epan/dissectors/packet-http-urlencoded.c

   1 /* packet-http-urlencoded.c
   2  * Routines for dissection of HTTP urlecncoded form, based on packet-text-media.c (C) Olivier Biot, 2004.
   3  *
   4  * $Id$
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version 2
  13  * of the License, or (at your option) any later version.
  14  *
  15  * This program is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  * GNU General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with this program; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23  */
  24
  25 #define NEW_PROTO_TREE_API
  26
  27 #include "config.h"
  28
  29 #include <glib.h>
  30
  31 #include <epan/packet.h>
  32 #include <epan/wmem/wmem.h>
  33
  34 static dissector_handle_t form_urlencoded_handle;
  35
  36 static header_field_info *hfi_urlencoded = NULL;
  37
  38 #define URLENCODED_HFI_INIT HFI_INIT(proto_urlencoded)
  39
  40 static header_field_info hfi_form_keyvalue URLENCODED_HFI_INIT =
  41         { "Form item", "urlencoded-form", FT_NONE, BASE_NONE, NULL, 0x0, NULL, HFILL };
  42
  43 static header_field_info hfi_form_key URLENCODED_HFI_INIT =
  44         { "Key", "urlencoded-form.key", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL };
  45
  46 static header_field_info hfi_form_value URLENCODED_HFI_INIT =
  47         { "Value", "urlencoded-form.value", FT_STRINGZ, BASE_NONE, NULL, 0x0, NULL, HFILL };
  48
  49 static gint ett_form_urlencoded = -1;
  50 static gint ett_form_keyvalue = -1;
  51
  52 static guint8
  53 get_hexa(guint8 a)
  54 {
  55         if (a >= '0' && a <= '9')
  56                 return a - '0';
  57         if (a >= 'A' && a <= 'F')
  58                 return (a - 'A') + 10;
  59         if (a >= 'a' && a <= 'f')
  60                 return (a - 'a') + 10;
  61
  62         return 0xff;
  63 }
  64
  65 static int
  66 get_form_key_value(tvbuff_t *tvb, char **ptr, int offset, char stop)
  67 {
  68         const int orig_offset = offset;
  69         char *tmp;
  70         int len;
  71
  72         len = 0;
  73         while (tvb_reported_length_remaining(tvb, offset) > 0) {
  74                 guint8 ch;
  75
  76                 ch = tvb_get_guint8(tvb, offset);
  77                 if (!ch)
  78                         return -1;
  79                 if (ch == stop)
  80                         break;
  81                 if (ch == '%') {
  82                         offset++;
  83                         ch = tvb_get_guint8(tvb, offset);
  84                         if (get_hexa(ch) > 15)
  85                                 return -1;
  86
  87                         offset++;
  88                         ch = tvb_get_guint8(tvb, offset);
  89                         if (get_hexa(ch) > 15)
  90                                 return -1;
  91                 }
  92
  93                 len++;
  94                 offset++;
  95         }
  96
  97         *ptr = tmp = (char*)wmem_alloc(wmem_packet_scope(), len + 1);
  98         tmp[len] = '\0';
  99
 100         len = 0;
 101         offset = orig_offset;
 102         while (tvb_reported_length_remaining(tvb, offset) > 0) {
 103                 guint8 ch;
 104
 105                 ch = tvb_get_guint8(tvb, offset);
 106                 if (!ch)
 107                         return -1;
 108                 if (ch == stop)
 109                         break;
 110
 111                 if (ch == '%') {
 112                         guint8 ch1, ch2;
 113
 114                         offset++;
 115                         ch1 = tvb_get_guint8(tvb, offset);
 116
 117                         offset++;
 118                         ch2 = tvb_get_guint8(tvb, offset);
 119
 120                         tmp[len] = get_hexa(ch1) << 4 | get_hexa(ch2);
 121
 122                 } else if (ch == '+')
 123                         tmp[len] = ' ';
 124                 else
 125                         tmp[len] = ch;
 126
 127                 len++;
 128                 offset++;
 129         }
 130
 131         return offset;
 132 }
 133
 134
 135 static int
 136 dissect_form_urlencoded(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 137 {
