PageRenderTime 58ms CodeModel.GetById 16ms RepoModel.GetById 0ms app.codeStats 1ms

/epan/dissectors/packet-http.c

https://github.com/labx-technologies-llc/wireshark
C | 3187 lines | 2182 code | 382 blank | 623 comment | 385 complexity | a669e9c4fa2a4a2bb6fc252d5a4a4a3d MD5 | raw file
Possible License(s): GPL-2.0, BSD-3-Clause 
    

  1. /* packet-http.c
    2. 

  2.  * Routines for HTTP packet disassembly
    3. 

  3.  * RFC 1945 (HTTP/1.0)
    4. 

  4.  * RFC 2616 (HTTP/1.1)
    5. 

  5.  *
    6. 

  6.  * Guy Harris <guy@alum.mit.edu>
    7. 

  7.  *
    8. 

  8.  * Copyright 2004, Jerry Talkington <jtalkington@users.sourceforge.net>
    9. 

  9.  * Copyright 2002, Tim Potter <tpot@samba.org>
    10. 

  10.  * Copyright 1999, Andrew Tridgell <tridge@samba.org>
    11. 

  11.  *
    12. 

  12.  * $Id$
    13. 

  13.  *
    14. 

  14.  * Wireshark - Network traffic analyzer
    15. 

  15.  * By Gerald Combs <gerald@wireshark.org>
    16. 

  16.  * Copyright 1998 Gerald Combs
    17. 

  17.  *
    18. 

  18.  * This program is free software; you can redistribute it and/or
    19. 

  19.  * modify it under the terms of the GNU General Public License
    20. 

  20.  * as published by the Free Software Foundation; either version 2
    21. 

  21.  * of the License, or (at your option) any later version.
    22. 

  22.  *
    23. 

  23.  * This program is distributed in the hope that it will be useful,
    24. 

  24.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
    25. 

  25.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    26. 

  26.  * GNU General Public License for more details.
    27. 

  27.  *
    28. 

  28.  * You should have received a copy of the GNU General Public License
    29. 

  29.  * along with this program; if not, write to the Free Software
    30. 

  30.  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
    31. 

  31.  */
    32. 

  32. 

  33. #include "config.h"
    34. 

  34. 

  35. #include <stdlib.h>
    36. 

  36. #include <string.h>
    37. 

  37. #include <ctype.h>
    38. 

  38. #include <errno.h>
    39. 

  39. 

  40. #include <glib.h>
    41. 

  41. #include <epan/conversation.h>
    42. 

  42. #include <epan/packet.h>
    43. 

  43. #include <epan/strutil.h>
    44. 

  44. #include <epan/base64.h>
    45. 

  45. #include <epan/emem.h>
    46. 

  46. #include <epan/stats_tree.h>
    47. 

  47. 

  48. #include <epan/req_resp_hdrs.h>
    49. 

  49. #include "packet-http.h"
    50. 

  50. #include "packet-tcp.h"
    51. 

  51. #include "packet-ssl.h"
    52. 

  52. #include <epan/prefs.h>
    53. 

  53. #include <epan/expert.h>
    54. 

  54. #include <epan/uat.h>
    55. 

  55. #include <epan/wmem/wmem.h>
    56. 

  56. 

  57. typedef enum _http_type {
    58. 

  58. 	HTTP_REQUEST,
    59. 

  59. 	HTTP_RESPONSE,
    60. 

  60. 	HTTP_NOTIFICATION,
    61. 

  61. 	HTTP_OTHERS
    62. 

  62. } http_type_t;
    63. 

  63. 

  64. #include <epan/tap.h>
    65. 

  65. 

  66. 

  67. static int http_tap = -1;
    68. 

  68. static int http_eo_tap = -1;
    69. 

  69. 

  70. static int proto_http = -1;
    71. 

  71. static int hf_http_notification = -1;
    72. 

  72. static int hf_http_response = -1;
    73. 

  73. static int hf_http_request = -1;
    74. 

  74. static int hf_http_basic = -1;
    75. 

  75. static int hf_http_request_method = -1;
    76. 

  76. static int hf_http_request_uri = -1;
    77. 

  77. static int hf_http_request_full_uri = -1;
    78. 

  78. static int hf_http_version = -1;
    79. 

  79. static int hf_http_response_code = -1;
    80. 

  80. static int hf_http_response_phrase = -1;
    81. 

  81. static int hf_http_authorization = -1;
    82. 

  82. static int hf_http_proxy_authenticate = -1;
    83. 

  83. static int hf_http_proxy_authorization = -1;
    84. 

  84. static int hf_http_proxy_connect_host = -1;
    85. 

  85. static int hf_http_proxy_connect_port = -1;
    86. 

  86. static int hf_http_www_authenticate = -1;
    87. 

  87. static int hf_http_content_type = -1;
    88. 

  88. static int hf_http_content_length_header = -1;
    89. 

  89. static int hf_http_content_length = -1;
    90. 

  90. static int hf_http_content_encoding = -1;
    91. 

  91. static int hf_http_transfer_encoding = -1;
    92. 

  92. static int hf_http_upgrade = -1;
    93. 

  93. static int hf_http_user_agent = -1;
    94. 

  94. static int hf_http_host = -1;
    95. 

  95. static int hf_http_connection = -1;
    96. 

  96. static int hf_http_cookie = -1;
    97. 

  97. static int hf_http_accept = -1;
    98. 

  98. static int hf_http_referer = -1;
    99. 

  99. static int hf_http_accept_language = -1;
    100. 

  100. static int hf_http_accept_encoding = -1;
    101. 

  101. static int hf_http_date = -1;
    102. 

  102. static int hf_http_cache_control = -1;
    103. 

  103. static int hf_http_server = -1;
    104. 

  104. static int hf_http_location = -1;
    105. 

  105. static int hf_http_sec_websocket_accept = -1;
    106. 

  106. static int hf_http_sec_websocket_extensions = -1;
    107. 

  107. static int hf_http_sec_websocket_key = -1;
    108. 

  108. static int hf_http_sec_websocket_protocol = -1;
    109. 

  109. static int hf_http_sec_websocket_version = -1;
    110. 

  110. static int hf_http_set_cookie = -1;
    111. 

  111. static int hf_http_last_modified = -1;
    112. 

  112. static int hf_http_x_forwarded_for = -1;
    113. 

  113. static int hf_http_request_in = -1;
    114. 

  114. static int hf_http_response_in = -1;
    115. 

  115. static int hf_http_next_request_in = -1;
    116. 

  116. static int hf_http_next_response_in = -1;
    117. 

  117. static int hf_http_prev_request_in = -1;
    118. 

  118. static int hf_http_prev_response_in = -1;
    119. 

  119. static int hf_http_time = -1;
    120. 

  120. 

  121. static gint ett_http = -1;
    122. 

  122. static gint ett_http_ntlmssp = -1;
    123. 

  123. static gint ett_http_kerberos = -1;
    124. 

  124. static gint ett_http_request = -1;
    125. 

  125. static gint ett_http_chunked_response = -1;
    126. 

  126. static gint ett_http_chunk_data = -1;
    127. 

  127. static gint ett_http_encoded_entity = -1;
    128. 

  128. static gint ett_http_header_item = -1;
    129. 

  129. 

  130. static expert_field ei_http_chat = EI_INIT;
    131. 

  131. static expert_field ei_http_subdissector_failed = EI_INIT;
    132. 

  132. 

  133. static dissector_handle_t http_handle;
    134. 

  134. 

  135. static dissector_handle_t data_handle;
    136. 

  136. static dissector_handle_t media_handle;
    137. 

  137. static dissector_handle_t websocket_handle;
    138. 

  138. 

  139. /* Stuff for generation/handling of fields for custom HTTP headers */
    140. 

  140. typedef struct _header_field_t {
    141. 

  141. 	gchar* header_name;
    142. 

  142. 	gchar* header_desc;
    143. 

  143. } header_field_t;
    144. 

  144. 

  145. static header_field_t* header_fields = NULL;
    146. 

  146. static guint num_header_fields = 0;
    147. 

  147. 

  148. static GHashTable* header_fields_hash = NULL;
    149. 

  149. 

  150. static void
    151. 

  151. header_fields_update_cb(void *r, const char **err)
    152. 

  152. {
    153. 

  153. 	header_field_t *rec = (header_field_t *)r;
    154. 

  154. 	char c;
    155. 

  155. 

  156. 	if (rec->header_name == NULL) {
    157. 

  157. 		*err = ep_strdup_printf("Header name can't be empty");
    158. 

  158. 		return;
    159. 

  159. 	}
    160. 

  160. 

  161. 	g_strstrip(rec->header_name);
    162. 

  162. 	if (rec->header_name[0] == 0) {
    163. 

  163. 		*err = ep_strdup_printf("Header name can't be empty");
    164. 

  164. 		return;
    165. 

  165. 	}
    166. 

  166. 

  167. 	/* Check for invalid characters (to avoid asserting out when
    168. 

  168. 	 * registering the field).
    169. 

  169. 	 */
    170. 

  170. 	c = proto_check_field_name(rec->header_name);
    171. 

  171. 	if (c) {
    172. 

  172. 		*err = ep_strdup_printf("Header name can't contain '%c'", c);
    173. 

  173. 		return;
    174. 

  174. 	}
    175. 

  175. 

  176. 	*err = NULL;
    177. 

  177. }
    178. 

  178. 

  179. static void *
    180. 

  180. header_fields_copy_cb(void* n, const void* o, size_t siz _U_)
    181. 

  181. {
    182. 

  182.     header_field_t* new_rec = (header_field_t*)n;
    183. 

  183.     const header_field_t* old_rec = (const header_field_t*)o;
    184. 

  184. 

  185.     if (old_rec->header_name) {
    186. 

  186. 	new_rec->header_name = g_strdup(old_rec->header_name);
    187. 

  187.     } else {
    188. 

  188. 	new_rec->header_name = NULL;
    189. 

  189.     }
    190. 

  190. 

  191.     if (old_rec->header_desc) {
    192. 

  192. 	new_rec->header_desc = g_strdup(old_rec->header_desc);
    193. 

  193.     } else {
    194. 

  194. 	new_rec->header_desc = NULL;
    195. 

  195.     }
    196. 

  196. 

  197.     return new_rec;
    198. 

  198. }
    199. 

  199. 

  200. static void
    201. 

  201. header_fields_free_cb(void*r)
    202. 

  202. {
    203. 

  203.     header_field_t* rec = (header_field_t*)r;
    204. 

  204. 

  205.     if (rec->header_name) g_free(rec->header_name);
    206. 

  206.     if (rec->header_desc) g_free(rec->header_desc);
    207. 

  207. }
    208. 

  208. 

  209. UAT_CSTRING_CB_DEF(header_fields, header_name, header_field_t)
    210. 

  210. UAT_CSTRING_CB_DEF(header_fields, header_desc, header_field_t)
    211. 

  211. 

  212. /*
    213. 

  213.  * desegmentation of HTTP headers
    214. 

  214.  * (when we are over TCP or another protocol providing the desegmentation API)
    215. 

  215.  */
    216. 

  216. static gboolean http_desegment_headers = TRUE;
    217. 

  217. 

  218. /*
    219. 

  219.  * desegmentation of HTTP bodies
    220. 

  220.  * (when we are over TCP or another protocol providing the desegmentation API)
    221. 

  221.  * TODO let the user filter on content-type the bodies he wants desegmented
    222. 

  222.  */
    223. 

  223. static gboolean http_desegment_body = TRUE;
    224. 

  224. 

  225. /*
    226. 

  226.  * De-chunking of content-encoding: chunk entity bodies.
    227. 

  227.  */
    228. 

  228. static gboolean http_dechunk_body = TRUE;
    229. 

  229. 

  230. /*
    231. 

  231.  * Decompression of zlib encoded entities.
    232. 

  232.  */
    233. 

  233. #ifdef HAVE_LIBZ
    234. 

  234. static gboolean http_decompress_body = TRUE;
    235. 

  235. #else
    236. 

  236. static gboolean http_decompress_body = FALSE;
    237. 

  237. #endif
    238. 

  238. 

  239. /* Simple Service Discovery Protocol
    240. 

  240.  * SSDP is implemented atop HTTP (yes, it really *does* run over UDP).
    241. 

  241.  * SSDP is the discovery protocol of Universal Plug and Play
    242. 

  242.  * UPnP   http://www.upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf
    243. 

  243.  */
    244. 

  244. #define TCP_PORT_SSDP			1900
    245. 

  245. #define UDP_PORT_SSDP			1900
    246. 

  246. 

  247. /*
    248. 

  248.  * tcp and ssl ports
    249. 

  249.  *
    250. 

  250.  * 2710 is the XBT BitTorrent tracker
    251. 

  251.  */
    252. 

  252. 

  253. #define TCP_DEFAULT_RANGE "80,3128,3132,5985,8080,8088,11371,1900,2869,2710"
    254. 

  254. #define SSL_DEFAULT_RANGE "443"
    255. 

  255. 

  256. #define UPGRADE_WEBSOCKET 1
    257. 

  257. 

  258. static range_t *global_http_tcp_range = NULL;
    259. 

  259. static range_t *global_http_ssl_range = NULL;
    260. 

  260. 

  261. static range_t *http_tcp_range = NULL;
    262. 

  262. static range_t *http_ssl_range = NULL;
    263. 

  263. 

  264. typedef void (*ReqRespDissector)(tvbuff_t*, proto_tree*, int, const guchar*,
    265. 

  265. 				 const guchar*, http_conv_t *);
    266. 

  266. 

  267. /*
    268. 

  268.  * Structure holding information from headers needed by main
    269. 

  269.  * HTTP dissector code.
    270. 

  270.  */
    271. 

  271. typedef struct {
    272. 

  272. 	char	*content_type;
    273. 

  273. 	char	*content_type_parameters;
    274. 

  274. 	gboolean have_content_length;
    275. 

  275. 	gint64	content_length;
    276. 

  276. 	char	*content_encoding;
    277. 

  277. 	char	*transfer_encoding;
    278. 

  278. 	guint8  upgrade;
    279. 

  279. } headers_t;
    280. 

  280. 

  281. static int is_http_request_or_reply(const gchar *data, int linelen,
    282. 

  282. 				    http_type_t *type, ReqRespDissector
    283. 

  283. 				    *reqresp_dissector, http_conv_t *conv_data);
    284. 

  284. static int chunked_encoding_dissector(tvbuff_t **tvb_ptr, packet_info *pinfo,
    285. 

  285. 				      proto_tree *tree, int offset);
    286. 

  286. static void process_header(tvbuff_t *tvb, int offset, int next_offset,
    287. 

  287. 			   const guchar *line, int linelen, int colon_offset,
    288. 

  288. 			   packet_info *pinfo, proto_tree *tree,
    289. 

  289. 			   headers_t *eh_ptr, http_conv_t *conv_data);
    290. 

  290. static gint find_header_hf_value(tvbuff_t *tvb, int offset, guint header_len);
    291. 

  291. static gboolean check_auth_ntlmssp(proto_item *hdr_item, tvbuff_t *tvb,
    292. 

  292. 				   packet_info *pinfo, gchar *value);
    293. 

  293. static gboolean check_auth_basic(proto_item *hdr_item, tvbuff_t *tvb,
    294. 

  294. 				 gchar *value);
    295. 

  295. static gboolean check_auth_kerberos(proto_item *hdr_item, tvbuff_t *tvb,
    296. 

  296. 				   packet_info *pinfo, const gchar *value);
    297. 

  297. 

  298. static dissector_table_t port_subdissector_table;
    299. 

  299. static dissector_table_t media_type_subdissector_table;
    300. 

  300. static heur_dissector_list_t heur_subdissector_list;
    301. 

  301. 

  302. static dissector_handle_t ntlmssp_handle;
    303. 

  303. static dissector_handle_t gssapi_handle;
    304. 

  304. 

  305. /* --- HTTP Status Codes */
    306. 

  306. /* Note: The reference for uncommented entries is RFC 2616 */
    307. 

  307. static const value_string vals_status_code[] = {
    308. 

  308. 	{ 100, "Continue" },
    309. 

  309. 	{ 101, "Switching Protocols" },
    310. 

  310. 	{ 102, "Processing" },                     /* RFC 2518 */
    311. 

  311. 	{ 199, "Informational - Others" },
    312. 

  312. 

  313. 	{ 200, "OK"},
    314. 

  314. 	{ 201, "Created"},
    315. 

  315. 	{ 202, "Accepted"},
    316. 

  316. 	{ 203, "Non-authoritative Information"},
    317. 

  317. 	{ 204, "No Content"},
    318. 

  318. 	{ 205, "Reset Content"},
    319. 

  319. 	{ 206, "Partial Content"},
    320. 

  320. 	{ 207, "Multi-Status"},                    /* RFC 4918 */
    321. 

  321.         { 226, "IM Used"},                         /* RFC 3229 */
    322. 

  322. 	{ 299, "Success - Others"},
    323. 

  323. 

  324. 	{ 300, "Multiple Choices"},
    325. 

  325. 	{ 301, "Moved Permanently"},
    326. 

  326. 	{ 302, "Found"},
    327. 

  327. 	{ 303, "See Other"},
    328. 

  328. 	{ 304, "Not Modified"},
    329. 

  329. 	{ 305, "Use Proxy"},
    330. 

  330. 	{ 307, "Temporary Redirect"},
    331. 

  331. 	{ 399, "Redirection - Others"},
    332. 

  332. 

  333. 	{ 400, "Bad Request"},
    334. 

  334. 	{ 401, "Unauthorized"},
    335. 

  335. 	{ 402, "Payment Required"},
    336. 

  336. 	{ 403, "Forbidden"},
    337. 

  337. 	{ 404, "Not Found"},
    338. 

  338. 	{ 405, "Method Not Allowed"},
    339. 

  339. 	{ 406, "Not Acceptable"},
    340. 

  340. 	{ 407, "Proxy Authentication Required"},
    341. 

  341. 	{ 408, "Request Time-out"},
    342. 

  342. 	{ 409, "Conflict"},
    343. 

  343. 	{ 410, "Gone"},
    344. 

  344. 	{ 411, "Length Required"},
    345. 

  345. 	{ 412, "Precondition Failed"},
    346. 

  346. 	{ 413, "Request Entity Too Large"},
    347. 

  347. 	{ 414, "Request-URI Too Long"},
    348. 

  348. 	{ 415, "Unsupported Media Type"},
    349. 

  349. 	{ 416, "Requested Range Not Satisfiable"},
    350. 

  350. 	{ 417, "Expectation Failed"},
    351. 

  351. 	{ 418, "I'm a teapot"},                    /* RFC 2324 */
    352. 

  352. 	{ 422, "Unprocessable Entity"},            /* RFC 4918 */
    353. 

  353. 	{ 423, "Locked"},                          /* RFC 4918 */
    354. 

  354. 	{ 424, "Failed Dependency"},               /* RFC 4918 */
    355. 

  355.         { 426, "Upgrade Required"},                /* RFC 2817 */
    356. 

  356.         { 428, "Precondition Required"},           /* RFC 6585 */
    357. 

  357.         { 429, "Too Many Requests"},               /* RFC 6585 */
    358. 

  358.         { 431, "Request Header Fields Too Large"}, /* RFC 6585 */
    359. 

  359. 	{ 499, "Client Error - Others"},
    360. 

  360. 

  361. 	{ 500, "Internal Server Error"},
    362. 

  362. 	{ 501, "Not Implemented"},
    363. 

  363. 	{ 502, "Bad Gateway"},
    364. 

  364. 	{ 503, "Service Unavailable"},
    365. 

  365. 	{ 504, "Gateway Time-out"},
    366. 

  366. 	{ 505, "HTTP Version not supported"},
    367. 

  367. 	{ 507, "Insufficient Storage"},            /* RFC 4918 */
    368. 

  368.         { 511, "Network Authentication Required"}, /* RFC 6585 */
    369. 

  369. 	{ 599, "Server Error - Others"},
    370. 

  370. 

  371. 	{ 0, 	NULL}
    372. 

  372. };
    373. 

  373. 

  374. static const gchar* st_str_reqs = "HTTP Requests by Server";
    375. 

  375. static const gchar* st_str_reqs_by_srv_addr = "HTTP Requests by Server Address";
    376. 

  376. static const gchar* st_str_reqs_by_http_host = "HTTP Requests by HTTP Host";
    377. 

  377. static const gchar* st_str_resps_by_srv_addr = "HTTP Responses by Server Address";
    378. 

  378. 

  379. static int st_node_reqs = -1;
    380. 

  380. static int st_node_reqs_by_srv_addr = -1;
    381. 

  381. static int st_node_reqs_by_http_host = -1;
    382. 

  382. static int st_node_resps_by_srv_addr = -1;
    383. 

  383. 

  384. /* HTTP/Load Distribution stats init function */
    385. 

  385. static void
    386. 

  386. http_reqs_stats_tree_init(stats_tree* st)
    387. 

  387. {
    388. 

  388. 	st_node_reqs = stats_tree_create_node(st, st_str_reqs, 0, TRUE);
    389. 

  389. 	st_node_reqs_by_srv_addr = stats_tree_create_node(st, st_str_reqs_by_srv_addr, st_node_reqs, TRUE);
    390. 

  390. 	st_node_reqs_by_http_host = stats_tree_create_node(st, st_str_reqs_by_http_host, st_node_reqs, TRUE);
    391. 

  391. 	st_node_resps_by_srv_addr = stats_tree_create_node(st, st_str_resps_by_srv_addr, 0, TRUE);
    392. 

  392. }
    393. 

  393. 

  394. /* HTTP/Load Distribution stats packet function */
    395. 

  395. static int
    396. 

  396. http_reqs_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t* edt _U_, const void* p)
    397. 

  397. {
    398. 

  398. 	const http_info_value_t* v = (const http_info_value_t*)p;
    399. 

  399. 	int reqs_by_this_host;
    400. 

  400. 	int reqs_by_this_addr;
    401. 

  401. 	int resps_by_this_addr;
    402. 

  402. 	int i = v->response_code;
    403. 

  403. 	gchar *ip_str;
    404. 

  404. 

  405. 

  406. 	if (v->request_method) {
    407. 

  407. 		ip_str = ep_address_to_str(&pinfo->dst);
    408. 

  408. 

  409. 		tick_stat_node(st, st_str_reqs, 0, FALSE);
    410. 

  410. 		tick_stat_node(st, st_str_reqs_by_srv_addr, st_node_reqs, TRUE);
    411. 

  411. 		tick_stat_node(st, st_str_reqs_by_http_host, st_node_reqs, TRUE);
    412. 

  412. 		reqs_by_this_addr = tick_stat_node(st, ip_str, st_node_reqs_by_srv_addr, TRUE);
    413. 

  413. 

  414. 		if (v->http_host) {
    415. 

