
|
|
|
#if 0
|
|
|
|
/* TODO: Content-Length header (encoded by 0x08) is special */
|
2002-06-28 21:02:55 +00:00
|
|
|
if (hid == 0x08)
|
|
|
|
cl = 1;
|
2011-04-27 16:25:05 +00:00
|
|
|
#endif
|
2002-06-28 21:02:55 +00:00
|
|
|
} else {
|
2011-02-17 19:28:30 +00:00
|
|
|
hname = ajp13_get_nstring(tvb, pos, &hname_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=hname_len+2;
|
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
hval = ajp13_get_nstring(tvb, pos, &hval_len);
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
if (ajp13_tree) {
|
|
|
|
proto_tree_add_string_format(ajp13_tree, hf_ajp13_additional_header,
|
|
|
|
tvb, hpos, hname_len+2+hval_len+2,
|
|
|
|
ep_strdup_printf("%s: %s", hname, hval),
|
|
|
|
"%s: %s", hname, hval);
|
|
|
|
}
|
|
|
|
pos+=hval_len+2;
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
}
|
2011-09-22 03:10:30 +00:00
|
|
|
break;
|
|
|
|
}
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
case MTYPE_GET_BODY_CHUNK:
|
|
|
|
{
|
2010-05-10 15:54:57 +00:00
|
|
|
guint16 rlen;
|
|
|
|
rlen = tvb_get_ntohs(tvb, pos);
|
|
|
|
cd->content_length = rlen;
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_rlen, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2012-04-30 21:15:17 +00:00
|
|
|
/*pos+=2;*/
|
2011-09-22 03:10:30 +00:00
|
|
|
break;
|
|
|
|
}
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
case MTYPE_CPONG:
|
|
|
|
break;
|
2006-07-22 01:44:10 +00:00
|
|
|
|
2011-09-22 03:10:30 +00:00
|
|
|
default:
|
2002-06-28 21:02:55 +00:00
|
|
|
/* MESSAGE DATA (COPOUT)
|
|
|
|
*/
|
|
|
|
if (ajp13_tree)
|
2011-10-15 18:46:26 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_data, tvb, pos+2, -1, ENC_UTF_8|ENC_NA);
|
2011-09-22 03:10:30 +00:00
|
|
|
break;
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* dissect a request body. see AJPv13.html, but the idea is that these
|
|
|
|
* packets, unlike all other packets, have no type field. you just
|
|
|
|
* sort of have to know that they're coming based on the previous
|
|
|
|
* packets.
|
|
|
|
*/
|
|
|
|
static void
|
2006-07-22 01:44:10 +00:00
|
|
|
display_req_body(tvbuff_t *tvb, proto_tree *ajp13_tree, ajp13_conv_data* cd)
|
2002-06-28 21:02:55 +00:00
|
|
|
{
|
|
|
|
/*printf("ajp13:display_req_body()\n");*/
|
2006-07-22 01:44:10 +00:00
|
|
|
/*
|
|
|
|
* In a resued connection this is never reset.
|
|
|
|
*/
|
2011-04-04 16:54:02 +00:00
|
|
|
guint16 content_length;
|
|
|
|
guint16 packet_length;
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-04-04 16:54:02 +00:00
|
|
|
int pos = 0;
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2011-04-04 16:54:02 +00:00
|
|
|
/* MAGIC
|
|
|
|
*/
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_magic, tvb, pos, 2, ENC_NA);
|
2011-04-04 16:54:02 +00:00
|
|
|
pos+=2;
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2011-04-04 16:54:02 +00:00
|
|
|
/* PACKET LENGTH
|
|
|
|
*/
|
|
|
|
packet_length = tvb_get_ntohs(tvb, pos);
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_len, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2011-04-04 16:54:02 +00:00
|
|
|
pos+=2;
|
2009-12-09 23:14:31 +00:00
|
|
|
|
2011-04-04 16:54:02 +00:00
|
|
|
if (packet_length == 0)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* We've got an empty packet:
|
|
|
|
* 0x12 0x34 0x00 0x00
|
|
|
|
* It signals that there is no more data in the body
|
2002-06-28 21:02:55 +00:00
|
|
|
*/
|
2011-04-04 16:54:02 +00:00
|
|
|
cd->content_length = 0;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* BODY (AS STRING)
|
|
|
|
*/
|
|
|
|
content_length = tvb_get_ntohs( tvb, pos);
|
2011-11-08 12:50:13 +00:00
|
|
|
if (content_length == 0) {
|
|
|
|
/* zero length content also signals no more body data */
|
|
|
|
cd->content_length = 0;
|
|
|
|
return;
|
|
|
|
}
|
2011-04-04 16:54:02 +00:00
|
|
|
cd->content_length -= content_length;
|
2011-10-15 18:46:26 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_data, tvb, pos+2, content_length, ENC_UTF_8|ENC_NA);
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* note that even if ajp13_tree is null on the first pass, we still
|
|
|
|
* need to dissect the packet in order to determine if there is a
|
|
|
|
* content-length, and thus if there is a subsequent automatic
|
|
|
|
* request-body transmitted in the next request packet. if there is a
|
|
|
|
* content-length, we record the fact in the conversation context.
