epan/dissectors/packet-xmpp.c

   1 /* packet-xmpp.c
   2  * Wireshark's XMPP dissector.
   3  *
   4  * Copyright 2011, Mariusz Okroj <okrojmariusz[]gmail.com>
   5  *
   6  * $Id$
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  25  */
  26
  27 #include "config.h"
  28
  29 #include <string.h>
  30
  31 #include <glib.h>
  32
  33 #include <epan/packet.h>
  34 #include <epan/wmem/wmem.h>
  35 #include <epan/conversation.h>
  36 #include <epan/prefs.h>
  37
  38 #include <epan/dissectors/packet-xml.h>
  39
  40 #include <packet-xmpp-utils.h>
  41 #include <packet-xmpp.h>
  42 #include <packet-xmpp-core.h>
  43 #include <packet-xmpp-jingle.h>
  44
  45 #define XMPP_PORT 5222
  46
  47 int proto_xmpp = -1;
  48
  49 static gboolean xmpp_desegment = TRUE;
  50
  51 gint hf_xmpp_xmlns = -1;
  52 gint hf_xmpp_id = -1;
  53 gint hf_xmpp_from = -1;
  54 gint hf_xmpp_to = -1;
  55 gint hf_xmpp_type = -1;
  56
  57 gint hf_xmpp_iq = -1;
  58
  59 gint hf_xmpp_query = -1;
  60 gint hf_xmpp_query_node = -1;
  61
  62 gint hf_xmpp_query_item = -1;
  63 gint hf_xmpp_query_item_jid = -1;
  64 gint hf_xmpp_query_item_name = -1;
  65 gint hf_xmpp_query_item_subscription = -1;
  66 gint hf_xmpp_query_item_ask = -1;
  67 gint hf_xmpp_query_item_group = -1;
  68 gint hf_xmpp_query_item_node = -1;
  69 gint hf_xmpp_query_item_approved = -1;
  70
  71 gint hf_xmpp_query_identity = -1;
  72 gint hf_xmpp_query_identity_category = -1;
  73 gint hf_xmpp_query_identity_type = -1;
  74 gint hf_xmpp_query_identity_name = -1;
  75 gint hf_xmpp_query_identity_lang = -1;
  76
  77 gint hf_xmpp_query_feature = -1;
  78
  79 gint hf_xmpp_query_streamhost = -1;
  80 gint hf_xmpp_query_streamhost_used = -1;
  81 gint hf_xmpp_query_activate = -1;
  82 gint hf_xmpp_query_udpsuccess = -1;
  83
  84 gint hf_xmpp_error = -1;
  85 gint hf_xmpp_error_type = -1;
  86 gint hf_xmpp_error_code = -1;
  87 gint hf_xmpp_error_condition = -1;
  88 gint hf_xmpp_error_text = -1;
  89
  90 gint hf_xmpp_iq_bind = -1;
  91 gint hf_xmpp_iq_bind_jid = -1;
  92 gint hf_xmpp_iq_bind_resource = -1;
  93
  94 gint hf_xmpp_services = -1;
  95 gint hf_xmpp_channel = -1;
  96
  97 gint hf_xmpp_iq_session = -1;
  98 gint hf_xmpp_stream = -1;
  99 gint hf_xmpp_features = -1;
 100
 101 gint hf_xmpp_vcard  = -1;
 102 gint hf_xmpp_vcard_x_update = -1;
 103
 104 gint hf_xmpp_jingle = -1;
 105 gint hf_xmpp_jingle_sid = -1;
 106 gint hf_xmpp_jingle_initiator = -1;
 107 gint hf_xmpp_jingle_responder = -1;
 108 gint hf_xmpp_jingle_action = -1;
 109
 110 gint hf_xmpp_jingle_content = -1;
 111 gint hf_xmpp_jingle_content_creator = -1;
 112 gint hf_xmpp_jingle_content_name = -1;
 113 gint hf_xmpp_jingle_content_disposition = -1;
 114 gint hf_xmpp_jingle_content_senders = -1;
 115
 116 gint hf_xmpp_jingle_content_description = -1;
 117 gint hf_xmpp_jingle_content_description_media = -1;
 118 gint hf_xmpp_jingle_content_description_ssrc = -1;
 119
 120 gint hf_xmpp_jingle_cont_desc_payload = -1;
 121 gint hf_xmpp_jingle_cont_desc_payload_id = -1;
 122 gint hf_xmpp_jingle_cont_desc_payload_channels = -1;
 123 gint hf_xmpp_jingle_cont_desc_payload_clockrate = -1;
 124 gint hf_xmpp_jingle_cont_desc_payload_maxptime = -1;
 125 gint hf_xmpp_jingle_cont_desc_payload_name = -1;
 126 gint hf_xmpp_jingle_cont_desc_payload_ptime = -1;
 127
 128 gint hf_xmpp_jingle_cont_desc_payload_param = -1;
 129 gint hf_xmpp_jingle_cont_desc_payload_param_value = -1;
 130 gint hf_xmpp_jingle_cont_desc_payload_param_name = -1;
 131
 132 gint hf_xmpp_jingle_cont_desc_enc = -1;
 133 gint hf_xmpp_jingle_cont_desc_enc_zrtp_hash = -1;
 134 gint hf_xmpp_jingle_cont_desc_enc_crypto = -1;
 135
 136 gint hf_xmpp_jingle_cont_desc_rtp_hdr = -1;
 137 gint hf_xmpp_jingle_cont_desc_bandwidth = -1;
 138
 139 gint hf_xmpp_jingle_cont_trans = -1;
 140 gint hf_xmpp_jingle_cont_trans_pwd = -1;
 141 gint hf_xmpp_jingle_cont_trans_ufrag = -1;
 142
 143 gint hf_xmpp_jingle_cont_trans_cand = -1;
 144 gint hf_xmpp_jingle_cont_trans_rem_cand = -1;
 145 gint hf_xmpp_jingle_cont_trans_activated = -1;
 146 gint hf_xmpp_jingle_cont_trans_candidate_error = -1;
 147 gint hf_xmpp_jingle_cont_trans_candidate_used = -1;
 148 gint hf_xmpp_jingle_cont_trans_proxy_error = -1;
 149
 150
 151 gint hf_xmpp_jingle_reason = -1;
 152 gint hf_xmpp_jingle_reason_condition = -1;
 153 gint hf_xmpp_jingle_reason_text = -1;
 154
 155 gint hf_xmpp_jingle_rtp_info = -1;
 156
 157 gint hf_xmpp_jingle_file_transfer_offer = -1;
 158 gint hf_xmpp_jingle_file_transfer_request = -1;
 159 gint hf_xmpp_jingle_file_transfer_received = -1;
 160 gint hf_xmpp_jingle_file_transfer_abort = -1;
 161 gint hf_xmpp_jingle_file_transfer_checksum = -1;
 162
 163 gint hf_xmpp_si = -1;
 164 gint hf_xmpp_si_file = -1;
 165
 166 gint hf_xmpp_iq_feature_neg = -1;
 167 gint hf_xmpp_x_data = -1;
 168 gint hf_xmpp_x_data_field = -1;
 169 gint hf_xmpp_x_data_field_value = -1;
 170
 171 gint hf_xmpp_message = -1;
 172 gint hf_xmpp_message_chatstate = -1;
 173
 174 gint hf_xmpp_message_thread = -1;
 175 gint hf_xmpp_message_thread_parent = -1;
 176
 177 gint hf_xmpp_message_body = -1;
 178 gint hf_xmpp_message_subject = -1;
 179
 180 gint hf_xmpp_ibb_open = -1;
 181 gint hf_xmpp_ibb_close = -1;
 182 gint hf_xmpp_ibb_data = -1;
 183
 184 gint hf_xmpp_delay = -1;
 185
 186 gint hf_xmpp_x_event = -1;
 187 gint hf_xmpp_x_event_condition = -1;
 188
 189 gint hf_xmpp_presence = -1;
 190 gint hf_xmpp_presence_show = -1;
 191 gint hf_xmpp_presence_status = -1;
 192 gint hf_xmpp_presence_caps = -1;
 193
 194 gint hf_xmpp_auth = -1;
 195 gint hf_xmpp_failure = -1;
 196 gint hf_xmpp_starttls = -1;
 197 gint hf_xmpp_proceed = -1;
 198
 199 gint hf_xmpp_muc_x = -1;
 200 gint hf_xmpp_muc_user_x  = -1;
 201 gint hf_xmpp_muc_user_item  = -1;
 202 gint hf_xmpp_muc_user_invite  = -1;
 203
 204 gint hf_xmpp_gtalk_session = -1;
 205 gint hf_xmpp_gtalk_session_type = -1;
 206 gint hf_xmpp_gtalk = -1;
 207 gint hf_xmpp_gtalk_setting = -1;
 208 gint hf_xmpp_gtalk_nosave_x = -1;
 209 gint hf_xmpp_gtalk_mail_mailbox = -1;
 210 gint hf_xmpp_gtalk_mail_new_mail = -1;
 211 gint hf_xmpp_gtalk_transport_p2p = -1;
 212
 213
 214 gint hf_xmpp_conf_info = -1;
 215 gint hf_xmpp_conf_info_sid = -1;
 216
 217 gint hf_xmpp_unknown = -1;
 218 gint hf_xmpp_unknown_attr = -1;
 219
 220 gint hf_xmpp_out = -1;
 221 gint hf_xmpp_in = -1;
 222 gint hf_xmpp_response_in = -1;
 223 gint hf_xmpp_response_to = -1;
 224 gint hf_xmpp_jingle_session = -1;
 225 gint hf_xmpp_ibb = -1;
 226
 227 gint hf_xmpp_ping = -1;
 228 gint hf_xmpp_hashes = -1;
 229
 230 gint hf_xmpp_jitsi_inputevt = -1;
 231 gint hf_xmpp_jitsi_inputevt_rmt_ctrl = -1;
 232
 233 gint ett_xmpp = -1;
 234 gint ett_xmpp_iq = -1;
 235 gint ett_xmpp_query = -1;
 236 gint ett_xmpp_query_item = -1;
 237 gint ett_xmpp_query_identity = -1;
 238 gint ett_xmpp_query_feature = -1;
 239
 240 gint ett_xmpp_query_streamhost = -1;
 241 gint ett_xmpp_query_streamhost_used = -1;
 242 gint ett_xmpp_query_udpsuccess = -1;
 243
 244 gint ett_xmpp_iq_error = -1;
 245 gint ett_xmpp_iq_bind = -1;
 246 gint ett_xmpp_iq_session = -1;
 247 gint ett_xmpp_vcard = -1;
 248 gint ett_xmpp_vcard_x_update = -1;
 249
 250 gint ett_xmpp_jingle = -1;
 251 gint ett_xmpp_jingle_content = -1;
 252 gint ett_xmpp_jingle_content_description = -1;
 253 gint ett_xmpp_jingle_cont_desc_enc = -1;
