| blob | 71580005279a3c0945a324622eab87f6af18de80 |
1 /* packet-http.c
2 * Routines for HTTP packet disassembly
3 * RFC 1945 (HTTP/1.0)
4 * RFC 2616 (HTTP/1.1)
5 *
6 * Guy Harris <guy@alum.mit.edu>
7 *
8 * Copyright 2004, Jerry Talkington <jtalkington@users.sourceforge.net>
9 * Copyright 2002, Tim Potter <tpot@samba.org>
10 * Copyright 1999, Andrew Tridgell <tridge@samba.org>
11 *
12 * $Id$
13 *
14 * Wireshark - Network traffic analyzer
15 * By Gerald Combs <gerald@wireshark.org>
16 * Copyright 1998 Gerald Combs
17 *
18 * This program is free software; you can redistribute it and/or
19 * modify it under the terms of the GNU General Public License
20 * as published by the Free Software Foundation; either version 2
21 * of the License, or (at your option) any later version.
22 *
23 * This program is distributed in the hope that it will be useful,
24 * but WITHOUT ANY WARRANTY; without even the implied warranty of
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
26 * GNU General Public License for more details.
27 *
28 * You should have received a copy of the GNU General Public License
29 * along with this program; if not, write to the Free Software
30 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
31 */
35 #include <stdlib.h>
36 #include <string.h>
37 #include <ctype.h>
38 #include <errno.h>
40 #include <glib.h>
41 #include <epan/conversation.h>
42 #include <epan/packet.h>
43 #include <epan/strutil.h>
44 #include <epan/base64.h>
45 #include <epan/stats_tree.h>
47 #include <epan/req_resp_hdrs.h>
51 #include <epan/prefs.h>
52 #include <epan/expert.h>
53 #include <epan/uat.h>
54 #include <epan/wmem/wmem.h>
57 HTTP_REQUEST,
58 HTTP_RESPONSE,
59 HTTP_NOTIFICATION,
60 HTTP_OTHERS
63 #include <epan/tap.h>
142 /* Stuff for generation/handling of fields for custom HTTP headers */
153 static void
155 {
162 }
168 }
170 /* Check for invalid characters (to avoid asserting out when
171 * registering the field).
172 */
177 }
180 }
184 {
192 }
198 }
201 }
203 static void
205 {
210 }
215 /*
216 * desegmentation of HTTP headers
217 * (when we are over TCP or another protocol providing the desegmentation API)
218 */
221 /*
222 * desegmentation of HTTP bodies
223 * (when we are over TCP or another protocol providing the desegmentation API)
224 * TODO let the user filter on content-type the bodies he wants desegmented
225 */
228 /*
229 * De-chunking of content-encoding: chunk entity bodies.
230 */
233 /*
234 * Decompression of zlib encoded entities.
235 */
236 #ifdef HAVE_LIBZ
238 #else
240 #endif
242 /* Simple Service Discovery Protocol
243 * SSDP is implemented atop HTTP (yes, it really *does* run over UDP).
244 * SSDP is the discovery protocol of Universal Plug and Play
245 * UPnP http://www.upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf
246 */
247 #define TCP_PORT_SSDP 1900
248 #define UDP_PORT_SSDP 1900
250 /*
251 * tcp and ssl ports
252 *
253 * 2710 is the XBT BitTorrent tracker
254 */
259 #define UPGRADE_WEBSOCKET 1
260 #define UPGRADE_HTTP2 2
271 /*
272 * Structure holding information from headers needed by main
273 * HTTP dissector code.
274 */
278 gboolean have_content_length;
279 gint64 content_length;
282 guint8 upgrade;
310 /* --- HTTP Status Codes */
311 /* Note: The reference for uncommented entries is RFC 2616 */
377 };
389 /* HTTP/Load Distribution stats init function */
390 static void
392 {
394 st_node_reqs_by_srv_addr = stats_tree_create_node(st, st_str_reqs_by_srv_addr, st_node_reqs, TRUE);
395 st_node_reqs_by_http_host = stats_tree_create_node(st, st_str_reqs_by_http_host, st_node_reqs, TRUE);
397 }
399 /* HTTP/Load Distribution stats packet function */
400 static int
401 http_reqs_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t* edt _U_, const void* p)
402 {
424 }
438 }
441 }
444 }
450 /* HTTP/Requests stats init function */
451 static void
453 {
455 }
457 /* HTTP/Requests stats packet function */
458 static int
459 http_req_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p)
460 {
472 }
473 }
476 }
479 }
504 /* HTTP/Packet Counter stats init function */
505 static void
507 {
518 }
520 /* HTTP/Packet Counter stats packet function */
521 static int
522 http_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p)
523 {
553 }
564 }
567 }
570 static void
573 {
580 else
582 }
584 static void
587 {
594 }
599 {
605 /* Retrieve information from conversation
606 * or add it if it isn't there yet
607 */
610 /* Setup the conversation structure itself */
614 conv_data);
615 }
618 }
620 /**
621 * create a new http_req_res_t and add it to the conversation.