|
|
|
|
* ref the top of this file for comments explaining the multi-pass
|
|
|
|
* thing.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
display_req_forward(tvbuff_t *tvb, packet_info *pinfo,
|
|
|
|
proto_tree *ajp13_tree,
|
|
|
|
ajp13_conv_data* cd)
|
|
|
|
{
|
|
|
|
int pos = 0;
|
|
|
|
guint8 meth;
|
|
|
|
guint8 cod;
|
2011-02-17 19:28:30 +00:00
|
|
|
const gchar *ver;
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 ver_len;
|
2011-02-17 19:28:30 +00:00
|
|
|
const gchar *uri;
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 uri_len;
|
2011-10-14 07:52:11 +00:00
|
|
|
const gchar *raddr;
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 raddr_len;
|
2011-10-14 07:52:11 +00:00
|
|
|
const gchar *rhost;
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 rhost_len;
|
2011-10-14 07:52:11 +00:00
|
|
|
const gchar *srv;
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 srv_len;
|
|
|
|
guint nhdr;
|
2002-06-28 22:35:26 +00:00
|
|
|
guint i;
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_magic, tvb, pos, 2, ENC_NA);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_len, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
/* PACKET CODE
|
|
|
|
*/
|
|
|
|
cod = tvb_get_guint8(tvb, 4);
|
2011-09-22 03:10:30 +00:00
|
|
|
if (ajp13_tree)
|
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_code, tvb, pos, 1, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=1;
|
2011-09-22 03:10:30 +00:00
|
|
|
if ( cod == MTYPE_CPING ) {
|
2009-09-24 20:21:23 +00:00
|
|
|
col_append_str(pinfo->cinfo, COL_INFO, "CPING" );
|
2006-07-22 01:44:10 +00:00
|
|
|
return;
|
|
|
|
}
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* HTTP METHOD (ENCODED AS INTEGER)
|
|
|
|
*/
|
2011-09-22 03:10:30 +00:00
|
|
|
meth = tvb_get_guint8(tvb, pos);
|
|
|
|
col_append_str(pinfo->cinfo, COL_INFO, val_to_str(meth, http_method_codes, "Unknown method %u"));
|
|
|
|
if (ajp13_tree)
|
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_method, tvb, pos, 1, ENC_BIG_ENDIAN);
|
|
|
|
pos+=1;
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* HTTP VERSION STRING
|
|
|
|
*/
|
2011-02-17 19:28:30 +00:00
|
|
|
ver = ajp13_get_nstring(tvb, pos, &ver_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-10-14 07:52:11 +00:00
|
|
|
proto_tree_add_string(ajp13_tree, hf_ajp13_ver, tvb, pos, ver_len+2, ver);
|
|
|
|
pos=pos+ver_len+2; /* skip over size + chars + trailing null */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* URI
|
|
|
|
*/
|
2011-02-17 19:28:30 +00:00
|
|
|
uri = ajp13_get_nstring(tvb, pos, &uri_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-10-14 07:52:11 +00:00
|
|
|
proto_tree_add_string(ajp13_tree, hf_ajp13_uri, tvb, pos, uri_len+2, uri);
|
|
|
|
pos=pos+uri_len+2; /* skip over size + chars + trailing null */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
|
2011-09-26 05:52:58 +00:00
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, " %s %s", uri, ver);
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
|
|
|
|
/* REMOTE ADDRESS
|
|
|
|
*/
|
2011-10-14 07:52:11 +00:00
|
|
|
raddr = ajp13_get_nstring(tvb, pos, &raddr_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-10-14 07:52:11 +00:00
|
|
|
proto_tree_add_string(ajp13_tree, hf_ajp13_raddr, tvb, pos, raddr_len+2, raddr);
|
|
|
|
pos=pos+raddr_len+2; /* skip over size + chars + trailing null */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* REMOTE HOST
|
|
|
|
*/
|
2011-10-14 07:52:11 +00:00
|
|
|
rhost = ajp13_get_nstring(tvb, pos, &rhost_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-10-14 07:52:11 +00:00
|
|
|
proto_tree_add_string(ajp13_tree, hf_ajp13_rhost, tvb, pos, rhost_len+2, rhost);
|
|
|
|
pos=pos+rhost_len+2; /* skip over size + chars + trailing null */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* SERVER NAME
|
|
|
|
*/
|
2011-10-14 07:52:11 +00:00
|
|
|
srv = ajp13_get_nstring(tvb, pos, &srv_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-10-14 07:52:11 +00:00
|
|
|
proto_tree_add_string(ajp13_tree, hf_ajp13_srv, tvb, pos, srv_len+2, srv);
|
|
|
|
pos=pos+srv_len+2; /* skip over size + chars + trailing null */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* SERVER PORT
|
|
|
|
*/
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_port, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
|
|
|
|
/* IS SSL?