 254 gint ett_xmpp_jingle_cont_desc_enc_zrtp_hash = -1;
 255 gint ett_xmpp_jingle_cont_desc_enc_crypto = -1;
 256 gint ett_xmpp_jingle_cont_desc_rtp_hdr = -1;
 257 gint ett_xmpp_jingle_cont_desc_bandwidth = -1;
 258 gint ett_xmpp_jingle_cont_desc_payload = -1;
 259 gint ett_xmpp_jingle_cont_desc_payload_param = -1;
 260 gint ett_xmpp_jingle_cont_trans = -1;
 261 gint ett_xmpp_jingle_cont_trans_cand = -1;
 262 gint ett_xmpp_jingle_cont_trans_rem_cand = -1;
 263 gint ett_xmpp_jingle_reason = -1;
 264 gint ett_xmpp_jingle_rtp_info = -1;
 265
 266 gint ett_xmpp_jingle_file_transfer_offer = -1;
 267 gint ett_xmpp_jingle_file_transfer_request = -1;
 268 gint ett_xmpp_jingle_file_transfer_abort = -1;
 269 gint ett_xmpp_jingle_file_transfer_received = -1;
 270 gint ett_xmpp_jingle_file_transfer_checksum = -1;
 271 gint ett_xmpp_jingle_file_transfer_file = -1;
 272
 273 gint ett_xmpp_services = -1;
 274 gint ett_xmpp_services_relay = -1;
 275 gint ett_xmpp_channel = -1;
 276
 277 gint ett_xmpp_si = -1;
 278 gint ett_xmpp_si_file = -1;
 279 gint ett_xmpp_si_file_range = -1;
 280
 281 gint ett_xmpp_iq_feature_neg = -1;
 282 gint ett_xmpp_x_data = -1;
 283 gint ett_xmpp_x_data_field = -1;
 284 gint ett_xmpp_x_data_field_value = -1;
 285
 286 gint ett_xmpp_ibb_open = -1;
 287 gint ett_xmpp_ibb_close = -1;
 288 gint ett_xmpp_ibb_data = -1;
 289
 290 gint ett_xmpp_delay = -1;
 291
 292 gint ett_xmpp_x_event = -1;
 293
 294 gint ett_xmpp_message = -1;
 295 gint ett_xmpp_message_thread = -1;
 296 gint ett_xmpp_message_body = -1;
 297 gint ett_xmpp_message_subject = -1;
 298
 299 gint ett_xmpp_presence = -1;
 300 gint ett_xmpp_presence_status = -1;
 301 gint ett_xmpp_presence_caps = -1;
 302
 303 gint ett_xmpp_auth = -1;
 304 gint ett_xmpp_challenge = -1;
 305 gint ett_xmpp_response = -1;
 306 gint ett_xmpp_success = -1;
 307 gint ett_xmpp_failure = -1;
 308 gint ett_xmpp_stream = -1;
 309 gint ett_xmpp_features = -1;
 310 gint ett_xmpp_features_mechanisms = -1;
 311 gint ett_xmpp_starttls = -1;
 312 gint ett_xmpp_proceed = -1;
 313
 314 gint ett_xmpp_muc_x = -1;
 315 gint ett_xmpp_muc_hist = -1;
 316 gint ett_xmpp_muc_user_x = -1;
 317 gint ett_xmpp_muc_user_item = -1;
 318 gint ett_xmpp_muc_user_invite = -1;
 319
 320 gint ett_xmpp_gtalk_session = -1;
 321 gint ett_xmpp_gtalk_session_desc = -1;
 322 gint ett_xmpp_gtalk_session_cand = -1;
 323 gint ett_xmpp_gtalk_session_desc_payload = -1;
 324 gint ett_xmpp_gtalk_session_reason = -1;
 325 gint ett_xmpp_gtalk_jingleinfo_stun = -1;
 326 gint ett_xmpp_gtalk_jingleinfo_server = -1;
 327 gint ett_xmpp_gtalk_jingleinfo_relay = -1;
 328 gint ett_xmpp_gtalk_jingleinfo_relay_serv = -1;
 329 gint ett_xmpp_gtalk_setting = -1;
 330 gint ett_xmpp_gtalk_nosave_x = -1;
 331 gint ett_xmpp_gtalk_mail_mailbox = -1;
 332 gint ett_xmpp_gtalk_mail_mail_info = -1;
 333 gint ett_xmpp_gtalk_mail_senders = -1;
 334 gint ett_xmpp_gtalk_mail_sender = -1;
 335 gint ett_xmpp_gtalk_status_status_list = -1;
 336 gint ett_xmpp_gtalk_transport_p2p = -1;
 337 gint ett_xmpp_gtalk_transport_p2p_cand = -1;
 338
 339 gint ett_xmpp_conf_info = -1;
 340 gint ett_xmpp_conf_desc = -1;
 341 gint ett_xmpp_conf_state = -1;
 342 gint ett_xmpp_conf_users = -1;
 343 gint ett_xmpp_conf_user = -1;
 344 gint ett_xmpp_conf_endpoint = -1;
 345 gint ett_xmpp_conf_media = -1;
 346
 347 gint ett_xmpp_ping = -1;
 348 gint ett_xmpp_hashes = -1;
 349 gint ett_xmpp_hashes_hash = -1;
 350
 351 gint ett_xmpp_jitsi_inputevt = -1;
 352 gint ett_xmpp_jitsi_inputevt_rmt_ctrl = -1;
 353
 354 gint ett_unknown[ETT_UNKNOWN_LEN];
 355
 356 static expert_field ei_xmpp_xml_disabled = EI_INIT;
 357 static expert_field ei_xmpp_packet_unknown = EI_INIT;
 358 expert_field ei_xmpp_starttls_missing = EI_INIT;
 359 expert_field ei_xmpp_response = EI_INIT;
 360 expert_field ei_xmpp_challenge = EI_INIT;
 361 expert_field ei_xmpp_success = EI_INIT;
 362 expert_field ei_xmpp_proceed_already_in_frame = EI_INIT;
 363 expert_field ei_xmpp_starttls_already_in_frame = EI_INIT;
 364 expert_field ei_xmpp_packet_without_response = EI_INIT;
 365 expert_field ei_xmpp_unknown_element = EI_INIT;
 366 expert_field ei_xmpp_field_unexpected_value = EI_INIT;
 367 expert_field ei_xmpp_unknown_attribute = EI_INIT;
 368 expert_field ei_xmpp_required_attribute = EI_INIT;
 369
 370 static dissector_handle_t xmpp_handle;
 371
 372 static dissector_handle_t ssl_handle;
 373 static dissector_handle_t xml_handle;
 374
 375 static void
 376 dissect_xmpp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
 377
 378     xml_frame_t *xml_frame;
 379     gboolean     out_packet;
 380
 381     conversation_t   *conversation;
 382     xmpp_conv_info_t *xmpp_info;
 383
 384     proto_tree *xmpp_tree  = NULL;
 385     proto_item *xmpp_item  = NULL;
 386     proto_item *outin_item;
 387
 388     xmpp_element_t *packet = NULL;
 389
 390     /*check if desegment
 391      * now it checks that last char is '>',
 392      * TODO checks that first element in packet is closed*/
 393     int   indx;
 394     gchar last_char;
 395
 396     conversation = find_or_create_conversation(pinfo);
 397     xmpp_info = (xmpp_conv_info_t *)conversation_get_proto_data(conversation, proto_xmpp);
 398
 399     if ((!xmpp_info || !xmpp_info->ssl_proceed) && xmpp_desegment)
 400     {
 401         indx = tvb_reported_length(tvb) - 1;
 402         if (indx >= 0)
 403         {
 404             last_char = tvb_get_guint8(tvb, indx);
 405
 406             while ((last_char <= ' ') && (indx - 1 >= 0))
 407             {
 408                 indx--;
 409                 last_char = tvb_get_guint8(tvb, indx);
 410             }
 411
 412             if ((indx >= 0) && (last_char != '>'))
 413             {
 414                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 415                 return;
 416             }
 417         }
 418     }
 419
 420     col_set_str(pinfo->cinfo, COL_PROTOCOL, "XMPP");
 421
 422     col_clear(pinfo->cinfo, COL_INFO);
 423
 424     if (xmpp_info && xmpp_info->ssl_proceed &&
 425             xmpp_info->ssl_proceed < pinfo->fd->num)
 426     {
 427         guint16 save_can_desegment;
 428         guint32 save_ssl_proceed;
 429
 430         /* Make sure SSL/TLS can desegment */
 431         save_can_desegment = pinfo->can_desegment;
 432         pinfo->can_desegment = pinfo->saved_can_desegment;
 433
 434         /* Make sure the SSL dissector will not be called again after decryption */
 435         save_ssl_proceed = xmpp_info->ssl_proceed;
 436         xmpp_info->ssl_proceed = 0;
 437
 438         call_dissector(ssl_handle, tvb, pinfo, tree);
 439
 440         pinfo->can_desegment = save_can_desegment;
 441         xmpp_info->ssl_proceed = save_ssl_proceed;
 442         return;
 443     }
 444
 445     /*if tree == NULL then xmpp_item and xmpp_tree will also NULL*/
 446     xmpp_item = proto_tree_add_item(tree, proto_xmpp, tvb, 0, -1, ENC_NA);
 447     xmpp_tree = proto_item_add_subtree(xmpp_item, ett_xmpp);
 448
 449     call_dissector(xml_handle, tvb, pinfo, xmpp_tree);
 450
 451     /* If XML dissector is disabled, we can't do much */
 452     if (!proto_is_protocol_enabled(find_protocol_by_id(dissector_handle_get_protocol_index(xml_handle))))
 453     {
 454         col_append_str(pinfo->cinfo, COL_INFO, "(XML dissector disabled, can't dissect XMPP)");