622 * @return the new allocated object which is already added to the linked list
623 */
625 {
626 http_req_res_t *req_res = (http_req_res_t *)wmem_alloc0(wmem_file_scope(), sizeof(http_req_res_t));
636 }
639 }
641 /**
642 * push a request frame number and its time stamp to the conversation data.
643 */
645 {
646 /* a request will always create a new http_req_res_t object */
653 }
655 /**
656 * push a response frame number to the conversation data.
657 */
659 {
660 /* a response will create a new http_req_res_t object: if no
661 object exists, or if one exists for another response. In
662 both cases the corresponding request was not
663 detected/included in the conversation. In all other cases
664 the http_req_res_t object created by the request is
665 used. */
669 }
672 }
674 /*
675 * TODO: remove this ugly global variable.
676 * XXX: do we really want to have to pass this from one function to another?
677 */
680 static int
683 {
689 gint next_offset;
693 gboolean is_request_or_reply;
694 gboolean saw_req_resp_or_header;
695 guchar c;
696 http_type_t http_type;
698 ReqRespDissector reqresp_dissector;
701 headers_t headers;
704 dissector_handle_t handle;
706 /*guint i;*/
707 /*http_info_value_t *si;*/
710 /*
711 * Is this a request or response?
712 *
713 * Note that "tvb_find_line_end()" will return a value that
714 * is not longer than what's in the buffer, so the
715 * "tvb_get_ptr()" call won't throw an exception.
716 */
719 TRUE);
722 /* No complete line was found in this segment, do
723 * desegmentation if we're told to.
724 */
727 /*
728 * More data needed for desegmentation.
729 */
731 }
732 }
734 /*
735 * Is the first line a request or response?
736 */
742 /*
743 * Yes, it's a request or response.
744 * Do header desegmentation if we've been told to,
745 * and do body desegmentation if we've been told to and
746 * we find a Content-Length header.
747 */
750 /*
751 * More data needed for desegmentation.
752 */
754 }
755 }
773 }
776 /*
777 * Put the first line from the buffer into the summary
778 * if it's an HTTP request or reply (but leave out the
779 * line terminator).
780 * Otherwise, just call it a continuation.
781 *
782 * Note that "tvb_find_line_end()" will return a value that
783 * is not longer than what's in the buffer, so the
784 * "tvb_get_ptr()" call won't throw an exception.
785 */
789 }
790 else
796 ENC_NA);
798 }
800 /*
801 * Process the packet data, a line at a time.
802 */
813 /*
814 * Find the end of the line.
815 * XXX - what if we don't find it because the packet
816 * is cut short by a snapshot length or the header is
817 * split across TCP segments? How much dissection should
818 * we do on it?
819 */
822 FALSE);
826 /*
827 * Get a buffer that refers to the line.
828 */
833 /*
834 * OK, does it look like an HTTP request or response?
835 */
837 is_request_or_reply =
843 /*
844 * No. Does it look like a blank line (as would appear
845 * at the end of an HTTP request)?
846 */
850 /*
851 * No. Does it look like a header?
852 */
858 /*
859 * This must be a CHAR to be part of a token; that
860 * means it must be ASCII.
861 */
865 /*
866 * This mustn't be a CTL to be part of a token.
867 *
868 * XXX - what about leading LWS on continuation
869 * lines of a header?
870 */
874 /*
875 * This mustn't be a SEP to be part of a token;
876 * a ':' ends the token, everything else is an
877 * indication that this isn't a header.
878 */
898 /*
899 * It's a separator, so it's not part of a
900 * token, so it's not a field name for the
901 * beginning of a header.