|
|
|
|
*/
|
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_sslp, tvb, pos, 1, ENC_NA);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=1;
|
|
|
|
|
|
|
|
/* NUM HEADERS
|
|
|
|
*/
|
|
|
|
nhdr = tvb_get_ntohs(tvb, pos);
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
if (ajp13_tree)
|
2011-09-22 03:10:30 +00:00
|
|
|
proto_tree_add_item(ajp13_tree, hf_ajp13_nhdr, tvb, pos, 2, ENC_BIG_ENDIAN);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=2;
|
|
|
|
cd->content_length = 0;
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
/* HEADERS
|
|
|
|
*/
|
|
|
|
for(i=0; i<nhdr; i++) {
|
|
|
|
|
|
|
|
guint8 hcd;
|
|
|
|
guint8 hid;
|
2005-06-26 19:56:52 +00:00
|
|
|
const gchar* hname = NULL;
|
2011-10-14 07:52:11 +00:00
|
|
|
header_field_info *hfinfo;
|
|
|
|
int hpos = pos;
|
2002-06-28 21:02:55 +00:00
|
|
|
int cl = 0;
|
2011-02-17 19:28:30 +00:00
|
|
|
const gchar *hval;
|
|
|
|
guint16 hval_len, hname_len;
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
/* HEADER CODE/NAME
|
|
|
|
*/
|
|
|
|
hcd = tvb_get_guint8(tvb, pos);
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
if (hcd == 0xA0) {
|
|
|
|
pos+=1;
|
|
|
|
hid = tvb_get_guint8(tvb, pos);
|
|
|
|
pos+=1;
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
if (hid >= array_length(req_headers))
|
|
|
|
hid = 0;
|
|
|
|
|
|
|
|
hval = ajp13_get_nstring(tvb, pos, &hval_len);
|
|
|
|
|
|
|
|
if (ajp13_tree) {
|
|
|
|
hfinfo = proto_registrar_get_nth(*req_headers[hid]);
|
|
|
|
proto_tree_add_string_format(ajp13_tree, *req_headers[hid],
|
|
|
|
tvb, hpos, 2+hval_len+2, hval,
|
|
|
|
"%s: %s", hfinfo->name, hval);
|
|
|
|
}
|
|
|
|
pos+=hval_len+2;
|
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
if (hid == 0x08)
|
|
|
|
cl = 1;
|
|
|
|
} else {
|
2011-02-17 19:28:30 +00:00
|
|
|
hname = ajp13_get_nstring(tvb, pos, &hname_len);
|
2002-06-28 21:02:55 +00:00
|
|
|
pos+=hname_len+2;
|
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
hval = ajp13_get_nstring(tvb, pos, &hval_len);
|
2003-01-27 22:19:10 +00:00
|
|
|
|
2011-10-14 07:52:11 +00:00
|
|
|
if (ajp13_tree) {
|
|
|
|
proto_tree_add_string_format(ajp13_tree, hf_ajp13_additional_header,
|
|
|
|
tvb, hpos, hname_len+2+hval_len+2,
|
|
|
|
ep_strdup_printf("%s: %s", hname, hval),
|
|
|
|
"%s: %s", hname, hval);
|
|
|
|
}
|
|
|
|
pos+=hval_len+2;
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
2011-10-14 07:52:11 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
if (cl) {
|
|
|
|
cl = atoi(hval);
|
|
|
|
cd->content_length = cl;
|
|
|
|
}
|
|
|
|
}
|
2011-10-14 08:00:21 +00:00
|
|
|
|
|
|
|
/* ATTRIBUTES
|
|
|
|
*/
|
2011-11-15 21:22:01 +00:00
|
|
|
while(tvb_reported_length_remaining(tvb, pos) > 0) {
|
2011-10-14 08:00:21 +00:00
|
|
|
guint8 aid;
|
|
|
|
const gchar* aname = NULL;
|
|
|
|
const gchar* aval;
|
|
|
|
guint16 aval_len, aname_len;
|
|
|
|
|
|
|
|
header_field_info *hfinfo;
|
|
|
|
int apos = pos;
|
|
|
|
|
|
|
|
/* ATTRIBUTE CODE/NAME
|
|
|
|
*/
|
|
|
|
aid = tvb_get_guint8(tvb, pos);
|
|
|
|
pos+=1;
|
|
|
|
|
|
|
|
if (aid == 0xFF) {