  415. 			reqs_by_this_host = tick_stat_node(st, v->http_host, st_node_reqs_by_http_host, TRUE);
    416. 

  416. 			tick_stat_node(st, ip_str, reqs_by_this_host, FALSE);
    417. 

  417. 

  418. 			tick_stat_node(st, v->http_host, reqs_by_this_addr, FALSE);
    419. 

  419. 		}
    420. 

  420. 

  421. 		return 1;
    422. 

  422. 

  423. 	} else if (i != 0) {
    424. 

  424. 		ip_str = ep_address_to_str(&pinfo->src);
    425. 

  425. 

  426. 		tick_stat_node(st, st_str_resps_by_srv_addr, 0, FALSE);
    427. 

  427. 		resps_by_this_addr = tick_stat_node(st, ip_str, st_node_resps_by_srv_addr, TRUE);
    428. 

  428. 

  429. 		if ( (i>100)&&(i<400) ) {
    430. 

  430. 			tick_stat_node(st, "OK", resps_by_this_addr, FALSE);
    431. 

  431. 		} else {
    432. 

  432. 			tick_stat_node(st, "KO", resps_by_this_addr, FALSE);
    433. 

  433. 		}
    434. 

  434. 

  435. 		return 1;
    436. 

  436. 	}
    437. 

  437. 

  438. 	return 0;
    439. 

  439. }
    440. 

  440. 

  441. 

  442. static int st_node_requests_by_host = -1;
    443. 

  443. static const gchar *st_str_requests_by_host = "HTTP Requests by HTTP Host";
    444. 

  444. 

  445. /* HTTP/Requests stats init function */
    446. 

  446. static void
    447. 

  447. http_req_stats_tree_init(stats_tree* st)
    448. 

  448. {
    449. 

  449. 	st_node_requests_by_host = stats_tree_create_node(st, st_str_requests_by_host, 0, TRUE);
    450. 

  450. }
    451. 

  451. 

  452. /* HTTP/Requests stats packet function */
    453. 

  453. static int
    454. 

  454. http_req_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p)
    455. 

  455. {
    456. 

  456. 	const http_info_value_t* v = (const http_info_value_t*)p;
    457. 

  457. 	int reqs_by_this_host;
    458. 

  458. 

  459. 	if (v->request_method) {
    460. 

  460. 		tick_stat_node(st, st_str_requests_by_host, 0, FALSE);
    461. 

  461. 

  462. 		if (v->http_host) {
    463. 

  463. 			reqs_by_this_host = tick_stat_node(st, v->http_host, st_node_requests_by_host, TRUE);
    464. 

  464. 

  465. 			if (v->request_uri) {
    466. 

  466. 				tick_stat_node(st, v->request_uri, reqs_by_this_host, TRUE);
    467. 

  467. 			}
    468. 

  468. 		}
    469. 

  469. 

  470. 		return 1;
    471. 

  471. 	}
    472. 

  472. 

  473. 	return 0;
    474. 

  474. }
    475. 

  475. 

  476. static const gchar *st_str_packets = "Total HTTP Packets";
    477. 

  477. static const gchar *st_str_requests = "HTTP Request Packets";
    478. 

  478. static const gchar *st_str_responses = "HTTP Response Packets";
    479. 

  479. static const gchar *st_str_resp_broken = "???: broken";
    480. 

  480. static const gchar *st_str_resp_100 = "1xx: Informational";
    481. 

  481. static const gchar *st_str_resp_200 = "2xx: Success";
    482. 

  482. static const gchar *st_str_resp_300 = "3xx: Redirection";
    483. 

  483. static const gchar *st_str_resp_400 = "4xx: Client Error";
    484. 

  484. static const gchar *st_str_resp_500 = "5xx: Server Error";
    485. 

  485. static const gchar *st_str_other = "Other HTTP Packets";
    486. 

  486. 

  487. static int st_node_packets = -1;
    488. 

  488. static int st_node_requests = -1;
    489. 

  489. static int st_node_responses = -1;
    490. 

  490. static int st_node_resp_broken = -1;
    491. 

  491. static int st_node_resp_100 = -1;
    492. 

  492. static int st_node_resp_200 = -1;
    493. 

  493. static int st_node_resp_300 = -1;
    494. 

  494. static int st_node_resp_400 = -1;
    495. 

  495. static int st_node_resp_500 = -1;
    496. 

  496. static int st_node_other = -1;
    497. 

  497. 

  498. 

  499. /* HTTP/Packet Counter stats init function */
    500. 

  500. static void
    501. 

  501. http_stats_tree_init(stats_tree* st)
    502. 

  502. {
    503. 

  503. 	st_node_packets = stats_tree_create_node(st, st_str_packets, 0, TRUE);
    504. 

  504. 	st_node_requests = stats_tree_create_pivot(st, st_str_requests, st_node_packets);
    505. 

  505. 	st_node_responses = stats_tree_create_node(st, st_str_responses, st_node_packets, TRUE);
    506. 

  506. 	st_node_resp_broken = stats_tree_create_node(st, st_str_resp_broken, st_node_responses, TRUE);
    507. 

  507. 	st_node_resp_100    = stats_tree_create_node(st, st_str_resp_100,    st_node_responses, TRUE);
    508. 

  508. 	st_node_resp_200    = stats_tree_create_node(st, st_str_resp_200,    st_node_responses, TRUE);
    509. 

  509. 	st_node_resp_300    = stats_tree_create_node(st, st_str_resp_300,    st_node_responses, TRUE);
    510. 

  510. 	st_node_resp_400    = stats_tree_create_node(st, st_str_resp_400,    st_node_responses, TRUE);
    511. 

  511. 	st_node_resp_500    = stats_tree_create_node(st, st_str_resp_500,    st_node_responses, TRUE);
    512. 

  512. 	st_node_other = stats_tree_create_node(st, st_str_other, st_node_packets,FALSE);
    513. 

  513. }
    514. 

  514. 

  515. /* HTTP/Packet Counter stats packet function */
    516. 

  516. static int
    517. 

  517. http_stats_tree_packet(stats_tree* st, packet_info* pinfo _U_, epan_dissect_t* edt _U_, const void* p)
    518. 

  518. {
    519. 

  519. 	const http_info_value_t* v = (const http_info_value_t*)p;
    520. 

  520. 	guint i = v->response_code;
    521. 

  521. 	int resp_grp;
    522. 

  522. 	const gchar *resp_str;
    523. 

  523. 	gchar str[64];
    524. 

  524. 

  525. 	tick_stat_node(st, st_str_packets, 0, FALSE);
    526. 

  526. 

  527. 	if (i) {
    528. 

  528. 		tick_stat_node(st, st_str_responses, st_node_packets, FALSE);
    529. 

  529. 

  530. 		if ( (i<100)||(i>=600) ) {
    531. 

  531. 			resp_grp = st_node_resp_broken;
    532. 

  532. 			resp_str = st_str_resp_broken;
    533. 

  533. 		} else if (i<200) {
    534. 

  534. 			resp_grp = st_node_resp_100;
    535. 

  535. 			resp_str = st_str_resp_100;
    536. 

  536. 		} else if (i<300) {
    537. 

  537. 			resp_grp = st_node_resp_200;
    538. 

  538. 			resp_str = st_str_resp_200;
    539. 

  539. 		} else if (i<400) {
    540. 

  540. 			resp_grp = st_node_resp_300;
    541. 

  541. 			resp_str = st_str_resp_300;
    542. 

  542. 		} else if (i<500) {
    543. 

  543. 			resp_grp = st_node_resp_400;
    544. 

  544. 			resp_str = st_str_resp_400;
    545. 

  545. 		} else {
    546. 

  546. 			resp_grp = st_node_resp_500;
    547. 

  547. 			resp_str = st_str_resp_500;
    548. 

  548. 		}
    549. 

  549. 

  550. 		tick_stat_node(st, resp_str, st_node_responses, FALSE);
    551. 

  551. 

  552. 		g_snprintf(str, sizeof(str), "%u %s", i,
    553. 

  553. 			   val_to_str(i, vals_status_code, "Unknown (%d)"));
    554. 

  554. 		tick_stat_node(st, str, resp_grp, FALSE);
    555. 

  555. 	} else if (v->request_method) {
    556. 

  556. 		stats_tree_tick_pivot(st,st_node_requests,v->request_method);
    557. 

  557. 	} else {
    558. 

  558. 		tick_stat_node(st, st_str_other, st_node_packets, FALSE);
    559. 

  559. 	}
    560. 

  560. 

  561. 	return 1;
    562. 

  562. }
    563. 

  563. 

  564. 

  565. static void
    566. 

  566. dissect_http_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
    567. 

  567. 		     const char *line)
    568. 

  568. {
    569. 

  569. 	tvbuff_t *ntlmssp_tvb;
    570. 

  570. 

  571. 	ntlmssp_tvb = base64_to_tvb(tvb, line);
    572. 

  572. 	add_new_data_source(pinfo, ntlmssp_tvb, "NTLMSSP / GSSAPI Data");
    573. 

  573. 	if (tvb_strneql(ntlmssp_tvb, 0, "NTLMSSP", 7) == 0)
    574. 

  574. 		call_dissector(ntlmssp_handle, ntlmssp_tvb, pinfo, tree);
    575. 

  575. 	else
    576. 

  576. 		call_dissector(gssapi_handle, ntlmssp_tvb, pinfo, tree);
    577. 

  577. }
    578. 

  578. 

  579. static void
    580. 

  580. dissect_http_kerberos(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
    581. 

  581. 		     const char *line)
    582. 

  582. {
    583. 

  583. 	tvbuff_t *kerberos_tvb;
    584. 

  584. 

  585. 	kerberos_tvb = base64_to_tvb(tvb, line + 9); /* skip 'Kerberos ' which is 9 chars */
    586. 

  586. 	add_new_data_source(pinfo, kerberos_tvb, "Kerberos Data");
    587. 

  587. 	call_dissector(gssapi_handle, kerberos_tvb, pinfo, tree);
    588. 

  588. 

  589. }
    590. 

  590. 

  591. 

  592. static http_conv_t *
    593. 

  593. get_http_conversation_data(packet_info *pinfo)
    594. 

  594. {
    595. 

  595. 	conversation_t  *conversation;
    596. 

  596. 	http_conv_t	*conv_data;
    597. 

  597. 

  598. 	conversation = find_or_create_conversation(pinfo);
    599. 

  599. 

  600. 	/* Retrieve information from conversation
    601. 

  601. 	 * or add it if it isn't there yet
    602. 

  602. 	 */
    603. 

  603. 	conv_data = (http_conv_t *)conversation_get_proto_data(conversation, proto_http);
    604. 

  604. 	if(!conv_data) {
    605. 

  605. 		/* Setup the conversation structure itself */
    606. 

  606. 		conv_data = (http_conv_t *)wmem_alloc0(wmem_file_scope(), sizeof(http_conv_t));
    607. 

  607. 

  608. 		conversation_add_proto_data(conversation, proto_http,
    609. 

  609. 					    conv_data);
    610. 

  610. 	}
    611. 

  611. 

  612. 	return conv_data;
    613. 

  613. }
    614. 

  614. 

  615. /**
    616. 

  616.  * create a new http_req_res_t and add it to the conversation.
    617. 

  617.  * @return the new allocated object which is already added to the linked list
    618. 

  618.  */
    619. 

  619. static http_req_res_t* push_req_res(http_conv_t *conv_data)
    620. 

  620. {
    621. 

  621. 	http_req_res_t *req_res = (http_req_res_t *)wmem_alloc0(wmem_file_scope(), sizeof(http_req_res_t));
    622. 

  622. 	nstime_set_unset(&(req_res->req_ts));
    623. 

  623. 	req_res->number = ++conv_data->req_res_num;
    624. 

  624. 

  625. 	if (! conv_data->req_res_tail) {
    626. 

  626. 		conv_data->req_res_tail = req_res;
    627. 

  627. 	} else {
    628. 

  628. 		req_res->prev = conv_data->req_res_tail;
    629. 

  629. 		conv_data->req_res_tail->next = req_res;
    630. 

  630. 		conv_data->req_res_tail = req_res;
    631. 

  631. 	}
    632. 

  632. 

  633. 	return req_res;
    634. 

  634. }
    635. 

  635. 

  636. /**
    637. 

  637.  * push a request frame number and its time stamp to the conversation data.
    638. 

  638.  */
    639. 

  639. static void push_req(http_conv_t *conv_data, packet_info *pinfo)
    640. 

  640. {
    641. 

  641. 	/* a request will always create a new http_req_res_t object */
    642. 

  642. 	http_req_res_t *req_res = push_req_res(conv_data);
    643. 

  643. 

  644. 	req_res->req_framenum = pinfo->fd->num;
    645. 

  645. 	req_res->req_ts = pinfo->fd->abs_ts;
    646. 

  646. 

  647. 	p_add_proto_data(pinfo->fd, proto_http, 0, req_res);
    648. 

  648. }
    649. 

  649. 

  650. /**
    651. 

  651.  * push a response frame number to the conversation data.
    652. 

  652.  */
    653. 

  653. static void push_res(http_conv_t *conv_data, packet_info *pinfo)
    654. 

  654. {
    655. 

  655. 	/* a response will create a new http_req_res_t object: if no
    656. 

  656. 	   object exists, or if one exists for another response. In
    657. 

  657. 	   both cases the corresponding request was not
    658. 

  658. 	   detected/included in the conversation. In all other cases
    659. 

  659. 	   the http_req_res_t object created by the request is
    660. 

  660. 	   used. */
    661. 

  661. 	http_req_res_t *req_res = conv_data->req_res_tail;
    662. 

  662. 	if (!req_res || req_res->res_framenum > 0) {
    663. 

  663. 		req_res = push_req_res(conv_data);
    664. 

  664. 	}
    665. 

  665. 	req_res->res_framenum = pinfo->fd->num;
    666. 

  666. 	p_add_proto_data(pinfo->fd, proto_http, 0, req_res);
    667. 

  667. }
    668. 

  668. 

  669. /*
    670. 

  670.  * TODO: remove this ugly global variable.
    671. 

  671.  * XXX: do we really want to have to pass this from one function to another?
    672. 

  672.  */
    673. 

  673. static http_info_value_t	*stat_info;
    674. 

  674. 

  675. static int
    676. 

  676. dissect_http_message(tvbuff_t *tvb, int offset, packet_info *pinfo,
    677. 

  677. 		     proto_tree *tree, http_conv_t *conv_data)
    678. 

  678. {
    679. 

  679. 	const char	*proto_tag;
    680. 

  680. 	proto_tree	*http_tree = NULL;
    681. 

  681. 	proto_item	*ti = NULL;
    682. 

  682. 	proto_item	*hidden_item;
    683. 

  683. 	const guchar	*line;
    684. 

  684. 	gint		next_offset;
    685. 

  685. 	const guchar	*linep, *lineend;
    686. 

  686. 	int		orig_offset;
    687. 

  687. 	int		first_linelen, linelen;
    688. 

  688. 	gboolean	is_request_or_reply;
    689. 

  689. 	gboolean	saw_req_resp_or_header;
    690. 

  690. 	guchar		c;
    691. 

  691. 	http_type_t     http_type;
    692. 

  692. 	proto_item	*hdr_item = NULL;
    693. 

  693. 	ReqRespDissector reqresp_dissector;
    694. 

  694. 	proto_tree	*req_tree;
    695. 

  695. 	int		colon_offset;
    696. 

  696. 	headers_t	headers;
    697. 

  697. 	int		datalen;
    698. 

  698. 	int		reported_datalen = -1;
    699. 

  699. 	dissector_handle_t handle;
    700. 

  700. 	gboolean	dissected = FALSE;
    701. 

  701. 	/*guint		i;*/
    702. 

  702. 	/*http_info_value_t *si;*/
    703. 

  703. 	http_eo_t       *eo_info;
    704. 

  704. 

  705. 	/*
    706. 

  706. 	 * Is this a request or response?
    707. 

  707. 	 *
    708. 

  708. 	 * Note that "tvb_find_line_end()" will return a value that
    709. 

  709. 	 * is not longer than what's in the buffer, so the
    710. 

  710. 	 * "tvb_get_ptr()" call won't throw an exception.
    711. 

  711. 	 */
    712. 

  712. 	first_linelen = tvb_find_line_end(tvb, offset,
    713. 

  713. 	    tvb_ensure_length_remaining(tvb, offset), &next_offset,
    714. 

  714. 	    TRUE);
    715. 

  715. 	
    716. 

  716. 	if (first_linelen == -1) {
    717. 

  717. 		/* No complete line was found in this segment, do
    718. 

  718. 		 * desegmentation if we're told to.
    719. 

  719. 		 */
    720. 

  720. 		if (!req_resp_hdrs_do_reassembly(tvb, offset, pinfo,
    721. 

  721. 		    http_desegment_headers, http_desegment_body)) {
    722. 

  722. 			/*
    723. 

  723. 			 * More data needed for desegmentation.
    724. 

  724. 			 */
    725. 

  725. 			return -1;
    726. 

  726. 		}
    727. 

  727. 	}
    728. 

  728. 

  729. 	/*
    730. 

  730. 	 * Is the first line a request or response?
    731. 

  731. 	 */
    732. 

  732. 	line = tvb_get_ptr(tvb, offset, first_linelen);
    733. 

  733. 	http_type = HTTP_OTHERS;	/* type not known yet */
    734. 

  734. 	is_request_or_reply = is_http_request_or_reply((const gchar *)line,
    735. 

  735. 	    first_linelen, &http_type, NULL, conv_data);
    736. 

  736. 	if (is_request_or_reply) {
    737. 

  737. 		/*
    738. 

  738. 		 * Yes, it's a request or response.
    739. 

  739. 		 * Do header desegmentation if we've been told to,
    740. 

  740. 		 * and do body desegmentation if we've been told to and
    741. 

  741. 		 * we find a Content-Length header.
    742. 

  742. 		 */
    743. 

  743. 		if (!req_resp_hdrs_do_reassembly(tvb, offset, pinfo,
    744. 

  744. 		    http_desegment_headers, http_desegment_body)) {
    745. 

  745. 			/*
    746. 

  746. 			 * More data needed for desegmentation.
    747. 

  747. 			 */
    748. 

  748. 			return -1;
    749. 

  749. 		}
    750. 

  750. 	}
    751. 

  751. 

  752. 	stat_info = ep_new(http_info_value_t);
    753. 

  753. 	stat_info->framenum = pinfo->fd->num;
    754. 

  754. 	stat_info->response_code = 0;
    755. 

  755. 	stat_info->request_method = NULL;
    756. 

  756. 	stat_info->request_uri = NULL;
    757. 

  757. 	stat_info->http_host = NULL;
    758. 

  758. 

  759. 	switch (pinfo->match_uint) {
    760. 

  760. 

  761. 	case TCP_PORT_SSDP:	/* TCP_PORT_SSDP = UDP_PORT_SSDP */
    762. 

  762. 		proto_tag = "SSDP";
    763. 

  763. 		break;
    764. 

  764. 

  765. 	default:
    766. 

  766. 		proto_tag = "HTTP";
    767. 

  767. 		break;
    768. 

  768. 	}
    769. 

  769. 

  770. 	col_set_str(pinfo->cinfo, COL_PROTOCOL, proto_tag);
    771. 

  771. 	/*
    772. 

  772. 	 * Put the first line from the buffer into the summary
    773. 

  773. 	 * if it's an HTTP request or reply (but leave out the
    774. 

  774. 	 * line terminator).
    775. 

  775. 	 * Otherwise, just call it a continuation.
    776. 

  776. 	 *
    777. 

  777. 	 * Note that "tvb_find_line_end()" will return a value that
    778. 

  778. 	 * is not longer than what's in the buffer, so the
    779. 

  779. 	 * "tvb_get_ptr()" call won't throw an exception.
    780. 

  780. 	 */
    781. 

  781. 	if (is_request_or_reply) {
    782. 

  782. 	    line = tvb_get_ptr(tvb, offset, first_linelen);
    783. 

  783. 		col_add_fstr(pinfo->cinfo, COL_INFO, "%s ", format_text(line, first_linelen));
    784. 

  784. 	}
    785. 

  785. 	else
    786. 

  786. 		col_set_str(pinfo->cinfo, COL_INFO, "Continuation or non-HTTP traffic");
    787. 

  787. 

  788. 	orig_offset = offset;
    789. 

  789. 	if (tree) {
    790. 

  790. 		ti = proto_tree_add_item(tree, proto_http, tvb, offset, -1,
    791. 

  791. 		    ENC_NA);
    792. 

  792. 		http_tree = proto_item_add_subtree(ti, ett_http);
    793. 

  793. 	}
    794. 

  794. 

  795. 	/*
    796. 

  796. 	 * Process the packet data, a line at a time.
    797. 

  797. 	 */
    798. 

  798. 	http_type = HTTP_OTHERS;	/* type not known yet */
    799. 

  799. 	headers.content_type = NULL;	/* content type not known yet */
    800. 

  800. 	headers.content_type_parameters = NULL;	/* content type parameters too */
    801. 

  801. 	headers.have_content_length = FALSE;	/* content length not known yet */
    802. 

  802. 	headers.content_length = 0;		/* content length set to 0 (avoid a gcc warning) */
    803. 

  803. 	headers.content_encoding = NULL; /* content encoding not known yet */
    804. 

  804. 	headers.transfer_encoding = NULL; /* transfer encoding not known yet */
    805. 

  805. 	headers.upgrade = 0; /* assume we're not upgrading */
    806. 

  806. 	saw_req_resp_or_header = FALSE;	/* haven't seen anything yet */
    807. 

  807. 	while (tvb_reported_length_remaining(tvb, offset) != 0) {
    808. 

  808. 		/*
    809. 

  809. 		 * Find the end of the line.
    810. 

  810. 		 * XXX - what if we don't find it because the packet
    811. 

  811. 		 * is cut short by a snapshot length or the header is
    812. 

  812. 		 * split across TCP segments?  How much dissection should
    813. 

  813. 		 * we do on it?
    814. 

  814. 		 */
    815. 

  815. 		linelen = tvb_find_line_end(tvb, offset,
    816. 

  816. 		    tvb_ensure_length_remaining(tvb, offset), &next_offset,
    817. 

  817. 		    FALSE);
    818. 

  818. 		if (linelen < 0)
    819. 

  819. 			return -1;
    820. 

  820. 

  821. 		/*
    822. 

  822. 		 * Get a buffer that refers to the line.
    823. 

  823. 		 */
    824. 

  824. 		line = tvb_get_ptr(tvb, offset, linelen);
    825. 

  825. 		lineend = line + linelen;
    826. 

  826. 		colon_offset = -1;
    827. 

  827. 

  828. 		/*
    829. 

  829. 		 * OK, does it look like an HTTP request or response?
    830. 

  830. 		 */
    831. 

  831. 		reqresp_dissector = NULL;
    832. 

  832. 		is_request_or_reply =
    833. 