 455         expert_add_info(pinfo, xmpp_item, &ei_xmpp_xml_disabled);
 456         return;
 457     }
 458
 459     /*if stream end occurs then return*/
 460     if(xmpp_stream_close(xmpp_tree,tvb, pinfo))
 461     {
 462         if(xmpp_tree)
 463             xmpp_proto_tree_hide_first_child(xmpp_tree);
 464         return;
 465     }
 466
 467     if(!pinfo->private_data)
 468         return;
 469
 470     /*data from XML dissector*/
 471     xml_frame = ((xml_frame_t*)pinfo->private_data)->first_child;
 472
 473     if(!xml_frame)
 474         return;
 475
 476     if (!xmpp_info) {
 477         xmpp_info = wmem_new(wmem_file_scope(), xmpp_conv_info_t);
 478         xmpp_info->req_resp        = wmem_tree_new(wmem_file_scope());
 479         xmpp_info->jingle_sessions = wmem_tree_new(wmem_file_scope());
 480         xmpp_info->ibb_sessions    = wmem_tree_new(wmem_file_scope());
 481         xmpp_info->gtalk_sessions  = wmem_tree_new(wmem_file_scope());
 482         xmpp_info->ssl_start   = 0;
 483         xmpp_info->ssl_proceed = 0;
 484         conversation_add_proto_data(conversation, proto_xmpp, (void *) xmpp_info);
 485     }
 486
 487     if (pinfo->match_uint == pinfo->destport)
 488         out_packet = TRUE;
 489     else
 490         out_packet = FALSE;
 491
 492     while(xml_frame)
 493     {
 494         packet = xmpp_xml_frame_to_element_t(xml_frame, NULL, tvb);
 495         DISSECTOR_ASSERT(packet);
 496
 497         if (strcmp(packet->name, "iq") == 0) {
 498             xmpp_iq_reqresp_track(pinfo, packet, xmpp_info);
 499             xmpp_jingle_session_track(pinfo, packet, xmpp_info);
 500             xmpp_gtalk_session_track(pinfo, packet, xmpp_info);
 501         }
 502
 503         if (strcmp(packet->name, "iq") == 0 || strcmp(packet->name, "message") == 0) {
 504             xmpp_ibb_session_track(pinfo, packet, xmpp_info);
 505         }
 506
 507         if (out_packet)
 508             outin_item = proto_tree_add_boolean(xmpp_tree, hf_xmpp_out, tvb, 0, 0, TRUE);
 509         else
 510             outin_item = proto_tree_add_boolean(xmpp_tree, hf_xmpp_in, tvb, 0, 0, TRUE);
 511
 512         PROTO_ITEM_SET_HIDDEN(outin_item);
 513
 514
 515         /*it hides tree generated by XML dissector*/
 516         xmpp_proto_tree_hide_first_child(xmpp_tree);
 517
 518         if (strcmp(packet->name, "iq") == 0) {
 519             xmpp_iq(xmpp_tree, tvb, pinfo, packet);
 520         } else if (strcmp(packet->name, "presence") == 0) {
 521             xmpp_presence(xmpp_tree, tvb, pinfo, packet);
 522         } else if (strcmp(packet->name, "message") == 0) {
 523             xmpp_message(xmpp_tree, tvb, pinfo, packet);
 524         } else if (strcmp(packet->name, "auth") == 0) {
 525             xmpp_auth(xmpp_tree, tvb, pinfo, packet);
 526         } else if (strcmp(packet->name, "challenge") == 0) {
 527             xmpp_challenge_response_success(xmpp_tree, tvb, pinfo, packet, &ei_xmpp_challenge, ett_xmpp_challenge, "CHALLENGE");
 528         } else if (strcmp(packet->name, "response") == 0) {
 529             xmpp_challenge_response_success(xmpp_tree, tvb, pinfo, packet, &ei_xmpp_response, ett_xmpp_response, "RESPONSE");
 530         } else if (strcmp(packet->name, "success") == 0) {
 531             xmpp_challenge_response_success(xmpp_tree, tvb, pinfo, packet, &ei_xmpp_success, ett_xmpp_success, "SUCCESS");
 532         } else if (strcmp(packet->name, "failure") == 0) {
 533             xmpp_failure(xmpp_tree, tvb, pinfo, packet);
 534         } else if (strcmp(packet->name, "xml") == 0) {
 535             xmpp_xml_header(xmpp_tree, tvb, pinfo, packet);
 536         } else if (strcmp(packet->name, "stream") == 0) {
 537             xmpp_stream(xmpp_tree, tvb, pinfo, packet);
 538         } else if (strcmp(packet->name, "features") == 0) {
 539             xmpp_features(xmpp_tree, tvb, pinfo, packet);
 540         } else if (strcmp(packet->name, "starttls") == 0) {
 541             xmpp_starttls(xmpp_tree, tvb, pinfo, packet, xmpp_info);
 542         }else if (strcmp(packet->name, "proceed") == 0) {
 543             xmpp_proceed(xmpp_tree, tvb, pinfo, packet, xmpp_info);
 544         }else {
 545             xmpp_proto_tree_show_first_child(xmpp_tree);
 546             expert_add_info_format(pinfo, xmpp_tree, &ei_xmpp_packet_unknown, "Unknown packet: %s", packet->name);
 547             col_set_str(pinfo->cinfo, COL_INFO, "UNKNOWN PACKET ");
 548         }
 549
 550         /*appends to COL_INFO information about src or dst*/
 551         if (pinfo->match_uint == pinfo->destport) {
 552             xmpp_attr_t *to = xmpp_get_attr(packet, "to");
 553             if (to)
 554                 col_append_fstr(pinfo->cinfo, COL_INFO, "> %s ", to->value);
 555         } else {
 556             xmpp_attr_t *from = xmpp_get_attr(packet, "from");
 557             if (from)
 558                 col_append_fstr(pinfo->cinfo, COL_INFO, "< %s ", from->value);
 559         }
 560
 561         xmpp_element_t_tree_free(packet);
 562         xml_frame = xml_frame->next_sibling;
 563     }
 564 }
 565
 566
 567 void
 568 proto_register_xmpp(void) {
 569     static hf_register_info hf[] = {
 570         { &hf_xmpp_iq,
 571           {
 572               "IQ", "xmpp.iq", FT_NONE, BASE_NONE, NULL, 0x0,
 573               "iq packet", HFILL
 574           }},
 575         {&hf_xmpp_xmlns,
 576          {
 577              "xmlns", "xmpp.xmlns", FT_STRING, BASE_NONE, NULL, 0x0,
 578              "element namespace", HFILL
 579          }},
 580         { &hf_xmpp_id,
 581           {
 582               "id", "xmpp.id", FT_STRING, BASE_NONE, NULL, 0x0,
 583               "packet id", HFILL
 584           }},
 585         { &hf_xmpp_type,
 586           {
 587               "type", "xmpp.type", FT_STRING, BASE_NONE, NULL, 0x0,
 588               "packet type", HFILL
 589           }},
 590         { &hf_xmpp_from,
 591           {
 592               "from", "xmpp.from", FT_STRING, BASE_NONE, NULL, 0x0,
 593               "packet from", HFILL
 594           }},
 595         { &hf_xmpp_to,
 596           {
 597               "to", "xmpp.to", FT_STRING, BASE_NONE, NULL, 0x0,
 598               "packet to", HFILL
 599           }},
 600         { &hf_xmpp_query,
 601           {
 602               "QUERY", "xmpp.query", FT_NONE, BASE_NONE, NULL, 0x0,
 603               "iq query", HFILL
 604           }},
 605         { &hf_xmpp_query_node,
 606           {
 607               "node", "xmpp.query.node", FT_STRING, BASE_NONE, NULL, 0x0,
 608               "iq query node", HFILL
 609           }},
 610         { &hf_xmpp_query_item,
 611           {
 612               "ITEM", "xmpp.query.item", FT_NONE, BASE_NONE, NULL, 0x0,
 613               "iq query item", HFILL
 614
 615           }},
 616         { &hf_xmpp_query_item_jid,
 617           {
 618               "jid", "xmpp.query.item.jid", FT_STRING, BASE_NONE, NULL, 0x0,
 619               "iq query item jid", HFILL
 620
 621           }},
 622         { &hf_xmpp_query_item_name,
 623           {
 624               "name", "xmpp.query.item.name", FT_STRING, BASE_NONE, NULL, 0x0,
 625               "iq query item name", HFILL
 626           }},
 627         { &hf_xmpp_query_item_subscription,
 628           {