902 *
903 * (We don't have to check for HT; that's
904 * already been ruled out by "iscntrl()".)
905 */
909 /*
910 * This ends the token; we consider this
911 * to be a header.
912 */
916 colon_offset++;
918 }
919 }
921 /*
922 * We haven't seen the colon, but everything else looks
923 * OK for a header line.
924 *
925 * If we've already seen an HTTP request or response
926 * line, or a header line, and we're at the end of
927 * the tvbuff, we assume this is an incomplete header
928 * line. (We quit this loop after seeing a blank line,
929 * so if we've seen a request or response line, or a
930 * header line, this is probably more of the request
931 * or response we're presumably seeing. There is some
932 * risk of false positives, but the same applies for
933 * full request or response lines or header lines,
934 * although that's less likely.)
935 *
936 * We throw an exception in that case, by checking for
937 * the existence of the next byte after the last one
938 * in the line. If it exists, "tvb_ensure_bytes_exist()"
939 * throws no exception, and we fall through to the
940 * "not HTTP" case. If it doesn't exist,
941 * "tvb_ensure_bytes_exist()" will throw the appropriate
942 * exception.
943 */
947 not_http:
948 /*
949 * We don't consider this part of an HTTP request or
950 * reply, so we don't display it.
951 * (Yeah, that means we don't display, say, a text/http
952 * page, but you can get that from the data pane.)
953 */
956 is_http:
957 /*
958 * Process this line.
959 */
961 /*
962 * This is a blank line, which means that
963 * whatever follows it isn't part of this
964 * request or reply.
965 */
971 }
973 /*
974 * Not a blank line - either a request, a reply, or a header
975 * line.
976 */
983 }
991 }
994 /*
995 * Header.
996 */
999 http_type);
1000 }
1002 }
1016 }
1023 }
1024 }
1046 nstime_t delta;
1048 pi = proto_tree_add_text(http_tree, tvb, 0, 0, "HTTP response %u/%u", curr->number, conv_data->req_res_num);
1055 }
1056 }
1060 }
1064 }
1068 }
1072 }
1076 }
1086 pi = proto_tree_add_text(http_tree, tvb, 0, 0, "HTTP request %u/%u", curr->number, conv_data->req_res_num);
1088 }
1092 }
1096 }
1100 }
1107 }
1108 }
1113 /*
1114 * If a content length was supplied, the amount of data to be
1115 * processed as HTTP payload is the minimum of the content
1116 * length and the amount of data remaining in the frame.
1117 *
1118 * If a message is received with both a Transfer-Encoding
1119 * header field and a Content-Length header field, the latter
1120 * MUST be ignored.
1121 *
1122 * If no content length was supplied (or if a bad content length
1123 * was supplied), the amount of data to be processed is the amount
1124 * of data remaining in the frame.
1125 *
1126 * If there was no Content-Length entity header, we should
1127 * accumulate all data until the end of the connection.
1128 * That'd require that the TCP dissector call subdissectors
1129 * for all frames with FIN, even if they contain no data,
1130 * which would require subdissectors to deal intelligently
1131 * with empty segments.
1132 *
1133 * According to RFC 2616, however, 1xx responses, 204 responses,
1134 * and 304 responses MUST NOT include a message body; if no
1135 * content length is specified for them, we don't attempt to
1136 * dissect the body.
1137 *
1138 * XXX - it says the same about responses to HEAD requests;
1139 * unless there's a way to determine from the response
1140 * whether it's a response to a HEAD request, we have to
1141 * keep information about the request and associate that with
1142 * the response in order to handle that.
1143 */
1150 /*
1151 * XXX - limit the reported length in the tvbuff we'll
1152 * hand to a subdissector to be no greater than the
1153 * content length.
1154 *
1155 * We really need both unreassembled and "how long it'd
1156 * be if it were reassembled" lengths for tvbuffs, so
1157 * that we throw the appropriate exceptions for
1158 * "not enough data captured" (running past the length),
1159 * "packet needed reassembly" (within the length but
1160 * running past the unreassembled length), and
1161 * "packet is malformed" (running past the reassembled
1162 * length).
1163 */
1170 /*
1171 * Requests have no content if there's no
1172 * Content-Length header and no Transfer-Encoding
1173 * header.
