packet-http.c

   1 /* packet-http.c
   2  * Routines for HTTP packet disassembly
   3  *
   4  * Guy Harris <guy@alum.mit.edu>
   5  *
   6  * $Id: packet-http.c,v 1.33 2001/01/09 06:31:36 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@zing.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  *
  27  *
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #ifdef HAVE_SYS_TYPES_H
  35 #include <sys/types.h>
  36 #endif
  37
  38 #include <string.h>
  39 #include <ctype.h>
  40
  41 #include <glib.h>
  42 #include "packet.h"
  43 #include "strutil.h"
  44
  45 typedef enum _http_type {
  46         HTTP_REQUEST,
  47         HTTP_RESPONSE,
  48         HTTP_NOTIFICATION,
  49         HTTP_OTHERS
  50 } http_type_t;
  51
  52 static int proto_http = -1;
  53 static int hf_http_notification = -1;
  54 static int hf_http_response = -1;
  55 static int hf_http_request = -1;
  56
  57 static gint ett_http = -1;
  58
  59 #define TCP_PORT_HTTP                   80
  60 #define TCP_PORT_PROXY_HTTP             3128
  61 #define TCP_PORT_PROXY_ADMIN_HTTP       3132
  62 #define TCP_ALT_PORT_HTTP               8080
  63
  64 #define TCP_PORT_SSDP                   1900
  65 #define UDP_PORT_SSDP                   1900
  66
  67 /*
  68  * Protocols implemented atop HTTP.
  69  */
  70 typedef enum {
  71         PROTO_HTTP,             /* just HTTP */
  72         PROTO_IPP,              /* Internet Printing Protocol */
  73         PROTO_SSDP              /* Simple Service Discovery Protocol */
  74 } http_proto_t;
  75
  76 static int is_http_request_or_reply(const u_char *data, int linelen, http_type_t *type);
  77
  78 static dissector_handle_t ipp_handle;
  79
  80 void
  81 dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  82 {
  83         http_proto_t    proto;
  84         char            *proto_tag;
  85         proto_tree      *http_tree = NULL;
  86         proto_item      *ti = NULL;
  87         gint            offset = 0;
  88         const u_char    *line;
  89         gint            next_offset;
  90         const u_char    *linep, *lineend;
  91         int             linelen;
  92         u_char          c;
  93         http_type_t     http_type;
  94         int             datalen;
  95
  96         CHECK_DISPLAY_AS_DATA(proto_http, tvb, pinfo, tree);
  97
  98         pinfo->current_proto = "HTTP";
  99
 100         switch (pinfo->match_port) {
 101
 102         case 631:
 103                 proto = PROTO_IPP;
 104                 proto_tag = "IPP";
 105                 break;
 106
 107         case 1900:
 108                 proto = PROTO_SSDP;
 109                 proto_tag = "SSDP";
 110                 break;
 111
 112         default:
 113                 proto = PROTO_HTTP;
 114                 proto_tag = "HTTP";
 115                 break;
 116         }
 117
 118         if (check_col(pinfo->fd, COL_PROTOCOL))
 119                 col_set_str(pinfo->fd, COL_PROTOCOL, proto_tag);
 120         if (check_col(pinfo->fd, COL_INFO)) {
 121                 /*
 122                  * Put the first line from the buffer into the summary
 123                  * if it's an HTTP request or reply (but leave out the
 124                  * line terminator).
 125                  * Otherwise, just call it a continuation.
 126                  */
 127                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset);
 128                 line = tvb_get_ptr(tvb, offset, linelen);
 129                 http_type = HTTP_OTHERS;        /* type not known yet */
 130                 if (is_http_request_or_reply(line, linelen, &http_type))
 131                         col_add_str(pinfo->fd, COL_INFO,
 132                             format_text(line, linelen));
 133                 else
 134                         col_set_str(pinfo->fd, COL_INFO, "Continuation");
 135         }
 136
 137         if (tree) {
 138                 ti = proto_tree_add_item(tree, proto_http, tvb, offset,
 139                     tvb_length_remaining(tvb, offset), FALSE);
 140                 http_tree = proto_item_add_subtree(ti, ett_http);
 141
 142                 /*
 143                  * Process the packet data, a line at a time.
 144                  */
 145                 http_type = HTTP_OTHERS;        /* type not known yet */
 146                 while (tvb_offset_exists(tvb, offset)) {
 147                         /*
 148                          * Find the end of the line.
 149                          */
 150                         linelen = tvb_find_line_end(tvb, offset, -1,
 151                             &next_offset);
 152
 153                         /*
 154                          * Get a buffer that refers to the line.