 629               "subscription", "xmpp.query.item.subscription", FT_STRING, BASE_NONE, NULL, 0x0,
 630               "iq query item subscription", HFILL
 631           }},
 632         { &hf_xmpp_query_item_ask,
 633           {
 634               "ask", "xmpp.query.item.ask", FT_STRING, BASE_NONE, NULL, 0x0,
 635               "iq query item ask", HFILL
 636           }},
 637         { &hf_xmpp_query_item_group,
 638           {
 639               "GROUP", "xmpp.query.item.group", FT_STRING, BASE_NONE, NULL, 0x0,
 640               "iq query item group", HFILL
 641
 642           }},
 643         { &hf_xmpp_query_item_approved,
 644           {
 645               "approved", "xmpp.query.item.approved", FT_STRING, BASE_NONE, NULL, 0x0,
 646               "iq query item approved", HFILL
 647
 648           }},
 649         { &hf_xmpp_query_item_node,
 650           {
 651               "node", "xmpp.query.item.node", FT_STRING, BASE_NONE, NULL, 0x0,
 652               "iq query item node", HFILL
 653
 654           }},
 655         { &hf_xmpp_query_identity,
 656           {
 657               "IDENTITY", "xmpp.query.identity", FT_NONE, BASE_NONE, NULL, 0x0,
 658               "iq query identity", HFILL
 659
 660           }},
 661         { &hf_xmpp_query_identity_category,
 662           {
 663               "category", "xmpp.query.identity.category", FT_STRING, BASE_NONE, NULL, 0x0,
 664               "iq query identity category", HFILL
 665
 666           }},
 667         { &hf_xmpp_query_identity_type,
 668           {
 669               "type", "xmpp.query.identity.type", FT_STRING, BASE_NONE, NULL, 0x0,
 670               "iq query identity type", HFILL
 671
 672           }},
 673         { &hf_xmpp_query_identity_name,
 674           {
 675               "name", "xmpp.query.identity.name", FT_STRING, BASE_NONE, NULL, 0x0,
 676               "iq query identity name", HFILL
 677
 678           }},
 679         { &hf_xmpp_query_identity_lang,
 680           {
 681               "lang", "xmpp.query.identity.lang", FT_STRING, BASE_NONE, NULL, 0x0,
 682               "iq query identity lang", HFILL
 683
 684           }},
 685         { &hf_xmpp_query_feature,
 686           {
 687               "FEATURE", "xmpp.query.feature", FT_STRING, BASE_NONE, NULL, 0x0,
 688               "iq query feature", HFILL
 689
 690           }},
 691         { &hf_xmpp_query_streamhost,
 692           {
 693               "STREAMHOST", "xmpp.query.streamhost", FT_NONE, BASE_NONE, NULL, 0x0,
 694               "iq query streamhost", HFILL
 695
 696           }},
 697         { &hf_xmpp_query_streamhost_used,
 698           {
 699               "STREAMHOST-USED", "xmpp.query.streamhost-used", FT_NONE, BASE_NONE, NULL, 0x0,
 700               "iq query streamhost-used", HFILL
 701
 702           }},
 703         { &hf_xmpp_query_activate,
 704           {
 705               "ACTIVATE", "xmpp.query.activate", FT_STRING, BASE_NONE, NULL, 0x0,
 706               "iq query activate", HFILL
 707
 708           }},
 709         { &hf_xmpp_query_udpsuccess,
 710           {
 711               "UDPSUCCESS", "xmpp.query.udpsuccess", FT_NONE, BASE_NONE, NULL, 0x0,
 712               "iq query streamhost-used", HFILL
 713
 714           }},
 715         { &hf_xmpp_error,
 716           {
 717               "ERROR", "xmpp.error", FT_NONE, BASE_NONE, NULL, 0x0,
 718               "iq error", HFILL
 719           }},
 720         { &hf_xmpp_error_code,
 721           {
 722               "code", "xmpp.error.code", FT_STRING, BASE_NONE, NULL, 0x0,
 723               "iq stanza error code", HFILL
 724
 725           }},
 726         { &hf_xmpp_error_type,
 727           {
 728               "type", "xmpp.error.type", FT_STRING, BASE_NONE, NULL, 0x0,
 729               "iq error type", HFILL
 730
 731           }},
 732         { &hf_xmpp_error_condition,
 733           {
 734               "CONDITION", "xmpp.error.condition", FT_STRING, BASE_NONE, NULL, 0x0,
 735               "iq error condition", HFILL
 736
 737           }},
 738         { &hf_xmpp_error_text,
 739           {
 740               "TEXT", "xmpp.error.text", FT_STRING, BASE_NONE, NULL, 0x0,
 741               "iq error text", HFILL
 742
 743           }},
 744         { &hf_xmpp_iq_bind,
 745           {
 746               "BIND", "xmpp.iq.bind", FT_NONE, BASE_NONE, NULL, 0x0,
 747               "iq bind", HFILL
 748
 749           }},
 750         { &hf_xmpp_iq_bind_jid,
 751           {
 752               "jid", "xmpp.iq.bind.jid", FT_STRING, BASE_NONE, NULL, 0x0,
 753               "iq bind jid", HFILL
 754
 755           }},
 756         { &hf_xmpp_iq_bind_resource,
 757           {
 758               "resource", "xmpp.iq.bind.resource", FT_STRING, BASE_NONE, NULL, 0x0,
 759               "iq bind resource", HFILL
 760
 761           }},
 762         { &hf_xmpp_services,
 763           {
 764               "SERVICES", "xmpp.services", FT_NONE, BASE_NONE, NULL, 0x0,
 765               "http://jabber.org/protocol/jinglenodes services", HFILL
 766           }},
 767         { &hf_xmpp_channel,
 768           {
 769               "CHANNEL", "xmpp.channel", FT_NONE, BASE_NONE, NULL, 0x0,
 770               "http://jabber.org/protocol/jinglenodes#channel", HFILL
 771           }},
 772         { &hf_xmpp_iq_session,
 773           {
 774               "SESSION", "xmpp.iq.session", FT_NONE, BASE_NONE, NULL, 0x0,
 775               "iq session", HFILL
 776           }},
 777         { &hf_xmpp_vcard,
 778           {
 779               "VCARD", "xmpp.vcard", FT_NONE, BASE_NONE, NULL, 0x0,
 780               "vcard-temp", HFILL
 781           }},
 782         { &hf_xmpp_vcard_x_update,
 783           {
 784               "X VCARD-UPDATE", "xmpp.vcard-update", FT_NONE, BASE_NONE, NULL, 0x0,
 785               "vcard-temp:x:update", HFILL
 786           }},
 787         { &hf_xmpp_jingle,
 788           {
 789               "JINGLE", "xmpp.jingle", FT_NONE, BASE_NONE, NULL, 0x0,
 790               "iq jingle", HFILL
 791           }},
 792         { &hf_xmpp_jingle_action,
 793           {
 794               "action", "xmpp.jingle.action", FT_STRING, BASE_NONE, NULL, 0x0,
 795               "iq jingle action", HFILL
 796           }},
 797         { &hf_xmpp_jingle_sid,
 798           {
 799               "sid", "xmpp.jingle.sid", FT_STRING, BASE_NONE, NULL, 0x0,
 800               "iq jingle sid", HFILL
 801           }},
 802         { &hf_xmpp_jingle_initiator,
 803           {
 804               "initiator", "xmpp.jingle.initiator", FT_STRING, BASE_NONE, NULL, 0x0,
 805               "iq jingle initiator", HFILL
 806           }},
 807         { &hf_xmpp_jingle_responder,
 808           {
 809               "responder", "xmpp.jingle.responder", FT_STRING, BASE_NONE, NULL, 0x0,
 810               "iq jingle responder", HFILL
 811           }},
 812         { &hf_xmpp_jingle_content,
 813           {
 814               "CONTENT", "xmpp.jingle.content", FT_NONE, BASE_NONE, NULL, 0x0,
 815               "iq jingle content", HFILL
 816           }},
 817         { &hf_xmpp_jingle_content_creator,
 818           {
 819               "creator", "xmpp.jingle.content.creator", FT_STRING, BASE_NONE, NULL, 0x0,
 820               "iq jingle content creator", HFILL
 821           }},
