epan/dissectors/packet-xmpp.c

   1 /* packet-xmpp.c
   2  * Wireshark's XMPP dissector.
   3  *
   4  * Copyright 2011, Mariusz Okroj <okrojmariusz[]gmail.com>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13 #include "config.h"
  14
  15
  16 #include <epan/packet.h>
  17 #include <epan/conversation.h>
  18 #include <epan/prefs.h>
  19 #include <epan/proto_data.h>
  20 #include <epan/exceptions.h>
  21
  22 #include "packet-xmpp.h"
  23 #include "packet-xmpp-core.h"
  24
  25 #define XMPP_PORT 5222
  26
  27 void proto_register_xmpp(void);
  28 void proto_reg_handoff_xmpp(void);
  29
  30 int proto_xmpp;
  31
  32 static bool xmpp_desegment = true;
  33
  34 int hf_xmpp_xmlns;
  35 int hf_xmpp_id;
  36 int hf_xmpp_from;
  37 int hf_xmpp_to;
  38 int hf_xmpp_type;
  39 int hf_xmpp_cdata;
  40 int hf_xmpp_attribute;
  41
  42 int hf_xmpp_iq;
  43
  44 int hf_xmpp_query;
  45 int hf_xmpp_query_node;
  46
  47 int hf_xmpp_query_item;
  48 int hf_xmpp_query_item_jid;
  49 int hf_xmpp_query_item_name;
  50 int hf_xmpp_query_item_subscription;
  51 int hf_xmpp_query_item_ask;
  52 int hf_xmpp_query_item_group;
  53 int hf_xmpp_query_item_node;
  54 int hf_xmpp_query_item_approved;
  55
  56 int hf_xmpp_query_identity;
  57 int hf_xmpp_query_identity_category;
  58 int hf_xmpp_query_identity_type;
  59 int hf_xmpp_query_identity_name;
  60 static int hf_xmpp_query_identity_lang;
  61
  62 int hf_xmpp_query_feature;
  63
  64 int hf_xmpp_query_streamhost;
  65 int hf_xmpp_query_streamhost_used;
  66 int hf_xmpp_query_activate;
  67 int hf_xmpp_query_udpsuccess;
  68
  69 int hf_xmpp_error;
  70 int hf_xmpp_error_type;
  71 int hf_xmpp_error_code;
  72 int hf_xmpp_error_condition;
  73 int hf_xmpp_error_text;
  74
  75 int hf_xmpp_iq_bind;
  76 int hf_xmpp_iq_bind_jid;
  77 int hf_xmpp_iq_bind_resource;
  78
  79 int hf_xmpp_services;
  80 int hf_xmpp_channel;
  81
  82 int hf_xmpp_iq_session;
  83 int hf_xmpp_stream;
  84 int hf_xmpp_features;
  85
  86 int hf_xmpp_vcard;
  87 int hf_xmpp_vcard_x_update;
  88
  89 int hf_xmpp_jingle;
  90 int hf_xmpp_jingle_sid;
  91 int hf_xmpp_jingle_initiator;
  92 int hf_xmpp_jingle_responder;
  93 int hf_xmpp_jingle_action;
  94
  95 int hf_xmpp_jingle_content;
  96 int hf_xmpp_jingle_content_creator;
  97 int hf_xmpp_jingle_content_name;
  98 int hf_xmpp_jingle_content_disposition;
  99 int hf_xmpp_jingle_content_senders;
 100
 101 int hf_xmpp_jingle_content_description;
 102 int hf_xmpp_jingle_content_description_media;
 103 int hf_xmpp_jingle_content_description_ssrc;
 104
 105 int hf_xmpp_jingle_cont_desc_payload;
 106 int hf_xmpp_jingle_cont_desc_payload_id;
 107 int hf_xmpp_jingle_cont_desc_payload_channels;
 108 int hf_xmpp_jingle_cont_desc_payload_clockrate;
 109 int hf_xmpp_jingle_cont_desc_payload_maxptime;
 110 int hf_xmpp_jingle_cont_desc_payload_name;
 111 int hf_xmpp_jingle_cont_desc_payload_ptime;
 112
 113 int hf_xmpp_jingle_cont_desc_payload_param;
 114 int hf_xmpp_jingle_cont_desc_payload_param_value;
 115 int hf_xmpp_jingle_cont_desc_payload_param_name;
 116
 117 int hf_xmpp_jingle_cont_desc_enc;
 118 int hf_xmpp_jingle_cont_desc_enc_zrtp_hash;
 119 int hf_xmpp_jingle_cont_desc_enc_crypto;
 120
 121 int hf_xmpp_jingle_cont_desc_rtp_hdr;
 122 int hf_xmpp_jingle_cont_desc_bandwidth;
 123
 124 int hf_xmpp_jingle_cont_trans;
 125 int hf_xmpp_jingle_cont_trans_pwd;
 126 int hf_xmpp_jingle_cont_trans_ufrag;
 127
 128 int hf_xmpp_jingle_cont_trans_cand;
 129 int hf_xmpp_jingle_cont_trans_rem_cand;
 130 int hf_xmpp_jingle_cont_trans_activated;
 131 int hf_xmpp_jingle_cont_trans_candidate_error;
 132 int hf_xmpp_jingle_cont_trans_candidate_used;
 133 int hf_xmpp_jingle_cont_trans_proxy_error;
 134
 135
 136 int hf_xmpp_jingle_reason;
 137 int hf_xmpp_jingle_reason_condition;
 138 int hf_xmpp_jingle_reason_text;
 139
 140 int hf_xmpp_jingle_rtp_info;
 141
 142 int hf_xmpp_jingle_file_transfer_offer;
 143 int hf_xmpp_jingle_file_transfer_request;
 144 int hf_xmpp_jingle_file_transfer_received;
 145 int hf_xmpp_jingle_file_transfer_abort;
 146 int hf_xmpp_jingle_file_transfer_checksum;
 147
 148 int hf_xmpp_si;
 149 int hf_xmpp_si_file;
 150
 151 int hf_xmpp_iq_feature_neg;
 152 int hf_xmpp_x_data;
 153 int hf_xmpp_x_data_field;
 154 int hf_xmpp_x_data_field_value;
 155 int hf_xmpp_x_data_instructions;
 156 int hf_xmpp_muc_user_status;
 157
 158 int hf_xmpp_message;
 159 int hf_xmpp_message_chatstate;
 160
 161 int hf_xmpp_message_thread;
 162 int hf_xmpp_message_thread_parent;
 163
 164 int hf_xmpp_message_body;
 165 int hf_xmpp_message_subject;
 166
 167 int hf_xmpp_ibb_open;
 168 int hf_xmpp_ibb_close;
 169 int hf_xmpp_ibb_data;
 170
 171 int hf_xmpp_delay;
 172
 173 int hf_xmpp_x_event;
 174 int hf_xmpp_x_event_condition;
 175
 176 int hf_xmpp_presence;
 177 int hf_xmpp_presence_show;
 178 int hf_xmpp_presence_status;
 179 int hf_xmpp_presence_caps;
 180
 181 int hf_xmpp_auth;
 182 int hf_xmpp_failure;
 183 int hf_xmpp_failure_text;
 184 int hf_xmpp_starttls;
 185 int hf_xmpp_proceed;
 186 int hf_xmpp_xml_header_version;
 187 int hf_xmpp_stream_end;
 188
 189 int hf_xmpp_muc_x;
 190 int hf_xmpp_muc_user_x;
 191 int hf_xmpp_muc_user_item;
 192 int hf_xmpp_muc_user_invite;
 193
 194 int hf_xmpp_gtalk_session;
 195 int hf_xmpp_gtalk_session_type;
 196 int hf_xmpp_gtalk;
 197 int hf_xmpp_gtalk_setting;
 198 int hf_xmpp_gtalk_setting_element;
 199 int hf_xmpp_gtalk_nosave_x;
 200 int hf_xmpp_gtalk_mail_mailbox;
 201 int hf_xmpp_gtalk_mail_new_mail;
 202 int hf_xmpp_gtalk_transport_p2p;
 203 int hf_xmpp_gtalk_mail_snippet;
 204 int hf_xmpp_gtalk_status_status_list;
 205
 206 int hf_xmpp_conf_info;
 207 int hf_xmpp_conf_info_sid;
 208
 209 int hf_xmpp_unknown;
 210 int hf_xmpp_unknown_attr;
 211
 212 static int hf_xmpp_out;
 213 static int hf_xmpp_in;
 214 int hf_xmpp_response_in;
 215 int hf_xmpp_response_to;
 216 int hf_xmpp_jingle_session;
 217 int hf_xmpp_ibb;
 218
 219 int hf_xmpp_ping;
 220 int hf_xmpp_hashes;
 221
 222 int hf_xmpp_jitsi_inputevt;
 223 int hf_xmpp_jitsi_inputevt_rmt_ctrl;
 224
 225 static int ett_xmpp;
 226 int ett_xmpp_iq;
 227 int ett_xmpp_query;
 228 int ett_xmpp_query_item;
 229 int ett_xmpp_query_identity;
 230 static int ett_xmpp_query_feature;
 231
 232 int ett_xmpp_query_streamhost;
 233 int ett_xmpp_query_streamhost_used;
 234 int ett_xmpp_query_udpsuccess;
 235
 236 static int ett_xmpp_iq_error;
 237 int ett_xmpp_iq_bind;
 238 int ett_xmpp_iq_session;
 239 int ett_xmpp_vcard;
 240 int ett_xmpp_vcard_x_update;
 241
 242 int ett_xmpp_jingle;
 243 int ett_xmpp_jingle_content;
 244 int ett_xmpp_jingle_content_description;
 245 int ett_xmpp_jingle_cont_desc_enc;
 246 int ett_xmpp_jingle_cont_desc_enc_zrtp_hash;
 247 int ett_xmpp_jingle_cont_desc_enc_crypto;
 248 int ett_xmpp_jingle_cont_desc_rtp_hdr;
 249 int ett_xmpp_jingle_cont_desc_bandwidth;
 250 int ett_xmpp_jingle_cont_desc_payload;
 251 int ett_xmpp_jingle_cont_desc_payload_param;
 252 int ett_xmpp_jingle_cont_trans;
 253 int ett_xmpp_jingle_cont_trans_cand;
 254 int ett_xmpp_jingle_cont_trans_rem_cand;
 255 int ett_xmpp_jingle_reason;
 256 int ett_xmpp_jingle_rtp_info;
 257
 258 int ett_xmpp_jingle_file_transfer_offer;
 259 int ett_xmpp_jingle_file_transfer_request;
 260 int ett_xmpp_jingle_file_transfer_abort;
 261 int ett_xmpp_jingle_file_transfer_received;
 262 int ett_xmpp_jingle_file_transfer_checksum;