  833. 		    is_http_request_or_reply((const gchar *)line,
    834. 

  834. 		    linelen, &http_type, &reqresp_dissector, conv_data);
    835. 

  835. 		if (is_request_or_reply)
    836. 

  836. 			goto is_http;
    837. 

  837. 

  838. 		/*
    839. 

  839. 		 * No.  Does it look like a blank line (as would appear
    840. 

  840. 		 * at the end of an HTTP request)?
    841. 

  841. 		 */
    842. 

  842. 		if (linelen == 0)
    843. 

  843. 			goto is_http;	/* Yes. */
    844. 

  844. 

  845. 		/*
    846. 

  846. 		 * No.  Does it look like a header?
    847. 

  847. 		 */
    848. 

  848. 		linep = line;
    849. 

  849. 		colon_offset = offset;
    850. 

  850. 		while (linep < lineend) {
    851. 

  851. 			c = *linep++;
    852. 

  852. 

  853. 			/*
    854. 

  854. 			 * This must be a CHAR to be part of a token; that
    855. 

  855. 			 * means it must be ASCII.
    856. 

  856. 			 */
    857. 

  857. 			if (!isascii(c))
    858. 

  858. 				break;	/* not ASCII, thus not a CHAR */
    859. 

  859. 

  860. 			/*
    861. 

  861. 			 * This mustn't be a CTL to be part of a token.
    862. 

  862. 			 *
    863. 

  863. 			 * XXX - what about leading LWS on continuation
    864. 

  864. 			 * lines of a header?
    865. 

  865. 			 */
    866. 

  866. 			if (iscntrl(c))
    867. 

  867. 				break;	/* CTL, not part of a header */
    868. 

  868. 

  869. 			/*
    870. 

  870. 			 * This mustn't be a SEP to be part of a token;
    871. 

  871. 			 * a ':' ends the token, everything else is an
    872. 

  872. 			 * indication that this isn't a header.
    873. 

  873. 			 */
    874. 

  874. 			switch (c) {
    875. 

  875. 

  876. 			case '(':
    877. 

  877. 			case ')':
    878. 

  878. 			case '<':
    879. 

  879. 			case '>':
    880. 

  880. 			case '@':
    881. 

  881. 			case ',':
    882. 

  882. 			case ';':
    883. 

  883. 			case '\\':
    884. 

  884. 			case '"':
    885. 

  885. 			case '/':
    886. 

  886. 			case '[':
    887. 

  887. 			case ']':
    888. 

  888. 			case '?':
    889. 

  889. 			case '=':
    890. 

  890. 			case '{':
    891. 

  891. 			case '}':
    892. 

  892. 			case ' ':
    893. 

  893. 				/*
    894. 

  894. 				 * It's a separator, so it's not part of a
    895. 

  895. 				 * token, so it's not a field name for the
    896. 

  896. 				 * beginning of a header.
    897. 

  897. 				 *
    898. 

  898. 				 * (We don't have to check for HT; that's
    899. 

  899. 				 * already been ruled out by "iscntrl()".)
    900. 

  900. 				 */
    901. 

  901. 				goto not_http;
    902. 

  902. 

  903. 			case ':':
    904. 

  904. 				/*
    905. 

  905. 				 * This ends the token; we consider this
    906. 

  906. 				 * to be a header.
    907. 

  907. 				 */
    908. 

  908. 				goto is_http;
    909. 

  909. 

  910. 			default:
    911. 

  911. 				colon_offset++;
    912. 

  912. 				break;
    913. 

  913. 			}
    914. 

  914. 		}
    915. 

  915. 

  916. 		/*
    917. 

  917. 		 * We haven't seen the colon, but everything else looks
    918. 

  918. 		 * OK for a header line.
    919. 

  919. 		 *
    920. 

  920. 		 * If we've already seen an HTTP request or response
    921. 

  921. 		 * line, or a header line, and we're at the end of
    922. 

  922. 		 * the tvbuff, we assume this is an incomplete header
    923. 

  923. 		 * line.  (We quit this loop after seeing a blank line,
    924. 

  924. 		 * so if we've seen a request or response line, or a
    925. 

  925. 		 * header line, this is probably more of the request
    926. 

  926. 		 * or response we're presumably seeing.  There is some
    927. 

  927. 		 * risk of false positives, but the same applies for
    928. 

  928. 		 * full request or response lines or header lines,
    929. 

  929. 		 * although that's less likely.)
    930. 

  930. 		 *
    931. 

  931. 		 * We throw an exception in that case, by checking for
    932. 

  932. 		 * the existence of the next byte after the last one
    933. 

  933. 		 * in the line.  If it exists, "tvb_ensure_bytes_exist()"
    934. 

  934. 		 * throws no exception, and we fall through to the
    935. 

  935. 		 * "not HTTP" case.  If it doesn't exist,
    936. 

  936. 		 * "tvb_ensure_bytes_exist()" will throw the appropriate
    937. 

  937. 		 * exception.
    938. 

  938. 		 */
    939. 

  939. 		if (saw_req_resp_or_header)
    940. 

  940. 			tvb_ensure_bytes_exist(tvb, offset, linelen + 1);
    941. 

  941. 

  942. 	not_http:
    943. 

  943. 		/*
    944. 

  944. 		 * We don't consider this part of an HTTP request or
    945. 

  945. 		 * reply, so we don't display it.
    946. 

  946. 		 * (Yeah, that means we don't display, say, a text/http
    947. 

  947. 		 * page, but you can get that from the data pane.)
    948. 

  948. 		 */
    949. 

  949. 		break;
    950. 

  950. 

  951. 	is_http:
    952. 

  952. 		/*
    953. 

  953. 		 * Process this line.
    954. 

  954. 		 */
    955. 

  955. 		if (linelen == 0) {
    956. 

  956. 			/*
    957. 

  957. 			 * This is a blank line, which means that
    958. 

  958. 			 * whatever follows it isn't part of this
    959. 

  959. 			 * request or reply.
    960. 

  960. 			 */
    961. 

  961. 			proto_tree_add_text(http_tree, tvb, offset,
    962. 

  962. 			    next_offset - offset, "%s",
    963. 

  963. 			    tvb_format_text(tvb, offset, next_offset - offset));
    964. 

  964. 			offset = next_offset;
    965. 

  965. 			break;
    966. 

  966. 		}
    967. 

  967. 

  968. 		/*
    969. 

  969. 		 * Not a blank line - either a request, a reply, or a header
    970. 

  970. 		 * line.
    971. 

  971. 		 */
    972. 

  972. 		saw_req_resp_or_header = TRUE;
    973. 

  973. 		if (is_request_or_reply) {
    974. 

  974. 		    	char *text = tvb_format_text(tvb, offset, next_offset - offset);
    975. 

  975. 			if (tree) {
    976. 

  976. 				hdr_item = proto_tree_add_text(http_tree, tvb,
    977. 

  977. 				    offset, next_offset - offset, "%s", text);
    978. 

  978. 			}
    979. 

  979. 			expert_add_info_format_text(pinfo, hdr_item, &ei_http_chat, "%s", text);
    980. 

  980. 			if (reqresp_dissector) {
    981. 

  981. 				if (tree) req_tree = proto_item_add_subtree(hdr_item, ett_http_request);
    982. 

  982. 				else req_tree = NULL;
    983. 

  983. 

  984. 				reqresp_dissector(tvb, req_tree, offset, line,
    985. 

  985. 						  lineend, conv_data);
    986. 

  986. 			}
    987. 

  987. 

  988. 		} else {
    989. 

  989. 			/*
    990. 

  990. 			 * Header.
    991. 

  991. 			 */
    992. 

  992. 			process_header(tvb, offset, next_offset, line, linelen,
    993. 

  993. 			    colon_offset, pinfo, http_tree, &headers, conv_data);
    994. 

  994. 		}
    995. 

  995. 		offset = next_offset;
    996. 

  996. 	}
    997. 

  997. 

  998. 	if (tree && stat_info->http_host && stat_info->request_uri) {
    999. 

  999. 		proto_item *e_ti;
    1000. 

  1000. 		gchar *uri = ep_strdup_printf("%s://%s%s",
    1001. 

  1001. 			   "http",	/* XXX, https? */
    1002. 

  1002. 			    g_strstrip(ep_strdup(stat_info->http_host)), stat_info->request_uri);
    1003. 

  1003. 

  1004. 		e_ti = proto_tree_add_string(http_tree,
    1005. 

  1005. 					     hf_http_request_full_uri, tvb, 0,
    1006. 

  1006. 					     0, uri);
    1007. 

  1007. 

  1008. 		PROTO_ITEM_SET_URL(e_ti);
    1009. 

  1009. 		PROTO_ITEM_SET_GENERATED(e_ti);
    1010. 

  1010. 	}
    1011. 

  1011. 

  1012. 	if (!PINFO_FD_VISITED(pinfo)) {
    1013. 

  1013. 		if (http_type == HTTP_REQUEST) {
    1014. 

  1014. 			push_req(conv_data, pinfo);
    1015. 

  1015. 		} else if (http_type == HTTP_RESPONSE) {
    1016. 

  1016. 			push_res(conv_data, pinfo);
    1017. 

  1017. 		}
    1018. 

  1018. 	}
    1019. 

  1019. 

  1020. 	if (tree) {
    1021. 

  1021. 		proto_item *pi;
    1022. 

  1022. 		http_req_res_t *curr = (http_req_res_t *)p_get_proto_data(pinfo->fd, proto_http, 0);
    1023. 

  1023. 		http_req_res_t *prev = curr ? curr->prev : NULL;
    1024. 

  1024. 		http_req_res_t *next = curr ? curr->next : NULL;
    1025. 

  1025. 

  1026. 		switch (http_type) {
    1027. 

  1027. 

  1028. 		case HTTP_NOTIFICATION:
    1029. 

  1029. 			hidden_item = proto_tree_add_boolean(http_tree,
    1030. 

  1030. 					    hf_http_notification, tvb, 0, 0, 1);
    1031. 

  1031. 			PROTO_ITEM_SET_HIDDEN(hidden_item);
    1032. 

  1032. 			break;
    1033. 

  1033. 

  1034. 		case HTTP_RESPONSE:
    1035. 

  1035. 			hidden_item = proto_tree_add_boolean(http_tree,
    1036. 

  1036. 					    hf_http_response, tvb, 0, 0, 1);
    1037. 

  1037. 			PROTO_ITEM_SET_HIDDEN(hidden_item);
    1038. 

  1038. 

  1039. 			if (curr) {
    1040. 

  1040. 				nstime_t delta;
    1041. 

  1041. 

  1042. 				pi = proto_tree_add_text(http_tree, tvb, 0, 0, "HTTP response %u/%u", curr->number, conv_data->req_res_num);
    1043. 

  1043. 				PROTO_ITEM_SET_GENERATED(pi);
    1044. 

  1044. 

  1045. 				if (! nstime_is_unset(&(curr->req_ts))) {
    1046. 

  1046. 					nstime_delta(&delta, &pinfo->fd->abs_ts, &(curr->req_ts));
    1047. 

  1047. 					pi = proto_tree_add_time(http_tree, hf_http_time, tvb, 0, 0, &delta);
    1048. 

  1048. 					PROTO_ITEM_SET_GENERATED(pi);
    1049. 

  1049. 				}
    1050. 

  1050. 			}
    1051. 

  1051. 			if (prev && prev->req_framenum) {
    1052. 

  1052. 				pi = proto_tree_add_uint(http_tree, hf_http_prev_request_in, tvb, 0, 0, prev->req_framenum);
    1053. 

  1053. 				PROTO_ITEM_SET_GENERATED(pi);
    1054. 

  1054. 			}
    1055. 

  1055. 			if (prev && prev->res_framenum) {
    1056. 

  1056. 				pi = proto_tree_add_uint(http_tree, hf_http_prev_response_in, tvb, 0, 0, prev->res_framenum);
    1057. 

  1057. 				PROTO_ITEM_SET_GENERATED(pi);
    1058. 

  1058. 			}
    1059. 

  1059. 			if (curr && curr->req_framenum) {
    1060. 

  1060. 				pi = proto_tree_add_uint(http_tree, hf_http_request_in, tvb, 0, 0, curr->req_framenum);
    1061. 

  1061. 				PROTO_ITEM_SET_GENERATED(pi);
    1062. 

  1062. 			}
    1063. 

  1063. 			if (next && next->req_framenum) {
    1064. 

  1064. 				pi = proto_tree_add_uint(http_tree, hf_http_next_request_in, tvb, 0, 0, next->req_framenum);
    1065. 

  1065. 				PROTO_ITEM_SET_GENERATED(pi);
    1066. 

  1066. 			}
    1067. 

  1067. 			if (next && next->res_framenum) {
    1068. 

  1068. 				pi = proto_tree_add_uint(http_tree, hf_http_next_response_in, tvb, 0, 0, next->res_framenum);
    1069. 

  1069. 				PROTO_ITEM_SET_GENERATED(pi);
    1070. 

  1070. 			}
    1071. 

  1071. 

  1072. 			break;
    1073. 

  1073. 

  1074. 		case HTTP_REQUEST:
    1075. 

  1075. 			hidden_item = proto_tree_add_boolean(http_tree,
    1076. 

  1076. 					    hf_http_request, tvb, 0, 0, 1);
    1077. 

  1077. 			PROTO_ITEM_SET_HIDDEN(hidden_item);
    1078. 

  1078. 

  1079. 			if (curr) {
    1080. 

  1080. 				pi = proto_tree_add_text(http_tree, tvb, 0, 0, "HTTP request %u/%u", curr->number, conv_data->req_res_num);
    1081. 

  1081. 				PROTO_ITEM_SET_GENERATED(pi);
    1082. 

  1082. 			}
    1083. 

  1083. 			if (prev && prev->req_framenum) {
    1084. 

  1084. 				pi = proto_tree_add_uint(http_tree, hf_http_prev_request_in, tvb, 0, 0, prev->req_framenum);
    1085. 

  1085. 				PROTO_ITEM_SET_GENERATED(pi);
    1086. 

  1086. 			}
    1087. 

  1087. 			if (curr && curr->res_framenum) {
    1088. 

  1088. 				pi = proto_tree_add_uint(http_tree, hf_http_response_in, tvb, 0, 0, curr->res_framenum);
    1089. 

  1089. 				PROTO_ITEM_SET_GENERATED(pi);
    1090. 

  1090. 			}
    1091. 

  1091. 			if (next && next->req_framenum) {
    1092. 

  1092. 				pi = proto_tree_add_uint(http_tree, hf_http_next_request_in, tvb, 0, 0, next->req_framenum);
    1093. 

  1093. 				PROTO_ITEM_SET_GENERATED(pi);
    1094. 

  1094. 			}
    1095. 

  1095. 

  1096. 			break;
    1097. 

  1097. 

  1098. 		case HTTP_OTHERS:
    1099. 

  1099. 		default:
    1100. 

  1100. 			break;
    1101. 

  1101. 		}
    1102. 

  1102. 	}
    1103. 

  1103. 	
    1104. 

  1104. 	reported_datalen = tvb_reported_length_remaining(tvb, offset);
    1105. 

  1105. 	datalen = tvb_length_remaining(tvb, offset);
    1106. 

  1106. 

  1107. 	/*
    1108. 

  1108. 	 * If a content length was supplied, the amount of data to be
    1109. 

  1109. 	 * processed as HTTP payload is the minimum of the content
    1110. 

  1110. 	 * length and the amount of data remaining in the frame.
    1111. 

  1111. 	 *
    1112. 

  1112. 	 * If a message is received with both a Transfer-Encoding
    1113. 

  1113. 	 * header field and a Content-Length header field, the latter
    1114. 

  1114. 	 * MUST be ignored.
    1115. 

  1115. 	 *
    1116. 

  1116. 	 * If no content length was supplied (or if a bad content length
    1117. 

  1117. 	 * was supplied), the amount of data to be processed is the amount
    1118. 

  1118. 	 * of data remaining in the frame.
    1119. 

  1119. 	 *
    1120. 

  1120. 	 * If there was no Content-Length entity header, we should
    1121. 

  1121. 	 * accumulate all data until the end of the connection.
    1122. 

  1122. 	 * That'd require that the TCP dissector call subdissectors
    1123. 

  1123. 	 * for all frames with FIN, even if they contain no data,
    1124. 

  1124. 	 * which would require subdissectors to deal intelligently
    1125. 

  1125. 	 * with empty segments.
    1126. 

  1126. 	 *
    1127. 

  1127. 	 * According to RFC 2616, however, 1xx responses, 204 responses,
    1128. 

  1128. 	 * and 304 responses MUST NOT include a message body; if no
    1129. 

  1129. 	 * content length is specified for them, we don't attempt to
    1130. 

  1130. 	 * dissect the body.
    1131. 

  1131. 	 *
    1132. 

  1132. 	 * XXX - it says the same about responses to HEAD requests;
    1133. 

  1133. 	 * unless there's a way to determine from the response
    1134. 

  1134. 	 * whether it's a response to a HEAD request, we have to
    1135. 

  1135. 	 * keep information about the request and associate that with
    1136. 

  1136. 	 * the response in order to handle that.
    1137. 

  1137. 	 */
    1138. 

  1138. 	if (headers.have_content_length &&
    1139. 

  1139. 	    headers.content_length != -1 &&
    1140. 

  1140. 	    headers.transfer_encoding == NULL) {
    1141. 

  1141. 		if (datalen > headers.content_length)
    1142. 

  1142. 			datalen = (int)headers.content_length;
    1143. 

  1143. 

  1144. 		/*
    1145. 

  1145. 		 * XXX - limit the reported length in the tvbuff we'll
    1146. 

  1146. 		 * hand to a subdissector to be no greater than the
    1147. 

  1147. 		 * content length.
    1148. 

  1148. 		 *
    1149. 

  1149. 		 * We really need both unreassembled and "how long it'd
    1150. 

  1150. 		 * be if it were reassembled" lengths for tvbuffs, so
    1151. 

  1151. 		 * that we throw the appropriate exceptions for
    1152. 

  1152. 		 * "not enough data captured" (running past the length),
    1153. 

  1153. 		 * "packet needed reassembly" (within the length but
    1154. 

  1154. 		 * running past the unreassembled length), and
    1155. 

  1155. 		 * "packet is malformed" (running past the reassembled
    1156. 

  1156. 		 * length).
    1157. 

  1157. 		 */
    1158. 

  1158. 		if (reported_datalen > headers.content_length)
    1159. 

  1159. 			reported_datalen = (int)headers.content_length;
    1160. 

  1160. 	} else {
    1161. 

  1161. 		switch (http_type) {
    1162. 

  1162. 

  1163. 		case HTTP_REQUEST:
    1164. 

  1164. 			/*
    1165. 

  1165. 			 * Requests have no content if there's no
    1166. 

  1166. 			 * Content-Length header and no Transfer-Encoding
    1167. 

  1167. 			 * header.
    1168. 

  1168. 			 */
    1169. 

  1169. 			if (headers.transfer_encoding == NULL)
    1170. 

  1170. 				datalen = 0;
    1171. 

  1171. 			else
    1172. 

  1172. 				reported_datalen = -1;
    1173. 

  1173. 			break;
    1174. 

  1174. 

  1175. 		case HTTP_RESPONSE:
    1176. 

  1176. 			if ((stat_info->response_code/100) == 1 ||
    1177. 

  1177. 			    stat_info->response_code == 204 ||
    1178. 

  1178. 			    stat_info->response_code == 304)
    1179. 

  1179. 				datalen = 0;	/* no content! */
    1180. 

  1180. 			else {
    1181. 

  1181. 				/*
    1182. 

  1182. 				 * XXX - responses to HEAD requests,
    1183. 

  1183. 				 * and possibly other responses,
    1184. 

  1184. 				 * "MUST NOT" include a
    1185. 

  1185. 				 * message-body.
    1186. 

  1186. 				 */
    1187. 

  1187. 				reported_datalen = -1;
    1188. 

  1188. 			}
    1189. 

  1189. 			break;
    1190. 

  1190. 

  1191. 		default:
    1192. 

  1192. 			/*
    1193. 

  1193. 			 * XXX - what about HTTP_NOTIFICATION?
    1194. 

  1194. 			 */
    1195. 

  1195. 			reported_datalen = -1;
    1196. 

  1196. 			break;
    1197. 

  1197. 		}
    1198. 

  1198. 	}
    1199. 

  1199. 

  1200. 	if (datalen > 0) {
    1201. 

  1201. 		/*
    1202. 

  1202. 		 * There's stuff left over; process it.
    1203. 

  1203. 		 */
    1204. 

  1204. 		tvbuff_t *next_tvb;
    1205. 

  1205. 		void *save_private_data = NULL;
    1206. 

  1206. 		gboolean private_data_changed = FALSE;
    1207. 

  1207. 		gint chunks_decoded = 0;
    1208. 

  1208. 

  1209. 		/*
    1210. 

  1210. 		 * Create a tvbuff for the payload.
    1211. 

  1211. 		 *
    1212. 

  1212. 		 * The amount of data to be processed that's
    1213. 

  1213. 		 * available in the tvbuff is "datalen", which
    1214. 

  1214. 		 * is the minimum of the amount of data left in
    1215. 

  1215. 		 * the tvbuff and any specified content length.
    1216. 

  1216. 		 *
    1217. 

  1217. 		 * The amount of data to be processed that's in
    1218. 

  1218. 		 * this frame, regardless of whether it was
    1219. 

  1219. 		 * captured or not, is "reported_datalen",
    1220. 

  1220. 		 * which, if no content length was specified,
    1221. 

  1221. 		 * is -1, i.e. "to the end of the frame.
    1222. 

  1222. 		 */
    1223. 

  1223. 		next_tvb = tvb_new_subset(tvb, offset, datalen,
    1224. 

  1224. 		    reported_datalen);
    1225. 

  1225. 

  1226. 		/*
    1227. 

  1227. 		 * Handle *transfer* encodings other than "identity".
    1228. 

  1228. 		 */
    1229. 

  1229. 		if (headers.transfer_encoding != NULL &&
    1230. 

  1230. 		    g_ascii_strcasecmp(headers.transfer_encoding, "identity") != 0) {
    1231. 

  1231. 			if (http_dechunk_body &&
    1232. 

  1232. 			    (g_ascii_strncasecmp(headers.transfer_encoding, "chunked", 7)
    1233. 

  1233. 			    == 0)) {
    1234. 

  1234. 

  1235. 				chunks_decoded = chunked_encoding_dissector(
    1236. 

  1236. 				    &next_tvb, pinfo, http_tree, 0);
    1237. 

  1237. 

  1238. 				if (chunks_decoded <= 0) {
    1239. 

  1239. 					/*
    1240. 

  1240. 					 * The chunks weren't reassembled,
    1241. 

  1241. 					 * or there was a single zero
    1242. 

  1242. 					 * length chunk.
    1243. 