1174 */
1177 else
1187 /*
1188 * XXX - responses to HEAD requests,
1189 * and possibly other responses,
1190 * "MUST NOT" include a
1191 * message-body.
1192 */
1194 }
1198 /*
1199 * XXX - what about HTTP_NOTIFICATION?
1200 */
1203 }
1204 }
1207 /*
1208 * There's stuff left over; process it.
1209 */
1215 /*
1216 * Create a tvbuff for the payload.
1217 *
1218 * The amount of data to be processed that's
1219 * available in the tvbuff is "datalen", which
1220 * is the minimum of the amount of data left in
1221 * the tvbuff and any specified content length.
1222 *
1223 * The amount of data to be processed that's in
1224 * this frame, regardless of whether it was
1225 * captured or not, is "reported_datalen",
1226 * which, if no content length was specified,
1227 * is -1, i.e. "to the end of the frame.
1228 */
1230 reported_datalen);
1232 /*
1233 * Handle *transfer* encodings other than "identity".
1234 */
1245 /*
1246 * The chunks weren't reassembled,
1247 * or there was a single zero
1248 * length chunk.
1249 */
1252 /*
1253 * Add a new data source for the
1254 * de-chunked data.
1255 */
1258 next_tvb);
1259 #endif
1262 }
1264 /*
1265 * We currently can't handle, for example,
1266 * "gzip", "compress", or "deflate" as
1267 * *transfer* encodings; just handle them
1268 * as data for now.
1269 */
1271 http_tree);
1273 }
1274 }
1275 /*
1276 * At this point, any chunked *transfer* coding has been removed
1277 * (the entity body has been dechunked) so it can be presented
1278 * for the following operation (*content* encoding), or it has
1279 * been been handed off to the data dissector.
1280 *
1281 * Handle *content* encodings other than "identity" (which
1282 * shouldn't appear in a Content-Encoding header, but
1283 * we handle it in any case).
1284 */
1287 /*
1288 * We currently can't handle, for example, "compress";
1289 * just handle them as data for now.
1290 *
1291 * After July 7, 2004 the LZW patent expires, so support
1292 * might be added then. However, I don't think that
1293 * anybody ever really implemented "compress", due to
1294 * the aforementioned patent.
1295 */
1305 {
1308 }
1310 /*
1311 * Add the encoded entity to the protocol tree
1312 */
1319 ett_http_encoded_entity);
1322 /*
1323 * Decompression worked
1324 */
1326 /* XXX - Don't free this, since it's possible
1327 * that the data was only partially
1328 * decompressed, such as when desegmentation
1329 * isn't enabled.
1330 *
1331 tvb_free(next_tvb);
1332 */
1340 e_tree);
1343 }
1344 }
1345 /*
1346 * Note that a new data source is added for the entity body
1347 * only if it was content-encoded and/or transfer-encoded.
1348 */
1350 /* Save values for the Export Object GUI feature if we have
1351 * an active listener to process it (which happens when
1352 * the export object window is open). */
1363 }
1365 /*
1366 * Do subdissector checks.
1367 *
1368 * First, if we have a Content-Type value, check whether
1369 * there's a subdissector for that media type.
1370 */
1373 /*
1374 * We didn't find any subdissector that
1375 * registered for the port, and we have a
1376 * Content-Type value. Is there any subdissector
1377 * for that content type?
1378 */
1384 else
1386 /*
1387 * Calling the string handle for the media type
1388 * dissector table will set pinfo->match_string
1389 * to headers.content_type for us.
1390 */
1393 media_type_subdissector_table,
1397 /* Try to decode the unknown multipart subtype anyway */
1399 media_type_subdissector_table,
1401 }
1402 }
1404 /*
1405 * Now, if we didn't find such a subdissector, check
1406 * whether some subdissector asked that they be called
1407 * if HTTP traffic was on some particular port. This
1408 * handles protocols that use HTTP syntax but don't have
1409 * a media type and instead use a specified port.
1410 */
1414 }
1417 /*
1418 * We have a subdissector - call it.
1419 */
1423 }
1426 /*
1427 * We don't have a subdissector or we have one and it did not
1428 * dissect the payload - try the heuristic subdissectors.
1429 */
1432 }
1435 /*
1436 * The subdissector dissected the body.