 263 int ett_xmpp_jingle_file_transfer_file;
 264
 265 int ett_xmpp_services;
 266 int ett_xmpp_services_relay;
 267 int ett_xmpp_channel;
 268
 269 int ett_xmpp_si;
 270 int ett_xmpp_si_file;
 271 int ett_xmpp_si_file_range;
 272
 273 int ett_xmpp_iq_feature_neg;
 274 int ett_xmpp_x_data;
 275 int ett_xmpp_x_data_field;
 276 int ett_xmpp_x_data_field_value;
 277
 278 int ett_xmpp_ibb_open;
 279 int ett_xmpp_ibb_close;
 280 int ett_xmpp_ibb_data;
 281
 282 int ett_xmpp_delay;
 283
 284 int ett_xmpp_x_event;
 285
 286 int ett_xmpp_message;
 287 int ett_xmpp_message_thread;
 288 int ett_xmpp_message_body;
 289 int ett_xmpp_message_subject;
 290
 291 int ett_xmpp_presence;
 292 int ett_xmpp_presence_status;
 293 int ett_xmpp_presence_caps;
 294
 295 int ett_xmpp_auth;
 296 static int ett_xmpp_challenge;
 297 static int ett_xmpp_response;
 298 static int ett_xmpp_success;
 299 int ett_xmpp_failure;
 300 int ett_xmpp_stream;
 301 int ett_xmpp_features;
 302 int ett_xmpp_features_mechanisms;
 303 int ett_xmpp_starttls;
 304 int ett_xmpp_proceed;
 305
 306 int ett_xmpp_muc_x;
 307 int ett_xmpp_muc_hist;
 308 int ett_xmpp_muc_user_x;
 309 int ett_xmpp_muc_user_item;
 310 int ett_xmpp_muc_user_invite;
 311
 312 int ett_xmpp_gtalk_session;
 313 int ett_xmpp_gtalk_session_desc;
 314 int ett_xmpp_gtalk_session_cand;
 315 int ett_xmpp_gtalk_session_desc_payload;
 316 int ett_xmpp_gtalk_session_reason;
 317 int ett_xmpp_gtalk_jingleinfo_stun;
 318 int ett_xmpp_gtalk_jingleinfo_server;
 319 int ett_xmpp_gtalk_jingleinfo_relay;
 320 int ett_xmpp_gtalk_jingleinfo_relay_serv;
 321 int ett_xmpp_gtalk_setting;
 322 int ett_xmpp_gtalk_nosave_x;
 323 int ett_xmpp_gtalk_mail_mailbox;
 324 int ett_xmpp_gtalk_mail_mail_info;
 325 int ett_xmpp_gtalk_mail_senders;
 326 int ett_xmpp_gtalk_mail_sender;
 327 int ett_xmpp_gtalk_status_status_list;
 328 int ett_xmpp_gtalk_transport_p2p;
 329 int ett_xmpp_gtalk_transport_p2p_cand;
 330
 331 int ett_xmpp_conf_info;
 332 int ett_xmpp_conf_desc;
 333 int ett_xmpp_conf_state;
 334 int ett_xmpp_conf_users;
 335 int ett_xmpp_conf_user;
 336 int ett_xmpp_conf_endpoint;
 337 int ett_xmpp_conf_media;
 338
 339 int ett_xmpp_ping;
 340 int ett_xmpp_hashes;
 341 int ett_xmpp_hashes_hash;
 342
 343 int ett_xmpp_jitsi_inputevt;
 344 int ett_xmpp_jitsi_inputevt_rmt_ctrl;
 345
 346 int ett_unknown[ETT_UNKNOWN_LEN];
 347
 348 static expert_field ei_xmpp_xml_disabled;
 349 static expert_field ei_xmpp_packet_unknown;
 350 expert_field ei_xmpp_starttls_missing;
 351 expert_field ei_xmpp_response;
 352 static expert_field ei_xmpp_challenge;
 353 static expert_field ei_xmpp_success;
 354 expert_field ei_xmpp_proceed_already_in_frame;
 355 expert_field ei_xmpp_starttls_already_in_frame;
 356 expert_field ei_xmpp_packet_without_response;
 357 expert_field ei_xmpp_unknown_element;
 358 expert_field ei_xmpp_field_unexpected_value;
 359 expert_field ei_xmpp_unknown_attribute;
 360 expert_field ei_xmpp_required_attribute;
 361
 362 static dissector_handle_t xmpp_handle;
 363
 364 static dissector_handle_t xml_handle;
 365
 366 static void
 367 cleanup_xmpp(void *user_data) {
 368
 369     xmpp_element_t *root = (xmpp_element_t*)user_data;
 370
 371     xmpp_element_t_tree_free(root);
 372 }
 373
 374 static int
 375 dissect_xmpp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
 376
 377     xml_frame_t *xml_frame;
 378     xml_frame_t *xml_dissector_frame;
 379     bool         out_packet;
 380
 381     conversation_t   *conversation;
 382     xmpp_conv_info_t *xmpp_info;
 383
 384     proto_tree *xmpp_tree  = NULL;
 385     proto_item *xmpp_item  = NULL;
 386     proto_item *outin_item;
 387
 388     xmpp_element_t *packet = NULL;
 389
 390     int proto_xml = dissector_handle_get_protocol_index(xml_handle);
 391
 392     bool whitespace_keepalive = ((tvb_reported_length(tvb) == 1) && tvb_get_uint8(tvb, 0) == ' ');
 393
 394     /*check if desegment
 395      * now it checks that last char is '>',
 396      * TODO checks that first element in packet is closed*/
 397     int   indx;
 398     char last_char;
 399
 400     if (xmpp_desegment && !whitespace_keepalive)
 401     {
 402         indx = tvb_reported_length(tvb) - 1;
 403         if (indx >= 0)
 404         {
 405             last_char = tvb_get_uint8(tvb, indx);
 406
 407             while ((last_char <= ' ') && (indx - 1 >= 0))
 408             {
 409                 indx--;
 410                 last_char = tvb_get_uint8(tvb, indx);
 411             }
 412
 413             if ((indx >= 0) && (last_char != '>'))
 414             {
 415                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 416                 return tvb_captured_length(tvb);
 417             }
 418         }
 419     }
 420
 421     col_set_str(pinfo->cinfo, COL_PROTOCOL, "XMPP");
 422     col_clear(pinfo->cinfo, COL_INFO);
 423
 424     /*if tree == NULL then xmpp_item and xmpp_tree will also NULL*/
 425     xmpp_item = proto_tree_add_item(tree, proto_xmpp, tvb, 0, -1, ENC_NA);
 426     xmpp_tree = proto_item_add_subtree(xmpp_item, ett_xmpp);
 427
 428     if (whitespace_keepalive) {
 429         /* RFC 6120 section 4.6.1 */
 430         col_set_str(pinfo->cinfo, COL_INFO, "Whitespace Keepalive");
 431         return tvb_captured_length(tvb);
 432     }
 433
 434     call_dissector_with_data(xml_handle, tvb, pinfo, xmpp_tree, NULL);
 435
 436     /* If XML dissector is disabled, we can't do much */
 437     if (!proto_is_protocol_enabled(find_protocol_by_id(proto_xml)))
 438     {
 439         col_append_str(pinfo->cinfo, COL_INFO, "(XML dissector disabled, can't dissect XMPP)");
 440         expert_add_info(pinfo, xmpp_item, &ei_xmpp_xml_disabled);
 441         return tvb_captured_length(tvb);
 442     }
 443
 444     /*if stream end occurs then return*/
 445     if(xmpp_stream_close(xmpp_tree,tvb, pinfo))
 446     {
 447         if(xmpp_tree)
 448             xmpp_proto_tree_hide_first_child(xmpp_tree);
 449         return tvb_captured_length(tvb);
 450     }
 451
 452     xml_dissector_frame = (xml_frame_t *)p_get_proto_data(pinfo->pool, pinfo, proto_xml, 0);
 453     if(xml_dissector_frame == NULL)
 454         return tvb_captured_length(tvb);
 455
 456     /*data from XML dissector*/
 457     xml_frame = xml_dissector_frame->first_child;
 458
 459     if(!xml_frame)
 460         return tvb_captured_length(tvb);
 461
 462     conversation = find_or_create_conversation(pinfo);
 463     xmpp_info = (xmpp_conv_info_t *)conversation_get_proto_data(conversation, proto_xmpp);
 464
 465     if (!xmpp_info) {
 466         xmpp_info = wmem_new(wmem_file_scope(), xmpp_conv_info_t);
 467         xmpp_info->req_resp        = wmem_tree_new(wmem_file_scope());
 468         xmpp_info->jingle_sessions = wmem_tree_new(wmem_file_scope());
 469         xmpp_info->ibb_sessions    = wmem_tree_new(wmem_file_scope());
 470         xmpp_info->gtalk_sessions  = wmem_tree_new(wmem_file_scope());
 471         xmpp_info->ssl_start   = 0;
 472         conversation_add_proto_data(conversation, proto_xmpp, (void *) xmpp_info);
 473     }
 474
 475     if (pinfo->match_uint == pinfo->destport)
 476         out_packet = true;
 477     else
 478         out_packet = false;
 479
 480     while(xml_frame)
 481     {
 482         packet = xmpp_xml_frame_to_element_t(pinfo, xml_frame, NULL, tvb);
 483         DISSECTOR_ASSERT(packet);
 484         CLEANUP_PUSH(cleanup_xmpp, packet);