  1243. 					 */
    1244. 

  1244. 					goto body_dissected;
    1245. 

  1245. 				} else {
    1246. 

  1246. 					/*
    1247. 

  1247. 					 * Add a new data source for the
    1248. 

  1248. 					 * de-chunked data.
    1249. 

  1249. 					 */
    1250. 

  1250. #if 0 /* Handled in chunked_encoding_dissector() */
    1251. 

  1251. 					tvb_set_child_real_data_tvbuff(tvb,
    1252. 

  1252. 						next_tvb);
    1253. 

  1253. #endif
    1254. 

  1254. 					add_new_data_source(pinfo, next_tvb,
    1255. 

  1255. 						"De-chunked entity body");
    1256. 

  1256. 				}
    1257. 

  1257. 			} else {
    1258. 

  1258. 				/*
    1259. 

  1259. 				 * We currently can't handle, for example,
    1260. 

  1260. 				 * "gzip", "compress", or "deflate" as
    1261. 

  1261. 				 * *transfer* encodings; just handle them
    1262. 

  1262. 				 * as data for now.
    1263. 

  1263. 				 */
    1264. 

  1264. 				call_dissector(data_handle, next_tvb, pinfo,
    1265. 

  1265. 				    http_tree);
    1266. 

  1266. 				goto body_dissected;
    1267. 

  1267. 			}
    1268. 

  1268. 		}
    1269. 

  1269. 		/*
    1270. 

  1270. 		 * At this point, any chunked *transfer* coding has been removed
    1271. 

  1271. 		 * (the entity body has been dechunked) so it can be presented
    1272. 

  1272. 		 * for the following operation (*content* encoding), or it has
    1273. 

  1273. 		 * been been handed off to the data dissector.
    1274. 

  1274. 		 *
    1275. 

  1275. 		 * Handle *content* encodings other than "identity" (which
    1276. 

  1276. 		 * shouldn't appear in a Content-Encoding header, but
    1277. 

  1277. 		 * we handle it in any case).
    1278. 

  1278. 		 */
    1279. 

  1279. 		if (headers.content_encoding != NULL &&
    1280. 

  1280. 		    g_ascii_strcasecmp(headers.content_encoding, "identity") != 0) {
    1281. 

  1281. 			/*
    1282. 

  1282. 			 * We currently can't handle, for example, "compress";
    1283. 

  1283. 			 * just handle them as data for now.
    1284. 

  1284. 			 *
    1285. 

  1285. 			 * After July 7, 2004 the LZW patent expires, so support
    1286. 

  1286. 			 * might be added then.  However, I don't think that
    1287. 

  1287. 			 * anybody ever really implemented "compress", due to
    1288. 

  1288. 			 * the aforementioned patent.
    1289. 

  1289. 			 */
    1290. 

  1290. 			tvbuff_t *uncomp_tvb = NULL;
    1291. 

  1291. 			proto_item *e_ti = NULL;
    1292. 

  1292. 			proto_tree *e_tree = NULL;
    1293. 

  1293. 

  1294. 			if (http_decompress_body &&
    1295. 

  1295. 			    (g_ascii_strcasecmp(headers.content_encoding, "gzip") == 0 ||
    1296. 

  1296. 			     g_ascii_strcasecmp(headers.content_encoding, "deflate") == 0 ||
    1297. 

  1297. 			     g_ascii_strcasecmp(headers.content_encoding, "x-gzip") == 0 ||
    1298. 

  1298. 			     g_ascii_strcasecmp(headers.content_encoding, "x-deflate") == 0))
    1299. 

  1299. 			{
    1300. 

  1300. 				uncomp_tvb = tvb_child_uncompress(tvb, next_tvb, 0,
    1301. 

  1301. 				    tvb_length(next_tvb));
    1302. 

  1302. 			}
    1303. 

  1303. 

  1304. 			/*
    1305. 

  1305. 			 * Add the encoded entity to the protocol tree
    1306. 

  1306. 			 */
    1307. 

  1307. 			e_ti = proto_tree_add_text(http_tree, next_tvb,
    1308. 

  1308. 					0, tvb_length(next_tvb),
    1309. 

  1309. 					"Content-encoded entity body (%s): %u bytes",
    1310. 

  1310. 					headers.content_encoding,
    1311. 

  1311. 					tvb_length(next_tvb));
    1312. 

  1312. 			e_tree = proto_item_add_subtree(e_ti,
    1313. 

  1313. 					ett_http_encoded_entity);
    1314. 

  1314. 

  1315. 			if (uncomp_tvb != NULL) {
    1316. 

  1316. 				/*
    1317. 

  1317. 				 * Decompression worked
    1318. 

  1318. 				 */
    1319. 

  1319. 

  1320. 				/* XXX - Don't free this, since it's possible
    1321. 

  1321. 				 * that the data was only partially
    1322. 

  1322. 				 * decompressed, such as when desegmentation
    1323. 

  1323. 				 * isn't enabled.
    1324. 

  1324. 				 *
    1325. 

  1325.  				tvb_free(next_tvb);
    1326. 

  1326. 				*/
    1327. 

  1327. 				proto_item_append_text(e_ti, " -> %u bytes", tvb_length(uncomp_tvb));
    1328. 

  1328. 				next_tvb = uncomp_tvb;
    1329. 

  1329. 				add_new_data_source(pinfo, next_tvb,
    1330. 

  1330. 				    "Uncompressed entity body");
    1331. 

  1331. 			} else {
    1332. 

  1332. 				proto_item_append_text(e_ti, " [Error: Decompression failed]");
    1333. 

  1333. 				call_dissector(data_handle, next_tvb, pinfo,
    1334. 

  1334. 				    e_tree);
    1335. 

  1335. 

  1336. 				goto body_dissected;
    1337. 

  1337. 			}
    1338. 

  1338. 		}
    1339. 

  1339. 		/*
    1340. 

  1340. 		 * Note that a new data source is added for the entity body
    1341. 

  1341. 		 * only if it was content-encoded and/or transfer-encoded.
    1342. 

  1342. 		 */
    1343. 

  1343. 

  1344. 		/* Save values for the Export Object GUI feature if we have
    1345. 

  1345. 		 * an active listener to process it (which happens when
    1346. 

  1346. 		 * the export object window is open). */
    1347. 

  1347. 		if(have_tap_listener(http_eo_tap)) {
    1348. 

  1348. 			eo_info = ep_new(http_eo_t);
    1349. 

  1349. 

  1350. 			eo_info->hostname = conv_data->http_host;
    1351. 

  1351. 			eo_info->filename = conv_data->request_uri;
    1352. 

  1352. 			eo_info->content_type = headers.content_type;
    1353. 

  1353. 			eo_info->payload_len = tvb_length(next_tvb);
    1354. 

  1354. 			eo_info->payload_data = tvb_get_ptr(next_tvb, 0, eo_info->payload_len);
    1355. 

  1355. 

  1356. 			tap_queue_packet(http_eo_tap, pinfo, eo_info);
    1357. 

  1357. 		}
    1358. 

  1358. 

  1359. 		/*
    1360. 

  1360. 		 * Do subdissector checks.
    1361. 

  1361. 		 *
    1362. 

  1362. 		 * First, if we have a Content-Type value, check whether
    1363. 

  1363. 		 * there's a subdissector for that media type.
    1364. 

  1364. 		 */
    1365. 

  1365. 		handle = NULL;
    1366. 

  1366. 		if (headers.content_type != NULL) {
    1367. 

  1367. 			/*
    1368. 

  1368. 			 * We didn't find any subdissector that
    1369. 

  1369. 			 * registered for the port, and we have a
    1370. 

  1370. 			 * Content-Type value.  Is there any subdissector
    1371. 

  1371. 			 * for that content type?
    1372. 

  1372. 			 */
    1373. 

  1373. 			save_private_data = pinfo->private_data;
    1374. 

  1374. 			private_data_changed = TRUE;
    1375. 

  1375. 

  1376. 			if (headers.content_type_parameters)
    1377. 

  1377. 				pinfo->private_data = ep_strdup(headers.content_type_parameters);
    1378. 

  1378. 			else
    1379. 

  1379. 				pinfo->private_data = NULL;
    1380. 

  1380. 			/*
    1381. 

  1381. 			 * Calling the string handle for the media type
    1382. 

  1382. 			 * dissector table will set pinfo->match_string
    1383. 

  1383. 			 * to headers.content_type for us.
    1384. 

  1384. 			 */
    1385. 

  1385. 			pinfo->match_string = headers.content_type;
    1386. 

  1386. 			handle = dissector_get_string_handle(
    1387. 

  1387. 			    media_type_subdissector_table,
    1388. 

  1388. 			    headers.content_type);
    1389. 

  1389. 			if (handle == NULL &&
    1390. 

  1390. 			    strncmp(headers.content_type, "multipart/", sizeof("multipart/")-1) == 0) {
    1391. 

  1391. 				/* Try to decode the unknown multipart subtype anyway */
    1392. 

  1392. 				handle = dissector_get_string_handle(
    1393. 

  1393. 				    media_type_subdissector_table,
    1394. 

  1394. 				    "multipart/");
    1395. 

  1395. 			}
    1396. 

  1396. 		}
    1397. 

  1397. 

  1398. 		/*
    1399. 

  1399. 		 * Now, if we didn't find such a subdissector, check
    1400. 

  1400. 		 * whether some subdissector asked that they be called
    1401. 

  1401. 		 * if HTTP traffic was on some particular port.  This
    1402. 

  1402. 		 * handles protocols that use HTTP syntax but don't have
    1403. 

  1403. 		 * a media type and instead use a specified port.
    1404. 

  1404. 		 */
    1405. 

  1405. 		if (handle == NULL) {
    1406. 

  1406. 			handle = dissector_get_uint_handle(port_subdissector_table,
    1407. 

  1407. 			    pinfo->match_uint);
    1408. 

  1408. 		}
    1409. 

  1409. 

  1410. 		if (handle != NULL) {
    1411. 

  1411. 			/*
    1412. 

  1412. 			 * We have a subdissector - call it.
    1413. 

  1413. 			 */
    1414. 

  1414. 			dissected = call_dissector_only(handle, next_tvb, pinfo, tree, NULL);
    1415. 

  1415. 			if (!dissected)
    1416. 

  1416. 				expert_add_info(pinfo, http_tree, &ei_http_subdissector_failed);
    1417. 

  1417. 		}
    1418. 

  1418. 

  1419. 		if (!dissected) {
    1420. 

  1420. 			/*
    1421. 

  1421. 			 * We don't have a subdissector or we have one and it did not
    1422. 

  1422. 			 * dissect the payload - try the heuristic subdissectors.
    1423. 

  1423. 			 */
    1424. 

  1424. 			dissected = dissector_try_heuristic(heur_subdissector_list,
    1425. 

  1425. 							    next_tvb, pinfo, tree, NULL);
    1426. 

  1426. 		}
    1427. 

  1427. 

  1428. 		if (dissected) {
    1429. 

  1429. 			/*
    1430. 

  1430. 			 * The subdissector dissected the body.
    1431. 

  1431. 			 * Fix up the top-level item so that it doesn't
    1432. 

  1432. 			 * include the stuff for that protocol.
    1433. 

  1433. 			 */
    1434. 

  1434. 			if (ti != NULL)
    1435. 

  1435. 				proto_item_set_len(ti, offset);
    1436. 

  1436. 		} else {
    1437. 

  1437. 			if (headers.content_type != NULL) {
    1438. 

  1438. 				/*
    1439. 

  1439. 				 * Calling the default media handle if there is a content-type that
    1440. 

  1440. 				 * wasn't handled above.
    1441. 

  1441. 				 */
    1442. 

  1442. 				call_dissector(media_handle, next_tvb, pinfo, tree);
    1443. 

  1443. 			} else {
    1444. 

  1444. 				/* Call the default data dissector */
    1445. 

  1445. 				call_dissector(data_handle, next_tvb, pinfo, http_tree);
    1446. 

  1446. 			}
    1447. 

  1447. 		}
    1448. 

  1448. 

  1449. 	body_dissected:
    1450. 

  1450. 		/*
    1451. 

  1451. 		 * Do *not* attempt at freeing the private data;
    1452. 

  1452. 		 * it may be in use by subdissectors.
    1453. 

  1453. 		 */
    1454. 

  1454. 		if (private_data_changed) /*restore even NULL value*/
    1455. 

  1455. 			pinfo->private_data = save_private_data;
    1456. 

  1456. 		/*
    1457. 

  1457. 		 * We've processed "datalen" bytes worth of data
    1458. 

  1458. 		 * (which may be no data at all); advance the
    1459. 

  1459. 		 * offset past whatever data we've processed.
    1460. 

  1460. 		 */
    1461. 

  1461. 		offset += datalen;
    1462. 

  1462. 	}
    1463. 

  1463. 

  1464. 	if (http_type == HTTP_RESPONSE && pinfo->desegment_offset<=0 && pinfo->desegment_len<=0) {
    1465. 

  1465. 		conv_data->upgrade = headers.upgrade;
    1466. 

  1466. 		conv_data->startframe = pinfo->fd->num + 1;
    1467. 

  1467. 	}
    1468. 

  1468. 

  1469. 	tap_queue_packet(http_tap, pinfo, stat_info);
    1470. 

  1470. 

  1471. 	return offset - orig_offset;
    1472. 

  1472. }
    1473. 

  1473. 

  1474. /* This can be used to dissect an HTTP request until such time
    1475. 

  1475.  * that a more complete dissector is written for that HTTP request.
    1476. 

  1476.  * This simple dissector only puts the request method, URI, and
    1477. 

  1477.  * protocol version into a sub-tree.
    1478. 

  1478.  */
    1479. 

  1479. static void
    1480. 

  1480. basic_request_dissector(tvbuff_t *tvb, proto_tree *tree, int offset,
    1481. 

  1481. 			const guchar *line, const guchar *lineend,
    1482. 

  1482. 			http_conv_t *conv_data)
    1483. 

  1483. {
    1484. 

  1484. 	const guchar *next_token;
    1485. 

  1485. 	const gchar *request_uri;
    1486. 

  1486. 	int tokenlen;
    1487. 

  1487. 

  1488. 	/* The first token is the method. */
    1489. 

  1489. 	tokenlen = get_token_len(line, lineend, &next_token);
    1490. 

  1490. 	if (tokenlen == 0)
    1491. 

  1491. 		return;
    1492. 

  1492. 	proto_tree_add_item(tree, hf_http_request_method, tvb, offset, tokenlen,
    1493. 

  1493. 			    ENC_ASCII|ENC_NA);
    1494. 

  1494. 	if ((next_token - line) > 2 && next_token[-1] == ' ' && next_token[-2] == ' ') {
    1495. 

  1495. 	  /* Two spaces in a now indicates empty URI, so roll back one here */
    1496. 

  1496. 	  next_token--;
    1497. 

  1497. 	}
    1498. 

  1498. 	offset += (int) (next_token - line);
    1499. 

  1499. 	line = next_token;
    1500. 

  1500. 

  1501. 	/* The next token is the URI. */
    1502. 

  1502. 	tokenlen = get_token_len(line, lineend, &next_token);
    1503. 

  1503. 

  1504. 	/* Save the request URI for various later uses */
    1505. 

  1505. 	request_uri = tvb_get_ephemeral_string(tvb, offset, tokenlen);
    1506. 

  1506. 	stat_info->request_uri = ep_strdup(request_uri);
    1507. 

  1507.  	conv_data->request_uri = se_strdup(request_uri);
    1508. 

  1508. 

  1509. 	proto_tree_add_string(tree, hf_http_request_uri, tvb, offset, tokenlen,
    1510. 

  1510. 			      request_uri);
    1511. 

  1511. 	offset += (int) (next_token - line);
    1512. 

  1512. 	line = next_token;
    1513. 

  1513. 

  1514. 	/* Everything to the end of the line is the version. */
    1515. 

  1515. 	tokenlen = (int) (lineend - line);
    1516. 

  1516. 	proto_tree_add_item(tree, hf_http_version, tvb, offset, tokenlen,
    1517. 

  1517. 	    ENC_ASCII|ENC_NA);
    1518. 

  1518. }
    1519. 

  1519. 

  1520. static void
    1521. 

  1521. basic_response_dissector(tvbuff_t *tvb, proto_tree *tree, int offset,
    1522. 

  1522. 			 const guchar *line, const guchar *lineend,
    1523. 

  1523. 			 http_conv_t *conv_data _U_)
    1524. 

  1524. {
    1525. 

  1525. 	const guchar *next_token;
    1526. 

  1526. 	int tokenlen;
    1527. 

  1527. 	gchar response_code_chars[4];
    1528. 

  1528. 

  1529. 	/*
    1530. 

  1530. 	 * The first token is the HTTP Version.
    1531. 

  1531. 	 */
    1532. 

  1532. 	tokenlen = get_token_len(line, lineend, &next_token);
    1533. 

  1533. 	if (tokenlen == 0)
    1534. 

  1534. 		return;
    1535. 

  1535. 	proto_tree_add_item(tree, hf_http_version, tvb, offset, tokenlen,
    1536. 

  1536. 			    ENC_ASCII|ENC_NA);
    1537. 

  1537. 	/* Advance to the start of the next token. */
    1538. 

  1538. 	offset += (int) (next_token - line);
    1539. 

  1539. 	line = next_token;
    1540. 

  1540. 

  1541. 	/*
    1542. 

  1542. 	 * The second token is the Status Code.
    1543. 

  1543. 	 */
    1544. 

  1544. 	tokenlen = get_token_len(line, lineend, &next_token);
    1545. 

  1545. 	if (tokenlen < 3)
    1546. 

  1546. 		return;
    1547. 

  1547. 

  1548. 	/* The Status Code characters must be copied into a null-terminated
    1549. 

  1549. 	 * buffer for strtoul() to parse them into an unsigned integer value.
    1550. 

  1550. 	 */
    1551. 

  1551. 	memcpy(response_code_chars, line, 3);
    1552. 

  1552. 	response_code_chars[3] = '\0';
    1553. 

  1553. 

  1554. 	stat_info->response_code = conv_data->response_code =
    1555. 

  1555. 		(guint)strtoul(response_code_chars, NULL, 10);
    1556. 

  1556. 

  1557. 	proto_tree_add_uint(tree, hf_http_response_code, tvb, offset, 3,
    1558. 

  1558. 			    stat_info->response_code);
    1559. 

  1559. 

  1560. 	/* Advance to the start of the next token. */
    1561. 

  1561. 	offset += (int) (next_token - line);
    1562. 

  1562. 	line = next_token;
    1563. 

  1563. 

  1564. 	/*
    1565. 

  1565. 	 * The remaining tokens in the line comprise the Reason Phrase.
    1566. 

  1566. 	 */
    1567. 

  1567. 	tokenlen = (int) (lineend - line);
    1568. 

  1568. 	if (tokenlen < 1)
    1569. 

  1569. 		return;
    1570. 

  1570. 	proto_tree_add_item(tree, hf_http_response_phrase, tvb, offset,
    1571. 

  1571. 				tokenlen, ENC_ASCII|ENC_NA);
    1572. 

  1572. 

  1573. }
    1574. 

  1574. 

  1575. #if 0 /* XXX: Replaced by code creating the "Dechunked" tvb  O(N) rather tan O(N^2) */
    1576. 

  1576. /*
    1577. 

  1577.  * Dissect the http data chunks and add them to the tree.
    1578. 

  1578.  */
    1579. 

  1579. static int
    1580. 

  1580. chunked_encoding_dissector(tvbuff_t **tvb_ptr, packet_info *pinfo,
    1581. 

  1581. 			   proto_tree *tree, int offset)
    1582. 

  1582. {
    1583. 

  1583. 	guint8 *chunk_string = NULL;
    1584. 

  1584. 	guint32 chunk_size = 0;
    1585. 

  1585. 	gint chunk_offset = 0;
    1586. 

  1586. 	guint32 datalen = 0;
    1587. 

  1587. 	gint linelen = 0;
    1588. 

  1588. 	gint chunks_decoded = 0;
    1589. 

  1589. 	tvbuff_t *tvb = NULL;
    1590. 

  1590. 	tvbuff_t *new_tvb = NULL;
    1591. 

  1591. 	gint chunked_data_size = 0;
    1592. 

  1592. 	proto_tree *subtree = NULL;
    1593. 

  1593. 	proto_item *ti = NULL;
    1594. 

  1594. 

  1595. 	if (tvb_ptr == NULL || *tvb_ptr == NULL) {
    1596. 

  1596. 		return 0;
    1597. 

  1597. 	}
    1598. 

  1598. 

  1599. 	tvb = *tvb_ptr;
    1600. 

  1600. 

  1601. 	datalen = tvb_reported_length_remaining(tvb, offset);
    1602. 

  1602. 

  1603. 	if (tree) {
    1604. 

  1604. 		ti = proto_tree_add_text(tree, tvb, offset, datalen,
    1605. 

  1605. 					 "HTTP chunked response");
    1606. 

  1606. 		subtree = proto_item_add_subtree(ti, ett_http_chunked_response);
    1607. 

  1607. 	}
    1608. 

  1608. 

  1609. 

  1610. 	while (datalen != 0) {
    1611. 

  1611. 		proto_item *chunk_ti = NULL;
    1612. 

  1612. 		proto_tree *chunk_subtree = NULL;
    1613. 

  1613. 		tvbuff_t *data_tvb = NULL; /*  */
    1614. 

  1614. 		gchar *c = NULL;
    1615. 

  1615. 		guint8 *raw_data;
    1616. 

  1616. 		gint raw_len = 0;
    1617. 

  1617. 

  1618. 		linelen = tvb_find_line_end(tvb, offset, -1, &chunk_offset, TRUE);
    1619. 

  1619. 

  1620. 		if (linelen <= 0) {
    1621. 

  1621. 			/* Can't get the chunk size line */
    1622. 

  1622. 			break;
    1623. 

  1623. 		}
    1624. 

  1624. 

  1625. 		chunk_string = tvb_get_ephemeral_string(tvb, offset, linelen);
    1626. 

  1626. 

  1627. 		if (chunk_string == NULL) {
    1628. 

  1628. 			/* Can't get the chunk size line */
    1629. 

  1629. 			break;
    1630. 

  1630. 		}
    1631. 

  1631. 

  1632. 		c = (gchar*) chunk_string;
    1633. 

  1633. 

  1634. 		/*
    1635. 

  1635. 		 * We don't care about the extensions.
    1636. 

  1636. 		 */
    1637. 

  1637. 		if ((c = strchr(c, ';'))) {
    1638. 

  1638. 			*c = '\0';
    1639. 

  1639. 		}
    1640. 

  1640. 

  1641. 		chunk_size = strtol((gchar*)chunk_string, NULL, 16);
    1642. 

  1642. 

  1643. 		if (chunk_size > datalen) {
    1644. 

