epan/dissectors/packet-fcgi.c

   1 /* packet-fcgi.c
   2  * Routines for FastCGI dissection
   3  * Copyright 2010, Tom Hughes <tom@compton.nu>
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * SPDX-License-Identifier: GPL-2.0-or-later
  10  */
  11
  12 #include "config.h"
  13
  14 #include <epan/packet.h>
  15 #include "packet-tcp.h"
  16
  17 void proto_register_fcgi(void);
  18 void proto_reg_handoff_fcgi(void);
  19
  20 static int proto_fcgi;
  21
  22 static int hf_fcgi_version;
  23 static int hf_fcgi_type;
  24 static int hf_fcgi_id;
  25 static int hf_fcgi_content_length;
  26 static int hf_fcgi_padding_length;
  27 static int hf_fcgi_content_data;
  28 static int hf_fcgi_padding_data;
  29 static int hf_fcgi_begin_request_role;
  30 static int hf_fcgi_begin_request_flags;
  31 static int hf_fcgi_begin_request_keep_conn;
  32 static int hf_fcgi_end_request_app_status;
  33 static int hf_fcgi_end_request_protocol_status;
  34 static int hf_fcgi_nv_name;
  35
  36 static int ett_fcgi;
  37 static int ett_fcgi_begin_request;
  38 static int ett_fcgi_abort_request;
  39 static int ett_fcgi_end_request;
  40 static int ett_fcgi_params;
  41
  42 static dissector_handle_t fcgi_handle;
  43
  44 #define FCGI_BEGIN_REQUEST       1
  45 #define FCGI_ABORT_REQUEST       2
  46 #define FCGI_END_REQUEST         3
  47 #define FCGI_PARAMS              4
  48 #define FCGI_STDIN               5
  49 #define FCGI_STDOUT              6
  50 #define FCGI_STDERR              7
  51 #define FCGI_DATA                8
  52 #define FCGI_GET_VALUES          9
  53 #define FCGI_GET_VALUES_RESULT  10
  54 #define FCGI_UNKNOWN_TYPE       11
  55
  56 static const value_string record_types[] = {
  57    { 1, "FCGI_BEGIN_REQUEST" },
  58    { 2, "FCGI_ABORT_REQUEST" },
  59    { 3, "FCGI_END_REQUEST" },
  60    { 4, "FCGI_PARAMS" },
  61    { 5, "FCGI_STDIN" },
  62    { 6, "FCGI_STDOUT" },
  63    { 7, "FCGI_STDERR" },
  64    { 8, "FCGI_DATA" },
  65    { 9, "FCGI_GET_VALUES" },
  66    { 10, "FCGI_GET_VALUES_RESULT" },
  67    { 11, "FCGI_UNKNOWN_TYPE" },
  68    { 0, NULL }
  69 };
  70
  71 static const value_string application_roles[] = {
  72    { 1, "FCGI_RESPONDER" },
  73    { 2, "FCGI_AUTHORIZER" },
  74    { 3, "FCGI_FILTER" },
  75    { 0, NULL }
  76 };
  77
  78 #define FCGI_KEEP_CONN  1
  79
  80 static const value_string protocol_statuses[] = {
  81    { 0, "FCGI_REQUEST_COMPLETE" },
  82    { 1, "FCGI_CANT_MPX_CONN" },
  83    { 2, "FCGI_OVERLOADED" },
  84    { 3, "FCGI_UNKNOWN_ROLE" },
  85    { 0, NULL }
  86 };
  87
  88 static void
  89 dissect_nv_pairs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *fcgi_tree, int offset, uint16_t len)
  90 {
  91    int end_offset = offset + len;
  92
  93    while (offset < end_offset) {
  94       int start_offset = offset;
  95       uint32_t namelen;
  96       uint32_t valuelen;
  97       char *name;
  98       char *value;
  99
 100       namelen = tvb_get_uint8(tvb, offset);
 101       if ((namelen & 0x80) == 0) {
 102          offset += 1;
 103       } else {
 104          namelen = tvb_get_ntohl(tvb, offset) & 0x7FFFFFFF;
 105          offset += 4;
 106       }
 107
 108       valuelen = tvb_get_uint8(tvb, offset);
 109       if ((valuelen & 0x80) == 0) {
 110          offset += 1;
 111       } else {
 112          valuelen = tvb_get_ntohl(tvb, offset) & 0x7FFFFFFF;
 113          offset += 4;
 114       }
 115
 116       name = tvb_get_string_enc(pinfo->pool, tvb, offset, namelen, ENC_ASCII);