 485
 486         if (strcmp(packet->name, "iq") == 0) {
 487             xmpp_iq_reqresp_track(pinfo, packet, xmpp_info);
 488             xmpp_jingle_session_track(pinfo, packet, xmpp_info);
 489             xmpp_gtalk_session_track(pinfo, packet, xmpp_info);
 490         }
 491
 492         if (strcmp(packet->name, "iq") == 0 || strcmp(packet->name, "message") == 0) {
 493             xmpp_ibb_session_track(pinfo, packet, xmpp_info);
 494         }
 495
 496         if (out_packet)
 497             outin_item = proto_tree_add_boolean(xmpp_tree, hf_xmpp_out, tvb, 0, 0, true);
 498         else
 499             outin_item = proto_tree_add_boolean(xmpp_tree, hf_xmpp_in, tvb, 0, 0, true);
 500
 501         proto_item_set_hidden(outin_item);
 502
 503
 504         /*it hides tree generated by XML dissector*/
 505         xmpp_proto_tree_hide_first_child(xmpp_tree);
 506
 507         if (strcmp(packet->name, "iq") == 0) {
 508             xmpp_iq(xmpp_tree, tvb, pinfo, packet);
 509         } else if (strcmp(packet->name, "presence") == 0) {
 510             xmpp_presence(xmpp_tree, tvb, pinfo, packet);
 511         } else if (strcmp(packet->name, "message") == 0) {
 512             xmpp_message(xmpp_tree, tvb, pinfo, packet);
 513         } else if (strcmp(packet->name, "auth") == 0) {
 514             xmpp_auth(xmpp_tree, tvb, pinfo, packet);
 515         } else if (strcmp(packet->name, "challenge") == 0) {
 516             xmpp_challenge_response_success(xmpp_tree, tvb, pinfo, packet, &ei_xmpp_challenge, ett_xmpp_challenge, "CHALLENGE");
 517         } else if (strcmp(packet->name, "response") == 0) {
 518             xmpp_challenge_response_success(xmpp_tree, tvb, pinfo, packet, &ei_xmpp_response, ett_xmpp_response, "RESPONSE");
 519         } else if (strcmp(packet->name, "success") == 0) {
 520             xmpp_challenge_response_success(xmpp_tree, tvb, pinfo, packet, &ei_xmpp_success, ett_xmpp_success, "SUCCESS");
 521         } else if (strcmp(packet->name, "failure") == 0) {
 522             xmpp_failure(xmpp_tree, tvb, pinfo, packet);
 523         } else if (strcmp(packet->name, "xml") == 0) {
 524             xmpp_xml_header(xmpp_tree, tvb, pinfo, packet);
 525         } else if (strcmp(packet->name, "stream") == 0) {
 526             xmpp_stream(xmpp_tree, tvb, pinfo, packet);
 527         } else if (strcmp(packet->name, "features") == 0) {
 528             xmpp_features(xmpp_tree, tvb, pinfo, packet);
 529         } else if (strcmp(packet->name, "starttls") == 0) {
 530             xmpp_starttls(xmpp_tree, tvb, pinfo, packet, xmpp_info);
 531         } else if (strcmp(packet->name, "proceed") == 0) {
 532             xmpp_proceed(xmpp_tree, tvb, pinfo, packet, xmpp_info);
 533         } else {
 534             xmpp_proto_tree_show_first_child(xmpp_tree);
 535             expert_add_info_format(pinfo, xmpp_tree, &ei_xmpp_packet_unknown, "Unknown packet: %s", packet->name);
 536             col_set_str(pinfo->cinfo, COL_INFO, "UNKNOWN PACKET ");
 537         }
 538
 539         /*appends to COL_INFO information about src or dst*/
 540         if (pinfo->match_uint == pinfo->destport) {
 541             xmpp_attr_t *to = xmpp_get_attr(packet, "to");
 542             if (to)
 543                 col_append_fstr(pinfo->cinfo, COL_INFO, "> %s ", to->value);
 544         } else {
 545             xmpp_attr_t *from = xmpp_get_attr(packet, "from");
 546             if (from)
 547                 col_append_fstr(pinfo->cinfo, COL_INFO, "< %s ", from->value);
 548         }
 549
 550         CLEANUP_CALL_AND_POP;
 551         xml_frame = xml_frame->next_sibling;
 552     }
 553     return tvb_captured_length(tvb);
 554 }
 555
 556
 557 void
 558 proto_register_xmpp(void) {
 559     static hf_register_info hf[] = {
 560         { &hf_xmpp_iq,
 561           {
 562               "IQ", "xmpp.iq", FT_NONE, BASE_NONE, NULL, 0x0,
 563               "iq packet", HFILL
 564           }},
 565         {&hf_xmpp_xmlns,
 566          {
 567              "xmlns", "xmpp.xmlns", FT_STRING, BASE_NONE, NULL, 0x0,
 568              "element namespace", HFILL
 569          }},
 570         {&hf_xmpp_cdata,
 571          {
 572              "CDATA", "xmpp.cdata", FT_STRING, BASE_NONE, NULL, 0x0,
 573              NULL, HFILL
 574          }},
 575         {&hf_xmpp_attribute,
 576          {
 577              "Attribute", "xmpp.attribute", FT_STRING, BASE_NONE, NULL, 0x0,
 578              NULL, HFILL
 579          }},
 580         { &hf_xmpp_id,
 581           {
 582               "id", "xmpp.id", FT_STRING, BASE_NONE, NULL, 0x0,
 583               "packet id", HFILL
 584           }},
 585         { &hf_xmpp_type,
 586           {
 587               "type", "xmpp.type", FT_STRING, BASE_NONE, NULL, 0x0,
 588               "packet type", HFILL
 589           }},
 590         { &hf_xmpp_from,
 591           {
 592               "from", "xmpp.from", FT_STRING, BASE_NONE, NULL, 0x0,
 593               "packet from", HFILL
 594           }},
 595         { &hf_xmpp_to,
 596           {
 597               "to", "xmpp.to", FT_STRING, BASE_NONE, NULL, 0x0,
 598               "packet to", HFILL
 599           }},
 600         { &hf_xmpp_query,
 601           {
 602               "QUERY", "xmpp.query", FT_NONE, BASE_NONE, NULL, 0x0,
 603               "iq query", HFILL
 604           }},
 605         { &hf_xmpp_query_node,
 606           {
 607               "node", "xmpp.query.node", FT_STRING, BASE_NONE, NULL, 0x0,
 608               "iq query node", HFILL
 609           }},
 610         { &hf_xmpp_query_item,
 611           {
 612               "ITEM", "xmpp.query.item", FT_NONE, BASE_NONE, NULL, 0x0,
 613               "iq query item", HFILL
 614
 615           }},
 616         { &hf_xmpp_query_item_jid,
 617           {
 618               "jid", "xmpp.query.item.jid", FT_STRING, BASE_NONE, NULL, 0x0,
 619               "iq query item jid", HFILL
 620
 621           }},
 622         { &hf_xmpp_query_item_name,
 623           {
 624               "name", "xmpp.query.item.name", FT_STRING, BASE_NONE, NULL, 0x0,
 625               "iq query item name", HFILL
 626           }},
 627         { &hf_xmpp_query_item_subscription,
 628           {
 629               "subscription", "xmpp.query.item.subscription", FT_STRING, BASE_NONE, NULL, 0x0,
 630               "iq query item subscription", HFILL
 631           }},
 632         { &hf_xmpp_query_item_ask,
 633           {
 634               "ask", "xmpp.query.item.ask", FT_STRING, BASE_NONE, NULL, 0x0,
 635               "iq query item ask", HFILL
 636           }},
 637         { &hf_xmpp_query_item_group,
 638           {
 639               "GROUP", "xmpp.query.item.group", FT_STRING, BASE_NONE, NULL, 0x0,
 640               "iq query item group", HFILL
 641
 642           }},
 643         { &hf_xmpp_query_item_approved,
 644           {
 645               "approved", "xmpp.query.item.approved", FT_STRING, BASE_NONE, NULL, 0x0,
 646               "iq query item approved", HFILL
 647
 648           }},
 649         { &hf_xmpp_query_item_node,
 650           {
 651               "node", "xmpp.query.item.node", FT_STRING, BASE_NONE, NULL, 0x0,
 652               "iq query item node", HFILL
 653
 654           }},
 655         { &hf_xmpp_query_identity,
 656           {
 657               "IDENTITY", "xmpp.query.identity", FT_NONE, BASE_NONE, NULL, 0x0,