 138         proto_tree      *url_tree;
 139         proto_tree      *sub;
 140         proto_item      *ti;
 141         gint            offset = 0, next_offset;
 142         const char      *data_name;
 143
 144         data_name = pinfo->match_string;
 145         if (! (data_name && data_name[0])) {
 146                 /*
 147                  * No information from "match_string"
 148                  */
 149                 data_name = (char *)data;
 150                 if (! (data_name && data_name[0])) {
 151                         /*
 152                          * No information from dissector data
 153                          */
 154                         data_name = (char *)(pinfo->private_data);
 155                         if (! (data_name && data_name[0])) {
 156                                 /*
 157                                  * No information from "private_data"
 158                                  */
 159                                 data_name = NULL;
 160                         }
 161                 }
 162         }
 163
 164         if (data_name)
 165                 col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ", "(%s)", data_name);
 166
 167         ti = proto_tree_add_item(tree, hfi_urlencoded, tvb, 0, -1, ENC_NA);
 168         if (data_name)
 169                 proto_item_append_text(ti, ": %s", data_name);
 170         url_tree = proto_item_add_subtree(ti, ett_form_urlencoded);
 171
 172         while (tvb_reported_length_remaining(tvb, offset) > 0) {
 173                 const int start_offset = offset;
 174                 char *key, *value;
 175
 176                 ti = proto_tree_add_item(url_tree, &hfi_form_keyvalue, tvb, offset, 0, ENC_NA);
 177
 178                 sub = proto_item_add_subtree(ti, ett_form_keyvalue);
 179
 180                 next_offset = get_form_key_value(tvb, &key, offset, '=');
 181                 if (next_offset == -1)
 182                         break;
 183                 proto_tree_add_string(sub, &hfi_form_key, tvb, offset, next_offset - offset, key);
 184                 proto_item_append_text(sub, ": \"%s\"", key);
 185
 186                 offset = next_offset+1;
 187
 188                 next_offset = get_form_key_value(tvb, &value, offset, '&');
 189                 if (next_offset == -1)
 190                         break;
 191                 proto_tree_add_string(sub, &hfi_form_value, tvb, offset, next_offset - offset, value);
 192                 proto_item_append_text(sub, " = \"%s\"", value);
 193
 194                 offset = next_offset+1;
 195
 196                 proto_item_set_len(ti, offset - start_offset);
 197         }
 198
 199         return tvb_length(tvb);
 200 }
 201
 202 void
 203 proto_register_http_urlencoded(void)
 204 {
 205 #ifndef HAVE_HFI_SECTION_INIT
 206         static header_field_info *hfi[] = {
 207                 &hfi_form_keyvalue,
 208                 &hfi_form_key,
 209                 &hfi_form_value,
 210         };
 211 #endif
 212
 213         static gint *ett[] = {
 214                 &ett_form_urlencoded,
 215                 &ett_form_keyvalue
 216         };
 217
 218         int proto_urlencoded;
 219
 220         proto_urlencoded = proto_register_protocol("HTML Form URL Encoded", "URL Encoded Form Data", "urlencoded-form");
 221         hfi_urlencoded = proto_registrar_get_nth(proto_urlencoded);
 222
 223         form_urlencoded_handle = new_register_dissector("urlencoded-form", dissect_form_urlencoded, proto_urlencoded);
 224
 225         proto_register_fields(proto_urlencoded, hfi, array_length(hfi));
 226         proto_register_subtree_array(ett, array_length(ett));
 227 }
 228
 229 void
 230 proto_reg_handoff_http_urlencoded(void)
 231 {
 232         dissector_add_string("media_type", "application/x-www-form-urlencoded", form_urlencoded_handle);
 233 }
 234
 235 /*
 236  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 237  *
 238  * Local variables:
 239  * c-basic-offset: 8
 240  * tab-width: 8
 241  * indent-tabs-mode: t
 242  * End:
 243  *
 244  * vi: set shiftwidth=8 tabstop=8 noexpandtab:
 245  * :indentSize=8:tabSize=8:noTabs=false:
 246  */