|
|
|
|
/* request terminator */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (aid == 0x0A) {
|
|
|
|
/* req_attribute - name and value follow */
|
|
|
|
|
|
|
|
aname = ajp13_get_nstring(tvb, pos, &aname_len);
|
|
|
|
pos+=aname_len+2;
|
|
|
|
|
|
|
|
aval = ajp13_get_nstring(tvb, pos, &aval_len);
|
|
|
|
pos+=aval_len+2;
|
|
|
|
|
|
|
|
if (ajp13_tree) {
|
|
|
|
proto_tree_add_string_format(ajp13_tree, hf_ajp13_req_attribute,
|
|
|
|
tvb, apos, 1+aname_len+2+aval_len+2,
|
2012-08-14 16:29:38 +00:00
|
|
|
ep_strdup_printf("%s: %s", aname, aval),
|
2011-10-14 08:00:21 +00:00
|
|
|
"%s: %s", aname, aval);
|
|
|
|
}
|
|
|
|
} else if (aid == 0x0B ) {
|
|
|
|
/* ssl_key_length */
|
|
|
|
if (ajp13_tree) {
|
|
|
|
proto_tree_add_uint(ajp13_tree, hf_ajp13_ssl_key_size,
|
|
|
|
tvb, apos, 1+2, tvb_get_ntohs(tvb, pos));
|
|
|
|
}
|
|
|
|
pos+=2;
|
|
|
|
} else {
|
|
|
|
|
|
|
|
if (aid >= array_length(req_attributes))
|
|
|
|
aid = 0;
|
|
|
|
|
|
|
|
hfinfo = proto_registrar_get_nth(*req_attributes[aid]);
|
|
|
|
aval = ajp13_get_nstring(tvb, pos, &aval_len);
|
|
|
|
pos+=aval_len+2;
|
|
|
|
|
|
|
|
if (ajp13_tree) {
|
|
|
|
proto_tree_add_string_format(ajp13_tree, *req_attributes[aid],
|
|
|
|
tvb, apos, 1+aval_len+2, aval,
|
|
|
|
"%s: %s", hfinfo->name, aval);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-05-21 04:49:01 +00:00
|
|
|
/* main dissector function. wireshark calls it for segments in both
|
2002-06-28 21:02:55 +00:00
|
|
|
* directions.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
dissect_ajp13_tcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
guint16 mag;
|
2011-04-27 16:25:05 +00:00
|
|
|
/* guint16 len; */
|
2002-06-28 21:02:55 +00:00
|
|
|
conversation_t *conv = NULL;
|
|
|
|
ajp13_conv_data *cd = NULL;
|
|
|
|
proto_tree *ajp13_tree = NULL;
|
|
|
|
ajp13_frame_data* fd = NULL;
|
|
|
|
|
|
|
|
/* conversational state really only does us good during the first
|
|
|
|
* in-order traversal
|
|
|
|
*/
|
2010-05-13 18:28:34 +00:00
|
|
|
conv = find_or_create_conversation(pinfo);
|
|
|
|
|
2003-03-26 21:47:34 +00:00
|
|
|
cd = (ajp13_conv_data*)conversation_get_proto_data(conv, proto_ajp13);
|
|
|
|
if (!cd) {
|
2012-06-04 13:52:46 +00:00
|
|
|
cd = se_new(ajp13_conv_data);
|
2002-06-28 21:02:55 +00:00
|
|
|
cd->content_length = 0;
|
2003-03-26 21:47:34 +00:00
|
|
|
cd->was_get_body_chunk = FALSE;
|
2002-06-28 21:02:55 +00:00
|
|
|
conversation_add_proto_data(conv, proto_ajp13, cd);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* we use the per segment user data to record the conversational
|
|
|
|
* state for use later on when we're called out of order (see
|
|
|
|
* comments at top of this file)
|
|
|
|
*/
|
|
|
|
fd = (ajp13_frame_data*)p_get_proto_data(pinfo->fd, proto_ajp13);
|
|
|
|
if (!fd) {
|
|
|
|
/*printf("ajp13:dissect_ajp13_common():no frame data, adding");*/
|
|
|
|
/* since there's no per-packet user data, this must be the first
|
|
|
|
* time we've see the packet, and it must be the first "in order"
|
|
|
|
* pass through the data.