 155                          */
 156                         line = tvb_get_ptr(tvb, offset, linelen);
 157                         lineend = line + linelen;
 158
 159                         /*
 160                          * OK, does it look like an HTTP request or
 161                          * response?
 162                          */
 163                         if (is_http_request_or_reply(line, linelen, &http_type))
 164                                 goto is_http;
 165
 166                         /*
 167                          * No.  Does it look like a blank line (as would
 168                          * appear at the end of an HTTP request)?
 169                          */
 170                         if (linelen == 0)
 171                                 goto is_http;
 172
 173                         /*
 174                          * No.  Does it look like a MIME header?
 175                          */
 176                         linep = line;
 177                         while (linep < lineend) {
 178                                 c = *linep++;
 179                                 if (!isprint(c))
 180                                         break;  /* not printable, not a MIME header */
 181                                 switch (c) {
 182
 183                                 case '(':
 184                                 case ')':
 185                                 case '<':
 186                                 case '>':
 187                                 case '@':
 188                                 case ',':
 189                                 case ';':
 190                                 case '\\':
 191                                 case '"':
 192                                 case '/':
 193                                 case '[':
 194                                 case ']':
 195                                 case '?':
 196                                 case '=':
 197                                 case '{':
 198                                 case '}':
 199                                         /*
 200                                          * It's a tspecial, so it's not
 201                                          * part of a token, so it's not
 202                                          * a field name for the beginning
 203                                          * of a MIME header.
 204                                          */
 205                                         goto not_http;
 206
 207                                 case ':':
 208                                         /*
 209                                          * This ends the token; we consider
 210                                          * this to be a MIME header.
 211                                          */
 212                                         goto is_http;
 213                                 }
 214                         }
 215
 216                 not_http:
 217                         /*
 218                          * We don't consider this part of an HTTP request or
 219                          * reply, so we don't display it.
 220                          * (Yeah, that means we don't display, say, a
 221                          * text/http page, but you can get that from the
 222                          * data pane.)
 223                          */
 224                         break;
 225
 226                 is_http:
 227                         /*
 228                          * Put this line.
 229                          */
 230                         proto_tree_add_text(http_tree, tvb, offset,
 231                             next_offset - offset, "%s",
 232                             tvb_format_text(tvb, offset, next_offset - offset));
 233                         offset = next_offset;
 234                 }
 235
 236                 switch (http_type) {
 237
 238                 case HTTP_NOTIFICATION:
 239                         proto_tree_add_boolean_hidden(http_tree,
 240                             hf_http_notification, tvb, 0, 0, 1);
 241                         break;
 242
 243                 case HTTP_RESPONSE:
 244                         proto_tree_add_boolean_hidden(http_tree,
 245                             hf_http_response, tvb, 0, 0, 1);
 246                         break;
 247
 248                 case HTTP_REQUEST:
 249                         proto_tree_add_boolean_hidden(http_tree,
 250                             hf_http_request, tvb, 0, 0, 1);
 251                         break;
 252
 253                 case HTTP_OTHERS:
 254                 default:
 255                         break;
 256                 }
 257         }
 258
 259         datalen = tvb_length_remaining(tvb, offset);
 260         if (datalen > 0) {
 261                 if (proto == PROTO_IPP) {
 262                         tvbuff_t *new_tvb = tvb_new_subset(tvb, offset, -1, -1);
 263
 264                         /*
 265                          * Fix up the top-level item so that it doesn't
 266                          * include the IPP stuff.
 267                          */
 268                         if (ti != NULL)
 269                                 proto_item_set_len(ti, offset);
 270
 271                         call_dissector(ipp_handle, new_tvb, pinfo, tree);
 272                 } else
 273                         dissect_data(tvb, offset, pinfo, http_tree);
 274         }
 275 }
 276
 277 /*
 278  * XXX - this won't handle HTTP 0.9 replies, but they're all data
 279  * anyway.
 280  */
 281 static int
 282 is_http_request_or_reply(const u_char *data, int linelen, http_type_t *type)
 283 {
 284         /*
 285          * From RFC 2774 - An HTTP Extension Framework
 286          *
 287          * Support the command prefix that identifies the presence of
 288          * a "mandatory" header.