 117       offset += namelen;
 118
 119       if (valuelen > 0) {
 120          value = tvb_get_string_enc(pinfo->pool, tvb, offset, valuelen, ENC_ASCII);
 121          offset += valuelen;
 122
 123          proto_tree_add_string_format(fcgi_tree, hf_fcgi_nv_name, tvb, start_offset, offset - start_offset,
 124                             name, "%s = %s", name, value);
 125       } else {
 126          proto_tree_add_string_format(fcgi_tree, hf_fcgi_nv_name, tvb, start_offset, offset - start_offset,
 127                             name, "%s", name);
 128       }
 129    }
 130 }
 131
 132 static int
 133 dissect_begin_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *fcgi_tree, int offset, uint16_t len)
 134 {
 135    proto_tree *br_tree;
 136
 137    br_tree = proto_tree_add_subtree(fcgi_tree, tvb, offset, len, ett_fcgi_begin_request, NULL, "Begin Request:");
 138
 139    proto_tree_add_item(br_tree, hf_fcgi_begin_request_role, tvb, offset, 2, ENC_BIG_ENDIAN);
 140    offset += 2;
 141
 142    proto_tree_add_item(br_tree, hf_fcgi_begin_request_flags, tvb, offset, 1, ENC_BIG_ENDIAN);
 143    proto_tree_add_item(br_tree, hf_fcgi_begin_request_keep_conn, tvb, offset, 1, ENC_BIG_ENDIAN);
 144    offset += 1;
 145
 146    offset += 5;
 147
 148    return offset;
 149 }
 150
 151 static void
 152 dissect_abort_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *fcgi_tree, int offset, uint16_t len)
 153 {
 154    proto_tree_add_subtree(fcgi_tree, tvb, offset, len, ett_fcgi_abort_request, NULL, "Abort Request:");
 155
 156    return;
 157 }
 158
 159 static int
 160 dissect_end_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *fcgi_tree, int offset, uint16_t len)
 161 {
 162    proto_tree *er_tree;
 163
 164    er_tree = proto_tree_add_subtree(fcgi_tree, tvb, offset, len, ett_fcgi_end_request, NULL, "End Request:");
 165
 166    proto_tree_add_item(er_tree, hf_fcgi_end_request_app_status, tvb, offset, 4, ENC_BIG_ENDIAN);
 167    offset += 4;
 168
 169    proto_tree_add_item(er_tree, hf_fcgi_end_request_protocol_status, tvb, offset, 1, ENC_BIG_ENDIAN);
 170    offset += 1;
 171
 172    offset += 3;
 173
 174    return offset;
 175 }
 176
 177 static void
 178 dissect_params(tvbuff_t *tvb, packet_info *pinfo, proto_tree *fcgi_tree, int offset, uint16_t len)
 179 {
 180    proto_tree *p_tree;
 181
 182    p_tree = proto_tree_add_subtree(fcgi_tree, tvb, offset, len, ett_fcgi_params, NULL, "Params:");
 183
 184    dissect_nv_pairs(tvb, pinfo, p_tree, offset, len);
 185
 186    return;
 187 }
 188
 189 static void
 190 dissect_get_values(tvbuff_t *tvb, packet_info *pinfo, proto_tree *fcgi_tree, int offset, uint16_t len)
 191 {
 192    proto_tree *gv_tree;
 193
 194    gv_tree = proto_tree_add_subtree(fcgi_tree, tvb, offset, len, ett_fcgi_params, NULL, "Get Values:");
 195
 196    dissect_nv_pairs(tvb, pinfo, gv_tree, offset, len);
 197
 198    return;
 199 }
 200
 201 static void
 202 dissect_get_values_result(tvbuff_t *tvb, packet_info *pinfo, proto_tree *fcgi_tree, int offset, uint16_t len)
 203 {
 204    proto_tree *gvr_tree;
 205
 206    gvr_tree = proto_tree_add_subtree(fcgi_tree, tvb, offset, len, ett_fcgi_params, NULL, "Get Values:");
 207
 208    dissect_nv_pairs(tvb, pinfo, gvr_tree, offset, len);
 209
 210    return;
 211 }
 212
 213 static int
 214 dissect_fcgi_record(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 215 {
 216    int offset = 0;
 217    uint8_t type;
 218
 219    type = tvb_get_uint8(tvb, 1);
 220