 658               "iq query identity", HFILL
 659
 660           }},
 661         { &hf_xmpp_query_identity_category,
 662           {
 663               "category", "xmpp.query.identity.category", FT_STRING, BASE_NONE, NULL, 0x0,
 664               "iq query identity category", HFILL
 665
 666           }},
 667         { &hf_xmpp_query_identity_type,
 668           {
 669               "type", "xmpp.query.identity.type", FT_STRING, BASE_NONE, NULL, 0x0,
 670               "iq query identity type", HFILL
 671
 672           }},
 673         { &hf_xmpp_query_identity_name,
 674           {
 675               "name", "xmpp.query.identity.name", FT_STRING, BASE_NONE, NULL, 0x0,
 676               "iq query identity name", HFILL
 677
 678           }},
 679         { &hf_xmpp_query_identity_lang,
 680           {
 681               "lang", "xmpp.query.identity.lang", FT_STRING, BASE_NONE, NULL, 0x0,
 682               "iq query identity lang", HFILL
 683
 684           }},
 685         { &hf_xmpp_query_feature,
 686           {
 687               "FEATURE", "xmpp.query.feature", FT_STRING, BASE_NONE, NULL, 0x0,
 688               "iq query feature", HFILL
 689
 690           }},
 691         { &hf_xmpp_query_streamhost,
 692           {
 693               "STREAMHOST", "xmpp.query.streamhost", FT_NONE, BASE_NONE, NULL, 0x0,
 694               "iq query streamhost", HFILL
 695
 696           }},
 697         { &hf_xmpp_query_streamhost_used,
 698           {
 699               "STREAMHOST-USED", "xmpp.query.streamhost-used", FT_NONE, BASE_NONE, NULL, 0x0,
 700               "iq query streamhost-used", HFILL
 701
 702           }},
 703         { &hf_xmpp_query_activate,
 704           {
 705               "ACTIVATE", "xmpp.query.activate", FT_STRING, BASE_NONE, NULL, 0x0,
 706               "iq query activate", HFILL
 707
 708           }},
 709         { &hf_xmpp_query_udpsuccess,
 710           {
 711               "UDPSUCCESS", "xmpp.query.udpsuccess", FT_NONE, BASE_NONE, NULL, 0x0,
 712               "iq query streamhost-used", HFILL
 713
 714           }},
 715         { &hf_xmpp_error,
 716           {
 717               "ERROR", "xmpp.error", FT_NONE, BASE_NONE, NULL, 0x0,
 718               "iq error", HFILL
 719           }},
 720         { &hf_xmpp_error_code,
 721           {
 722               "code", "xmpp.error.code", FT_STRING, BASE_NONE, NULL, 0x0,
 723               "iq stanza error code", HFILL
 724
 725           }},
 726         { &hf_xmpp_error_type,
 727           {
 728               "type", "xmpp.error.type", FT_STRING, BASE_NONE, NULL, 0x0,
 729               "iq error type", HFILL
 730
 731           }},
 732         { &hf_xmpp_error_condition,
 733           {
 734               "CONDITION", "xmpp.error.condition", FT_STRING, BASE_NONE, NULL, 0x0,
 735               "iq error condition", HFILL
 736
 737           }},
 738         { &hf_xmpp_error_text,
 739           {
 740               "TEXT", "xmpp.error.text", FT_STRING, BASE_NONE, NULL, 0x0,
 741               "iq error text", HFILL
 742
 743           }},
 744         { &hf_xmpp_iq_bind,
 745           {
 746               "BIND", "xmpp.iq.bind", FT_NONE, BASE_NONE, NULL, 0x0,
 747               "iq bind", HFILL
 748
 749           }},
 750         { &hf_xmpp_iq_bind_jid,
 751           {
 752               "jid", "xmpp.iq.bind.jid", FT_STRING, BASE_NONE, NULL, 0x0,
 753               "iq bind jid", HFILL
 754
 755           }},
 756         { &hf_xmpp_iq_bind_resource,
 757           {
 758               "resource", "xmpp.iq.bind.resource", FT_STRING, BASE_NONE, NULL, 0x0,
 759               "iq bind resource", HFILL
 760
 761           }},
 762         { &hf_xmpp_services,
 763           {
 764               "SERVICES", "xmpp.services", FT_NONE, BASE_NONE, NULL, 0x0,
 765               "http://jabber.org/protocol/jinglenodes services", HFILL
 766           }},
 767         { &hf_xmpp_channel,
 768           {
 769               "CHANNEL", "xmpp.channel", FT_NONE, BASE_NONE, NULL, 0x0,
 770               "http://jabber.org/protocol/jinglenodes#channel", HFILL
 771           }},
 772         { &hf_xmpp_iq_session,
 773           {
 774               "SESSION", "xmpp.iq.session", FT_NONE, BASE_NONE, NULL, 0x0,
 775               "iq session", HFILL
 776           }},
 777         { &hf_xmpp_vcard,
 778           {
 779               "VCARD", "xmpp.vcard", FT_NONE, BASE_NONE, NULL, 0x0,
 780               "vcard-temp", HFILL
 781           }},
 782         { &hf_xmpp_vcard_x_update,
 783           {
 784               "X VCARD-UPDATE", "xmpp.vcard-update", FT_NONE, BASE_NONE, NULL, 0x0,
 785               "vcard-temp:x:update", HFILL
 786           }},
 787         { &hf_xmpp_jingle,
 788           {
 789               "JINGLE", "xmpp.jingle", FT_NONE, BASE_NONE, NULL, 0x0,
 790               "iq jingle", HFILL
 791           }},
 792         { &hf_xmpp_jingle_action,
 793           {
 794               "action", "xmpp.jingle.action", FT_STRING, BASE_NONE, NULL, 0x0,
 795               "iq jingle action", HFILL
 796           }},
 797         { &hf_xmpp_jingle_sid,
 798           {
 799               "sid", "xmpp.jingle.sid", FT_STRING, BASE_NONE, NULL, 0x0,
 800               "iq jingle sid", HFILL
 801           }},
 802         { &hf_xmpp_jingle_initiator,
 803           {
 804               "initiator", "xmpp.jingle.initiator", FT_STRING, BASE_NONE, NULL, 0x0,
 805               "iq jingle initiator", HFILL
 806           }},
 807         { &hf_xmpp_jingle_responder,
 808           {
 809               "responder", "xmpp.jingle.responder", FT_STRING, BASE_NONE, NULL, 0x0,
 810               "iq jingle responder", HFILL
 811           }},
 812         { &hf_xmpp_jingle_content,
 813           {
 814               "CONTENT", "xmpp.jingle.content", FT_NONE, BASE_NONE, NULL, 0x0,
 815               "iq jingle content", HFILL
 816           }},
 817         { &hf_xmpp_jingle_content_creator,
 818           {
 819               "creator", "xmpp.jingle.content.creator", FT_STRING, BASE_NONE, NULL, 0x0,
 820               "iq jingle content creator", HFILL
 821           }},
 822         { &hf_xmpp_jingle_content_name,
 823           {
 824               "name", "xmpp.jingle.content.name", FT_STRING, BASE_NONE, NULL, 0x0,
 825               "iq jingle content name", HFILL
 826           }},
 827         { &hf_xmpp_jingle_content_disposition,
 828           {
 829               "disposition", "xmpp.jingle.content.disposition", FT_STRING, BASE_NONE, NULL, 0x0,
 830               "iq jingle content disposition", HFILL
 831           }},
 832         { &hf_xmpp_jingle_content_senders,
 833           {
 834               "senders", "xmpp.jingle.content.senders", FT_STRING, BASE_NONE, NULL, 0x0,
 835               "iq jingle content senders", HFILL
 836           }},
 837         { &hf_xmpp_jingle_content_description,
 838           {
 839               "DESCRIPTION", "xmpp.jingle.content.description", FT_NONE, BASE_NONE, NULL, 0x0,
 840               "iq jingle content description", HFILL
 841           }},
 842         { &hf_xmpp_jingle_content_description_media,
 843           {
 844               "media", "xmpp.jingle.content.description.media", FT_STRING, BASE_NONE, NULL, 0x0,
 845               "iq jingle content description", HFILL
 846           }},