 289          */
 290         if (strncmp(data, "M-", 2) == 0) {
 291                 data += 2;
 292                 linelen -= 2;
 293         }
 294
 295         /*
 296          * From draft-cohen-gena-client-01.txt, available from the uPnP forum:
 297          *      NOTIFY, SUBSCRIBE, UNSUBSCRIBE
 298          *
 299          * From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
 300          *      SEARCH
 301          */
 302         if (linelen >= 4) {
 303                 if (strncmp(data, "GET ", 4) == 0 ||
 304                     strncmp(data, "PUT ", 4) == 0) {
 305                         if (*type == HTTP_OTHERS)
 306                                 *type = HTTP_REQUEST;
 307                         return TRUE;
 308                 }
 309         }
 310         if (linelen >= 5) {
 311                 if (strncmp(data, "HEAD ", 5) == 0 ||
 312                     strncmp(data, "POST ", 5) == 0) {
 313                         if (*type == HTTP_OTHERS)
 314                                 *type = HTTP_REQUEST;
 315                         return TRUE;
 316                 }
 317                 if (strncmp(data, "HTTP/", 5) == 0) {
 318                         if (*type == HTTP_OTHERS)
 319                                 *type = HTTP_RESPONSE;
 320                         return TRUE;    /* response */
 321                 }
 322         }
 323         if (linelen >= 6) {
 324                 if (strncmp(data, "TRACE ", 6) == 0) {
 325                         if (*type == HTTP_OTHERS)
 326                                 *type = HTTP_REQUEST;
 327                         return TRUE;
 328                 }
 329         }
 330         if (linelen >= 7) {
 331                 if (strncmp(data, "DELETE ", 7) == 0) {
 332                         if (*type == HTTP_OTHERS)
 333                                 *type = HTTP_REQUEST;
 334                         return TRUE;
 335                 }
 336                 if (strncmp(data, "NOTIFY ", 7) == 0 ||
 337                     strncmp(data, "SEARCH ", 7) == 0) {
 338                         if (*type == HTTP_OTHERS)
 339                                 *type = HTTP_NOTIFICATION;
 340                         return TRUE;
 341                 }
 342         }
 343         if (linelen >= 8) {
 344                 if (strncmp(data, "OPTIONS ", 8) == 0 ||
 345                     strncmp(data, "CONNECT ", 8) == 0) {
 346                         if (*type == HTTP_OTHERS)
 347                                 *type = HTTP_REQUEST;
 348                         return TRUE;
 349                 }
 350         }
 351         if (linelen >= 10) {
 352                 if (strncmp(data, "SUBSCRIBE ", 10) == 0) {
 353                         if (*type == HTTP_OTHERS)
 354                                 *type = HTTP_NOTIFICATION;
 355                         return TRUE;
 356                 }
 357         }
 358         if (linelen >= 12) {
 359                 if (strncmp(data, "UNSUBSCRIBE ", 10) == 0) {
 360                         if (*type == HTTP_OTHERS)
 361                                 *type = HTTP_NOTIFICATION;
 362                         return TRUE;
 363                 }
 364         }
 365         return FALSE;
 366 }
 367
 368 void
 369 proto_register_http(void)
 370 {
 371         static hf_register_info hf[] = {
 372             { &hf_http_notification,
 373               { "Notification",         "http.notification",
 374                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 375                 "TRUE if HTTP notification" }},
 376             { &hf_http_response,
 377               { "Response",             "http.response",
 378                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 379                 "TRUE if HTTP response" }},
 380             { &hf_http_request,
 381               { "Request",              "http.request",
 382                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 383                 "TRUE if HTTP request" }},
 384         };
 385         static gint *ett[] = {
 386                 &ett_http,
 387         };
 388
 389         proto_http = proto_register_protocol("Hypertext Transfer Protocol",
 390             "HTTP", "http");
 391         proto_register_field_array(proto_http, hf, array_length(hf));
 392         proto_register_subtree_array(ett, array_length(ett));
 393 }
 394
 395 void
 396 proto_reg_handoff_http(void)
 397 {
 398         dissector_add("tcp.port", TCP_PORT_HTTP, dissect_http, proto_http);
 399         dissector_add("tcp.port", TCP_ALT_PORT_HTTP, dissect_http, proto_http);
 400         dissector_add("tcp.port", TCP_PORT_PROXY_HTTP, dissect_http,
 401             proto_http);
 402         dissector_add("tcp.port", TCP_PORT_PROXY_ADMIN_HTTP, dissect_http,
 403             proto_http);
 404         dissector_add("tcp.port", 631, dissect_http, proto_http);
 405
 406         dissector_add("tcp.port", TCP_PORT_SSDP, dissect_http, proto_http);
 407         dissector_add("udp.port", UDP_PORT_SSDP, dissect_http, proto_http);
 408
 409         /*
 410          * Get a handle for the IPP dissector.
 411          */
 412         ipp_handle = find_dissector("ipp");
 413 }