|
|
|
|
*/
|
2012-06-04 13:52:46 +00:00
|
|
|
fd = se_new(ajp13_frame_data);
|
2002-06-28 21:02:55 +00:00
|
|
|
p_add_proto_data(pinfo->fd, proto_ajp13, fd);
|
2003-03-26 21:47:34 +00:00
|
|
|
fd->is_request_body = FALSE;
|
2002-06-28 21:02:55 +00:00
|
|
|
if (cd->content_length) {
|
|
|
|
/* this is screwy, see AJPv13.html. the idea is that if the
|
|
|
|
* request has a body (as determined by the content-length
|
|
|
|
* header), then there's always an immediate follow-up PDU with
|
|
|
|
* no GET_BODY_CHUNK from the container.
|
|
|
|
*/
|
2003-03-26 21:47:34 +00:00
|
|
|
fd->is_request_body = TRUE;
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-08-09 07:36:13 +00:00
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
2002-08-28 21:04:11 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
mag = tvb_get_ntohs(tvb, 0);
|
2011-04-27 16:25:05 +00:00
|
|
|
/* len = tvb_get_ntohs(tvb, 2); */
|
2002-06-28 21:02:55 +00:00
|
|
|
|
2009-08-09 06:26:46 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "AJP13");
|
2011-09-26 05:52:58 +00:00
|
|
|
|
|
|
|
if (mag == 0x1234 && !fd->is_request_body)
|
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, "%d:REQ:", conv->index);
|
|
|
|
else if (mag == 0x1234 && fd->is_request_body)
|
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, "%d:REQ:Body", conv->index);
|
|
|
|
else if (mag == 0x4142)
|
|
|
|
col_append_fstr(pinfo->cinfo, COL_INFO, "%d:RSP:", conv->index);
|
|
|
|
else
|
|
|
|
col_set_str(pinfo->cinfo, COL_INFO, "AJP13 Error?");
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
if (tree) {
|
|
|
|
proto_item *ti;
|
2011-09-22 03:10:30 +00:00
|
|
|
ti = proto_tree_add_item(tree, proto_ajp13, tvb, 0, -1, ENC_NA);
|
2002-06-28 21:02:55 +00:00
|
|
|
ajp13_tree = proto_item_add_subtree(ti, ett_ajp13);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (mag == 0x1234) {
|
|
|
|
|
|
|
|
if (fd->is_request_body)
|
2006-07-22 01:44:10 +00:00
|
|
|
display_req_body(tvb, ajp13_tree, cd);
|
2002-06-28 21:02:55 +00:00
|
|
|
else
|
|
|
|
display_req_forward(tvb, pinfo, ajp13_tree, cd);
|
|
|
|
|
|
|
|
} else if (mag == 0x4142) {
|
|
|
|
|
2009-12-09 23:14:31 +00:00
|
|
|
display_rsp(tvb, pinfo, ajp13_tree, cd);
|
2002-06-28 21:02:55 +00:00
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* given the first chunk of the AJP13 pdu, extract out and return the
|
|
|
|
* packet length. see comments in packet-tcp.c:tcp_dissect_pdus().