1437 * Fix up the top-level item so that it doesn't
1438 * include the stuff for that protocol.
1439 */
1444 /*
1445 * Calling the default media handle if there is a content-type that
1446 * wasn't handled above.
1447 */
1450 /* Call the default data dissector */
1452 }
1453 }
1455 body_dissected:
1456 /*
1457 * Do *not* attempt at freeing the private data;
1458 * it may be in use by subdissectors.
1459 */
1462 /*
1463 * We've processed "datalen" bytes worth of data
1464 * (which may be no data at all); advance the
1465 * offset past whatever data we've processed.
1466 */
1468 }
1473 }
1478 }
1480 /* This can be used to dissect an HTTP request until such time
1481 * that a more complete dissector is written for that HTTP request.
1482 * This simple dissector only puts the request method, URI, and
1483 * protocol version into a sub-tree.
1484 */
1485 static void
1489 {
1494 /* The first token is the method. */
1501 /* Two spaces in a now indicates empty URI, so roll back one here */
1502 next_token--;
1503 }
1507 /* The next token is the URI. */
1510 /* Save the request URI for various later uses */
1516 request_uri);
1520 /* Everything to the end of the line is the version. */
1524 }
1526 static void
1530 {
1535 /*
1536 * The first token is the HTTP Version.
1537 */
1543 /* Advance to the start of the next token. */
1547 /*
1548 * The second token is the Status Code.
1549 */
1554 /* The Status Code characters must be copied into a null-terminated
1555 * buffer for strtoul() to parse them into an unsigned integer value.
1556 */
1566 /* Advance to the start of the next token. */
1570 /*
1571 * The remaining tokens in the line comprise the Reason Phrase.
1572 */
1579 }
1582 /*
1583 * Dissect the http data chunks and add them to the tree.
1584 */
1585 static int
1588 {
1603 }
1613 }
1627 /* Can't get the chunk size line */
1629 }
1634 /* Can't get the chunk size line */
1636 }
1640 /*
1641 * We don't care about the extensions.
1642 */
1645 }
1650 /*
1651 * The chunk size is more than what's in the tvbuff,
1652 * so either the user hasn't enabled decoding, or all
1653 * of the segments weren't captured.
1654 */
1656 }
1657 #if 0
1660 }
1672 }
1673 #endif
1685 }
1690 /* Don't create a new tvb if we have a single chunk with
1691 * a size of zero (meaning it is the end of the chunks). */
1696 }
1702 offset,
1707 offset,
1710 }
1713 ett_http_chunk_data);
1717 chunk_size);
1722 /*
1723 * XXX - just use "proto_tree_add_text()"?
1724 * This means that, in TShark, you get
1725 * the entire chunk dumped out in hex,
1726 * in addition to whatever dissection is
1727 * done on the reassembled data.
1728 */
1730 chunk_subtree);
1734 }
1736 chunks_decoded++;
1739 }
1743 /* Placeholder for the day that composite tvbuffer's will work.
1744 tvb_composite_finalize(new_tvb);
1745 / * tvb_set_reported_length(new_tvb, chunked_data_size); * /
1746 */
1748 /*
1749 * XXX - Don't free this, since the tvbuffer that was passed
1750 * may be used if the data spans multiple frames and reassembly
1751 * isn't enabled.
1752 *
1753 tvb_free(*tvb_ptr);
1754 */
1758 /*
1759 * We didn't create a new tvb, so don't allow sub dissectors
1760 * try to decode the non-existent entity body.
1761 */
1763 }
1767 }
1768 #else
1769 /*
1770 * Dissect the http data chunks and add them to the tree.
1771 */
1772 static int
1775 {
1777 guint32 datalen;
1778 guint32 orig_datalen;
1779 gint chunks_decoded;
1780 gint chunked_data_size;
1783 gint raw_len;
1787 }
1799 }
1801 /* Dechunk the "chunked response" to a new memory buffer */
1810 guint32 chunk_size;
1811 gint chunk_offset;
1813 gint linelen;
1819 /* Can't get the chunk size line */
1821 }
1826 /* Can't get the chunk size line */
1828 }
1832 /*
1833 * We don't care about the extensions.
1834 */
1837 }
1842 /*
1843 * The chunk size is more than what's in the tvbuff,
1844 * so either the user hasn't enabled decoding, or all
1845 * of the segments weren't captured.