 822         { &hf_xmpp_jingle_content_name,
 823           {
 824               "name", "xmpp.jingle.content.name", FT_STRING, BASE_NONE, NULL, 0x0,
 825               "iq jingle content name", HFILL
 826           }},
 827         { &hf_xmpp_jingle_content_disposition,
 828           {
 829               "disposition", "xmpp.jingle.content.disposition", FT_STRING, BASE_NONE, NULL, 0x0,
 830               "iq jingle content disposition", HFILL
 831           }},
 832         { &hf_xmpp_jingle_content_senders,
 833           {
 834               "senders", "xmpp.jingle.content.senders", FT_STRING, BASE_NONE, NULL, 0x0,
 835               "iq jingle content senders", HFILL
 836           }},
 837         { &hf_xmpp_jingle_content_description,
 838           {
 839               "DESCRIPTION", "xmpp.jingle.content.description", FT_NONE, BASE_NONE, NULL, 0x0,
 840               "iq jingle content description", HFILL
 841           }},
 842         { &hf_xmpp_jingle_content_description_media,
 843           {
 844               "media", "xmpp.jingle.content.description.media", FT_STRING, BASE_NONE, NULL, 0x0,
 845               "iq jingle content description", HFILL
 846           }},
 847         { &hf_xmpp_jingle_content_description_ssrc,
 848           {
 849               "ssrc", "xmpp.jingle.content.description.ssrc", FT_STRING, BASE_NONE, NULL, 0x0,
 850               "iq jingle content description ssrc", HFILL
 851           }},
 852         { &hf_xmpp_jingle_cont_desc_payload,
 853           {
 854               "PAYLOAD-TYPE", "xmpp.jingle.content.description.payload-type", FT_NONE, BASE_NONE, NULL, 0x0,
 855               "iq jingle content description payload-type", HFILL
 856           }},
 857         { &hf_xmpp_jingle_cont_desc_payload_id,
 858           {
 859               "id", "xmpp.jingle.content.description.payload-type.id", FT_STRING, BASE_NONE, NULL, 0x0,
 860               "iq jingle content description payload-type id", HFILL
 861           }},
 862         { &hf_xmpp_jingle_cont_desc_payload_channels,
 863           {
 864               "channels", "xmpp.jingle.content.description.payload-type.channels", FT_STRING, BASE_NONE, NULL, 0x0,
 865               "iq jingle content description payload-type channels", HFILL
 866           }},
 867         { &hf_xmpp_jingle_cont_desc_payload_clockrate,
 868           {
 869               "clockrate", "xmpp.jingle.content.description.payload-type.clockrate", FT_STRING, BASE_NONE, NULL, 0x0,
 870               "iq jingle content description payload-type clockrate", HFILL
 871           }},
 872         { &hf_xmpp_jingle_cont_desc_payload_maxptime,
 873           {
 874               "maxptime", "xmpp.jingle.content.description.payload-type.maxptime", FT_STRING, BASE_NONE, NULL, 0x0,
 875               "iq jingle content description payload-type maxptime", HFILL
 876           }},
 877         { &hf_xmpp_jingle_cont_desc_payload_name,
 878           {
 879               "name", "xmpp.jingle.content.description.payload-type.name", FT_STRING, BASE_NONE, NULL, 0x0,
 880               "iq jingle content description payload-type name", HFILL
 881           }},
 882         { &hf_xmpp_jingle_cont_desc_payload_ptime,
 883           {
 884               "ptime", "xmpp.jingle.content.description.payload-type.ptime", FT_STRING, BASE_NONE, NULL, 0x0,
 885               "iq jingle content description payload-type ptime", HFILL
 886           }},
 887         { &hf_xmpp_jingle_cont_desc_payload_param,
 888           {
 889               "PARAMETER", "xmpp.jingle.content.description.payload-type.parameter", FT_NONE, BASE_NONE, NULL, 0x0,
 890               "iq jingle content description payload-type parameter", HFILL
 891           }},
 892         { &hf_xmpp_jingle_cont_desc_payload_param_name,
 893           {
 894               "name", "xmpp.jingle.content.description.payload-type.parameter.name", FT_STRING, BASE_NONE, NULL, 0x0,
 895               "iq jingle content description payload-type parameter name", HFILL
 896           }},
 897         { &hf_xmpp_jingle_cont_desc_payload_param_value,
 898           {
 899               "value", "xmpp.jingle.content.description.payload-type.parameter.value", FT_STRING, BASE_NONE, NULL, 0x0,
 900               "iq jingle content description payload-type parameter value", HFILL
 901           }},
 902         { &hf_xmpp_jingle_cont_trans,
 903           {
 904               "TRANSPORT", "xmpp.jingle.content.transport", FT_NONE, BASE_NONE, NULL, 0x0,
 905               "iq jingle content transport", HFILL
 906           }},
 907         { &hf_xmpp_jingle_cont_trans_ufrag,
 908           {
 909               "ufrag", "xmpp.jingle.content.transport.ufrag", FT_STRING, BASE_NONE, NULL, 0x0,
 910               "iq jingle content transport ufrag", HFILL
 911           }},
 912         { &hf_xmpp_jingle_cont_trans_pwd,
 913           {
 914               "pwd", "xmpp.jingle.content.transport.pwd", FT_STRING, BASE_NONE, NULL, 0x0,
 915               "iq jingle content transport pwd", HFILL
 916           }},
 917         { &hf_xmpp_jingle_cont_trans_cand,
 918           {
 919               "CANDIDATE", "xmpp.jingle.content.transport.candidate", FT_NONE, BASE_NONE, NULL, 0x0,
 920               "iq jingle content transport candidate", HFILL
 921           }},
 922         { &hf_xmpp_jingle_cont_trans_rem_cand,
 923           {
 924               "REMOTE-CANDIDATE", "xmpp.jingle.content.transport.remote-candidate", FT_NONE, BASE_NONE, NULL, 0x0,
 925               "iq jingle content transport remote-candidate", HFILL
 926           }},
 927         { &hf_xmpp_jingle_cont_trans_activated,
 928           {
 929               "ACTIVATED", "xmpp.jingle.content.transport.activated", FT_NONE, BASE_NONE, NULL, 0x0,
 930               "urn:xmpp:jingle:transports:s5b:1 activated", HFILL
 931           }},
 932         { &hf_xmpp_jingle_cont_trans_candidate_used,
 933           {
 934               "CANDIDATE-USED", "xmpp.jingle.content.transport.candidate-used", FT_NONE, BASE_NONE, NULL, 0x0,
 935               "urn:xmpp:jingle:transports:s5b:1 candidate-used", HFILL
 936           }},
 937         { &hf_xmpp_jingle_cont_trans_candidate_error,
 938           {
 939               "CANDIDATE-ERROR", "xmpp.jingle.content.transport.candidate-error", FT_NONE, BASE_NONE, NULL, 0x0,
 940               "urn:xmpp:jingle:transports:s5b:1 candidate-error", HFILL
 941           }},
 942         { &hf_xmpp_jingle_cont_trans_proxy_error,
 943           {
 944               "PROXY-ERROR", "xmpp.jingle.content.transport.proxy-error", FT_NONE, BASE_NONE, NULL, 0x0,
 945               "urn:xmpp:jingle:transports:s5b:1 proxy-error", HFILL
 946           }},
 947         { &hf_xmpp_jingle_cont_desc_enc,
 948           {
 949               "ENCRYPTION", "xmpp.jingle.content.description.encryption", FT_NONE, BASE_NONE, NULL, 0x0,
 950               "iq jingle content descryption encryption", HFILL
 951           }},
 952         { &hf_xmpp_jingle_cont_desc_enc_zrtp_hash,
 953           {
 954               "ZRTP-HASH", "xmpp.jingle.content.description.encryption.zrtp-hash", FT_NONE, BASE_NONE, NULL, 0x0,
 955               "iq jingle content descryption encryption zrtp-hash", HFILL
 956           }},
 957         { &hf_xmpp_jingle_cont_desc_enc_crypto,