|
|
|
|
*/
|
|
|
|
static guint
|
2006-10-31 09:29:07 +00:00
|
|
|
get_ajp13_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset)
|
2002-06-28 21:02:55 +00:00
|
|
|
{
|
2011-04-27 16:25:05 +00:00
|
|
|
/*guint16 magic;*/
|
2002-06-28 21:02:55 +00:00
|
|
|
guint16 plen;
|
2011-04-27 16:25:05 +00:00
|
|
|
/*magic = tvb_get_ntohs(tvb, offset); */
|
2002-06-28 21:02:55 +00:00
|
|
|
plen = tvb_get_ntohs(tvb, offset+2);
|
|
|
|
plen += 4;
|
|
|
|
return plen;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
/* Code to actually dissect the packets.
|
2002-06-28 21:02:55 +00:00
|
|
|
*/
|
|
|
|
static void
|
|
|
|
dissect_ajp13(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
|
|
|
{
|
|
|
|
/* Set up structures needed to add the protocol subtree and manage it
|
|
|
|
*/
|
|
|
|
tcp_dissect_pdus(tvb, pinfo, tree,
|
|
|
|
TRUE, /* desegment or not */
|
|
|
|
4, /* magic + length */
|
|
|
|
get_ajp13_pdu_len, /* use first 4, calc data len */
|
|
|
|
dissect_ajp13_tcp_pdu); /* the naive dissector */
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_register_ajp13(void)
|
2002-08-28 21:04:11 +00:00
|
|
|
{
|
2002-06-28 21:02:55 +00:00
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_ajp13_magic,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "Magic", "ajp13.magic", FT_BYTES, BASE_NONE, NULL, 0x0, "Magic Number",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_len,
|
2002-06-28 22:35:26 +00:00
|
|
|
{ "Length", "ajp13.len", FT_UINT16, BASE_DEC, NULL, 0x0, "Data Length",
|
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_code,
|
2011-09-22 03:10:30 +00:00
|
|
|
{ "Code", "ajp13.code", FT_UINT32, BASE_DEC, VALS(mtype_codes), 0x0, "Type Code",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_method,
|
2011-09-22 03:10:30 +00:00
|
|
|
{ "Method", "ajp13.method", FT_UINT8, BASE_DEC, VALS(http_method_codes), 0x0, "HTTP Method",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_ver,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "Version", "ajp13.ver", FT_STRING, BASE_NONE, NULL, 0x0, "HTTP Version",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_uri,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "URI", "ajp13.uri", FT_STRING, BASE_NONE, NULL, 0x0, "HTTP URI",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_raddr,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "RADDR", "ajp13.raddr", FT_STRING, BASE_NONE, NULL, 0x0, "Remote Address",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_rhost,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "RHOST", "ajp13.rhost", FT_STRING, BASE_NONE, NULL, 0x0, "Remote Host",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_srv,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "SRV", "ajp13.srv", FT_STRING, BASE_NONE, NULL, 0x0, "Server",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_port,
|
2010-09-23 21:46:31 +00:00
|
|
|
{ "PORT", "ajp13.port", FT_UINT16, BASE_DEC, NULL, 0x0, NULL,
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_sslp,
|
2011-09-22 03:10:30 +00:00
|
|
|
{ "SSLP", "ajp13.sslp", FT_BOOLEAN, BASE_NONE, NULL, 0x0, "Is SSL?",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_nhdr,
|
2002-06-28 22:35:26 +00:00
|
|
|
{ "NHDR", "ajp13.nhdr", FT_UINT16, BASE_DEC, NULL, 0x0, "Num Headers",
|
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
2011-10-14 07:52:11 +00:00
|
|
|
/* response headers */
|
|
|
|
{ &hf_ajp13_unknown_header,
|
|
|
|
{ "unknown_header", "ajp13.unknown_header", FT_STRING, BASE_NONE, NULL, 0x0, "Unknown Header Type",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_additional_header,
|
|
|
|
{ "additional_header", "ajp13.additional_header", FT_STRING, BASE_NONE, NULL, 0x0, "Additional Header Type",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_content_type,
|
|
|
|
{ "Content-Type", "ajp13.content_type", FT_STRING, BASE_NONE, NULL, 0x0, "Content-Type Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_content_language,
|
|
|
|