  1644. 			/*
    1645. 

  1645. 			 * The chunk size is more than what's in the tvbuff,
    1646. 

  1646. 			 * so either the user hasn't enabled decoding, or all
    1647. 

  1647. 			 * of the segments weren't captured.
    1648. 

  1648. 			 */
    1649. 

  1649. 			chunk_size = datalen;
    1650. 

  1650. 		}
    1651. 

  1651. #if 0
    1652. 

  1652. 		  else if (new_tvb == NULL) {
    1653. 

  1653. 			new_tvb = tvb_new_composite();
    1654. 

  1654. 		}
    1655. 

  1655. 

  1656. 

  1657. 

  1658. 		if (new_tvb != NULL && chunk_size != 0) {
    1659. 

  1659. 			tvbuff_t *chunk_tvb = NULL;
    1660. 

  1660. 

  1661. 			chunk_tvb = tvb_new_subset(tvb, chunk_offset,
    1662. 

  1662. 			    chunk_size, datalen);
    1663. 

  1663. 

  1664. 			tvb_composite_append(new_tvb, chunk_tvb);
    1665. 

  1665. 

  1666. 		}
    1667. 

  1667. #endif
    1668. 

  1668. 

  1669. 		chunked_data_size += chunk_size;
    1670. 

  1670. 

  1671. 		raw_data = g_malloc(chunked_data_size);
    1672. 

  1672. 		raw_len = 0;
    1673. 

  1673. 

  1674. 		if (new_tvb != NULL) {
    1675. 

  1675. 			raw_len = tvb_length_remaining(new_tvb, 0);
    1676. 

  1676. 			tvb_memcpy(new_tvb, raw_data, 0, raw_len);
    1677. 

  1677. 

  1678. 			tvb_free(new_tvb);
    1679. 

  1679. 		}
    1680. 

  1680. 

  1681. 		tvb_memcpy(tvb, (guint8 *)(raw_data + raw_len),
    1682. 

  1682. 			    chunk_offset, chunk_size);
    1683. 

  1683. 

  1684. 		/* Don't create a new tvb if we have a single chunk with
    1685. 

  1685. 		 * a size of zero (meaning it is the end of the chunks). */
    1686. 

  1686. 		if(chunked_data_size > 0) {
    1687. 

  1687. 			new_tvb = tvb_new_real_data(raw_data,
    1688. 

  1688. 			      chunked_data_size, chunked_data_size);
    1689. 

  1689. 			tvb_set_free_cb(new_tvb, g_free);
    1690. 

  1690. 		}
    1691. 

  1691. 

  1692. 

  1693. 		if (subtree) {
    1694. 

  1694. 			if(chunk_size == 0) {
    1695. 

  1695. 				chunk_ti = proto_tree_add_text(subtree, tvb,
    1696. 

  1696. 					    offset,
    1697. 

  1697. 					    chunk_offset - offset + chunk_size + 2,
    1698. 

  1698. 					    "End of chunked encoding");
    1699. 

  1699. 			} else {
    1700. 

  1700. 				chunk_ti = proto_tree_add_text(subtree, tvb,
    1701. 

  1701. 					    offset,
    1702. 

  1702. 					    chunk_offset - offset + chunk_size + 2,
    1703. 

  1703. 					    "Data chunk (%u octets)", chunk_size);
    1704. 

  1704. 			}
    1705. 

  1705. 

  1706. 			chunk_subtree = proto_item_add_subtree(chunk_ti,
    1707. 

  1707. 			    ett_http_chunk_data);
    1708. 

  1708. 

  1709. 			proto_tree_add_text(chunk_subtree, tvb, offset,
    1710. 

  1710. 			    chunk_offset - offset, "Chunk size: %u octets",
    1711. 

  1711. 			    chunk_size);
    1712. 

  1712. 

  1713. 			data_tvb = tvb_new_subset(tvb, chunk_offset, chunk_size, chunk_size);
    1714. 

  1714. 

  1715. 

  1716. 			/*
    1717. 

  1717. 			 * XXX - just use "proto_tree_add_text()"?
    1718. 

  1718. 			 * This means that, in TShark, you get
    1719. 

  1719. 			 * the entire chunk dumped out in hex,
    1720. 

  1720. 			 * in addition to whatever dissection is
    1721. 

  1721. 			 * done on the reassembled data.
    1722. 

  1722. 			 */
    1723. 

  1723. 			call_dissector(data_handle, data_tvb, pinfo,
    1724. 

  1724. 				    chunk_subtree);
    1725. 

  1725. 

  1726. 			proto_tree_add_text(chunk_subtree, tvb, chunk_offset +
    1727. 

  1727. 			    chunk_size, 2, "Chunk boundary");
    1728. 

  1728. 		}
    1729. 

  1729. 

  1730. 		chunks_decoded++;
    1731. 

  1731. 		offset = chunk_offset + chunk_size + 2;
    1732. 

  1732. 		datalen = tvb_reported_length_remaining(tvb, offset);
    1733. 

  1733. 	}
    1734. 

  1734. 

  1735. 	if (new_tvb != NULL) {
    1736. 

  1736. 

  1737. 		/* Placeholder for the day that composite tvbuffer's will work.
    1738. 

  1738. 		tvb_composite_finalize(new_tvb);
    1739. 

  1739. 		/ * tvb_set_reported_length(new_tvb, chunked_data_size); * /
    1740. 

  1740. 		*/
    1741. 

  1741. 

  1742. 		/*
    1743. 

  1743. 		 * XXX - Don't free this, since the tvbuffer that was passed
    1744. 

  1744. 		 * may be used if the data spans multiple frames and reassembly
    1745. 

  1745. 		 * isn't enabled.
    1746. 

  1746. 		 *
    1747. 

  1747. 		tvb_free(*tvb_ptr);
    1748. 

  1748. 		 */
    1749. 

  1749. 		*tvb_ptr = new_tvb;
    1750. 

  1750. 

  1751. 	} else {
    1752. 

  1752. 		/*
    1753. 

  1753. 		 * We didn't create a new tvb, so don't allow sub dissectors
    1754. 

  1754. 		 * try to decode the non-existent entity body.
    1755. 

  1755. 		 */
    1756. 

  1756. 		chunks_decoded = -1;
    1757. 

  1757. 	}
    1758. 

  1758. 

  1759. 	return chunks_decoded;
    1760. 

  1760. 

  1761. }
    1762. 

  1762. #else
    1763. 

  1763. /*
    1764. 

  1764.  * Dissect the http data chunks and add them to the tree.
    1765. 

  1765.  */
    1766. 

  1766. static int
    1767. 

  1767. chunked_encoding_dissector(tvbuff_t **tvb_ptr, packet_info *pinfo,
    1768. 

  1768. 			   proto_tree *tree, int offset)
    1769. 

  1769. {
    1770. 

  1770. 	tvbuff_t	*tvb;
    1771. 

  1771. 	guint32		 datalen;
    1772. 

  1772. 	guint32		 orig_datalen;
    1773. 

  1773. 	gint		 chunks_decoded;
    1774. 

  1774. 	gint		 chunked_data_size;
    1775. 

  1775. 	proto_tree	*subtree;
    1776. 

  1776. 	guint8		*raw_data;
    1777. 

  1777. 	gint		 raw_len;
    1778. 

  1778. 

  1779. 	if ((tvb_ptr == NULL) || (*tvb_ptr == NULL)) {
    1780. 

  1780. 		return 0;
    1781. 

  1781. 	}
    1782. 

  1782. 

  1783. 	tvb = *tvb_ptr;
    1784. 

  1784. 

  1785. 	datalen = tvb_reported_length_remaining(tvb, offset);
    1786. 

  1786. 

  1787. 	subtree = NULL;
    1788. 

  1788. 	if (tree) {
    1789. 

  1789. 		proto_item *ti;
    1790. 

  1790. 		ti = proto_tree_add_text(tree, tvb, offset, datalen,
    1791. 

  1791. 					 "HTTP chunked response");
    1792. 

  1792. 		subtree = proto_item_add_subtree(ti, ett_http_chunked_response);
    1793. 

  1793. 	}
    1794. 

  1794. 

  1795.         /* Dechunk the "chunked response" to a new memory buffer */
    1796. 

  1796. 	orig_datalen      = datalen;
    1797. 

  1797. 	raw_data	      = (guint8 *)wmem_alloc(pinfo->pool, datalen);
    1798. 

  1798. 	raw_len		      = 0;
    1799. 

  1799. 	chunks_decoded	  = 0;
    1800. 

  1800. 	chunked_data_size = 0;
    1801. 

  1801. 

  1802. 	while (datalen != 0) {
    1803. 

  1803. 		tvbuff_t *data_tvb;
    1804. 

  1804. 		guint32	  chunk_size;
    1805. 

  1805. 		gint	  chunk_offset;
    1806. 

  1806. 		guint8	 *chunk_string;
    1807. 

  1807. 		gint	  linelen;
    1808. 

  1808. 		gchar	 *c;
    1809. 

  1809. 

  1810. 		linelen = tvb_find_line_end(tvb, offset, -1, &chunk_offset, TRUE);
    1811. 

  1811. 

  1812. 		if (linelen <= 0) {
    1813. 

  1813. 			/* Can't get the chunk size line */
    1814. 

  1814. 			break;
    1815. 

  1815. 		}
    1816. 

  1816. 

  1817. 		chunk_string = tvb_get_ephemeral_string(tvb, offset, linelen);
    1818. 

  1818. 

  1819. 		if (chunk_string == NULL) {
    1820. 

  1820. 			/* Can't get the chunk size line */
    1821. 

  1821. 			break;
    1822. 

  1822. 		}
    1823. 

  1823. 

  1824. 		c = (gchar*)chunk_string;
    1825. 

  1825. 

  1826. 		/*
    1827. 

  1827. 		 * We don't care about the extensions.
    1828. 

  1828. 		 */
    1829. 

  1829. 		if ((c = strchr(c, ';'))) {
    1830. 

  1830. 			*c = '\0';
    1831. 

  1831. 		}
    1832. 

  1832. 

  1833. 		chunk_size = (guint32)strtol((gchar*)chunk_string, NULL, 16);
    1834. 

  1834. 

  1835. 		if (chunk_size > datalen) {
    1836. 

  1836. 			/*
    1837. 

  1837. 			 * The chunk size is more than what's in the tvbuff,
    1838. 

  1838. 			 * so either the user hasn't enabled decoding, or all
    1839. 

  1839. 			 * of the segments weren't captured.
    1840. 

  1840. 			 */
    1841. 

  1841. 			chunk_size = datalen;
    1842. 

  1842. 		}
    1843. 

  1843. 

  1844. 		chunked_data_size += chunk_size;
    1845. 

  1845. 

  1846. 		DISSECTOR_ASSERT((raw_len+chunk_size) <= orig_datalen);
    1847. 

  1847. 		tvb_memcpy(tvb, (guint8 *)(raw_data + raw_len), chunk_offset, chunk_size);
    1848. 

  1848. 		raw_len += chunk_size;
    1849. 

  1849. 

  1850. 		if (subtree) {
    1851. 

  1851. 			proto_item *chunk_ti;
    1852. 

  1852. 			proto_tree *chunk_subtree;
    1853. 

  1853. 

  1854. 			if(chunk_size == 0) {
    1855. 

  1855. 				chunk_ti = proto_tree_add_text(subtree, tvb,
    1856. 

  1856. 					    offset,
    1857. 

  1857. 					    chunk_offset - offset + chunk_size + 2,
    1858. 

  1858. 					    "End of chunked encoding");
    1859. 

  1859. 			} else {
    1860. 

  1860. 				chunk_ti = proto_tree_add_text(subtree, tvb,
    1861. 

  1861. 					    offset,
    1862. 

  1862. 					    chunk_offset - offset + chunk_size + 2,
    1863. 

  1863. 					    "Data chunk (%u octets)", chunk_size);
    1864. 

  1864. 			}
    1865. 

  1865. 

  1866. 			chunk_subtree = proto_item_add_subtree(chunk_ti,
    1867. 

  1867. 			    ett_http_chunk_data);
    1868. 

  1868. 

  1869. 			proto_tree_add_text(chunk_subtree, tvb, offset,
    1870. 

  1870. 			    chunk_offset - offset, "Chunk size: %u octets",
    1871. 

  1871. 			    chunk_size);
    1872. 

  1872. 

  1873. 			data_tvb = tvb_new_subset(tvb, chunk_offset, chunk_size, datalen);
    1874. 

  1874. 

  1875. 			/*
    1876. 

  1876. 			 * XXX - just use "proto_tree_add_text()"?
    1877. 

  1877. 			 * This means that, in TShark, you get
    1878. 

  1878. 			 * the entire chunk dumped out in hex,
    1879. 

  1879. 			 * in addition to whatever dissection is
    1880. 

  1880. 			 * done on the reassembled data.
    1881. 

  1881. 			 */
    1882. 

  1882. 			call_dissector(data_handle, data_tvb, pinfo,
    1883. 

  1883. 				    chunk_subtree);
    1884. 

  1884. 

  1885. 			proto_tree_add_text(chunk_subtree, tvb, chunk_offset +
    1886. 

  1886. 			    chunk_size, 2, "Chunk boundary");
    1887. 

  1887. 		}
    1888. 

  1888. 

  1889. 		chunks_decoded++;
    1890. 

  1890. 		offset  = chunk_offset + 2 + chunk_size;  /* beginning of next chunk */
    1891. 

  1891. 		datalen = tvb_reported_length_remaining(tvb, offset);
    1892. 

  1892. 	}
    1893. 

  1893. 

  1894. 	if (chunked_data_size > 0) {
    1895. 

  1895. 		tvbuff_t *new_tvb;
    1896. 

  1896. 		new_tvb = tvb_new_child_real_data(tvb, raw_data, chunked_data_size, chunked_data_size);
    1897. 

  1897. 		*tvb_ptr = new_tvb;
    1898. 

  1898. 	} else {
    1899. 

  1899. 		/*
    1900. 

  1900. 		 * There was no actual chunk data, so don't allow sub dissectors
    1901. 

  1901. 		 * try to decode the non-existent entity body.
    1902. 

  1902. 		 */
    1903. 

  1903. 		chunks_decoded = -1;
    1904. 

  1904. 	}
    1905. 

  1905. 

  1906. 	return chunks_decoded;
    1907. 

  1907. }
    1908. 

  1908. #endif
    1909. 

  1909. 

  1910. /* Call a subdissector to handle HTTP CONNECT's traffic */
    1911. 

  1911. static void
    1912. 

  1912. http_payload_subdissector(tvbuff_t *tvb, proto_tree *tree,
    1913. 

  1913. 			  packet_info *pinfo, http_conv_t *conv_data)
    1914. 

  1914. {
    1915. 

  1915. 	guint32 *ptr = NULL;
    1916. 

  1916.  	guint32 uri_port, saved_port, srcport, destport;
    1917. 

  1917. 	gchar **strings; /* An array for splitting the request URI into hostname and port */
    1918. 

  1918. 	proto_item *item;
    1919. 

  1919. 	proto_tree *proxy_tree;
    1920. 

  1920. 	conversation_t *conv;
    1921. 

  1921. 

  1922. 	/* Grab the destination port number from the request URI to find the right subdissector */
    1923. 

  1923. 	strings = g_strsplit(conv_data->request_uri, ":", 2);
    1924. 

  1924. 

  1925. 	if(strings[0] != NULL && strings[1] != NULL) {
    1926. 

  1926. 		/*
    1927. 

  1927. 		 * The string was successfully split in two
    1928. 

  1928. 		 * Create a proxy-connect subtree
    1929. 

  1929. 		 */
    1930. 

  1930. 		if(tree) {
    1931. 

  1931. 			item = proto_tree_add_item(tree, proto_http, tvb, 0, -1, ENC_NA);
    1932. 

  1932. 			proxy_tree = proto_item_add_subtree(item, ett_http);
    1933. 

  1933. 

  1934. 			item = proto_tree_add_string(proxy_tree, hf_http_proxy_connect_host,
    1935. 

  1935. 						     tvb, 0, 0, strings[0]);
    1936. 

  1936. 			PROTO_ITEM_SET_GENERATED(item);
    1937. 

  1937. 

  1938. 			item = proto_tree_add_uint(proxy_tree, hf_http_proxy_connect_port,
    1939. 

  1939. 						   tvb, 0, 0, (guint32)strtol(strings[1], NULL, 10) );
    1940. 

  1940. 			PROTO_ITEM_SET_GENERATED(item);
    1941. 

  1941. 		}
    1942. 

  1942. 

  1943. 		uri_port = (int)strtol(strings[1], NULL, 10); /* Convert string to a base-10 integer */
    1944. 

  1944. 

  1945. 		if (value_is_in_range(http_tcp_range, pinfo->destport)) {
    1946. 

  1946. 			srcport = pinfo->srcport;
    1947. 

  1947. 			destport = uri_port;
    1948. 

  1948. 		} else {
    1949. 

  1949. 			srcport = uri_port;
    1950. 

  1950. 			destport = pinfo->destport;
    1951. 

  1951. 		}
    1952. 

  1952. 

  1953. 		conv = find_conversation(PINFO_FD_NUM(pinfo), &pinfo->src, &pinfo->dst, PT_TCP, srcport, destport, 0);
    1954. 

  1954. 

  1955. 		/* We may get stuck in a recursion loop if we let process_tcp_payload() call us.
    1956. 

  1956. 		 * So, if the port in the URI is one we're registered for or we have set up a
    1957. 

  1957. 		 * conversation (e.g., one we detected heuristically or via Decode-As) call the data
    1958. 

  1958. 		 * dissector directly.
    1959. 

  1959. 		 */
    1960. 

  1960. 		if (value_is_in_range(http_tcp_range, uri_port) || (conv && conv->dissector_handle == http_handle)) {
    1961. 

  1961. 			call_dissector(data_handle, tvb, pinfo, tree);
    1962. 

  1962. 		} else {
    1963. 

  1963. 			/* set pinfo->{src/dst port} and call the TCP sub-dissector lookup */
    1964. 

  1964. 			if (value_is_in_range(http_tcp_range, pinfo->destport))
    1965. 

  1965. 				ptr = &pinfo->destport;
    1966. 

  1966. 			else
    1967. 

  1967. 				ptr = &pinfo->srcport;
    1968. 

  1968. 

  1969. 			/* Increase pinfo->can_desegment because we are traversing
    1970. 

  1970. 			 * http and want to preserve desegmentation functionality for
    1971. 

  1971.        			 * the proxied protocol
    1972. 

  1972. 			 */
    1973. 

  1973. 			if( pinfo->can_desegment>0 )
    1974. 

  1974. 				pinfo->can_desegment++;
    1975. 

  1975. 

  1976. 			saved_port = *ptr;
    1977. 

  1977. 			*ptr = uri_port;
    1978. 

  1978. 			decode_tcp_ports(tvb, 0, pinfo, tree,
    1979. 

  1979. 				pinfo->srcport, pinfo->destport, NULL);
    1980. 

  1980. 			*ptr = saved_port;
    1981. 

  1981. 		}
    1982. 

  1982. 	}
    1983. 

  1983. 	g_strfreev(strings); /* Free the result of g_strsplit() above */
    1984. 

  1984. }
    1985. 

  1985. 

  1986. 

  1987. 

  1988. /*
    1989. 

  1989.  * XXX - this won't handle HTTP 0.9 replies, but they're all data
    1990. 

  1990.  * anyway.
    1991. 

  1991.  */
    1992. 

  1992. static int
    1993. 

  1993. is_http_request_or_reply(const gchar *data, int linelen, http_type_t *type,
    1994. 

  1994. 			 ReqRespDissector *reqresp_dissector,
    1995. 

  1995. 			 http_conv_t *conv_data)
    1996. 

  1996. {
    1997. 

  1997. 	int isHttpRequestOrReply = FALSE;
    1998. 

  1998. 

  1999. 	/*
    2000. 

  2000. 	 * From RFC 2774 - An HTTP Extension Framework
    2001. 

  2001. 	 *
    2002. 

  2002. 	 * Support the command prefix that identifies the presence of
    2003. 

  2003. 	 * a "mandatory" header.
    2004. 

  2004. 	 */
    2005. 

  2005. 	if (linelen >= 2 && strncmp(data, "M-", 2) == 0) {
    2006. 

  2006. 		data += 2;
    2007. 

  2007. 		linelen -= 2;
    2008. 

  2008. 	}
    2009. 

  2009. 

  2010. 	/*
    2011. 

  2011. 	 * From draft-cohen-gena-client-01.txt, available from the uPnP forum:
    2012. 

  2012. 	 *	NOTIFY, SUBSCRIBE, UNSUBSCRIBE
    2013. 

  2013. 	 *
    2014. 

  2014. 	 * From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
    2015. 

  2015. 	 *	SEARCH
    2016. 

  2016. 	 */
    2017. 

  2017. 	if (linelen >= 5 && strncmp(data, "HTTP/", 5) == 0) {
    2018. 

  2018. 		*type = HTTP_RESPONSE;
    2019. 

  2019. 		isHttpRequestOrReply = TRUE;	/* response */
    2020. 

  2020. 		if (reqresp_dissector)
    2021. 

  2021. 			*reqresp_dissector = basic_response_dissector;
    2022. 

  2022. 	} else {
    2023. 

  2023. 		const guchar * ptr = (const guchar *)data;
    2024. 

  2024. 		int		 indx = 0;
    2025. 

  2025. 

  2026. 		/* Look for the space following the Method */
    2027. 

  2027. 		while (indx < linelen) {
    2028. 

  2028. 			if (*ptr == ' ')
    2029. 

  2029. 				break;
    2030. 

  2030. 			else {
    2031. 

  2031. 				ptr++;
    2032. 

  2032. 				indx++;
    2033. 

  2033. 			}
    2034. 

  2034. 		}
    2035. 

  2035. 

  2036. 		/* Check the methods that have same length */
    2037. 

  2037. 		switch (indx) {
    2038. 

  2038. 

  2039. 		case 3:
    2040. 

  2040. 			if (strncmp(data, "GET", indx) == 0 ||
    2041. 

  2041. 			    strncmp(data, "PUT", indx) == 0) {
    2042. 

  2042. 				*type = HTTP_REQUEST;
    2043. 

  2043. 				isHttpRequestOrReply = TRUE;
    2044. 

  2044. 			}
    2045. 

  2045. 			else if (strncmp(data, "ICY", indx) == 0) {
    2046. 

  2046. 				*type = HTTP_RESPONSE;
    2047. 

  2047. 				isHttpRequestOrReply = TRUE;
    2048. 

  2048. 			}
    2049. 

  2049. 			break;
    2050. 

  2050. 

  2051. 		case 4:
    2052. 

  2052. 			if (strncmp(data, "COPY", indx) == 0 ||
    2053. 

  2053. 			    strncmp(data, "HEAD", indx) == 0 ||
    2054. 