 221    /* When there are multiple FCGI records in a TCP frame the following code */
 222    /* will append the type for each record to COL_INFO.                      */
 223    /* XXX: Unfortunately, something in the tcp_dissect_pdus() code is broken */
 224    /*      such that only the type for the first FCGI record appears in the  */
 225    /*      INFO column. (All write attempts to COL_INFO after the first fail */
 226    /*      because pinfo->cinfo->writable is false).                         */
 227    col_set_str(pinfo->cinfo, COL_PROTOCOL, "FCGI");
 228    col_clear(pinfo->cinfo, COL_INFO);
 229    col_append_sep_str(pinfo->cinfo, COL_INFO, NULL,
 230                       val_to_str(type, record_types, "Unknown (%u)"));
 231    col_set_fence(pinfo->cinfo, COL_INFO);
 232
 233    if (tree) { /* we are being asked for details */
 234       proto_item *ti;
 235       proto_tree *fcgi_tree;
 236       uint16_t clen;
 237       uint8_t plen;
 238
 239       ti = proto_tree_add_item(tree, proto_fcgi, tvb, 0, -1, ENC_NA);
 240       proto_item_append_text(ti, " (%s)",
 241                              val_to_str(type, record_types, "Unknown (%u)"));
 242       fcgi_tree = proto_item_add_subtree(ti, ett_fcgi);
 243
 244       proto_tree_add_item(fcgi_tree, hf_fcgi_version, tvb, offset, 1, ENC_BIG_ENDIAN);
 245       offset += 1;
 246
 247       proto_tree_add_item(fcgi_tree, hf_fcgi_type, tvb, offset, 1, ENC_BIG_ENDIAN);
 248       offset += 1;
 249
 250       proto_tree_add_item(fcgi_tree, hf_fcgi_id, tvb, offset, 2, ENC_BIG_ENDIAN);
 251       offset += 2;
 252
 253       clen = tvb_get_ntohs(tvb, offset);
 254       proto_tree_add_item(fcgi_tree, hf_fcgi_content_length, tvb, offset, 2, ENC_BIG_ENDIAN);
 255       offset += 2;
 256
 257       plen = tvb_get_uint8(tvb, offset);
 258       proto_tree_add_item(fcgi_tree, hf_fcgi_padding_length, tvb, offset, 1, ENC_BIG_ENDIAN);
 259       offset += 1;
 260
 261       offset += 1;
 262
 263       switch (type)
 264       {
 265       case FCGI_BEGIN_REQUEST:
 266          dissect_begin_request(tvb, pinfo, fcgi_tree, offset, clen);
 267          offset += clen;
 268          break;
 269       case FCGI_ABORT_REQUEST:
 270          dissect_abort_request(tvb, pinfo, fcgi_tree, offset, clen);
 271          offset += clen;
 272          break;
 273       case FCGI_END_REQUEST:
 274          dissect_end_request(tvb, pinfo, fcgi_tree, offset, clen);
 275          offset += clen;
 276          break;
 277       case FCGI_PARAMS:
 278          dissect_params(tvb, pinfo, fcgi_tree, offset, clen);
 279          offset += clen;
 280          break;
 281       case FCGI_GET_VALUES:
 282          dissect_get_values(tvb, pinfo, fcgi_tree, offset, clen);
 283          offset += clen;
 284          break;
 285       case FCGI_GET_VALUES_RESULT:
 286          dissect_get_values_result(tvb, pinfo, fcgi_tree, offset, clen);
 287          offset += clen;
 288          break;
 289       default:
 290          if (clen > 0) {
 291             proto_tree_add_item(fcgi_tree, hf_fcgi_content_data, tvb, offset, clen, ENC_NA);
 292             offset += clen;
 293          }
 294          break;
 295       }
 296
 297       if (plen > 0) {
 298          proto_tree_add_item(fcgi_tree, hf_fcgi_padding_data, tvb, offset, plen, ENC_NA);
 299          /*offset += plen;*/
 300       }
 301    }
 302
 303    return tvb_captured_length(tvb);
 304 }
 305
 306 static unsigned
 307 get_fcgi_record_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)