 847         { &hf_xmpp_jingle_content_description_ssrc,
 848           {
 849               "ssrc", "xmpp.jingle.content.description.ssrc", FT_STRING, BASE_NONE, NULL, 0x0,
 850               "iq jingle content description ssrc", HFILL
 851           }},
 852         { &hf_xmpp_jingle_cont_desc_payload,
 853           {
 854               "PAYLOAD-TYPE", "xmpp.jingle.content.description.payload-type", FT_NONE, BASE_NONE, NULL, 0x0,
 855               "iq jingle content description payload-type", HFILL
 856           }},
 857         { &hf_xmpp_jingle_cont_desc_payload_id,
 858           {
 859               "id", "xmpp.jingle.content.description.payload-type.id", FT_STRING, BASE_NONE, NULL, 0x0,
 860               "iq jingle content description payload-type id", HFILL
 861           }},
 862         { &hf_xmpp_jingle_cont_desc_payload_channels,
 863           {
 864               "channels", "xmpp.jingle.content.description.payload-type.channels", FT_STRING, BASE_NONE, NULL, 0x0,
 865               "iq jingle content description payload-type channels", HFILL
 866           }},
 867         { &hf_xmpp_jingle_cont_desc_payload_clockrate,
 868           {
 869               "clockrate", "xmpp.jingle.content.description.payload-type.clockrate", FT_STRING, BASE_NONE, NULL, 0x0,
 870               "iq jingle content description payload-type clockrate", HFILL
 871           }},
 872         { &hf_xmpp_jingle_cont_desc_payload_maxptime,
 873           {
 874               "maxptime", "xmpp.jingle.content.description.payload-type.maxptime", FT_STRING, BASE_NONE, NULL, 0x0,
 875               "iq jingle content description payload-type maxptime", HFILL
 876           }},
 877         { &hf_xmpp_jingle_cont_desc_payload_name,
 878           {
 879               "name", "xmpp.jingle.content.description.payload-type.name", FT_STRING, BASE_NONE, NULL, 0x0,
 880               "iq jingle content description payload-type name", HFILL
 881           }},
 882         { &hf_xmpp_jingle_cont_desc_payload_ptime,
 883           {
 884               "ptime", "xmpp.jingle.content.description.payload-type.ptime", FT_STRING, BASE_NONE, NULL, 0x0,
 885               "iq jingle content description payload-type ptime", HFILL
 886           }},
 887         { &hf_xmpp_jingle_cont_desc_payload_param,
 888           {
 889               "PARAMETER", "xmpp.jingle.content.description.payload-type.parameter", FT_NONE, BASE_NONE, NULL, 0x0,
 890               "iq jingle content description payload-type parameter", HFILL
 891           }},
 892         { &hf_xmpp_jingle_cont_desc_payload_param_name,
 893           {
 894               "name", "xmpp.jingle.content.description.payload-type.parameter.name", FT_STRING, BASE_NONE, NULL, 0x0,
 895               "iq jingle content description payload-type parameter name", HFILL
 896           }},
 897         { &hf_xmpp_jingle_cont_desc_payload_param_value,
 898           {
 899               "value", "xmpp.jingle.content.description.payload-type.parameter.value", FT_STRING, BASE_NONE, NULL, 0x0,
 900               "iq jingle content description payload-type parameter value", HFILL
 901           }},
 902         { &hf_xmpp_jingle_cont_trans,
 903           {
 904               "TRANSPORT", "xmpp.jingle.content.transport", FT_NONE, BASE_NONE, NULL, 0x0,
 905               "iq jingle content transport", HFILL
 906           }},
 907         { &hf_xmpp_jingle_cont_trans_ufrag,
 908           {
 909               "ufrag", "xmpp.jingle.content.transport.ufrag", FT_STRING, BASE_NONE, NULL, 0x0,
 910               "iq jingle content transport ufrag", HFILL
 911           }},
 912         { &hf_xmpp_jingle_cont_trans_pwd,
 913           {
 914               "pwd", "xmpp.jingle.content.transport.pwd", FT_STRING, BASE_NONE, NULL, 0x0,
 915               "iq jingle content transport pwd", HFILL
 916           }},
 917         { &hf_xmpp_jingle_cont_trans_cand,
 918           {
 919               "CANDIDATE", "xmpp.jingle.content.transport.candidate", FT_NONE, BASE_NONE, NULL, 0x0,
 920               "iq jingle content transport candidate", HFILL
 921           }},
 922         { &hf_xmpp_jingle_cont_trans_rem_cand,
 923           {
 924               "REMOTE-CANDIDATE", "xmpp.jingle.content.transport.remote-candidate", FT_NONE, BASE_NONE, NULL, 0x0,
 925               "iq jingle content transport remote-candidate", HFILL
 926           }},
 927         { &hf_xmpp_jingle_cont_trans_activated,
 928           {
 929               "ACTIVATED", "xmpp.jingle.content.transport.activated", FT_NONE, BASE_NONE, NULL, 0x0,
 930               "urn:xmpp:jingle:transports:s5b:1 activated", HFILL
 931           }},
 932         { &hf_xmpp_jingle_cont_trans_candidate_used,
 933           {
 934               "CANDIDATE-USED", "xmpp.jingle.content.transport.candidate-used", FT_NONE, BASE_NONE, NULL, 0x0,
 935               "urn:xmpp:jingle:transports:s5b:1 candidate-used", HFILL
 936           }},
 937         { &hf_xmpp_jingle_cont_trans_candidate_error,
 938           {
 939               "CANDIDATE-ERROR", "xmpp.jingle.content.transport.candidate-error", FT_NONE, BASE_NONE, NULL, 0x0,
 940               "urn:xmpp:jingle:transports:s5b:1 candidate-error", HFILL
 941           }},
 942         { &hf_xmpp_jingle_cont_trans_proxy_error,
 943           {
 944               "PROXY-ERROR", "xmpp.jingle.content.transport.proxy-error", FT_NONE, BASE_NONE, NULL, 0x0,
 945               "urn:xmpp:jingle:transports:s5b:1 proxy-error", HFILL
 946           }},
 947         { &hf_xmpp_jingle_cont_desc_enc,
 948           {
 949               "ENCRYPTION", "xmpp.jingle.content.description.encryption", FT_NONE, BASE_NONE, NULL, 0x0,
 950               "iq jingle content description encryption", HFILL
 951           }},
 952         { &hf_xmpp_jingle_cont_desc_enc_zrtp_hash,
 953           {
 954               "ZRTP-HASH", "xmpp.jingle.content.description.encryption.zrtp-hash", FT_NONE, BASE_NONE, NULL, 0x0,
 955               "iq jingle content description encryption zrtp-hash", HFILL
 956           }},
 957         { &hf_xmpp_jingle_cont_desc_enc_crypto,
 958           {
 959               "CRYPTO", "xmpp.jingle.content.description.encryption.crypto", FT_NONE, BASE_NONE, NULL, 0x0,
 960               "iq jingle content description encryption crypto", HFILL
 961           }},
 962         { &hf_xmpp_jingle_cont_desc_bandwidth,
 963           {
 964               "BANDWIDTH", "xmpp.jingle.content.description.bandwidth", FT_NONE, BASE_NONE, NULL, 0x0,
 965               "iq jingle content description bandwidth", HFILL
 966           }},
 967         { &hf_xmpp_jingle_cont_desc_rtp_hdr,
 968           {
 969               "RTP-HDREXT", "xmpp.jingle.content.description.rtp-hdrext", FT_NONE, BASE_NONE, NULL, 0x0,
 970               "iq jingle content description rtp-hdrext", HFILL
 971           }},
 972         { &hf_xmpp_jingle_reason,
 973           {
 974               "REASON", "xmpp.jingle.reason", FT_NONE, BASE_NONE, NULL, 0x0,
 975               "iq jingle reason", HFILL
 976           }},
 977         { &hf_xmpp_jingle_reason_condition,
 978           {
 979               "CONDITION", "xmpp.jingle.reason.condition", FT_STRING, BASE_NONE, NULL, 0x0,
 980               "iq jingle reason condition", HFILL
 981           }},
 982         { &hf_xmpp_jingle_reason_text,
 983           {