 958           {
 959               "CRYPTO", "xmpp.jingle.content.description.encryption.crypto", FT_NONE, BASE_NONE, NULL, 0x0,
 960               "iq jingle content descryption encryption crypto", HFILL
 961           }},
 962         { &hf_xmpp_jingle_cont_desc_bandwidth,
 963           {
 964               "BANDWIDTH", "xmpp.jingle.content.description.bandwidth", FT_NONE, BASE_NONE, NULL, 0x0,
 965               "iq jingle content descryption bandwidth", HFILL
 966           }},
 967         { &hf_xmpp_jingle_cont_desc_rtp_hdr,
 968           {
 969               "RTP-HDREXT", "xmpp.jingle.content.description.rtp-hdrext", FT_NONE, BASE_NONE, NULL, 0x0,
 970               "iq jingle content descryption rtp-hdrext", HFILL
 971           }},
 972         { &hf_xmpp_jingle_reason,
 973           {
 974               "REASON", "xmpp.jingle.reason", FT_NONE, BASE_NONE, NULL, 0x0,
 975               "iq jingle reason", HFILL
 976           }},
 977         { &hf_xmpp_jingle_reason_condition,
 978           {
 979               "CONDITION", "xmpp.jingle.reason.condition", FT_STRING, BASE_NONE, NULL, 0x0,
 980               "iq jingle reason condition", HFILL
 981           }},
 982         { &hf_xmpp_jingle_reason_text,
 983           {
 984               "TEXT", "xmpp.jingle.reason.text", FT_STRING, BASE_NONE, NULL, 0x0,
 985               "iq jingle reason text", HFILL
 986           }},
 987         { &hf_xmpp_jingle_rtp_info,
 988           {
 989               "RTP-INFO", "xmpp.jingle.rtp_info", FT_STRING, BASE_NONE, NULL, 0x0,
 990               "iq jingle rtp-info(ringing, active, hold, mute, ...)", HFILL
 991           }},
 992         { &hf_xmpp_jingle_file_transfer_offer,
 993           {
 994               "OFFER", "xmpp.jingle.content.description.offer", FT_NONE, BASE_NONE, NULL, 0x0,
 995               "urn:xmpp:jingle:apps:file-transfer:3 offer", HFILL
 996           }},
 997         { &hf_xmpp_jingle_file_transfer_request,
 998           {
 999               "REQUEST", "xmpp.jingle.content.description.request", FT_NONE, BASE_NONE, NULL, 0x0,
1000               "urn:xmpp:jingle:apps:file-transfer:3 request", HFILL
1001           }},
1002         { &hf_xmpp_jingle_file_transfer_received,
1003           {
1004               "RECEIVED", "xmpp.jingle.content.received", FT_NONE, BASE_NONE, NULL, 0x0,
1005               "urn:xmpp:jingle:apps:file-transfer:3 received", HFILL
1006           }},
1007         { &hf_xmpp_jingle_file_transfer_abort,
1008           {
1009               "ABORT", "xmpp.jingle.content.abort", FT_NONE, BASE_NONE, NULL, 0x0,
1010               "urn:xmpp:jingle:apps:file-transfer:3 abort", HFILL
1011           }},
1012         { &hf_xmpp_jingle_file_transfer_checksum,
1013           {
1014               "CHECKSUM", "xmpp.jingle.content.checksum", FT_NONE, BASE_NONE, NULL, 0x0,
1015               "urn:xmpp:jingle:apps:file-transfer:3 checksum", HFILL
1016           }},
1017         { &hf_xmpp_si,
1018           {
1019               "SI", "xmpp.si", FT_NONE, BASE_NONE, NULL, 0x0,
1020               "iq si", HFILL
1021           }},
1022         { &hf_xmpp_si_file,
1023           {
1024               "FILE", "xmpp.si.file", FT_NONE, BASE_NONE, NULL, 0x0,
1025               "iq si file", HFILL
1026           }},
1027         { &hf_xmpp_iq_feature_neg,
1028           {
1029               "FEATURE", "xmpp.feature-neg", FT_NONE, BASE_NONE, NULL, 0x0,
1030               "http://jabber.org/protocol/feature-neg", HFILL
1031           }},
1032         { &hf_xmpp_x_data,
1033           {
1034               "X-DATA", "xmpp.x-data", FT_NONE, BASE_NONE, NULL, 0x0,
1035               "jabber:x:data", HFILL
1036           }},
1037         { &hf_xmpp_x_data_field,
1038           {
1039               "FIELD", "xmpp.x-data.field", FT_NONE, BASE_NONE, NULL, 0x0,
1040               "jabber:x:data field", HFILL
1041           }},
1042         { &hf_xmpp_x_data_field_value,
1043           {
1044               "VALUE", "xmpp.x-data.field.value", FT_NONE, BASE_NONE, NULL, 0x0,
1045               "jabber:x:data field value", HFILL
1046           }},
1047         { &hf_xmpp_delay,
1048           {
1049               "DELAY", "xmpp.delay", FT_NONE, BASE_NONE, NULL, 0x0,
1050               "urn:xmpp:delay", HFILL
1051           }},
1052         { &hf_xmpp_x_event,
1053           {
1054               "X EVENT", "xmpp.x-event", FT_NONE, BASE_NONE, NULL, 0x0,
1055               "jabber:x:event", HFILL
1056           }},
1057         { &hf_xmpp_x_event_condition,
1058           {
1059               "CONDITION", "xmpp.x-event.condition", FT_STRING, BASE_NONE, NULL, 0x0,
1060               "jabber:x:event condition", HFILL
1061           }},
1062         { &hf_xmpp_presence,
1063           {
1064               "PRESENCE", "xmpp.presence", FT_NONE, BASE_NONE, NULL, 0x0,
1065               "presence packet", HFILL
1066           }},
1067         { &hf_xmpp_presence_show,
1068           {
1069               "SHOW", "xmpp.presence.show", FT_STRING, BASE_NONE, NULL, 0x0,
1070               "presence show", HFILL
1071           }},
1072         { &hf_xmpp_presence_status,
1073           {
1074               "STATUS", "xmpp.presence.status", FT_NONE, BASE_NONE, NULL, 0x0,
1075               "presence status", HFILL
1076           }},
1077         { &hf_xmpp_presence_caps,
1078           {
1079               "CAPS", "xmpp.presence.caps", FT_NONE, BASE_NONE, NULL, 0x0,
1080               "presence caps", HFILL
1081           }},
1082         { &hf_xmpp_message,
1083           {
1084               "MESSAGE", "xmpp.message", FT_NONE, BASE_NONE, NULL, 0x0,
1085               "message packet", HFILL
1086           }},
1087         { &hf_xmpp_message_chatstate,
1088           {
1089               "CHATSTATE", "xmpp.message.chatstate", FT_STRING, BASE_NONE, NULL, 0x0,
1090               "message chatstate", HFILL
1091           }},
1092         { &hf_xmpp_message_thread,
1093           {
1094               "THREAD", "xmpp.message.thread", FT_NONE, BASE_NONE, NULL, 0x0,
1095               "message thread", HFILL
1096           }},
1097         { &hf_xmpp_message_body,
1098           {
1099               "BODY", "xmpp.message.body", FT_NONE, BASE_NONE, NULL, 0x0,
1100               "message body", HFILL
1101           }},
1102         { &hf_xmpp_message_subject,
1103           {
1104               "SUBJECT", "xmpp.message.subject", FT_NONE, BASE_NONE, NULL, 0x0,
1105               "message subject", HFILL
1106           }},
1107         { &hf_xmpp_message_thread_parent,
1108           {
1109               "parent", "xmpp.message.thread.parent", FT_STRING, BASE_NONE, NULL, 0x0,
1110               "message thread parent", HFILL
1111           }},
1112         { &hf_xmpp_auth,
1113           {
1114               "AUTH", "xmpp.auth", FT_NONE, BASE_NONE, NULL, 0x0,
1115               "auth packet", HFILL
1116           }},
1117         { &hf_xmpp_stream,
1118           {
1119               "STREAM", "xmpp.stream", FT_NONE, BASE_NONE, NULL, 0x0,
1120               "XMPP stream", HFILL
1121           }},
1122         { &hf_xmpp_failure,
1123           {
1124               "FAILURE", "xmpp.failure", FT_NONE, BASE_NONE, NULL, 0x0,
1125               "failure packet", HFILL
1126           }},
1127         { &hf_xmpp_features,