{ "Content-Language", "ajp13.content_language", FT_STRING, BASE_NONE, NULL, 0x0, "Content-Language Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_content_length,
|
|
|
|
{ "Content-Length", "ajp13.content_length", FT_STRING, BASE_NONE, NULL, 0x0, "Content-Length header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_date,
|
|
|
|
{ "Date", "ajp13.date", FT_STRING, BASE_NONE, NULL, 0x0, "Date Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_last_modified,
|
|
|
|
{ "Last-Modified", "ajp13.last_modified", FT_STRING, BASE_NONE, NULL, 0x0, "Last Modified Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_location,
|
|
|
|
{ "Location", "ajp13.location", FT_STRING, BASE_NONE, NULL, 0x0, "Location Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_set_cookie,
|
|
|
|
{ "Set-Cookie", "ajp13.set_cookie", FT_STRING, BASE_NONE, NULL, 0x0, "Set-Cookie Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_set_cookie2,
|
|
|
|
{ "Set-Cookie2", "ajp13.set_cookie2", FT_STRING, BASE_NONE, NULL, 0x0, "Set-Cookie2 Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_servlet_engine,
|
|
|
|
{ "Servlet-Engine", "ajp13.servlet_engine", FT_STRING, BASE_NONE, NULL, 0x0, "Servlet-Engine Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_status,
|
|
|
|
{ "Status", "ajp13.status", FT_STRING, BASE_NONE, NULL, 0x0, "Status Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_www_authenticate,
|
|
|
|
{ "WWW-Authenticate", "ajp13.www_authenticate", FT_STRING, BASE_NONE, NULL, 0x0, "WWW-Authenticate Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
/* request headers */
|
|
|
|
{ &hf_ajp13_accept,
|
|
|
|
{ "Accept", "ajp13.accept", FT_STRING, BASE_NONE, NULL, 0x0, "Accept Header",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
2011-10-14 07:52:11 +00:00
|
|
|
{ &hf_ajp13_accept_charset,
|
|
|
|
{ "Accept-Charset", "ajp13.accept_charset", FT_STRING, BASE_NONE, NULL, 0x0, "Accept-Charset Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_accept_encoding,
|
|
|
|
{ "Accept-Encoding", "ajp13.accept_encoding", FT_STRING, BASE_NONE, NULL, 0x0, "Accept-Encoding Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_accept_language,
|
|
|
|
{ "Accept-Language", "ajp13.accept_language", FT_STRING, BASE_NONE, NULL, 0x0, "Accept-Language Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_authorization,
|
|
|
|
{ "Authorization", "ajp13.authorization", FT_STRING, BASE_NONE, NULL, 0x0, "Authorization Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_connection,
|
|
|
|
{ "Connection", "ajp13.connection", FT_STRING, BASE_NONE, NULL, 0x0, "Connection Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_cookie,
|
|
|
|
{ "Cookie", "ajp13.cookie", FT_STRING, BASE_NONE, NULL, 0x0, "Cookie Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_cookie2,
|
|
|
|
{ "Cookie2", "ajp13.cookie2", FT_STRING, BASE_NONE, NULL, 0x0, "Cookie2 Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_host,
|
|
|
|
{ "Host", "ajp13.host", FT_STRING, BASE_NONE, NULL, 0x0, "Host Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_pragma,
|
|
|
|
{ "Pragma", "ajp13.pragma", FT_STRING, BASE_NONE, NULL, 0x0, "Pragma Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_referer,
|
|
|
|
{ "Referer", "ajp13.referer", FT_STRING, BASE_NONE, NULL, 0x0, "Referer Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_user_agent,
|
|
|
|
{ "User-Agent", "ajp13.user_agent", FT_STRING, BASE_NONE, NULL, 0x0, "User-Agent Header",
|
|
|
|
HFILL }
|
|
|
|
},
|
2011-10-14 08:00:21 +00:00
|
|
|
/* request attributes */
|
|
|
|
{ &hf_ajp13_unknown_attribute,
|
|
|
|
{ "unknown_attribute", "ajp13.unknown_attribute", FT_STRING, BASE_NONE, NULL, 0x0, "Unknown Attribute Type",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_req_attribute,
|
|
|
|
{ "req_attribute", "ajp13.req_attribute", FT_STRING, BASE_NONE, NULL, 0x0, "Additional Attribute Type",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_context,
|
|
|
|
{ "Context", "ajp13.context", FT_STRING, BASE_NONE, NULL, 0x0, "Context Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_servlet_path,