 984               "TEXT", "xmpp.jingle.reason.text", FT_STRING, BASE_NONE, NULL, 0x0,
 985               "iq jingle reason text", HFILL
 986           }},
 987         { &hf_xmpp_jingle_rtp_info,
 988           {
 989               "RTP-INFO", "xmpp.jingle.rtp_info", FT_STRING, BASE_NONE, NULL, 0x0,
 990               "iq jingle rtp-info(ringing, active, hold, mute, ...)", HFILL
 991           }},
 992         { &hf_xmpp_jingle_file_transfer_offer,
 993           {
 994               "OFFER", "xmpp.jingle.content.description.offer", FT_NONE, BASE_NONE, NULL, 0x0,
 995               "urn:xmpp:jingle:apps:file-transfer:3 offer", HFILL
 996           }},
 997         { &hf_xmpp_jingle_file_transfer_request,
 998           {
 999               "REQUEST", "xmpp.jingle.content.description.request", FT_NONE, BASE_NONE, NULL, 0x0,
1000               "urn:xmpp:jingle:apps:file-transfer:3 request", HFILL
1001           }},
1002         { &hf_xmpp_jingle_file_transfer_received,
1003           {
1004               "RECEIVED", "xmpp.jingle.content.received", FT_NONE, BASE_NONE, NULL, 0x0,
1005               "urn:xmpp:jingle:apps:file-transfer:3 received", HFILL
1006           }},
1007         { &hf_xmpp_jingle_file_transfer_abort,
1008           {
1009               "ABORT", "xmpp.jingle.content.abort", FT_NONE, BASE_NONE, NULL, 0x0,
1010               "urn:xmpp:jingle:apps:file-transfer:3 abort", HFILL
1011           }},
1012         { &hf_xmpp_jingle_file_transfer_checksum,
1013           {
1014               "CHECKSUM", "xmpp.jingle.content.checksum", FT_NONE, BASE_NONE, NULL, 0x0,
1015               "urn:xmpp:jingle:apps:file-transfer:3 checksum", HFILL
1016           }},
1017         { &hf_xmpp_si,
1018           {
1019               "SI", "xmpp.si", FT_NONE, BASE_NONE, NULL, 0x0,
1020               "iq si", HFILL
1021           }},
1022         { &hf_xmpp_si_file,
1023           {
1024               "FILE", "xmpp.si.file", FT_NONE, BASE_NONE, NULL, 0x0,
1025               "iq si file", HFILL
1026           }},
1027         { &hf_xmpp_iq_feature_neg,
1028           {
1029               "FEATURE", "xmpp.feature-neg", FT_NONE, BASE_NONE, NULL, 0x0,
1030               "http://jabber.org/protocol/feature-neg", HFILL
1031           }},
1032         { &hf_xmpp_x_data,
1033           {
1034               "X-DATA", "xmpp.x-data", FT_NONE, BASE_NONE, NULL, 0x0,
1035               "jabber:x:data", HFILL
1036           }},
1037         { &hf_xmpp_x_data_field,
1038           {
1039               "FIELD", "xmpp.x-data.field", FT_NONE, BASE_NONE, NULL, 0x0,
1040               "jabber:x:data field", HFILL
1041           }},
1042         { &hf_xmpp_x_data_field_value,
1043           {
1044               "VALUE", "xmpp.x-data.field.value", FT_NONE, BASE_NONE, NULL, 0x0,
1045               "jabber:x:data field value", HFILL
1046           }},
1047         { &hf_xmpp_x_data_instructions,
1048           {
1049               "INSTRUCTIONS", "xmpp.x-data.instructions", FT_STRING, BASE_NONE, NULL, 0x0,
1050               NULL, HFILL
1051           }},
1052         { &hf_xmpp_muc_user_status,
1053           {
1054               "STATUS", "xmpp.muc_user_status", FT_STRING, BASE_NONE, NULL, 0x0,
1055               NULL, HFILL
1056           }},
1057         { &hf_xmpp_delay,
1058           {
1059               "DELAY", "xmpp.delay", FT_NONE, BASE_NONE, NULL, 0x0,
1060               "urn:xmpp:delay", HFILL
1061           }},
1062         { &hf_xmpp_x_event,
1063           {
1064               "X EVENT", "xmpp.x-event", FT_NONE, BASE_NONE, NULL, 0x0,
1065               "jabber:x:event", HFILL
1066           }},
1067         { &hf_xmpp_x_event_condition,
1068           {
1069               "CONDITION", "xmpp.x-event.condition", FT_STRING, BASE_NONE, NULL, 0x0,
1070               "jabber:x:event condition", HFILL
1071           }},
1072         { &hf_xmpp_presence,
1073           {
1074               "PRESENCE", "xmpp.presence", FT_NONE, BASE_NONE, NULL, 0x0,
1075               "presence packet", HFILL
1076           }},
1077         { &hf_xmpp_presence_show,
1078           {
1079               "SHOW", "xmpp.presence.show", FT_STRING, BASE_NONE, NULL, 0x0,
1080               "presence show", HFILL
1081           }},
1082         { &hf_xmpp_presence_status,
1083           {
1084               "STATUS", "xmpp.presence.status", FT_NONE, BASE_NONE, NULL, 0x0,
1085               "presence status", HFILL
1086           }},
1087         { &hf_xmpp_presence_caps,
1088           {
1089               "CAPS", "xmpp.presence.caps", FT_NONE, BASE_NONE, NULL, 0x0,
1090               "presence caps", HFILL
1091           }},
1092         { &hf_xmpp_message,
1093           {
1094               "MESSAGE", "xmpp.message", FT_NONE, BASE_NONE, NULL, 0x0,
1095               "message packet", HFILL
1096           }},
1097         { &hf_xmpp_message_chatstate,
1098           {
1099               "CHATSTATE", "xmpp.message.chatstate", FT_STRING, BASE_NONE, NULL, 0x0,
1100               "message chatstate", HFILL
1101           }},
1102         { &hf_xmpp_message_thread,
1103           {
1104               "THREAD", "xmpp.message.thread", FT_NONE, BASE_NONE, NULL, 0x0,
1105               "message thread", HFILL
1106           }},
1107         { &hf_xmpp_message_body,
1108           {
1109               "BODY", "xmpp.message.body", FT_NONE, BASE_NONE, NULL, 0x0,
1110               "message body", HFILL
1111           }},
1112         { &hf_xmpp_message_subject,
1113           {
1114               "SUBJECT", "xmpp.message.subject", FT_NONE, BASE_NONE, NULL, 0x0,
1115               "message subject", HFILL
1116           }},
1117         { &hf_xmpp_message_thread_parent,
1118           {
1119               "parent", "xmpp.message.thread.parent", FT_STRING, BASE_NONE, NULL, 0x0,
1120               "message thread parent", HFILL
1121           }},
1122         { &hf_xmpp_auth,
1123           {
1124               "AUTH", "xmpp.auth", FT_NONE, BASE_NONE, NULL, 0x0,
1125               "auth packet", HFILL
1126           }},
1127         { &hf_xmpp_stream,
1128           {
1129               "STREAM", "xmpp.stream", FT_NONE, BASE_NONE, NULL, 0x0,
1130               "XMPP stream", HFILL
1131           }},
1132         { &hf_xmpp_failure,
1133           {
1134               "FAILURE", "xmpp.failure", FT_NONE, BASE_NONE, NULL, 0x0,
1135               "failure packet", HFILL
1136           }},
1137         { &hf_xmpp_failure_text,
1138           {
1139               "FAILURE TEXT", "xmpp.failure_text", FT_STRING, BASE_NONE, NULL, 0x0,
1140               NULL, HFILL
1141           }},
1142         { &hf_xmpp_xml_header_version,
1143           {
1144               "XML HEADER VER", "xmpp.xml_header_version", FT_STRING, BASE_NONE, NULL, 0x0,
1145               NULL, HFILL
1146           }},
1147         { &hf_xmpp_stream_end,
1148           {
1149               "STREAM END", "xmpp.stream_end", FT_NONE, BASE_NONE, NULL, 0x0,
1150               NULL, HFILL
1151           }},
1152         { &hf_xmpp_features,
1153           {
1154               "FEATURES", "xmpp.features", FT_NONE, BASE_NONE, NULL, 0x0,
1155               "stream features", HFILL
1156           }},
1157         { &hf_xmpp_starttls,
1158           {
1159               "STARTTLS", "xmpp.starttls", FT_NONE, BASE_NONE, NULL, 0x0,
1160               "starttls packet", HFILL