 308 {
 309    return 8 + tvb_get_ntohs(tvb, offset + 4) + tvb_get_uint8(tvb, offset + 6);
 310 }
 311
 312 static int
 313 dissect_fcgi(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 314 {
 315    tcp_dissect_pdus(tvb, pinfo, tree, true, 8, get_fcgi_record_len, dissect_fcgi_record, data);
 316    return tvb_captured_length(tvb);
 317 }
 318
 319 void
 320 proto_register_fcgi(void)
 321 {
 322    static hf_register_info hf[] = {
 323       { &hf_fcgi_version,
 324         { "Version", "fcgi.version",
 325           FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 326       { &hf_fcgi_type,
 327         { "Type", "fcgi.type",
 328           FT_UINT8, BASE_DEC, VALS(record_types), 0x0, NULL, HFILL } },
 329       { &hf_fcgi_id,
 330         { "Request ID", "fcgi.id",
 331           FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 332       { &hf_fcgi_content_length,
 333         { "Content Length", "fcgi.content.length",
 334           FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 335       { &hf_fcgi_padding_length,
 336         { "Padding Length", "fcgi.padding.length",
 337           FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 338       { &hf_fcgi_content_data,
 339         { "Content Data", "fcgi.content.data",
 340           FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 341       { &hf_fcgi_padding_data,
 342         { "Padding Data", "fcgi.padding.data",
 343           FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 344       { &hf_fcgi_begin_request_role,
 345         { "Role", "fcgi.begin_request.role",
 346           FT_UINT16, BASE_DEC, VALS(application_roles), 0x0, NULL, HFILL } },
 347       { &hf_fcgi_begin_request_flags,
 348         { "Flags", "fcgi.begin_request.flags",
 349           FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } },
 350       { &hf_fcgi_begin_request_keep_conn,
 351         { "FCGI_KEEP_CONN", "fcgi.begin_request.keep_conn",
 352           FT_BOOLEAN, 8, NULL, FCGI_KEEP_CONN, NULL, HFILL } },
 353       { &hf_fcgi_end_request_app_status,
 354         { "Application Status", "fcgi.end_request.app_status",
 355           FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 356       { &hf_fcgi_end_request_protocol_status,
 357         { "Protocol Status", "fcgi.end_request.protocol_status",
 358           FT_UINT32, BASE_DEC, VALS(protocol_statuses), 0x0, NULL, HFILL } },
 359       { &hf_fcgi_nv_name,
 360         { "NV Pair name", "fcgi.nv_name",
 361           FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 362    };
 363    static int *ett[] = {
 364       &ett_fcgi,
 365       &ett_fcgi_begin_request,
 366       &ett_fcgi_abort_request,
 367       &ett_fcgi_end_request,
 368       &ett_fcgi_params
 369    };
 370
 371    proto_fcgi = proto_register_protocol("FastCGI", "FCGI", "fcgi");
 372
 373    proto_register_field_array(proto_fcgi, hf, array_length(hf));
 374    proto_register_subtree_array(ett, array_length(ett));
 375
 376    fcgi_handle = register_dissector("fcgi", dissect_fcgi, proto_fcgi);
 377 }
 378
 379 void
 380 proto_reg_handoff_fcgi(void)
 381 {
 382    dissector_add_for_decode_as_with_preference("tcp.port", fcgi_handle);
 383 }
 384
 385 /*
 386  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 387  *
 388  * Local Variables:
 389  * c-basic-offset: 3
 390  * tab-width: 8
 391  * indent-tabs-mode: nil
 392  * End:
 393  *
 394  * ex: set shiftwidth=3 tabstop=8 expandtab:
 395  * :indentSize=3:tabSize=8:noTabs=true:
 396  */