|
|
|
|
{ "Servlet-Path", "ajp13.servlet_path", FT_STRING, BASE_NONE, NULL, 0x0, "Servlet-Path Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_remote_user,
|
|
|
|
{ "Remote-User", "ajp13.remote_user", FT_STRING, BASE_NONE, NULL, 0x0, "Remote-User Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_auth_type,
|
|
|
|
{ "Auth-Type", "ajp13.auth_type", FT_STRING, BASE_NONE, NULL, 0x0, "Auth-Type Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_query_string,
|
|
|
|
{ "Query-String", "ajp13.query_string", FT_STRING, BASE_NONE, NULL, 0x0, "Query-String Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_route,
|
|
|
|
{ "Route", "ajp13.route", FT_STRING, BASE_NONE, NULL, 0x0, "Route Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_ssl_cert,
|
|
|
|
{ "SSL-Cert", "ajp13.ssl_cert", FT_STRING, BASE_NONE, NULL, 0x0, "SSL-Cert Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_ssl_cipher,
|
|
|
|
{ "SSL-Cipher", "ajp13.ssl_cipher", FT_STRING, BASE_NONE, NULL, 0x0, "SSL-Cipher Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_ssl_session,
|
|
|
|
{ "SSL-Session", "ajp13.ssl_session", FT_STRING, BASE_NONE, NULL, 0x0, "SSL-Session Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_ssl_key_size,
|
|
|
|
{ "SSL-Key-Size", "ajp13.ssl_key_size", FT_UINT16, BASE_DEC, NULL, 0x0, "SSL-Key-Size Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_secret,
|
|
|
|
{ "Secret", "ajp13.secret", FT_STRING, BASE_NONE, NULL, 0x0, "Secret Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
|
|
|
{ &hf_ajp13_stored_method,
|
|
|
|
{ "Stored-Method", "ajp13.stored_method", FT_STRING, BASE_NONE, NULL, 0x0, "Stored-Method Attribute",
|
|
|
|
HFILL }
|
|
|
|
},
|
2011-10-14 07:52:11 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
{ &hf_ajp13_rlen,
|
2002-06-28 22:35:26 +00:00
|
|
|
{ "RLEN", "ajp13.rlen", FT_UINT16, BASE_DEC, NULL, 0x0, "Requested Length",
|
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_reusep,
|
2002-06-28 22:35:26 +00:00
|
|
|
{ "REUSEP", "ajp13.reusep", FT_UINT8, BASE_DEC, NULL, 0x0, "Reuse Connection?",
|
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_rstatus,
|
2002-06-28 22:35:26 +00:00
|
|
|
{ "RSTATUS", "ajp13.rstatus", FT_UINT16, BASE_DEC, NULL, 0x0, "HTTP Status Code",
|
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_rsmsg,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "RSMSG", "ajp13.rmsg", FT_STRING, BASE_NONE, NULL, 0x0, "HTTP Status Message",
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
{ &hf_ajp13_data,
|
From Kovarththanan Rajaratnam via bug 3548:
(1) Trailing/leading spaces are removed from 'name's/'blurb's
(2) Duplicate 'blurb's are replaced with NULL
(3) Empty ("") 'blurb's are replaced with NULL
(4) BASE_NONE, NULL, 0x0 are used for 'display', 'strings' and 'bitmask' fields
for FT_NONE, FT_BYTES, FT_IPv4, FT_IPv6, FT_ABSOLUTE_TIME, FT_RELATIVE_TIME,
FT_PROTOCOL, FT_STRING and FT_STRINGZ field types
(5) Only allow non-zero value for 'display' if 'bitmask' is non-zero
svn path=/trunk/; revision=28770
2009-06-18 21:30:42 +00:00
|
|
|
{ "Data", "ajp13.data", FT_STRING, BASE_NONE, NULL, 0x0, NULL,
|
2002-06-28 22:35:26 +00:00
|
|
|
HFILL }
|
2002-06-28 21:02:55 +00:00
|
|
|
},
|
|
|
|
};
|
|
|
|
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_ajp13,
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Register the protocol name and description
|
|
|
|
*/
|
|
|
|
proto_ajp13 = proto_register_protocol("Apache JServ Protocol v1.3", "AJP13", "ajp13");
|
|
|
|
|
|
|
|
proto_register_field_array(proto_ajp13, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2003-03-26 21:47:34 +00:00
|
|
|
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_ajp13(void)
|
|
|
|
{
|
|
|
|
dissector_handle_t ajp13_handle;
|
|
|
|
ajp13_handle = create_dissector_handle(dissect_ajp13, proto_ajp13);
|
2010-12-20 05:35:29 +00:00
|
|
|
dissector_add_uint("tcp.port", 8009, ajp13_handle);
|
2002-06-28 21:02:55 +00:00
|
|
|
}
|