1161           }},
1162         { &hf_xmpp_proceed,
1163           {
1164               "PROCEED", "xmpp.proceed", FT_NONE, BASE_NONE, NULL, 0x0,
1165               "proceed packet", HFILL
1166           }},
1167         { &hf_xmpp_unknown,
1168           {
1169               "UNKNOWN", "xmpp.unknown", FT_STRING, BASE_NONE, NULL, 0x0,
1170               "unknown element", HFILL
1171           }},
1172         { &hf_xmpp_unknown_attr,
1173           {
1174               "UNKNOWN ATTR", "xmpp.unknown_attr", FT_STRING, BASE_NONE, NULL, 0x0,
1175               "unknown attribute", HFILL
1176           }},
1177         { &hf_xmpp_ibb_open,
1178           {
1179               "IBB-OPEN", "xmpp.ibb.open", FT_NONE, BASE_NONE, NULL, 0x0,
1180               "xmpp ibb open", HFILL
1181           }},
1182         { &hf_xmpp_ibb_close,
1183           {
1184               "IBB-CLOSE", "xmpp.ibb.close", FT_NONE, BASE_NONE, NULL, 0x0,
1185               "xmpp ibb close", HFILL
1186           }},
1187         { &hf_xmpp_ibb_data,
1188           {
1189               "IBB-DATA", "xmpp.ibb.data", FT_NONE, BASE_NONE, NULL, 0x0,
1190               "xmpp ibb data", HFILL
1191           }},
1192         { &hf_xmpp_muc_x,
1193           {
1194               "X MUC", "xmpp.muc-x", FT_NONE, BASE_NONE, NULL, 0x0,
1195               "http://jabber.org/protocol/muc", HFILL
1196           }},
1197         { &hf_xmpp_muc_user_x,
1198           {
1199               "X MUC-USER", "xmpp.muc-user-x", FT_NONE, BASE_NONE, NULL, 0x0,
1200               "http://jabber.org/protocol/muc#user", HFILL
1201           }},
1202         { &hf_xmpp_muc_user_item,
1203           {
1204               "ITEM", "xmpp.muc-user-x.item", FT_NONE, BASE_NONE, NULL, 0x0,
1205               "muc#user item", HFILL
1206           }},
1207         { &hf_xmpp_muc_user_invite,
1208           {
1209               "INVITE", "xmpp.muc-user-x.invite", FT_NONE, BASE_NONE, NULL, 0x0,
1210               "muc#user invite", HFILL
1211           }},
1212         { &hf_xmpp_gtalk_session,
1213           {
1214               "GTALK-SESSION", "xmpp.gtalk.session", FT_NONE, BASE_NONE, NULL, 0x0,
1215               "GTalk session", HFILL
1216           }},
1217         { &hf_xmpp_gtalk_session_type,
1218           {
1219               "type", "xmpp.gtalk.session.type", FT_STRING, BASE_NONE, NULL, 0x0,
1220               "GTalk session type", HFILL
1221           }},
1222         { &hf_xmpp_gtalk,
1223           {
1224               "GTALK SESSION", "xmpp.gtalk", FT_STRING, BASE_NONE, NULL, 0x0,
1225               "GTalk SID", HFILL
1226           }},
1227         { &hf_xmpp_gtalk_setting,
1228           {
1229               "USERSETTING", "xmpp.gtalk.setting", FT_NONE, BASE_NONE, NULL, 0x0,
1230               "google:setting usersetting", HFILL
1231           }},
1232         { &hf_xmpp_gtalk_setting_element,
1233           {
1234               "USERSETTING ELEMENT", "xmpp.gtalk.setting_element", FT_STRING, BASE_NONE, NULL, 0x0,
1235               NULL, HFILL
1236           }},
1237         { &hf_xmpp_gtalk_nosave_x,
1238           {
1239               "X-NOSAVE", "xmpp.gtalk.nosave.x", FT_NONE, BASE_NONE, NULL, 0x0,
1240               "google:nosave x", HFILL
1241           }},
1242         { &hf_xmpp_gtalk_mail_mailbox,
1243           {
1244               "MAILBOX", "xmpp.gtalk.mailbox", FT_NONE, BASE_NONE, NULL, 0x0,
1245               "google:mail:notify mailbox", HFILL
1246           }},
1247         { &hf_xmpp_gtalk_mail_new_mail,
1248           {
1249               "NEW MAIL", "xmpp.gtalk.new-mail", FT_NONE, BASE_NONE, NULL, 0x0,
1250               "google:mail:notify new-mail", HFILL
1251           }},
1252         { &hf_xmpp_gtalk_transport_p2p,
1253           {
1254               "TRANSPORT", "xmpp.gtalk.transport-p2p", FT_NONE, BASE_NONE, NULL, 0x0,
1255               "google/transport/p2p", HFILL
1256           }},
1257         { &hf_xmpp_gtalk_mail_snippet,
1258           {
1259               "SNIPPET", "xmpp.gtalk.mail_snippet", FT_STRING, BASE_NONE, NULL, 0x0,
1260               NULL, HFILL
1261           }},
1262         { &hf_xmpp_gtalk_status_status_list,
1263           {
1264               "STATUS", "xmpp.gtalk.status_status_list", FT_STRING, BASE_NONE, NULL, 0x0,
1265               NULL, HFILL
1266           }},
1267         { &hf_xmpp_conf_info,
1268           {
1269               "CONFERENCE INFO", "xmpp.conf-info", FT_NONE, BASE_NONE, NULL, 0x0,
1270               "urn:ietf:params:xml:ns:conference-info", HFILL
1271           }},
1272         { &hf_xmpp_conf_info_sid,
1273           {
1274               "sid", "xmpp.conf-info.sid", FT_STRING, BASE_NONE, NULL, 0x0,
1275               "urn:ietf:params:xml:ns:conference-info sid", HFILL
1276           }},
1277         { &hf_xmpp_response_in,
1278           { "Response In", "xmpp.response_in",
1279             FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_RESPONSE), 0x0,
1280             "The response to this request is in this frame", HFILL }
1281         },
1282         { &hf_xmpp_response_to,
1283           { "Request In", "xmpp.response_to",
1284             FT_FRAMENUM, BASE_NONE, FRAMENUM_TYPE(FT_FRAMENUM_REQUEST), 0x0,
1285             "This is a response to the request in this frame", HFILL }
1286         },
1287         { &hf_xmpp_out,
1288           {
1289               "Out", "xmpp.out", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1290               "Outgoing packet", HFILL
1291           }},
1292         { &hf_xmpp_in,
1293           {
1294               "In", "xmpp.in", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1295               "Ingoing packet", HFILL
1296           }},
1297         { &hf_xmpp_ibb,
1298           {
1299               "IBB SESSION", "xmpp.ibb", FT_STRING, BASE_NONE, NULL, 0x0,
1300               "In-Band Bytestreams session", HFILL
1301           }},
1302         { &hf_xmpp_jingle_session,
1303           {
1304               "JINGLE SESSION", "xmpp.jingle_session", FT_STRING, BASE_NONE, NULL, 0x0,
1305               "Jingle SID", HFILL
1306           }},
1307         { &hf_xmpp_ping,
1308           {
1309               "PING", "xmpp.ping", FT_NONE, BASE_NONE, NULL, 0x0,
1310               "urn:xmpp:ping", HFILL
1311           }},
1312         { &hf_xmpp_hashes,
1313           {
1314               "HASHES", "xmpp.hashes", FT_NONE, BASE_NONE, NULL, 0x0,
1315               "urn:xmpp:hashes:0", HFILL
1316           }},
1317         { &hf_xmpp_jitsi_inputevt,
1318           {
1319               "INPUTEVT", "xmpp.inputevt", FT_NONE, BASE_NONE, NULL, 0x0,
1320               "http://jitsi.org/protocol/inputevt", HFILL
1321           }},
1322         { &hf_xmpp_jitsi_inputevt_rmt_ctrl,
1323           {
1324               "REMOTE-CONTROL", "xmpp.inputevt.remote-control", FT_NONE, BASE_NONE, NULL, 0x0,
1325               "http://jitsi.org/protocol/inputevt remote-control", HFILL
1326           }},
1327     };
1328
1329     static int * ett[] = {
1330         &ett_xmpp,
1331         &ett_xmpp_iq,
1332         &ett_xmpp_query,
1333         &ett_xmpp_query_item,
1334         &ett_xmpp_query_identity,
1335         &ett_xmpp_query_feature,
1336         &ett_xmpp_query_streamhost,
1337         &ett_xmpp_query_streamhost_used,
1338         &ett_xmpp_query_udpsuccess,
1339         &ett_xmpp_iq_error,
1340         &ett_xmpp_iq_bind,