1846 */
1848 }
1862 offset,
1867 offset,
1870 }
1873 ett_http_chunk_data);
1877 chunk_size);
1881 /*
1882 * XXX - just use "proto_tree_add_text()"?
1883 * This means that, in TShark, you get
1884 * the entire chunk dumped out in hex,
1885 * in addition to whatever dissection is
1886 * done on the reassembled data.
1887 */
1889 chunk_subtree);
1893 }
1895 chunks_decoded++;
1898 }
1905 /*
1906 * There was no actual chunk data, so don't allow sub dissectors
1907 * try to decode the non-existent entity body.
1908 */
1910 }
1913 }
1914 #endif
1916 /* Call a subdissector to handle HTTP CONNECT's traffic */
1917 static void
1920 {
1928 /* Grab the destination port number from the request URI to find the right subdissector */
1932 /*
1933 * The string was successfully split in two
1934 * Create a proxy-connect subtree
1935 */
1947 }
1957 }
1959 conv = find_conversation(PINFO_FD_NUM(pinfo), &pinfo->src, &pinfo->dst, PT_TCP, srcport, destport, 0);
1961 /* We may get stuck in a recursion loop if we let process_tcp_payload() call us.
1962 * So, if the port in the URI is one we're registered for or we have set up a
1963 * conversation (e.g., one we detected heuristically or via Decode-As) call the data
1964 * dissector directly.
1965 */
1966 if (value_is_in_range(http_tcp_range, uri_port) || (conv && conv->dissector_handle == http_handle)) {
1969 /* set pinfo->{src/dst port} and call the TCP sub-dissector lookup */
1972 else
1975 /* Increase pinfo->can_desegment because we are traversing
1976 * http and want to preserve desegmentation functionality for
1977 * the proxied protocol
1978 */
1988 }
1989 }
1991 }
1995 /*
1996 * XXX - this won't handle HTTP 0.9 replies, but they're all data
1997 * anyway.
1998 */
1999 static int
2003 {
2006 /*
2007 * From RFC 2774 - An HTTP Extension Framework
2008 *
2009 * Support the command prefix that identifies the presence of
2010 * a "mandatory" header.
2011 */
2015 }
2017 /*
2018 * From draft-cohen-gena-client-01.txt, available from the uPnP forum:
2019 * NOTIFY, SUBSCRIBE, UNSUBSCRIBE
2020 *
2021 * From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
2022 * SEARCH
2023 */
2033 /* Look for the space following the Method */
2038 ptr++;
2039 indx++;
2040 }
2041 }
2043 /* Check the methods that have same length */
2051 }
2055 }
2067 }
2079 }
2090 }
2094 }
2104 }
2113 }
2124 }
2133 }
2145 }
2152 }
2159 }
2166 }
2171 }
2178 }
2182 }
2185 }
2187 /*
2188 * Process headers.
2189 */
2196 #define HDR_NO_SPECIAL 0
2197 #define HDR_AUTHORIZATION 1
2198 #define HDR_AUTHENTICATE 2
2199 #define HDR_CONTENT_TYPE 3
2200 #define HDR_CONTENT_LENGTH 4
2201 #define HDR_CONTENT_ENCODING 5
2202 #define HDR_TRANSFER_ENCODING 6
2203 #define HDR_HOST 7
2204 #define HDR_UPGRADE 8
2236 };
2238 /*
2239 *
2240 */
2243 {
2250 }
2253 }
2255 /*
2256 *
2257 */
2258 static void
2260 {
2263 guint i;
2268 /* Unregister all fields */
2276 }
2280 }
2302 }
2305 }
2306 }
2308 static void
2313 {
2317 gint hf_index;
2318 guchar c;
2335 /*
2336 * Skip whitespace after the colon.
2337 */
2341 value_offset++;
2343 /*
2344 * Fetch the value.
2345 *
2346 * XXX - the line may well have a NUL in it. Wireshark should
2347 * really treat strings extracted from packets as counted
2348 * strings, so that NUL isn't any different from any other
2349 * character. For now, we just allocate a buffer that's
2350 * value_len+1 bytes long, copy value_len bytes, and stick
2351 * in a NUL terminator, so that the buffer for value actually
2352 * has value_len bytes in it.