1128           {
1129               "FEATURES", "xmpp.features", FT_NONE, BASE_NONE, NULL, 0x0,
1130               "stream features", HFILL
1131           }},
1132         { &hf_xmpp_starttls,
1133           {
1134               "STARTTLS", "xmpp.starttls", FT_NONE, BASE_NONE, NULL, 0x0,
1135               "starttls packet", HFILL
1136           }},
1137         { &hf_xmpp_proceed,
1138           {
1139               "PROCEED", "xmpp.proceed", FT_NONE, BASE_NONE, NULL, 0x0,
1140               "proceed packet", HFILL
1141           }},
1142         { &hf_xmpp_unknown,
1143           {
1144               "UNKNOWN", "xmpp.unknown", FT_STRING, BASE_NONE, NULL, 0x0,
1145               "unknown element", HFILL
1146           }},
1147         { &hf_xmpp_unknown_attr,
1148           {
1149               "UNKNOWN ATTR", "xmpp.unknown_attr", FT_STRING, BASE_NONE, NULL, 0x0,
1150               "unknown attribute", HFILL
1151           }},
1152         { &hf_xmpp_ibb_open,
1153           {
1154               "IBB-OPEN", "xmpp.ibb.open", FT_NONE, BASE_NONE, NULL, 0x0,
1155               "xmpp ibb open", HFILL
1156           }},
1157         { &hf_xmpp_ibb_close,
1158           {
1159               "IBB-CLOSE", "xmpp.ibb.close", FT_NONE, BASE_NONE, NULL, 0x0,
1160               "xmpp ibb close", HFILL
1161           }},
1162         { &hf_xmpp_ibb_data,
1163           {
1164               "IBB-DATA", "xmpp.ibb.data", FT_NONE, BASE_NONE, NULL, 0x0,
1165               "xmpp ibb data", HFILL
1166           }},
1167         { &hf_xmpp_muc_x,
1168           {
1169               "X MUC", "xmpp.muc-x", FT_NONE, BASE_NONE, NULL, 0x0,
1170               "http://jabber.org/protocol/muc", HFILL
1171           }},
1172         { &hf_xmpp_muc_user_x,
1173           {
1174               "X MUC-USER", "xmpp.muc-user-x", FT_NONE, BASE_NONE, NULL, 0x0,
1175               "http://jabber.org/protocol/muc#user", HFILL
1176           }},
1177         { &hf_xmpp_muc_user_item,
1178           {
1179               "ITEM", "xmpp.muc-user-x.item", FT_NONE, BASE_NONE, NULL, 0x0,
1180               "muc#user item", HFILL
1181           }},
1182         { &hf_xmpp_muc_user_invite,
1183           {
1184               "INVITE", "xmpp.muc-user-x.invite", FT_NONE, BASE_NONE, NULL, 0x0,
1185               "muc#user invite", HFILL
1186           }},
1187         { &hf_xmpp_gtalk_session,
1188           {
1189               "GTALK-SESSION", "xmpp.gtalk.session", FT_NONE, BASE_NONE, NULL, 0x0,
1190               "GTalk session", HFILL
1191           }},
1192         { &hf_xmpp_gtalk_session_type,
1193           {
1194               "type", "xmpp.gtalk.session.type", FT_STRING, BASE_NONE, NULL, 0x0,
1195               "GTalk session type", HFILL
1196           }},
1197         { &hf_xmpp_gtalk,
1198           {
1199               "GTALK SESSION", "xmpp.gtalk", FT_STRING, BASE_NONE, NULL, 0x0,
1200               "GTalk SID", HFILL
1201           }},
1202         { &hf_xmpp_gtalk_setting,
1203           {
1204               "USERSETTING", "xmpp.gtalk.setting", FT_NONE, BASE_NONE, NULL, 0x0,
1205               "google:setting usersetting", HFILL
1206           }},
1207         { &hf_xmpp_gtalk_nosave_x,
1208           {
1209               "X-NOSAVE", "xmpp.gtalk.nosave.x", FT_NONE, BASE_NONE, NULL, 0x0,
1210               "google:nosave x", HFILL
1211           }},
1212         { &hf_xmpp_gtalk_mail_mailbox,
1213           {
1214               "MAILBOX", "xmpp.gtalk.mailbox", FT_NONE, BASE_NONE, NULL, 0x0,
1215               "google:mail:notify mailbox", HFILL
1216           }},
1217         { &hf_xmpp_gtalk_mail_new_mail,
1218           {
1219               "NEW MAIL", "xmpp.gtalk.new-mail", FT_NONE, BASE_NONE, NULL, 0x0,
1220               "google:mail:notify new-mail", HFILL
1221           }},
1222         { &hf_xmpp_gtalk_transport_p2p,
1223           {
1224               "TRANSPORT", "xmpp.gtalk.transport-p2p", FT_NONE, BASE_NONE, NULL, 0x0,
1225               "google/transport/p2p", HFILL
1226           }},
1227         { &hf_xmpp_conf_info,
1228           {
1229               "CONFERENCE INFO", "xmpp.conf-info", FT_NONE, BASE_NONE, NULL, 0x0,
1230               "urn:ietf:params:xml:ns:conference-info", HFILL
1231           }},
1232         { &hf_xmpp_conf_info_sid,
1233           {
1234               "sid", "xmpp.conf-info.sid", FT_STRING, BASE_NONE, NULL, 0x0,
1235               "urn:ietf:params:xml:ns:conference-info sid", HFILL
1236           }},
1237         { &hf_xmpp_response_in,
1238           { "Response In", "xmpp.response_in",
1239             FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1240             "The response to this request is in this frame", HFILL }
1241         },
1242         { &hf_xmpp_response_to,
1243           { "Request In", "xmpp.response_to",
1244             FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1245             "This is a response to the request in this frame", HFILL }
1246         },
1247         { &hf_xmpp_out,
1248           {
1249               "Out", "xmpp.out", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1250               "Outgoing packet", HFILL
1251           }},
1252         { &hf_xmpp_in,
1253           {
1254               "In", "xmpp.in", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1255               "Ingoing packet", HFILL
1256           }},
1257         { &hf_xmpp_ibb,
1258           {
1259               "IBB SESSION", "xmpp.ibb", FT_STRING, BASE_NONE, NULL, 0x0,
1260               "In-Band Bytestreams session", HFILL
1261           }},
1262         { &hf_xmpp_jingle_session,
1263           {
1264               "JINGLE SESSION", "xmpp.jingle_session", FT_STRING, BASE_NONE, NULL, 0x0,
1265               "Jingle SID", HFILL
1266           }},
1267         { &hf_xmpp_ping,
1268           {
1269               "PING", "xmpp.ping", FT_NONE, BASE_NONE, NULL, 0x0,
1270               "urn:xmpp:ping", HFILL
1271           }},
1272         { &hf_xmpp_hashes,
1273           {
1274               "HASHES", "xmpp.hashes", FT_NONE, BASE_NONE, NULL, 0x0,
1275               "urn:xmpp:hashes:0", HFILL
1276           }},
1277         { &hf_xmpp_jitsi_inputevt,
1278           {
1279               "INPUTEVT", "xmpp.inputevt", FT_NONE, BASE_NONE, NULL, 0x0,
1280               "http://jitsi.org/protocol/inputevt", HFILL
1281           }},
1282         { &hf_xmpp_jitsi_inputevt_rmt_ctrl,
1283           {
1284               "REMOTE-CONTROL", "xmpp.inputevt.remote-control", FT_NONE, BASE_NONE, NULL, 0x0,
1285               "http://jitsi.org/protocol/inputevt remote-control", HFILL
1286           }},
1287     };
1288
1289     static gint * ett[] = {
1290         &ett_xmpp,
1291         &ett_xmpp_iq,
1292         &ett_xmpp_query,
1293         &ett_xmpp_query_item,
1294         &ett_xmpp_query_identity,
1295         &ett_xmpp_query_feature,
1296         &ett_xmpp_query_streamhost,
1297         &ett_xmpp_query_streamhost_used,
1298         &ett_xmpp_query_udpsuccess,
1299         &ett_xmpp_iq_error,
1300         &ett_xmpp_iq_bind,
1301         &ett_xmpp_iq_session,
1302         &ett_xmpp_vcard,
1303         &ett_xmpp_vcard_x_update,
1304         &ett_xmpp_jingle,
1305         &ett_xmpp_jingle_content,
1306         &ett_xmpp_jingle_content_description,