  2054. 			    strncmp(data, "LOCK", indx) == 0 ||
    2055. 

  2055. 			    strncmp(data, "MOVE", indx) == 0 ||
    2056. 

  2056. 			    strncmp(data, "POLL", indx) == 0 ||
    2057. 

  2057. 			    strncmp(data, "POST", indx) == 0) {
    2058. 

  2058. 				*type = HTTP_REQUEST;
    2059. 

  2059. 				isHttpRequestOrReply = TRUE;
    2060. 

  2060. 			}
    2061. 

  2061. 			break;
    2062. 

  2062. 

  2063. 		case 5:
    2064. 

  2064. 			if (strncmp(data, "BCOPY", indx) == 0 ||
    2065. 

  2065. 				strncmp(data, "BMOVE", indx) == 0 ||
    2066. 

  2066. 				strncmp(data, "MKCOL", indx) == 0 ||
    2067. 

  2067. 				strncmp(data, "TRACE", indx) == 0 ||
    2068. 

  2068. 				strncmp(data, "LABEL", indx) == 0 ||  /* RFC 3253 8.2 */
    2069. 

  2069. 				strncmp(data, "MERGE", indx) == 0) {  /* RFC 3253 11.2 */
    2070. 

  2070. 				*type = HTTP_REQUEST;
    2071. 

  2071. 				isHttpRequestOrReply = TRUE;
    2072. 

  2072. 			}
    2073. 

  2073. 			break;
    2074. 

  2074. 

  2075. 		case 6:
    2076. 

  2076. 			if (strncmp(data, "DELETE", indx) == 0 ||
    2077. 

  2077. 				strncmp(data, "SEARCH", indx) == 0 ||
    2078. 

  2078. 				strncmp(data, "UNLOCK", indx) == 0 ||
    2079. 

  2079. 				strncmp(data, "REPORT", indx) == 0 ||  /* RFC 3253 3.6 */
    2080. 

  2080. 				strncmp(data, "UPDATE", indx) == 0) {  /* RFC 3253 7.1 */
    2081. 

  2081. 				*type = HTTP_REQUEST;
    2082. 

  2082. 				isHttpRequestOrReply = TRUE;
    2083. 

  2083. 			}
    2084. 

  2084. 			else if (strncmp(data, "NOTIFY", indx) == 0) {
    2085. 

  2085. 				*type = HTTP_NOTIFICATION;
    2086. 

  2086. 				isHttpRequestOrReply = TRUE;
    2087. 

  2087. 			}
    2088. 

  2088. 			break;
    2089. 

  2089. 

  2090. 		case 7:
    2091. 

  2091. 			if (strncmp(data, "BDELETE", indx) == 0 ||
    2092. 

  2092. 			    strncmp(data, "CONNECT", indx) == 0 ||
    2093. 

  2093. 			    strncmp(data, "OPTIONS", indx) == 0 ||
    2094. 

  2094. 			    strncmp(data, "CHECKIN", indx) == 0) {  /* RFC 3253 4.4, 9.4 */
    2095. 

  2095. 				*type = HTTP_REQUEST;
    2096. 

  2096. 				isHttpRequestOrReply = TRUE;
    2097. 

  2097. 			}
    2098. 

  2098. 			break;
    2099. 

  2099. 

  2100. 		case 8:
    2101. 

  2101. 			if (strncmp(data, "PROPFIND", indx) == 0 ||
    2102. 

  2102. 			    strncmp(data, "CHECKOUT", indx) == 0 || /* RFC 3253 4.3, 9.3 */
    2103. 

  2103. 			    strncmp(data, "CCM_POST", indx) == 0) {
    2104. 

  2104. 				*type = HTTP_REQUEST;
    2105. 

  2105. 				isHttpRequestOrReply = TRUE;
    2106. 

  2106. 			}
    2107. 

  2107. 			break;
    2108. 

  2108. 

  2109. 		case 9:
    2110. 

  2110. 			if (strncmp(data, "SUBSCRIBE", indx) == 0) {
    2111. 

  2111. 				*type = HTTP_NOTIFICATION;
    2112. 

  2112. 				isHttpRequestOrReply = TRUE;
    2113. 

  2113. 			} else if (strncmp(data, "PROPPATCH", indx) == 0 ||
    2114. 

  2114. 			    strncmp(data, "BPROPFIND", indx) == 0) {
    2115. 

  2115. 				*type = HTTP_REQUEST;
    2116. 

  2116. 				isHttpRequestOrReply = TRUE;
    2117. 

  2117. 			}
    2118. 

  2118. 			break;
    2119. 

  2119. 

  2120. 		case 10:
    2121. 

  2121. 			if (strncmp(data, "BPROPPATCH", indx) == 0 ||
    2122. 

  2122. 				strncmp(data, "UNCHECKOUT", indx) == 0 ||  /* RFC 3253 4.5 */
    2123. 

  2123. 				strncmp(data, "MKACTIVITY", indx) == 0) {  /* RFC 3253 13.5 */
    2124. 

  2124. 				*type = HTTP_REQUEST;
    2125. 

  2125. 				isHttpRequestOrReply = TRUE;
    2126. 

  2126. 			}
    2127. 

  2127. 			break;
    2128. 

  2128. 

  2129. 		case 11:
    2130. 

  2130. 			if (strncmp(data, "MKWORKSPACE", indx) == 0 || /* RFC 3253 6.3 */
    2131. 

  2131. 			    strncmp(data, "RPC_CONNECT", indx) == 0 || /* [MS-RPCH] 2.1.1.1.1 */
    2132. 

  2132. 			    strncmp(data, "RPC_IN_DATA", indx) == 0) { /* [MS-RPCH] 2.1.2.1.1 */
    2133. 

  2133. 				*type = HTTP_REQUEST;
    2134. 

  2134. 				isHttpRequestOrReply = TRUE;
    2135. 

  2135. 			} else if (strncmp(data, "UNSUBSCRIBE", indx) == 0) {
    2136. 

  2136. 				*type = HTTP_NOTIFICATION;
    2137. 

  2137. 				isHttpRequestOrReply = TRUE;
    2138. 

  2138. 			}
    2139. 

  2139. 			break;
    2140. 

  2140. 

  2141. 		case 12:
    2142. 

  2142. 			if (strncmp(data, "RPC_OUT_DATA", indx) == 0) { /* [MS-RPCH] 2.1.2.1.2 */
    2143. 

  2143. 				*type = HTTP_REQUEST;
    2144. 

  2144. 				isHttpRequestOrReply = TRUE;
    2145. 

  2145. 			}
    2146. 

  2146. 			break;
    2147. 

  2147. 

  2148. 		case 15:
    2149. 

  2149. 			if (strncmp(data, "VERSION-CONTROL", indx) == 0) {  /* RFC 3253 3.5 */
    2150. 

  2150. 				*type = HTTP_REQUEST;
    2151. 

  2151. 				isHttpRequestOrReply = TRUE;
    2152. 

  2152. 			}
    2153. 

  2153. 			break;
    2154. 

  2154. 

  2155. 		case 16:
    2156. 

  2156. 			if (strncmp(data, "BASELINE-CONTROL", indx) == 0) {  /* RFC 3253 12.6 */
    2157. 

  2157. 				*type = HTTP_REQUEST;
    2158. 

  2158. 				isHttpRequestOrReply = TRUE;
    2159. 

  2159. 			}
    2160. 

  2160. 			break;
    2161. 

  2161. 

  2162. 		default:
    2163. 

  2163. 			break;
    2164. 

  2164. 		}
    2165. 

  2165. 

  2166. 		if (isHttpRequestOrReply && reqresp_dissector) {
    2167. 

  2167. 			*reqresp_dissector = basic_request_dissector;
    2168. 

  2168. 

  2169. 			stat_info->request_method = ep_strndup(data, indx+1);
    2170. 

  2170. 			conv_data->request_method = se_strndup(data, indx+1);
    2171. 

  2171. 		}
    2172. 

  2172. 

  2173. 

  2174. 

  2175. 	}
    2176. 

  2176. 

  2177. 	return isHttpRequestOrReply;
    2178. 

  2178. }
    2179. 

  2179. 

  2180. /*
    2181. 

  2181.  * Process headers.
    2182. 

  2182.  */
    2183. 

  2183. typedef struct {
    2184. 

  2184. 	const char	*name;
    2185. 

  2185. 	gint		*hf;
    2186. 

  2186. 	int		special;
    2187. 

  2187. } header_info;
    2188. 

  2188. 

  2189. #define HDR_NO_SPECIAL		0
    2190. 

  2190. #define HDR_AUTHORIZATION	1
    2191. 

  2191. #define HDR_AUTHENTICATE	2
    2192. 

  2192. #define HDR_CONTENT_TYPE	3
    2193. 

  2193. #define HDR_CONTENT_LENGTH	4
    2194. 

  2194. #define HDR_CONTENT_ENCODING	5
    2195. 

  2195. #define HDR_TRANSFER_ENCODING	6
    2196. 

  2196. #define HDR_HOST		7
    2197. 

  2197. #define HDR_UPGRADE		8
    2198. 

  2198. 

  2199. static const header_info headers[] = {
    2200. 

  2200. 	{ "Authorization", &hf_http_authorization, HDR_AUTHORIZATION },
    2201. 

  2201. 	{ "Proxy-Authorization", &hf_http_proxy_authorization, HDR_AUTHORIZATION },
    2202. 

  2202. 	{ "Proxy-Authenticate", &hf_http_proxy_authenticate, HDR_AUTHENTICATE },
    2203. 

  2203. 	{ "WWW-Authenticate", &hf_http_www_authenticate, HDR_AUTHENTICATE },
    2204. 

  2204. 	{ "Content-Type", &hf_http_content_type, HDR_CONTENT_TYPE },
    2205. 

  2205. 	{ "Content-Length", &hf_http_content_length_header, HDR_CONTENT_LENGTH },
    2206. 

  2206. 	{ "Content-Encoding", &hf_http_content_encoding, HDR_CONTENT_ENCODING },
    2207. 

  2207. 	{ "Transfer-Encoding", &hf_http_transfer_encoding, HDR_TRANSFER_ENCODING },
    2208. 

  2208. 	{ "Upgrade", &hf_http_upgrade, HDR_UPGRADE },
    2209. 

  2209. 	{ "User-Agent",	&hf_http_user_agent, HDR_NO_SPECIAL },
    2210. 

  2210. 	{ "Host", &hf_http_host, HDR_HOST },
    2211. 

  2211. 	{ "Connection", &hf_http_connection, HDR_NO_SPECIAL },
    2212. 

  2212. 	{ "Cookie", &hf_http_cookie, HDR_NO_SPECIAL },
    2213. 

  2213. 	{ "Accept", &hf_http_accept, HDR_NO_SPECIAL },
    2214. 

  2214. 	{ "Referer", &hf_http_referer, HDR_NO_SPECIAL },
    2215. 

  2215. 	{ "Accept-Language", &hf_http_accept_language, HDR_NO_SPECIAL },
    2216. 

  2216. 	{ "Accept-Encoding", &hf_http_accept_encoding, HDR_NO_SPECIAL },
    2217. 

  2217. 	{ "Date", &hf_http_date, HDR_NO_SPECIAL },
    2218. 

  2218. 	{ "Cache-Control", &hf_http_cache_control, HDR_NO_SPECIAL },
    2219. 

  2219. 	{ "Server", &hf_http_server, HDR_NO_SPECIAL },
    2220. 

  2220. 	{ "Location", &hf_http_location, HDR_NO_SPECIAL },
    2221. 

  2221. 	{ "Sec-WebSocket-Accept", &hf_http_sec_websocket_accept, HDR_NO_SPECIAL },
    2222. 

  2222. 	{ "Sec-WebSocket-Extensions", &hf_http_sec_websocket_extensions, HDR_NO_SPECIAL },
    2223. 

  2223. 	{ "Sec-WebSocket-Key", &hf_http_sec_websocket_key, HDR_NO_SPECIAL },
    2224. 

  2224. 	{ "Sec-WebSocket-Protocol", &hf_http_sec_websocket_protocol, HDR_NO_SPECIAL },
    2225. 

  2225. 	{ "Sec-WebSocket-Version", &hf_http_sec_websocket_version, HDR_NO_SPECIAL },
    2226. 

  2226. 	{ "Set-Cookie", &hf_http_set_cookie, HDR_NO_SPECIAL },
    2227. 

  2227. 	{ "Last-Modified", &hf_http_last_modified, HDR_NO_SPECIAL },
    2228. 

  2228. 	{ "X-Forwarded-For", &hf_http_x_forwarded_for, HDR_NO_SPECIAL },
    2229. 

  2229. };
    2230. 

  2230. 

  2231. /*
    2232. 

  2232.  *
    2233. 

  2233.  */
    2234. 

  2234. static gint*
    2235. 

  2235. get_hf_for_header(char* header_name)
    2236. 

  2236. {
    2237. 

  2237. 	gint* hf_id = NULL;
    2238. 

  2238. 

  2239. 	if (header_fields_hash) {
    2240. 

  2240. 		hf_id = (gint*) g_hash_table_lookup(header_fields_hash, header_name);
    2241. 

  2241. 	} else {
    2242. 

  2242. 		hf_id = NULL;
    2243. 

  2243. 	}
    2244. 

  2244. 

  2245. 	return hf_id;
    2246. 

  2246. }
    2247. 

  2247. 

  2248. /*
    2249. 

  2249.  *
    2250. 

  2250.  */
    2251. 

  2251. static void
    2252. 

  2252. header_fields_initialize_cb(void)
    2253. 

  2253. {
    2254. 

  2254. 	static hf_register_info* hf;
    2255. 

  2255. 	gint* hf_id;
    2256. 

  2256. 	guint i;
    2257. 

  2257. 	gchar* header_name;
    2258. 

  2258. 

  2259. 	if (header_fields_hash && hf) {
    2260. 

  2260. 		guint hf_size = g_hash_table_size (header_fields_hash);
    2261. 

  2261. 		/* Unregister all fields */
    2262. 

  2262. 		for (i = 0; i < hf_size; i++) {
    2263. 

  2263. 			proto_unregister_field (proto_http, *(hf[i].p_id));
    2264. 

  2264. 

  2265. 			g_free (hf[i].p_id);
    2266. 

  2266. 			g_free ((char *) hf[i].hfinfo.name);
    2267. 

  2267. 			g_free ((char *) hf[i].hfinfo.abbrev);
    2268. 

  2268. 			g_free ((char *) hf[i].hfinfo.blurb);
    2269. 

  2269. 		}
    2270. 

  2270. 		g_hash_table_destroy (header_fields_hash);
    2271. 

  2271. 		g_free (hf);
    2272. 

  2272. 		header_fields_hash = NULL;
    2273. 

  2273. 	}
    2274. 

  2274. 

  2275. 	if (num_header_fields) {
    2276. 

  2276. 		header_fields_hash = g_hash_table_new(g_str_hash, g_str_equal);
    2277. 

  2277. 		hf = g_new0(hf_register_info, num_header_fields);
    2278. 

  2278. 

  2279. 		for (i = 0; i < num_header_fields; i++) {
    2280. 

  2280. 			hf_id = g_new(gint,1);
    2281. 

  2281. 			*hf_id = -1;
    2282. 

  2282. 			header_name = g_strdup(header_fields[i].header_name);
    2283. 

  2283. 

  2284. 			hf[i].p_id = hf_id;
    2285. 

  2285. 			hf[i].hfinfo.name = header_name;
    2286. 

  2286. 			hf[i].hfinfo.abbrev = g_strdup_printf("http.header.%s", header_name);
    2287. 

  2287. 			hf[i].hfinfo.type = FT_STRING;
    2288. 

  2288. 			hf[i].hfinfo.display = BASE_NONE;
    2289. 

  2289. 			hf[i].hfinfo.strings = NULL;
    2290. 

  2290. 			hf[i].hfinfo.blurb = g_strdup(header_fields[i].header_desc);
    2291. 

  2291. 			hf[i].hfinfo.same_name_prev_id = -1;
    2292. 

  2292. 			hf[i].hfinfo.same_name_next = NULL;
    2293. 

  2293. 

  2294. 			g_hash_table_insert(header_fields_hash, header_name, hf_id);
    2295. 

  2295. 		}
    2296. 

  2296. 

  2297. 		proto_register_field_array(proto_http, hf, num_header_fields);
    2298. 

  2298. 	}
    2299. 

  2299. }
    2300. 

  2300. 

  2301. static void
    2302. 

  2302. process_header(tvbuff_t *tvb, int offset, int next_offset,
    2303. 

  2303. 	       const guchar *line, int linelen, int colon_offset,
    2304. 

  2304. 	       packet_info *pinfo, proto_tree *tree, headers_t *eh_ptr,
    2305. 

  2305. 	       http_conv_t *conv_data)
    2306. 

  2306. {
    2307. 

  2307. 	int len;
    2308. 

  2308. 	int line_end_offset;
    2309. 

  2309. 	int header_len;
    2310. 

  2310. 	gint hf_index;
    2311. 

  2311. 	guchar c;
    2312. 

  2312. 	int value_offset;
    2313. 

  2313. 	int value_len;
    2314. 

  2314. 	char *value;
    2315. 

  2315. 	char *header_name;
    2316. 

  2316. 	char *p;
    2317. 

  2317. 	guchar *up;
    2318. 

  2318. 	proto_item *hdr_item;
    2319. 

  2319. 	int i;
    2320. 

  2320. 	int* hf_id;
    2321. 

  2321. 

  2322. 	len = next_offset - offset;
    2323. 

  2323. 	line_end_offset = offset + linelen;
    2324. 

  2324. 	header_len = colon_offset - offset;
    2325. 

  2325. 	header_name = se_strndup(&line[0], header_len);
    2326. 

  2326. 	hf_index = find_header_hf_value(tvb, offset, header_len);
    2327. 

  2327. 

  2328. 	/*
    2329. 

  2329. 	 * Skip whitespace after the colon.
    2330. 

  2330. 	 */
    2331. 

  2331. 	value_offset = colon_offset + 1;
    2332. 

  2332. 	while (value_offset < line_end_offset
    2333. 

  2333. 			&& ((c = line[value_offset - offset]) == ' ' || c == '\t'))
    2334. 

  2334. 		value_offset++;
    2335. 

  2335. 

  2336. 	/*
    2337. 

  2337. 	 * Fetch the value.
    2338. 

  2338. 	 *
    2339. 

  2339. 	 * XXX - the line may well have a NUL in it.  Wireshark should
    2340. 

  2340. 	 * really treat strings extracted from packets as counted
    2341. 

  2341. 	 * strings, so that NUL isn't any different from any other
    2342. 

  2342. 	 * character.  For now, we just allocate a buffer that's
    2343. 

  2343. 	 * value_len+1 bytes long, copy value_len bytes, and stick
    2344. 

  2344. 	 * in a NUL terminator, so that the buffer for value actually
    2345. 

  2345. 	 * has value_len bytes in it.
    2346. 

  2346. 	 */
    2347. 

  2347. 	value_len = line_end_offset - value_offset;
    2348. 

  2348. 	value = (char *)ep_alloc(value_len+1);
    2349. 

  2349. 	memcpy(value, &line[value_offset - offset], value_len);
    2350. 

  2350. 	value[value_len] = '\0';
    2351. 

  2351. 

  2352. 	if (hf_index == -1) {
    2353. 

  2353. 		/*
    2354. 

  2354. 		 * Not a header we know anything about.
    2355. 

  2355. 		 * Check if a HF generated from UAT information exists.
    2356. 

  2356. 		 */
    2357. 

  2357. 		hf_id = get_hf_for_header(header_name);
    2358. 

  2358. 

  2359. 		if (tree) {
    2360. 

  2360. 			if (!hf_id) {
    2361. 

  2361. 				proto_tree_add_text(tree, tvb, offset, len,
    2362. 

  2362. 				    "%s", format_text(line, len));
    2363. 

  2363. 			} else {
    2364. 

  2364. 				proto_tree_add_string_format(tree,
    2365. 

  2365. 					*hf_id, tvb, offset, len,
    2366. 

  2366. 				    value, "%s", format_text(line, len));
    2367. 

  2367. 			}
    2368. 

  2368. 		}
    2369. 

  2369. 	} else {
    2370. 

  2370. 		/*
    2371. 

  2371. 		 * Add it to the protocol tree as a particular field,
    2372. 

  2372. 		 * but display the line as is.
    2373. 

  2373. 		 */
    2374. 

  2374. 		if (tree) {
    2375. 

  2375. 			header_field_info *hfinfo;
    2376. 

  2376. 			guint32 tmp;
    2377. 

  2377. 

  2378. 			hfinfo = proto_registrar_get_nth(*headers[hf_index].hf);
    2379. 

  2379. 			switch(hfinfo->type){
    2380. 

  2380. 			case FT_UINT8:
    2381. 

  2381. 			case FT_UINT16:
    2382. 

  2382. 			case FT_UINT24:
    2383. 

  2383. 			case FT_UINT32:
    2384. 

  2384. 			case FT_INT8:
    2385. 

  2385. 			case FT_INT16:
    2386. 

  2386. 			case FT_INT24:
    2387. 

  2387. 			case FT_INT32:
    2388. 

  2388. 				tmp=(guint32)strtol(value, NULL, 10);
    2389. 

  2389. 				hdr_item = proto_tree_add_uint(tree, *headers[hf_index].hf, tvb, offset, len, tmp);
    2390. 

  2390. 				break;
    2391. 

  2391. 			default:
    2392. 

  2392. 				hdr_item = proto_tree_add_string_format(tree,
    2393. 

  2393. 				    *headers[hf_index].hf, tvb, offset, len,
    2394. 

  2394. 				    value, "%s", format_text(line, len));
    2395. 

  2395. 			}
    2396. 

  2396. 		} else
    2397. 

  2397. 			hdr_item = NULL;
    2398. 

  2398. 

  2399. 		/*
    2400. 

  2400. 		 * Do any special processing that particular headers
    2401. 

  2401. 		 * require.
    2402. 

  2402. 		 */
    2403. 

  2403. 		switch (headers[hf_index].special) {
    2404. 

  2404. 

  2405. 		case HDR_AUTHORIZATION:
    2406. 

  2406. 			if (check_auth_ntlmssp(hdr_item, tvb, pinfo, value))
    2407. 

  2407. 				break;	/* dissected NTLMSSP */
    2408. 

  2408. 			if (check_auth_basic(hdr_item, tvb, value))
    2409. 

  2409. 				break; /* dissected basic auth */
    2410. 

  2410. 			check_auth_kerberos(hdr_item, tvb, pinfo, value);
    2411. 

  2411. 			break;
    2412. 

  2412. 

  2413. 		case HDR_AUTHENTICATE:
    2414. 

  2414. 			if (check_auth_ntlmssp(hdr_item, tvb, pinfo, value))
    2415. 