1341         &ett_xmpp_iq_session,
1342         &ett_xmpp_vcard,
1343         &ett_xmpp_vcard_x_update,
1344         &ett_xmpp_jingle,
1345         &ett_xmpp_jingle_content,
1346         &ett_xmpp_jingle_content_description,
1347         &ett_xmpp_jingle_cont_desc_payload,
1348         &ett_xmpp_jingle_cont_desc_payload_param,
1349         &ett_xmpp_jingle_cont_desc_enc,
1350         &ett_xmpp_jingle_cont_desc_enc_zrtp_hash,
1351         &ett_xmpp_jingle_cont_desc_enc_crypto,
1352         &ett_xmpp_jingle_cont_desc_bandwidth,
1353         &ett_xmpp_jingle_cont_desc_rtp_hdr,
1354         &ett_xmpp_jingle_cont_trans,
1355         &ett_xmpp_jingle_cont_trans_cand,
1356         &ett_xmpp_jingle_cont_trans_rem_cand,
1357         &ett_xmpp_jingle_reason,
1358         &ett_xmpp_jingle_rtp_info,
1359         &ett_xmpp_services,
1360         &ett_xmpp_services_relay,
1361         &ett_xmpp_channel,
1362         &ett_xmpp_si,
1363         &ett_xmpp_si_file,
1364         &ett_xmpp_si_file_range,
1365         &ett_xmpp_iq_feature_neg,
1366         &ett_xmpp_x_data,
1367         &ett_xmpp_x_data_field,
1368         &ett_xmpp_x_data_field_value,
1369         &ett_xmpp_ibb_open,
1370         &ett_xmpp_ibb_close,
1371         &ett_xmpp_ibb_data,
1372         &ett_xmpp_delay,
1373         &ett_xmpp_x_event,
1374         &ett_xmpp_message,
1375         &ett_xmpp_message_thread,
1376         &ett_xmpp_message_subject,
1377         &ett_xmpp_message_body,
1378         &ett_xmpp_presence,
1379         &ett_xmpp_presence_status,
1380         &ett_xmpp_presence_caps,
1381         &ett_xmpp_auth,
1382         &ett_xmpp_challenge,
1383         &ett_xmpp_response,
1384         &ett_xmpp_success,
1385         &ett_xmpp_failure,
1386         &ett_xmpp_muc_x,
1387         &ett_xmpp_muc_hist,
1388         &ett_xmpp_muc_user_x,
1389         &ett_xmpp_muc_user_item,
1390         &ett_xmpp_muc_user_invite,
1391         &ett_xmpp_gtalk_session,
1392         &ett_xmpp_gtalk_session_desc,
1393         &ett_xmpp_gtalk_session_desc_payload,
1394         &ett_xmpp_gtalk_session_cand,
1395         &ett_xmpp_gtalk_session_reason,
1396         &ett_xmpp_gtalk_jingleinfo_stun,
1397         &ett_xmpp_gtalk_jingleinfo_server,
1398         &ett_xmpp_gtalk_jingleinfo_relay,
1399         &ett_xmpp_gtalk_jingleinfo_relay_serv,
1400         &ett_xmpp_gtalk_setting,
1401         &ett_xmpp_gtalk_nosave_x,
1402         &ett_xmpp_gtalk_mail_mailbox,
1403         &ett_xmpp_gtalk_mail_mail_info,
1404         &ett_xmpp_gtalk_mail_senders,
1405         &ett_xmpp_gtalk_mail_sender,
1406         &ett_xmpp_gtalk_status_status_list,
1407         &ett_xmpp_conf_info,
1408         &ett_xmpp_conf_desc,
1409         &ett_xmpp_conf_state,
1410         &ett_xmpp_conf_users,
1411         &ett_xmpp_conf_user,
1412         &ett_xmpp_conf_endpoint,
1413         &ett_xmpp_conf_media,
1414         &ett_xmpp_gtalk_transport_p2p,
1415         &ett_xmpp_gtalk_transport_p2p_cand,
1416         &ett_xmpp_ping,
1417         &ett_xmpp_hashes_hash,
1418         &ett_xmpp_hashes,
1419         &ett_xmpp_jingle_file_transfer_offer,
1420         &ett_xmpp_jingle_file_transfer_request,
1421         &ett_xmpp_jingle_file_transfer_received,
1422         &ett_xmpp_jingle_file_transfer_abort,
1423         &ett_xmpp_jingle_file_transfer_checksum,
1424         &ett_xmpp_jingle_file_transfer_file,
1425         &ett_xmpp_jitsi_inputevt,
1426         &ett_xmpp_jitsi_inputevt_rmt_ctrl,
1427         &ett_xmpp_stream,
1428         &ett_xmpp_features,
1429         &ett_xmpp_features_mechanisms,
1430         &ett_xmpp_starttls,
1431         &ett_xmpp_proceed,
1432     };
1433
1434     static ei_register_info ei[] = {
1435         { &ei_xmpp_xml_disabled, { "xmpp.xml_disabled", PI_UNDECODED, PI_WARN, "XML dissector disabled, can't dissect XMPP", EXPFILL }},
1436         { &ei_xmpp_packet_unknown, { "xmpp.packet_unknown", PI_UNDECODED, PI_NOTE, "Unknown packet", EXPFILL }},
1437         { &ei_xmpp_packet_without_response, { "xmpp.packet_without_response", PI_PROTOCOL, PI_CHAT, "Packet without response", EXPFILL }},
1438         { &ei_xmpp_response, { "xmpp.response", PI_RESPONSE_CODE, PI_CHAT, "RESPONSE", EXPFILL }},
1439         { &ei_xmpp_challenge, { "xmpp.challenge", PI_RESPONSE_CODE, PI_CHAT, "CHALLENGE", EXPFILL }},
1440         { &ei_xmpp_success, { "xmpp.success", PI_RESPONSE_CODE, PI_CHAT, "SUCCESS", EXPFILL }},
1441         { &ei_xmpp_starttls_already_in_frame, { "xmpp.starttls.already_in_frame", PI_PROTOCOL, PI_WARN, "Already saw STARTTLS in frame X", EXPFILL }},
1442         { &ei_xmpp_starttls_missing, { "xmpp.starttls.missing", PI_PROTOCOL, PI_WARN, "Haven't seen a STARTTLS, did the capture start in the middle of a session?", EXPFILL }},
1443         { &ei_xmpp_proceed_already_in_frame, { "xmpp.proceed.already_in_frame", PI_PROTOCOL, PI_WARN, "Already saw PROCEED in frame X", EXPFILL }},
1444         { &ei_xmpp_unknown_element, { "xmpp.unknown.element", PI_UNDECODED, PI_NOTE, "Unknown element", EXPFILL }},
1445         { &ei_xmpp_unknown_attribute, { "xmpp.unknown.attribute", PI_UNDECODED, PI_NOTE, "Unknown attribute", EXPFILL }},
1446         { &ei_xmpp_required_attribute, { "xmpp.required_attribute", PI_PROTOCOL, PI_WARN, "Required attribute doesn't appear", EXPFILL }},
1447         { &ei_xmpp_field_unexpected_value, { "xmpp.field.unexpected_value", PI_PROTOCOL, PI_WARN, "Field has unexpected value", EXPFILL }},
1448     };
1449
1450     module_t *xmpp_module;
1451     expert_module_t* expert_xmpp;
1452
1453     static int* ett_unknown_ptr[ETT_UNKNOWN_LEN];
1454     int i;
1455     for(i=0;i<ETT_UNKNOWN_LEN;i++)
1456     {
1457         ett_unknown_ptr[i] = &ett_unknown[i];
1458     }
1459
1460     proto_xmpp = proto_register_protocol("XMPP Protocol", "XMPP", "xmpp");
1461
1462     xmpp_module = prefs_register_protocol(proto_xmpp, NULL);
1463     prefs_register_bool_preference(xmpp_module, "desegment",
1464                                    "Reassemble XMPP messages",
1465                                    "Whether the XMPP dissector should reassemble messages. "
1466                                    "To use this option, you must also enable"
1467                                    " \"Allow subdissectors to reassemble TCP streams\""
1468                                    " in the TCP protocol settings",
1469                                    &xmpp_desegment);
1470
1471     proto_register_field_array(proto_xmpp, hf, array_length(hf));
1472     proto_register_subtree_array(ett, array_length(ett));
1473     proto_register_subtree_array(ett_unknown_ptr, array_length(ett_unknown_ptr));
1474     expert_xmpp = expert_register_protocol(proto_xmpp);
1475     expert_register_field_array(expert_xmpp, ei, array_length(ei));
1476
1477     xmpp_handle = register_dissector("xmpp", dissect_xmpp, proto_xmpp);
1478
1479     xmpp_init_parsers();
1480 }
1481
1482 void
1483 proto_reg_handoff_xmpp(void) {
1484     xml_handle  = find_dissector_add_dependency("xml", proto_xmpp);
1485
1486     dissector_add_uint_with_preference("tcp.port", XMPP_PORT, xmpp_handle);
1487
1488 }
1489 /*
1490 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1491 *
1492 * Local variables:
1493 * c-basic-offset: 4
1494 * tab-width: 8
1495 * indent-tabs-mode: nil
1496 * End:
1497 *
1498 * ex: set shiftwidth=4 tabstop=8 expandtab:
1499 * :indentSize=4:tabSize=8:noTabs=true:
1500 */