1307         &ett_xmpp_jingle_cont_desc_payload,
1308         &ett_xmpp_jingle_cont_desc_payload_param,
1309         &ett_xmpp_jingle_cont_desc_enc,
1310         &ett_xmpp_jingle_cont_desc_enc_zrtp_hash,
1311         &ett_xmpp_jingle_cont_desc_enc_crypto,
1312         &ett_xmpp_jingle_cont_desc_bandwidth,
1313         &ett_xmpp_jingle_cont_desc_rtp_hdr,
1314         &ett_xmpp_jingle_cont_trans,
1315         &ett_xmpp_jingle_cont_trans_cand,
1316         &ett_xmpp_jingle_cont_trans_rem_cand,
1317         &ett_xmpp_jingle_reason,
1318         &ett_xmpp_jingle_rtp_info,
1319         &ett_xmpp_services,
1320         &ett_xmpp_services_relay,
1321         &ett_xmpp_channel,
1322         &ett_xmpp_si,
1323         &ett_xmpp_si_file,
1324         &ett_xmpp_si_file_range,
1325         &ett_xmpp_iq_feature_neg,
1326         &ett_xmpp_x_data,
1327         &ett_xmpp_x_data_field,
1328         &ett_xmpp_x_data_field_value,
1329         &ett_xmpp_ibb_open,
1330         &ett_xmpp_ibb_close,
1331         &ett_xmpp_ibb_data,
1332         &ett_xmpp_delay,
1333         &ett_xmpp_x_event,
1334         &ett_xmpp_message,
1335         &ett_xmpp_message_thread,
1336         &ett_xmpp_message_subject,
1337         &ett_xmpp_message_body,
1338         &ett_xmpp_presence,
1339         &ett_xmpp_presence_status,
1340         &ett_xmpp_presence_caps,
1341         &ett_xmpp_auth,
1342         &ett_xmpp_challenge,
1343         &ett_xmpp_response,
1344         &ett_xmpp_success,
1345         &ett_xmpp_failure,
1346         &ett_xmpp_muc_x,
1347         &ett_xmpp_muc_hist,
1348         &ett_xmpp_muc_user_x,
1349         &ett_xmpp_muc_user_item,
1350         &ett_xmpp_muc_user_invite,
1351         &ett_xmpp_gtalk_session,
1352         &ett_xmpp_gtalk_session_desc,
1353         &ett_xmpp_gtalk_session_desc_payload,
1354         &ett_xmpp_gtalk_session_cand,
1355         &ett_xmpp_gtalk_session_reason,
1356         &ett_xmpp_gtalk_jingleinfo_stun,
1357         &ett_xmpp_gtalk_jingleinfo_server,
1358         &ett_xmpp_gtalk_jingleinfo_relay,
1359         &ett_xmpp_gtalk_jingleinfo_relay_serv,
1360         &ett_xmpp_gtalk_setting,
1361         &ett_xmpp_gtalk_nosave_x,
1362         &ett_xmpp_gtalk_mail_mailbox,
1363         &ett_xmpp_gtalk_mail_mail_info,
1364         &ett_xmpp_gtalk_mail_senders,
1365         &ett_xmpp_gtalk_mail_sender,
1366         &ett_xmpp_gtalk_status_status_list,
1367         &ett_xmpp_conf_info,
1368         &ett_xmpp_conf_desc,
1369         &ett_xmpp_conf_state,
1370         &ett_xmpp_conf_users,
1371         &ett_xmpp_conf_user,
1372         &ett_xmpp_conf_endpoint,
1373         &ett_xmpp_conf_media,
1374         &ett_xmpp_gtalk_transport_p2p,
1375         &ett_xmpp_gtalk_transport_p2p_cand,
1376         &ett_xmpp_ping,
1377         &ett_xmpp_hashes_hash,
1378         &ett_xmpp_hashes,
1379         &ett_xmpp_jingle_file_transfer_offer,
1380         &ett_xmpp_jingle_file_transfer_request,
1381         &ett_xmpp_jingle_file_transfer_received,
1382         &ett_xmpp_jingle_file_transfer_abort,
1383         &ett_xmpp_jingle_file_transfer_checksum,
1384         &ett_xmpp_jingle_file_transfer_file,
1385         &ett_xmpp_jitsi_inputevt,
1386         &ett_xmpp_jitsi_inputevt_rmt_ctrl,
1387         &ett_xmpp_stream,
1388         &ett_xmpp_features,
1389         &ett_xmpp_features_mechanisms,
1390         &ett_xmpp_starttls,
1391         &ett_xmpp_proceed,
1392     };
1393
1394     static ei_register_info ei[] = {
1395         { &ei_xmpp_xml_disabled, { "xmpp.xml_disabled", PI_UNDECODED, PI_WARN, "XML dissector disabled, can't dissect XMPP", EXPFILL }},
1396         { &ei_xmpp_packet_unknown, { "xmpp.packet_unknown", PI_UNDECODED, PI_NOTE, "Unknown packet", EXPFILL }},
1397         { &ei_xmpp_packet_without_response, { "xmpp.packet_without_response", PI_PROTOCOL, PI_CHAT, "Packet without response", EXPFILL }},
1398         { &ei_xmpp_response, { "xmpp.response", PI_RESPONSE_CODE, PI_CHAT, "RESPONSE", EXPFILL }},
1399         { &ei_xmpp_challenge, { "xmpp.challenge", PI_RESPONSE_CODE, PI_CHAT, "CHALLENGE", EXPFILL }},
1400         { &ei_xmpp_success, { "xmpp.success", PI_RESPONSE_CODE, PI_CHAT, "SUCCESS", EXPFILL }},
1401         { &ei_xmpp_starttls_already_in_frame, { "xmpp.starttls.already_in_frame", PI_PROTOCOL, PI_WARN, "Already saw STARTTLS in frame X", EXPFILL }},
1402         { &ei_xmpp_starttls_missing, { "xmpp.starttls.missing", PI_PROTOCOL, PI_WARN, "Haven't seen a STARTTLS, did the capture start in the middle of a session?", EXPFILL }},
1403         { &ei_xmpp_proceed_already_in_frame, { "xmpp.proceed.already_in_frame", PI_PROTOCOL, PI_WARN, "Already saw PROCEED in frame X", EXPFILL }},
1404         { &ei_xmpp_unknown_element, { "xmpp.unknown.element", PI_UNDECODED, PI_NOTE, "Unknown element", EXPFILL }},
1405         { &ei_xmpp_unknown_attribute, { "xmpp.unknown.attribute", PI_UNDECODED, PI_NOTE, "Unknown attribute", EXPFILL }},
1406         { &ei_xmpp_required_attribute, { "xmpp.required_attribute", PI_PROTOCOL, PI_WARN, "Required attribute doesn't appear", EXPFILL }},
1407         { &ei_xmpp_field_unexpected_value, { "xmpp.field.unexpected_value", PI_PROTOCOL, PI_WARN, "Field has unexpected value", EXPFILL }},
1408     };
1409
1410     module_t *xmpp_module;
1411     expert_module_t* expert_xmpp;
1412
1413     static gint* ett_unknown_ptr[ETT_UNKNOWN_LEN];
1414     gint i;
1415     for(i=0;i<ETT_UNKNOWN_LEN;i++)
1416     {
1417         ett_unknown[i] = -1;
1418         ett_unknown_ptr[i] = &ett_unknown[i];
1419     }
1420
1421     proto_xmpp = proto_register_protocol(
1422         "XMPP Protocol", /* name       */
1423         "XMPP",          /* short name */
1424         "xmpp"           /* abbrev     */
1425         );
1426
1427     xmpp_module = prefs_register_protocol(proto_xmpp, NULL);
1428     prefs_register_bool_preference(xmpp_module, "desegment",
1429                                    "Reasemble XMPP messages",
1430                                    "Whether the XMPP dissector should reassemble messages. "
1431                                    "To use this option, you must also enable"
1432                                    " \"Allow subdissectors to reassemble TCP streams\""
1433                                    " in the TCP protocol settings",
1434                                    &xmpp_desegment);
1435
1436     proto_register_field_array(proto_xmpp, hf, array_length(hf));
1437     proto_register_subtree_array(ett, array_length(ett));
1438     proto_register_subtree_array(ett_unknown_ptr, array_length(ett_unknown_ptr));
1439     expert_xmpp = expert_register_protocol(proto_xmpp);
1440     expert_register_field_array(expert_xmpp, ei, array_length(ei));
1441
1442     xmpp_handle = register_dissector("xmpp", dissect_xmpp, proto_xmpp);
1443
1444     xmpp_init_parsers();
1445 }
1446
1447 void
1448 proto_reg_handoff_xmpp(void) {
1449     ssl_handle = find_dissector("ssl");
1450     xml_handle  = find_dissector("xml");
1451
1452     dissector_add_uint("tcp.port", XMPP_PORT, xmpp_handle);
1453
1454 }
1455 /*
1456 * Editor modelines - http://www.wireshark.org/tools/modelines.html
1457 *
1458 * Local variables:
1459 * c-basic-offset: 4
1460 * tab-width: 8
1461 * indent-tabs-mode: nil
1462 * End:
1463 *
1464 * ex: set shiftwidth=4 tabstop=8 expandtab:
1465 * :indentSize=4:tabSize=8:noTabs=true:
1466 */