  2415. 				break; /* dissected NTLMSSP */
    2416. 

  2416. 			check_auth_kerberos(hdr_item, tvb, pinfo, value);
    2417. 

  2417. 			break;
    2418. 

  2418. 

  2419. 		case HDR_CONTENT_TYPE:
    2420. 

  2420. 			eh_ptr->content_type = (gchar*) ep_memdup((guint8*)value,value_len + 1);
    2421. 

  2421. 

  2422. 			for (i = 0; i < value_len; i++) {
    2423. 

  2423. 				c = value[i];
    2424. 

  2424. 				if (c == ';' || g_ascii_isspace(c)) {
    2425. 

  2425. 					/*
    2426. 

  2426. 					 * End of subtype - either
    2427. 

  2427. 					 * white space or a ";"
    2428. 

  2428. 					 * separating the subtype from
    2429. 

  2429. 					 * a parameter.
    2430. 

  2430. 					 */
    2431. 

  2431. 					break;
    2432. 

  2432. 				}
    2433. 

  2433. 

  2434. 				/*
    2435. 

  2435. 				 * Map the character to lower case;
    2436. 

  2436. 				 * content types are case-insensitive.
    2437. 

  2437. 				 */
    2438. 

  2438. 				eh_ptr->content_type[i] = g_ascii_tolower(eh_ptr->content_type[i]);
    2439. 

  2439. 			}
    2440. 

  2440. 			eh_ptr->content_type[i] = '\0';
    2441. 

  2441. 			/*
    2442. 

  2442. 			 * Now find the start of the optional parameters;
    2443. 

  2443. 			 * skip the optional white space and the semicolon
    2444. 

  2444. 			 * if this has not been done before.
    2445. 

  2445. 			 */
    2446. 

  2446. 			i++;
    2447. 

  2447. 			while (i < value_len) {
    2448. 

  2448. 				c = eh_ptr->content_type[i];
    2449. 

  2449. 				if (c == ';' || g_ascii_isspace(c))
    2450. 

  2450. 					/* Skip till start of parameters */
    2451. 

  2451. 					i++;
    2452. 

  2452. 				else
    2453. 

  2453. 					break;
    2454. 

  2454. 			}
    2455. 

  2455. 			if (i < value_len)
    2456. 

  2456. 				eh_ptr->content_type_parameters = eh_ptr->content_type + i;
    2457. 

  2457. 			else
    2458. 

  2458. 				eh_ptr->content_type_parameters = NULL;
    2459. 

  2459. 			break;
    2460. 

  2460. 

  2461. 		case HDR_CONTENT_LENGTH:
    2462. 

  2462. 			errno = 0;
    2463. 

  2463. 			eh_ptr->content_length = g_ascii_strtoll(value, &p, 10);
    2464. 

  2464. 			up = (guchar *)p;
    2465. 

  2465. 			if (eh_ptr->content_length < 0 ||
    2466. 

  2466. 			    p == value ||
    2467. 

  2467. 			    errno == ERANGE ||
    2468. 

  2468. 			    (*up != '\0' && !isspace(*up))) {
    2469. 

  2469. 				/*
    2470. 

  2470. 				 * Content length not valid; pretend
    2471. 

  2471. 				 * we don't have it.
    2472. 

  2472. 				 */
    2473. 

  2473. 				eh_ptr->have_content_length = FALSE;
    2474. 

  2474. 			} else {
    2475. 

  2475. 				proto_tree *header_tree;
    2476. 

  2476. 				proto_item *tree_item;
    2477. 

  2477. 				/*
    2478. 

  2478. 				 * We do have a valid content length.
    2479. 

  2479. 				 */
    2480. 

  2480. 				eh_ptr->have_content_length = TRUE;
    2481. 

  2481. 				header_tree = proto_item_add_subtree(hdr_item, ett_http_header_item);
    2482. 

  2482. 				tree_item = proto_tree_add_uint64(header_tree, hf_http_content_length,
    2483. 

  2483. 					tvb, offset, len, eh_ptr->content_length);
    2484. 

  2484. 				PROTO_ITEM_SET_GENERATED(tree_item);
    2485. 

  2485. 			}
    2486. 

  2486. 			break;
    2487. 

  2487. 

  2488. 		case HDR_CONTENT_ENCODING:
    2489. 

  2489. 			eh_ptr->content_encoding = ep_strndup(value, value_len);
    2490. 

  2490. 			break;
    2491. 

  2491. 

  2492. 		case HDR_TRANSFER_ENCODING:
    2493. 

  2493. 			eh_ptr->transfer_encoding = ep_strndup(value, value_len);
    2494. 

  2494. 			break;
    2495. 

  2495. 

  2496. 		case HDR_HOST:
    2497. 

  2497. 			stat_info->http_host = ep_strndup(value, value_len);
    2498. 

  2498. 			conv_data->http_host = se_strndup(value, value_len);
    2499. 

  2499. 			break;
    2500. 

  2500. 

  2501. 		case HDR_UPGRADE:
    2502. 

  2502. 			if (g_ascii_strncasecmp(value, "WebSocket", value_len) == 0)
    2503. 

  2503. 				eh_ptr->upgrade = UPGRADE_WEBSOCKET;
    2504. 

  2504. 			break;
    2505. 

  2505. 		}
    2506. 

  2506. 	}
    2507. 

  2507. }
    2508. 

  2508. 

  2509. /* Returns index of header tag in headers */
    2510. 

  2510. static gint
    2511. 

  2511. find_header_hf_value(tvbuff_t *tvb, int offset, guint header_len)
    2512. 

  2512. {
    2513. 

  2513. 	guint i;
    2514. 

  2514. 

  2515. 	for (i = 0; i < array_length(headers); i++) {
    2516. 

  2516. 		if (header_len == strlen(headers[i].name) &&
    2517. 

  2517. 			tvb_strncaseeql(tvb, offset,
    2518. 

  2518. 				    headers[i].name, header_len) == 0)
    2519. 

  2519. 			return i;
    2520. 

  2520. 	}
    2521. 

  2521. 

  2522. 	return -1;
    2523. 

  2523. }
    2524. 

  2524. 

  2525. /*
    2526. 

  2526.  * Dissect Microsoft's abomination called NTLMSSP over HTTP.
    2527. 

  2527.  */
    2528. 

  2528. static gboolean
    2529. 

  2529. check_auth_ntlmssp(proto_item *hdr_item, tvbuff_t *tvb, packet_info *pinfo,
    2530. 

  2530.     gchar *value)
    2531. 

  2531. {
    2532. 

  2532. 	static const char *ntlm_headers[] = {
    2533. 

  2533. 		"NTLM ",
    2534. 

  2534. 		"Negotiate ",
    2535. 

  2535. 		NULL
    2536. 

  2536. 	};
    2537. 

  2537. 	const char **header;
    2538. 

  2538. 	size_t hdrlen;
    2539. 

  2539. 	proto_tree *hdr_tree;
    2540. 

  2540. 

  2541. 	/*
    2542. 

  2542. 	 * Check for NTLM credentials and challenge; those can
    2543. 

  2543. 	 * occur with WWW-Authenticate.
    2544. 

  2544. 	 */
    2545. 

  2545. 	for (header = &ntlm_headers[0]; *header != NULL; header++) {
    2546. 

  2546. 		hdrlen = strlen(*header);
    2547. 

  2547. 		if (strncmp(value, *header, hdrlen) == 0) {
    2548. 

  2548. 			if (hdr_item != NULL) {
    2549. 

  2549. 				hdr_tree = proto_item_add_subtree(hdr_item,
    2550. 

  2550. 				    ett_http_ntlmssp);
    2551. 

  2551. 			} else
    2552. 

  2552. 				hdr_tree = NULL;
    2553. 

  2553. 			value += hdrlen;
    2554. 

  2554. 			dissect_http_ntlmssp(tvb, pinfo, hdr_tree, value);
    2555. 

  2555. 			return TRUE;
    2556. 

  2556. 		}
    2557. 

  2557. 	}
    2558. 

  2558. 	return FALSE;
    2559. 

  2559. }
    2560. 

  2560. 

  2561. /*
    2562. 

  2562.  * Dissect HTTP Basic authorization.
    2563. 

  2563.  */
    2564. 

  2564. static gboolean
    2565. 

  2565. check_auth_basic(proto_item *hdr_item, tvbuff_t *tvb, gchar *value)
    2566. 

  2566. {
    2567. 

  2567. 	static const char *basic_headers[] = {
    2568. 

  2568. 		"Basic ",
    2569. 

  2569. 		NULL
    2570. 

  2570. 	};
    2571. 

  2571. 	const char **header;
    2572. 

  2572. 	size_t hdrlen;
    2573. 

  2573. 	proto_tree *hdr_tree;
    2574. 

  2574. 

  2575. 	for (header = &basic_headers[0]; *header != NULL; header++) {
    2576. 

  2576. 		hdrlen = strlen(*header);
    2577. 

  2577. 		if (strncmp(value, *header, hdrlen) == 0) {
    2578. 

  2578. 			if (hdr_item != NULL) {
    2579. 

  2579. 				hdr_tree = proto_item_add_subtree(hdr_item,
    2580. 

  2580. 				    ett_http_ntlmssp);
    2581. 

  2581. 			} else
    2582. 

  2582. 				hdr_tree = NULL;
    2583. 

  2583. 			value += hdrlen;
    2584. 

  2584. 

  2585. 			epan_base64_decode(value);
    2586. 

  2586. 			proto_tree_add_string(hdr_tree, hf_http_basic, tvb,
    2587. 

  2587. 			    0, 0, value);
    2588. 

  2588. 

  2589. 			return TRUE;
    2590. 

  2590. 		}
    2591. 

  2591. 	}
    2592. 

  2592. 	return FALSE;
    2593. 

  2593. }
    2594. 

  2594. 

  2595. static gboolean
    2596. 

  2596. check_auth_kerberos(proto_item *hdr_item, tvbuff_t *tvb, packet_info *pinfo,
    2597. 

  2597.     const gchar *value)
    2598. 

  2598. {
    2599. 

  2599. 	proto_tree *hdr_tree;
    2600. 

  2600. 

  2601. 	if (strncmp(value, "Kerberos ", 9) == 0) {
    2602. 

  2602. 		if (hdr_item != NULL) {
    2603. 

  2603. 			hdr_tree = proto_item_add_subtree(hdr_item, ett_http_kerberos);
    2604. 

  2604. 		} else
    2605. 

  2605. 			hdr_tree = NULL;
    2606. 

  2606. 

  2607. 		dissect_http_kerberos(tvb, pinfo, hdr_tree, value);
    2608. 

  2608. 		return TRUE;
    2609. 

  2609. 	}
    2610. 

  2610. 	return FALSE;
    2611. 

  2611. }
    2612. 

  2612. 

  2613. static void
    2614. 

  2614. dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
    2615. 

  2615. {
    2616. 

  2616. 	http_conv_t	*conv_data;
    2617. 

  2617. 	int		offset = 0;
    2618. 

  2618. 	int		len;
    2619. 

  2619. 

  2620. 	/*
    2621. 

  2621. 	 * Check if this is proxied connection and if so, hand of dissection to the
    2622. 

  2622. 	 * payload-dissector.
    2623. 

  2623. 	 * Response code 200 means "OK" and strncmp() == 0 means the strings match exactly */
    2624. 

  2624. 	conv_data = get_http_conversation_data(pinfo);
    2625. 

  2625. 	if(pinfo->fd->num >= conv_data->startframe &&
    2626. 

  2626. 	   conv_data->response_code == 200 &&
    2627. 

  2627. 	   conv_data->request_method &&
    2628. 

  2628. 	   strncmp(conv_data->request_method, "CONNECT", 7) == 0 &&
    2629. 

  2629. 	   conv_data->request_uri) {
    2630. 

  2630. 		if(conv_data->startframe == 0 && !pinfo->fd->flags.visited)
    2631. 

  2631. 			conv_data->startframe = pinfo->fd->num;
    2632. 

  2632. 		http_payload_subdissector(tvb, tree, pinfo, conv_data);
    2633. 

  2633. 	} else {
    2634. 

  2634. 		while (tvb_reported_length_remaining(tvb, offset) != 0) {
    2635. 

  2635. 			if (conv_data->upgrade == UPGRADE_WEBSOCKET && pinfo->fd->num >= conv_data->startframe) {
    2636. 

  2636. 				call_dissector_only(websocket_handle, tvb_new_subset_remaining(tvb, offset), pinfo, tree, NULL);
    2637. 

  2637. 				break;
    2638. 

  2638. 			}
    2639. 

  2639. 			len = dissect_http_message(tvb, offset, pinfo, tree, conv_data);
    2640. 

  2640. 			if (len == -1)
    2641. 

  2641. 				break;
    2642. 

  2642. 			offset += len;
    2643. 

  2643. 

  2644. 			/*
    2645. 

  2645. 			 * OK, we've set the Protocol and Info columns for the
    2646. 

  2646. 			 * first HTTP message; set a fence so that subsequent
    2647. 

  2647. 			 * HTTP messages don't overwrite the Info column.
    2648. 

  2648. 			 */
    2649. 

  2649. 			col_set_fence(pinfo->cinfo, COL_INFO);
    2650. 

  2650. 		}
    2651. 

  2651. 	}
    2652. 

  2652. }
    2653. 

  2653. 

  2654. static gboolean
    2655. 

  2655. dissect_http_heur_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
    2656. 

  2656. {
    2657. 

  2657. 	gint offset = 0, next_offset, linelen;
    2658. 

  2658. 	conversation_t  *conversation;
    2659. 

  2659. 

  2660. 

  2661. 	/* Check if we have a line terminated by CRLF
    2662. 

  2662. 	 * Return the length of the line (not counting the line terminator at
    2663. 

  2663. 	 * the end), or, if we don't find a line terminator:
    2664. 

  2664. 	 *
    2665. 

  2665. 	 *	if "deseg" is true, return -1;
    2666. 

  2666. 	 */
    2667. 

  2667. 	linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, TRUE);
    2668. 

  2668. 	if((linelen == -1)||(linelen == 8)){
    2669. 

  2669. 		return FALSE;
    2670. 

  2670. 	}
    2671. 

  2671. 

  2672. 	/* Check if the line start or ends with the HTTP token */
    2673. 

  2673. 	if((tvb_strncaseeql(tvb, linelen-8, "HTTP/1.1", 8) == 0)||(tvb_strncaseeql(tvb, 0, "HTTP/1.1", 8) == 0)){
    2674. 

  2674. 		conversation = find_or_create_conversation(pinfo);
    2675. 

  2675. 		conversation_set_dissector(conversation,http_handle);
    2676. 

  2676. 		dissect_http(tvb, pinfo, tree);
    2677. 

  2677. 		return TRUE;
    2678. 

  2678. 	}
    2679. 

  2679. 

  2680. 	return FALSE;
    2681. 

  2681. }
    2682. 

  2682. 

  2683. static void
    2684. 

  2684. dissect_http_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
    2685. 

  2685. {
    2686. 

  2686. 	http_conv_t	*conv_data;
    2687. 

  2687. 

  2688. 	conv_data = get_http_conversation_data(pinfo);
    2689. 

  2689. 	dissect_http_message(tvb, 0, pinfo, tree, conv_data);
    2690. 

  2690. }
    2691. 

  2691. 

  2692. static void
    2693. 

  2693. range_delete_http_tcp_callback(guint32 port) {
    2694. 

  2694. 	dissector_delete_uint("tcp.port", port, http_handle);
    2695. 

  2695. }
    2696. 

  2696. 

  2697. static void
    2698. 

  2698. range_add_http_tcp_callback(guint32 port) {
    2699. 

  2699. 	dissector_add_uint("tcp.port", port, http_handle);
    2700. 

  2700. }
    2701. 

  2701. 

  2702. static void
    2703. 

  2703. range_delete_http_ssl_callback(guint32 port) {
    2704. 

  2704. 	ssl_dissector_delete(port, "http", TRUE);
    2705. 

  2705. }
    2706. 

  2706. 

  2707. static void
    2708. 

  2708. range_add_http_ssl_callback(guint32 port) {
    2709. 

  2709. 	ssl_dissector_add(port, "http", TRUE);
    2710. 

  2710. }
    2711. 

  2711. 

  2712. static void reinit_http(void) {
    2713. 

  2713. 	range_foreach(http_tcp_range, range_delete_http_tcp_callback);
    2714. 

  2714. 	g_free(http_tcp_range);
    2715. 

  2715. 	http_tcp_range = range_copy(global_http_tcp_range);
    2716. 

  2716. 	range_foreach(http_tcp_range, range_add_http_tcp_callback);
    2717. 

  2717. 

  2718. 	range_foreach(http_ssl_range, range_delete_http_ssl_callback);
    2719. 

  2719. 	g_free(http_ssl_range);
    2720. 

  2720. 	http_ssl_range = range_copy(global_http_ssl_range);
    2721. 

  2721. 	range_foreach(http_ssl_range, range_add_http_ssl_callback);
    2722. 

  2722. }
    2723. 

  2723. 

  2724. void
    2725. 

  2725. proto_register_http(void)
    2726. 

  2726. {
    2727. 

  2727. 	static hf_register_info hf[] = {
    2728. 

  2728. 	    { &hf_http_notification,
    2729. 

  2729. 	      { "Notification",		"http.notification",
    2730. 

  2730. 		FT_BOOLEAN, BASE_NONE, NULL, 0x0,
    2731. 

  2731. 		"TRUE if HTTP notification", HFILL }},
    2732. 

  2732. 	    { &hf_http_response,
    2733. 

  2733. 	      { "Response",		"http.response",
    2734. 

  2734. 		FT_BOOLEAN, BASE_NONE, NULL, 0x0,
    2735. 

  2735. 		"TRUE if HTTP response", HFILL }},
    2736. 

  2736. 	    { &hf_http_request,
    2737. 

  2737. 	      { "Request",		"http.request",
    2738. 

  2738. 		FT_BOOLEAN, BASE_NONE, NULL, 0x0,
    2739. 

  2739. 		"TRUE if HTTP request", HFILL }},
    2740. 

  2740. 	    { &hf_http_basic,
    2741. 

  2741. 	      { "Credentials",		"http.authbasic",
    2742. 

  2742. 		FT_STRING, BASE_NONE, NULL, 0x0, NULL, HFILL }},
    2743. 

  2743. 	    { &hf_http_request_method,
    2744. 

  2744. 	      { "Request Method",	"http.request.method",
    2745. 

  2745. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2746. 

  2746. 		"HTTP Request Method", HFILL }},
    2747. 

  2747. 	    { &hf_http_request_uri,
    2748. 

  2748. 	      { "Request URI",	"http.request.uri",
    2749. 

  2749. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2750. 

  2750. 		"HTTP Request-URI", HFILL }},
    2751. 

  2751. 	    { &hf_http_version,
    2752. 

  2752. 	      { "Request Version",	"http.request.version",
    2753. 

  2753. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2754. 

  2754. 		"HTTP Request HTTP-Version", HFILL }},
    2755. 

  2755. 	    { &hf_http_request_full_uri,
    2756. 

  2756. 	      { "Full request URI",	"http.request.full_uri",
    2757. 

  2757. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2758. 

  2758. 		"The full requested URI (including host name)", HFILL }},
    2759. 

  2759. 	    { &hf_http_response_code,
    2760. 

  2760. 	      { "Status Code",	"http.response.code",
    2761. 

  2761. 		FT_UINT16, BASE_DEC, NULL, 0x0,
    2762. 

  2762. 		"HTTP Response Status Code", HFILL }},
    2763. 

  2763. 		{ &hf_http_response_phrase,
    2764. 

  2764. 		  { "Response Phrase", "http.response.phrase",
    2765. 

  2765. 	    FT_STRING, BASE_NONE, NULL, 0x0,
    2766. 

  2766. 		"HTTP Response Reason Phrase", HFILL }},
    2767. 

  2767. 	    { &hf_http_authorization,
    2768. 

  2768. 	      { "Authorization",	"http.authorization",
    2769. 

  2769. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2770. 

  2770. 		"HTTP Authorization header", HFILL }},
    2771. 

  2771. 	    { &hf_http_proxy_authenticate,
    2772. 

  2772. 	      { "Proxy-Authenticate",	"http.proxy_authenticate",
    2773. 

  2773. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2774. 

  2774. 		"HTTP Proxy-Authenticate header", HFILL }},
    2775. 

  2775. 	    { &hf_http_proxy_authorization,
    2776. 

  2776. 	      { "Proxy-Authorization",	"http.proxy_authorization",
    2777. 

  2777. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2778. 

  2778. 		"HTTP Proxy-Authorization header", HFILL }},
    2779. 

  2779. 	    { &hf_http_proxy_connect_host,
    2780. 

  2780. 	      { "Proxy-Connect-Hostname", "http.proxy_connect_host",
    2781. 

  2781. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2782. 

  2782. 		"HTTP Proxy Connect Hostname", HFILL }},
    2783. 

  2783. 	    { &hf_http_proxy_connect_port,
    2784. 

  2784. 	      { "Proxy-Connect-Port",	"http.proxy_connect_port",
    2785. 

  2785. 		FT_UINT16, BASE_DEC, NULL, 0x0,
    2786. 

  2786. 		"HTTP Proxy Connect Port", HFILL }},
    2787. 

  2787. 	    { &hf_http_www_authenticate,
    2788. 

  2788. 	      { "WWW-Authenticate",	"http.www_authenticate",
    2789. 

  2789. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2790. 

  2790. 		"HTTP WWW-Authenticate header", HFILL }},
    2791. 

  2791. 	    { &hf_http_content_type,
    2792. 

  2792. 	      { "Content-Type",	"http.content_type",
    2793. 

  2793. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2794. 

  2794. 		"HTTP Content-Type header", HFILL }},
    2795. 

  2795. 	    { &hf_http_content_length_header,
    2796. 

  2796. 	      { "Content-Length",	"http.content_length_header",
    2797. 

  2797. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2798. 

  2798. 		"HTTP Content-Length header", HFILL }},
    2799. 

  2799. 	    { &hf_http_content_length,
    2800. 

  2800. 	      { "Content length",	"http.content_length",
    2801. 

  2801. 		FT_UINT64, BASE_DEC, NULL, 0x0,
    2802. 

  2802. 		NULL, HFILL }},
    2803. 

  2803. 	    { &hf_http_content_encoding,
    2804. 

  2804. 	      { "Content-Encoding",	"http.content_encoding",
    2805. 

  2805. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2806. 

  2806. 		"HTTP Content-Encoding header", HFILL }},
    2807. 

  2807. 	    { &hf_http_transfer_encoding,
    2808. 

  2808. 	      { "Transfer-Encoding",	"http.transfer_encoding",
    2809. 

  2809. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2810. 

  2810. 		"HTTP Transfer-Encoding header", HFILL }},
    2811. 

  2811. 	    { &hf_http_upgrade,
    2812. 