2353 */
2360 /*
2361 * Not a header we know anything about.
2362 * Check if a HF generated from UAT information exists.
2363 */
2372 hf_http_response_line :
2373 hf_http_request_line,
2381 }
2391 hf_http_response_line :
2392 hf_http_request_line,
2398 }
2399 }
2400 }
2402 /*
2403 * Add it to the protocol tree as a particular field,
2404 * but display the line as is.
2405 */
2408 guint32 tmp;
2426 hf_http_response_line :
2427 hf_http_request_line,
2432 }
2442 hf_http_response_line :
2443 hf_http_request_line,
2449 }
2450 }
2454 /*
2455 * Do any special processing that particular headers
2456 * require.
2457 */
2475 eh_ptr->content_type = (gchar*) wmem_memdup(wmem_packet_scope(), (guint8*)value,value_len + 1);
2480 /*
2481 * End of subtype - either
2482 * white space or a ";"
2483 * separating the subtype from
2484 * a parameter.
2485 */
2487 }
2489 /*
2490 * Map the character to lower case;
2491 * content types are case-insensitive.
2492 */
2494 }
2496 /*
2497 * Now find the start of the optional parameters;
2498 * skip the optional white space and the semicolon
2499 * if this has not been done before.
2500 */
2501 i++;
2505 /* Skip till start of parameters */
2506 i++;
2507 else
2509 }
2512 else
2524 /*
2525 * Content length not valid; pretend
2526 * we don't have it.
2527 */
2532 /*
2533 * We do have a valid content length.
2534 */
2543 }
2544 }
2556 }
2567 }
2568 /* Check if upgrade is HTTP 2.0 (work for HTTP/2.0 and draft HTTP-draft-XX/2.0) */
2571 }
2573 }
2574 }
2575 }
2577 /* Returns index of header tag in headers */
2578 static gint
2580 {
2581 guint i;
2588 }
2591 }
2593 /*
2594 * Dissect Microsoft's abomination called NTLMSSP over HTTP.
2595 */
2596 static gboolean
2599 {
2603 NULL
2604 };
2609 /*
2610 * Check for NTLM credentials and challenge; those can
2611 * occur with WWW-Authenticate.
2612 */
2618 ett_http_ntlmssp);
2624 }
2625 }
2627 }
2629 /*
2630 * Dissect HTTP Basic authorization.
2631 */
2632 static gboolean
2634 {
2637 NULL
2638 };
2648 ett_http_ntlmssp);
2658 }
2659 }
2661 }
2663 static gboolean
2666 {
2677 }
2679 }
2681 static int
2683 {
2688 /*
2689 * Check if this is proxied connection and if so, hand of dissection to the
2690 * payload-dissector.
2691 * Response code 200 means "OK" and strncmp() == 0 means the strings match exactly */
2704 /*g_warning("Go Websocket");*/
2705 call_dissector_only(websocket_handle, tvb_new_subset_remaining(tvb, offset), pinfo, tree, NULL);
2707 }
2709 /*g_warning("Go HTTP2");*/
2712 }
2718 /*
2719 * OK, we've set the Protocol and Info columns for the
2720 * first HTTP message; set a fence so that subsequent
2721 * HTTP messages don't overwrite the Info column.