  2812. 	      { "Upgrade",	"http.upgrade",
    2813. 

  2813. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2814. 

  2814. 		"HTTP Upgrade header", HFILL }},
    2815. 

  2815. 	    { &hf_http_user_agent,
    2816. 

  2816. 	      { "User-Agent",	"http.user_agent",
    2817. 

  2817. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2818. 

  2818. 		"HTTP User-Agent header", HFILL }},
    2819. 

  2819. 	    { &hf_http_host,
    2820. 

  2820. 	      { "Host",	"http.host",
    2821. 

  2821. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2822. 

  2822. 		"HTTP Host", HFILL }},
    2823. 

  2823. 	    { &hf_http_connection,
    2824. 

  2824. 	      { "Connection",	"http.connection",
    2825. 

  2825. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2826. 

  2826. 		"HTTP Connection", HFILL }},
    2827. 

  2827. 	    { &hf_http_cookie,
    2828. 

  2828. 	      { "Cookie",	"http.cookie",
    2829. 

  2829. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2830. 

  2830. 		"HTTP Cookie", HFILL }},
    2831. 

  2831. 	    { &hf_http_accept,
    2832. 

  2832. 	      { "Accept",	"http.accept",
    2833. 

  2833. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2834. 

  2834. 		"HTTP Accept", HFILL }},
    2835. 

  2835. 	    { &hf_http_referer,
    2836. 

  2836. 	      { "Referer",	"http.referer",
    2837. 

  2837. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2838. 

  2838. 		"HTTP Referer", HFILL }},
    2839. 

  2839. 	    { &hf_http_accept_language,
    2840. 

  2840. 	      { "Accept-Language",	"http.accept_language",
    2841. 

  2841. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2842. 

  2842. 		"HTTP Accept Language", HFILL }},
    2843. 

  2843. 	    { &hf_http_accept_encoding,
    2844. 

  2844. 	      { "Accept Encoding",	"http.accept_encoding",
    2845. 

  2845. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2846. 

  2846. 		"HTTP Accept Encoding", HFILL }},
    2847. 

  2847. 	    { &hf_http_date,
    2848. 

  2848. 	      { "Date",	"http.date",
    2849. 

  2849. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2850. 

  2850. 		"HTTP Date", HFILL }},
    2851. 

  2851. 	    { &hf_http_cache_control,
    2852. 

  2852. 	      { "Cache-Control",	"http.cache_control",
    2853. 

  2853. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2854. 

  2854. 		"HTTP Cache Control", HFILL }},
    2855. 

  2855. 	    { &hf_http_server,
    2856. 

  2856. 	      { "Server",	"http.server",
    2857. 

  2857. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2858. 

  2858. 		"HTTP Server", HFILL }},
    2859. 

  2859. 	    { &hf_http_location,
    2860. 

  2860. 	      { "Location",	"http.location",
    2861. 

  2861. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2862. 

  2862. 		"HTTP Location", HFILL }},
    2863. 

  2863. 	    { &hf_http_sec_websocket_accept,
    2864. 

  2864. 	      { "Sec-WebSocket-Accept",	"http.sec_websocket_accept",
    2865. 

  2865. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2866. 

  2866. 		NULL, HFILL }},
    2867. 

  2867. 	    { &hf_http_sec_websocket_extensions,
    2868. 

  2868. 	      { "Sec-WebSocket-Extensions",	"http.sec_websocket_extensions",
    2869. 

  2869. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2870. 

  2870. 		NULL, HFILL }},
    2871. 

  2871. 	    { &hf_http_sec_websocket_key,
    2872. 

  2872. 	      { "Sec-WebSocket-Key",	"http.sec_websocket_key",
    2873. 

  2873. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2874. 

  2874. 		NULL, HFILL }},
    2875. 

  2875. 	    { &hf_http_sec_websocket_protocol,
    2876. 

  2876. 	      { "Sec-WebSocket-Protocol",	"http.sec_websocket_protocol",
    2877. 

  2877. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2878. 

  2878. 		NULL, HFILL }},
    2879. 

  2879. 	    { &hf_http_sec_websocket_version,
    2880. 

  2880. 	      { "Sec-WebSocket-Version",	"http.sec_websocket_version",
    2881. 

  2881. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2882. 

  2882. 		NULL, HFILL }},
    2883. 

  2883. 	    { &hf_http_set_cookie,
    2884. 

  2884. 	      { "Set-Cookie",	"http.set_cookie",
    2885. 

  2885. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2886. 

  2886. 		"HTTP Set Cookie", HFILL }},
    2887. 

  2887. 	    { &hf_http_last_modified,
    2888. 

  2888. 	      { "Last-Modified",	"http.last_modified",
    2889. 

  2889. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2890. 

  2890. 		"HTTP Last Modified", HFILL }},
    2891. 

  2891. 	    { &hf_http_x_forwarded_for,
    2892. 

  2892. 	      { "X-Forwarded-For",	"http.x_forwarded_for",
    2893. 

  2893. 		FT_STRING, BASE_NONE, NULL, 0x0,
    2894. 

  2894. 		"HTTP X-Forwarded-For", HFILL }},
    2895. 

  2895. 	    { &hf_http_request_in,
    2896. 

  2896. 	      { "Request in frame", "http.request_in",
    2897. 

  2897. 		FT_FRAMENUM, BASE_NONE, NULL, 0,
    2898. 

  2898. 		"This packet is a response to the packet with this number", HFILL }},
    2899. 

  2899. 	    { &hf_http_response_in,
    2900. 

  2900. 	      { "Response in frame","http.response_in",
    2901. 

  2901. 		FT_FRAMENUM, BASE_NONE, NULL, 0,
    2902. 

  2902. 		"This packet will be responded in the packet with this number", HFILL }},
    2903. 

  2903. 	    { &hf_http_next_request_in,
    2904. 

  2904. 	      { "Next request in frame", "http.next_request_in",
    2905. 

  2905. 		FT_FRAMENUM, BASE_NONE, NULL, 0,
    2906. 

  2906. 		"The next HTTP request starts in packet number", HFILL }},
    2907. 

  2907. 	    { &hf_http_next_response_in,
    2908. 

  2908. 	      { "Next response in frame","http.next_response_in",
    2909. 

  2909. 		FT_FRAMENUM, BASE_NONE, NULL, 0,
    2910. 

  2910. 		"The next HTTP response starts in packet number", HFILL }},
    2911. 

  2911. 	    { &hf_http_prev_request_in,
    2912. 

  2912. 	      { "Prev request in frame", "http.prev_request_in",
    2913. 

  2913. 		FT_FRAMENUM, BASE_NONE, NULL, 0,
    2914. 

  2914. 		"The previous HTTP request starts in packet number", HFILL }},
    2915. 

  2915. 	    { &hf_http_prev_response_in,
    2916. 

  2916. 	      { "Prev response in frame","http.prev_response_in",
    2917. 

  2917. 		FT_FRAMENUM, BASE_NONE, NULL, 0,
    2918. 

  2918. 		"The previous HTTP response starts in packet number", HFILL }},
    2919. 

  2919. 	    { &hf_http_time,
    2920. 

  2920. 	      { "Time since request", "http.time",
    2921. 

  2921. 		FT_RELATIVE_TIME, BASE_NONE, NULL, 0,
    2922. 

  2922. 		"Time since the request was send", HFILL }},
    2923. 

  2923. 	};
    2924. 

  2924. 	static gint *ett[] = {
    2925. 

  2925. 		&ett_http,
    2926. 

  2926. 		&ett_http_ntlmssp,
    2927. 

  2927. 		&ett_http_kerberos,
    2928. 

  2928. 		&ett_http_request,
    2929. 

  2929. 		&ett_http_chunked_response,
    2930. 

  2930. 		&ett_http_chunk_data,
    2931. 

  2931. 		&ett_http_encoded_entity,
    2932. 

  2932. 		&ett_http_header_item
    2933. 

  2933. 	};
    2934. 

  2934. 

  2935. 	static ei_register_info ei[] = {
    2936. 

  2936. 		{ &ei_http_chat, { "http.chat", PI_SEQUENCE, PI_CHAT, "Formatted text", EXPFILL }},
    2937. 

  2937. 		{ &ei_http_subdissector_failed, { "http.subdissector_failed", PI_MALFORMED, PI_NOTE, "HTTP body subdissector failed, trying heuristic subdissector", EXPFILL }},
    2938. 

  2938. 	};
    2939. 

  2939. 

  2940. 	/* UAT for header fields */
    2941. 

  2941. 	static uat_field_t custom_header_uat_fields[] = {
    2942. 

  2942. 		UAT_FLD_CSTRING(header_fields, header_name, "Header name", "HTTP header name"),
    2943. 

  2943. 		UAT_FLD_CSTRING(header_fields, header_desc, "Field desc", "Description of the value contained in the header"),
    2944. 

  2944. 		UAT_END_FIELDS
    2945. 

  2945. 	};
    2946. 

  2946. 

  2947. 	module_t *http_module;
    2948. 

  2948. 	expert_module_t* expert_http;
    2949. 

  2949. 	uat_t* headers_uat;
    2950. 

  2950. 

  2951. 	proto_http = proto_register_protocol("Hypertext Transfer Protocol",
    2952. 

  2952. 	    "HTTP", "http");
    2953. 

  2953. 	proto_register_field_array(proto_http, hf, array_length(hf));
    2954. 

  2954. 	proto_register_subtree_array(ett, array_length(ett));
    2955. 

  2955. 	expert_http = expert_register_protocol(proto_http);
    2956. 

  2956. 	expert_register_field_array(expert_http, ei, array_length(ei));
    2957. 

  2957. 

  2958. 	http_handle = register_dissector("http", dissect_http, proto_http);
    2959. 

  2959. 

  2960. 	http_module = prefs_register_protocol(proto_http, reinit_http);
    2961. 

  2961. 	prefs_register_bool_preference(http_module, "desegment_headers",
    2962. 

  2962. 	    "Reassemble HTTP headers spanning multiple TCP segments",
    2963. 

  2963. 	    "Whether the HTTP dissector should reassemble headers "
    2964. 

  2964. 	    "of a request spanning multiple TCP segments. "
    2965. 

  2965. 		"To use this option, you must also enable "
    2966. 

  2966. 	"\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
    2967. 

  2967. 	    &http_desegment_headers);
    2968. 

  2968. 	prefs_register_bool_preference(http_module, "desegment_body",
    2969. 

  2969. 	    "Reassemble HTTP bodies spanning multiple TCP segments",
    2970. 

  2970. 	    "Whether the HTTP dissector should use the "
    2971. 

  2971. 	    "\"Content-length:\" value, if present, to reassemble "
    2972. 

  2972. 	    "the body of a request spanning multiple TCP segments, "
    2973. 

  2973. 	    "and reassemble chunked data spanning multiple TCP segments. "
    2974. 

  2974. 		"To use this option, you must also enable "
    2975. 

  2975. 	"\"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
    2976. 

  2976. 	    &http_desegment_body);
    2977. 

  2977. 	prefs_register_bool_preference(http_module, "dechunk_body",
    2978. 

  2978. 	    "Reassemble chunked transfer-coded bodies",
    2979. 

  2979. 	    "Whether to reassemble bodies of entities that are transferred "
    2980. 

  2980. 	    "using the \"Transfer-Encoding: chunked\" method",
    2981. 

  2981. 	    &http_dechunk_body);
    2982. 

  2982. #ifdef HAVE_LIBZ
    2983. 

  2983. 	prefs_register_bool_preference(http_module, "decompress_body",
    2984. 

  2984. 	    "Uncompress entity bodies",
    2985. 

  2985. 	    "Whether to uncompress entity bodies that are compressed "
    2986. 

  2986. 	    "using \"Content-Encoding: \"",
    2987. 

  2987. 	    &http_decompress_body);
    2988. 

  2988. #endif
    2989. 

  2989. 	prefs_register_obsolete_preference(http_module, "tcp_alternate_port");
    2990. 

  2990. 

  2991. 	range_convert_str(&global_http_tcp_range, TCP_DEFAULT_RANGE, 65535);
    2992. 

  2992. 	http_tcp_range = range_empty();
    2993. 

  2993. 	prefs_register_range_preference(http_module, "tcp.port", "TCP Ports",
    2994. 

  2994. 					"TCP Ports range",
    2995. 

  2995. 					&global_http_tcp_range, 65535);
    2996. 

  2996. 

  2997. 	range_convert_str(&global_http_ssl_range, SSL_DEFAULT_RANGE, 65535);
    2998. 

  2998. 	http_ssl_range = range_empty();
    2999. 

  2999. 	prefs_register_range_preference(http_module, "ssl.port", "SSL/TLS Ports",
    3000. 

  3000. 					"SSL/TLS Ports range",
    3001. 

  3001. 					&global_http_ssl_range, 65535);
    3002. 

  3002. 	/* UAT */
    3003. 

  3003. 	headers_uat = uat_new("Custom HTTP headers fields Table",
    3004. 

  3004. 			      sizeof(header_field_t),
    3005. 

  3005. 			      "custom_http_header_fields",
    3006. 

  3006. 			      TRUE,
    3007. 

  3007. 			      (void**) &header_fields,
    3008. 

  3008. 			      &num_header_fields,
    3009. 

  3009.                               /* specifies named fields, so affects dissection
    3010. 

  3010.                                  and the set of named fields */
    3011. 

  3011.                               UAT_AFFECTS_DISSECTION|UAT_AFFECTS_FIELDS,
    3012. 

  3012. 			      NULL,
    3013. 

  3013. 			      header_fields_copy_cb,
    3014. 

  3014. 			      header_fields_update_cb,
    3015. 

  3015. 			      header_fields_free_cb,
    3016. 

  3016. 			      header_fields_initialize_cb,
    3017. 

  3017. 			      custom_header_uat_fields
    3018. 

  3018. 	);
    3019. 

  3019. 

  3020. 	prefs_register_uat_preference(http_module, "custom_http_header_fields", "Custom HTTP headers fields",
    3021. 

  3021. 	    "A table to define custom HTTP header for which fields can be setup and used for filtering/data extraction etc.",
    3022. 

  3022. 	   headers_uat);
    3023. 

  3023. 

  3024. 	/*
    3025. 

  3025. 	 * Dissectors shouldn't register themselves in this table;
    3026. 

  3026. 	 * instead, they should call "http_dissector_add()", and
    3027. 

  3027. 	 * we'll register the port number they specify as a port
    3028. 

  3028. 	 * for HTTP, and register them in our subdissector table.
    3029. 

  3029. 	 *
    3030. 

  3030. 	 * This only works for protocols such as IPP that run over
    3031. 

  3031. 	 * HTTP on a specific non-HTTP port.
    3032. 

  3032. 	 */
    3033. 

  3033. 	port_subdissector_table = register_dissector_table("http.port",
    3034. 

  3034. 	    "TCP port for protocols using HTTP", FT_UINT16, BASE_DEC);
    3035. 

  3035. 

  3036. 	/*
    3037. 

  3037. 	 * Dissectors can register themselves in this table.
    3038. 

  3038. 	 * It's just "media_type", not "http.content_type", because
    3039. 

  3039. 	 * it's an Internet media type, usable by other protocols as well.
    3040. 

  3040. 	 */
    3041. 

  3041. 	media_type_subdissector_table =
    3042. 

  3042. 	    register_dissector_table("media_type",
    3043. 

  3043. 		"Internet media type", FT_STRING, BASE_NONE);
    3044. 

  3044. 

  3045. 	/*
    3046. 

  3046. 	 * Heuristic dissectors SHOULD register themselves in
    3047. 

  3047. 	 * this table using the standard heur_dissector_add()
    3048. 

  3048. 	 * function.
    3049. 

  3049. 	 */
    3050. 

  3050. 	register_heur_dissector_list("http", &heur_subdissector_list);
    3051. 

  3051. 

  3052. 	/*
    3053. 

  3053. 	 * Register for tapping
    3054. 

  3054. 	 */
    3055. 

  3055. 	http_tap = register_tap("http"); /* HTTP statistics tap */
    3056. 

  3056.       	http_eo_tap = register_tap("http_eo"); /* HTTP Export Object tap */
    3057. 

  3057. }
    3058. 

  3058. 

  3059. /*
    3060. 

  3060.  * Called by dissectors for protocols that run atop HTTP/TCP.
    3061. 

  3061.  */
    3062. 

  3062. void
    3063. 

  3063. http_dissector_add(guint32 port, dissector_handle_t handle)
    3064. 

  3064. {
    3065. 

  3065. 	/*
    3066. 

  3066. 	 * Register ourselves as the handler for that port number
    3067. 

  3067. 	 * over TCP.
    3068. 

  3068. 	 */
    3069. 

  3069. 	dissector_add_uint("tcp.port", port, http_handle);
    3070. 

  3070. 

  3071. 	/*
    3072. 

  3072. 	 * And register them in *our* table for that port.
    3073. 

  3073. 	 */
    3074. 

  3074. 	dissector_add_uint("http.port", port, handle);
    3075. 

  3075. }
    3076. 

  3076. 

  3077. void
    3078. 

  3078. http_port_add(guint32 port)
    3079. 

  3079. {
    3080. 

  3080. 	/*
    3081. 

  3081. 	 * Register ourselves as the handler for that port number
    3082. 

  3082. 	 * over TCP.  We rely on our caller having registered
    3083. 

  3083. 	 * themselves for the appropriate media type.
    3084. 

  3084. 	 */
    3085. 

  3085. 	dissector_add_uint("tcp.port", port, http_handle);
    3086. 

  3086. }
    3087. 

  3087. 

  3088. void
    3089. 

  3089. proto_reg_handoff_http(void)
    3090. 

  3090. {
    3091. 

  3091. 	dissector_handle_t http_udp_handle;
    3092. 

  3092. 

  3093. 	data_handle = find_dissector("data");
    3094. 

  3094. 	media_handle = find_dissector("media");
    3095. 

  3095. 	websocket_handle = find_dissector("websocket");
    3096. 

  3096. 	/*
    3097. 

  3097. 	 * XXX - is there anything to dissect in the body of an SSDP
    3098. 

  3098. 	 * request or reply?  I.e., should there be an SSDP dissector?
    3099. 

  3099. 	 */
    3100. 

  3100. 	http_udp_handle = create_dissector_handle(dissect_http_udp, proto_http);
    3101. 

  3101. 	dissector_add_uint("udp.port", UDP_PORT_SSDP, http_udp_handle);
    3102. 

  3102. 

  3103. 	ntlmssp_handle = find_dissector("ntlmssp");
    3104. 

  3104. 	gssapi_handle = find_dissector("gssapi");
    3105. 

  3105. 

  3106. 	stats_tree_register("http", "http",     "HTTP/Packet Counter",   0, http_stats_tree_packet,      http_stats_tree_init, NULL );
    3107. 

  3107. 	stats_tree_register("http", "http_req", "HTTP/Requests",         0, http_req_stats_tree_packet,  http_req_stats_tree_init, NULL );
    3108. 

  3108. 	stats_tree_register("http", "http_srv", "HTTP/Load Distribution",0, http_reqs_stats_tree_packet, http_reqs_stats_tree_init, NULL );
    3109. 

  3109. 

  3110. }
    3111. 

  3111. 

  3112. /*
    3113. 

  3113.  * Content-Type: message/http
    3114. 

  3114.  */
    3115. 

  3115. 

  3116. static gint proto_message_http = -1;
    3117. 

  3117. static gint ett_message_http = -1;
    3118. 

  3118. 

  3119. static void
    3120. 

  3120. dissect_message_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
    3121. 

  3121. {
    3122. 

  3122. 	proto_tree	*subtree;
    3123. 

  3123. 	proto_item	*ti;
    3124. 

  3124. 	gint		offset = 0, next_offset;
    3125. 

  3125. 	gint		len;
    3126. 

  3126. 

  3127. 	col_append_str(pinfo->cinfo, COL_INFO, " (message/http)");
    3128. 

  3128. 	if (tree) {
    3129. 

  3129. 		ti = proto_tree_add_item(tree, proto_message_http,
    3130. 

  3130. 				tvb, 0, -1, ENC_NA);
    3131. 

  3131. 		subtree = proto_item_add_subtree(ti, ett_message_http);
    3132. 

  3132. 		while (tvb_reported_length_remaining(tvb, offset) != 0) {
    3133. 

  3133. 			len = tvb_find_line_end(tvb, offset,
    3134. 

  3134. 					tvb_ensure_length_remaining(tvb, offset),
    3135. 

  3135. 					&next_offset, FALSE);
    3136. 

  3136. 			if (len == -1)
    3137. 

  3137. 				break;
    3138. 

  3138. 			proto_tree_add_text(subtree, tvb, offset, next_offset - offset,
    3139. 

  3139. 					"%s", tvb_format_text(tvb, offset, len));
    3140. 

  3140. 			offset = next_offset;
    3141. 

  3141. 		}
    3142. 

  3142. 	}
    3143. 

  3143. }
    3144. 

  3144. 

  3145. void
    3146. 

  3146. proto_register_message_http(void)
    3147. 

  3147. {
    3148. 

  3148. 	static gint *ett[] = {
    3149. 

  3149. 		&ett_message_http,
    3150. 

  3150. 	};
    3151. 

  3151. 

  3152. 	proto_message_http = proto_register_protocol(
    3153. 

  3153. 			"Media Type: message/http",
    3154. 

  3154. 			"message/http",
    3155. 

  3155. 			"message-http"
    3156. 

  3156. 	);
    3157. 

  3157. 	proto_register_subtree_array(ett, array_length(ett));
    3158. 

  3158. }
    3159. 

  3159. 

  3160. void
    3161. 

  3161. proto_reg_handoff_message_http(void)
    3162. 

  3162. {
    3163. 

  3163. 	dissector_handle_t message_http_handle;
    3164. 

  3164. 

  3165. 	message_http_handle = create_dissector_handle(dissect_message_http,
    3166. 

  3166. 			proto_message_http);
    3167. 

  3167. 

  3168. 	dissector_add_string("media_type", "message/http", message_http_handle);
    3169. 

  3169. 

  3170. 	heur_dissector_add("tcp", dissect_http_heur_tcp, proto_http);
    3171. 

  3171. 

  3172. 

  3173. 	reinit_http();
    3174. 

  3174. }
    3175. 

  3175. 

  3176. /*
    3177. 

  3177.  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
    3178. 

  3178.  *
    3179. 

  3179.  * Local variables:
    3180. 

  3180.  * c-basic-offset: 8
    3181. 

  3181.  * tab-width: 8
    3182. 

  3182.  * indent-tabs-mode: true
    3183. 

  3183.  * End:
    3184. 

  3184.  *
    3185. 

  3185.  * vi: set shiftwidth=8 tabstop=8:
    3186. 

  3186.  * :indentSize=8:tabSize=8:
    3187. 

  3187.  */
    3188. 

  3188.