2722 */
2724 }
2725 }
2728 }
2730 static gboolean
2732 {
2737 /* Check if we have a line terminated by CRLF
2738 * Return the length of the line (not counting the line terminator at
2739 * the end), or, if we don't find a line terminator:
2740 *
2741 * if "deseg" is true, return -1;
2742 */
2746 }
2748 /* Check if the line start or ends with the HTTP token */
2749 if((tvb_strncaseeql(tvb, linelen-8, "HTTP/1.1", 8) == 0)||(tvb_strncaseeql(tvb, 0, "HTTP/1.1", 8) == 0)){
2754 }
2757 }
2759 static void
2761 {
2766 }
2769 static void
2772 }
2774 static void
2777 }
2789 }
2791 void
2793 {
2996 };
3005 &ett_http_header_item
3006 };
3010 { &ei_http_chunked_and_length, { "http.chunkd_and_length", PI_MALFORMED, PI_WARN, "It is incorrect to specify a content-length header and chunked encoding together.", EXPFILL }},
3011 { &ei_http_subdissector_failed, { "http.subdissector_failed", PI_MALFORMED, PI_NOTE, "HTTP body subdissector failed, trying heuristic subdissector", EXPFILL }},
3012 };
3014 /* UAT for header fields */
3017 UAT_FLD_CSTRING(header_fields, header_desc, "Field desc", "Description of the value contained in the header"),
3018 UAT_END_FIELDS
3019 };
3037 "Whether the HTTP dissector should reassemble headers "
3038 "of a request spanning multiple TCP segments. "
3039 "To use this option, you must also enable "
3044 "Whether the HTTP dissector should use the "
3046 "the body of a request spanning multiple TCP segments, "
3047 "and reassemble chunked data spanning multiple TCP segments. "
3048 "To use this option, you must also enable "
3053 "Whether to reassemble bodies of entities that are transferred "
3056 #ifdef HAVE_LIBZ
3059 "Whether to uncompress entity bodies that are compressed "
3062 #endif
3076 /* UAT */
3080 TRUE,
3083 /* specifies named fields, so affects dissection
3084 and the set of named fields */
3086 NULL,
3087 header_fields_copy_cb,
3088 header_fields_update_cb,
3089 header_fields_free_cb,
3090 header_fields_initialize_cb,
3091 custom_header_uat_fields
3092 );
3094 prefs_register_uat_preference(http_module, "custom_http_header_fields", "Custom HTTP headers fields",
3095 "A table to define custom HTTP header for which fields can be setup and used for filtering/data extraction etc.",
3096 headers_uat);
3098 /*
3099 * Dissectors shouldn't register themselves in this table;
3100 * instead, they should call "http_dissector_add()", and
3101 * we'll register the port number they specify as a port
3102 * for HTTP, and register them in our subdissector table.
3103 *
3104 * This only works for protocols such as IPP that run over
3105 * HTTP on a specific non-HTTP port.
3106 */
3110 /*
3111 * Dissectors can register themselves in this table.
3112 * It's just "media_type", not "http.content_type", because
3113 * it's an Internet media type, usable by other protocols as well.
3114 */
3115 media_type_subdissector_table =
3119 /*
3120 * Heuristic dissectors SHOULD register themselves in
3121 * this table using the standard heur_dissector_add()
3122 * function.
3123 */
3126 /*
3127 * Register for tapping
3128 */
3131 }
3133 /*
3134 * Called by dissectors for protocols that run atop HTTP/TCP.
3135 */
3136 void
3138 {
3139 /*
3140 * Register ourselves as the handler for that port number
3141 * over TCP.
3142 */
3145 /*
3146 * And register them in *our* table for that port.
3147 */
3149 }
3151 void
3153 {
3154 /*
3155 * Register ourselves as the handler for that port number
3156 * over TCP. We rely on our caller having registered
3157 * themselves for the appropriate media type.
3158 */
3160 }
3162 void
3164 {
3165 dissector_handle_t http_udp_handle;
3171 /*
3172 * XXX - is there anything to dissect in the body of an SSDP
3173 * request or reply? I.e., should there be an SSDP dissector?
3174 */
3181 stats_tree_register("http", "http", "HTTP/Packet Counter", 0, http_stats_tree_packet, http_stats_tree_init, NULL );
3182 stats_tree_register("http", "http_req", "HTTP/Requests", 0, http_req_stats_tree_packet, http_req_stats_tree_init, NULL );
3183 stats_tree_register("http", "http_srv", "HTTP/Load Distribution",0, http_reqs_stats_tree_packet, http_reqs_stats_tree_init, NULL );
3185 }
3187 /*
3188 * Content-Type: message/http
3189 */
3194 static void
3196 {
3200 gint len;
3216 }
3217 }
3218 }
3220 void
3222 {
3225 };
3230 "message-http"
3231 );
3233 }
3235 void
3237 {
3238 dissector_handle_t message_http_handle;
3241 proto_message_http);
3249 }
3251 /*
3252 * Editor modelines - http://www.wireshark.org/tools/modelines.html
3253 *
3254 * Local variables:
3255 * c-basic-offset: 8
3256 * tab-width: 8
3257 * indent-tabs-mode: true
3258 * End:
3259 *
3260 * vi: set shiftwidth=8 tabstop=8 noexpandtab:
3261 * :indentSize=8:tabSize=8:noTabs=false:
3262 */