2 * Routines for multipart media encapsulation dissection
3 * Copyright 2004, Anders Broman.
4 * Copyright 2004, Olivier Biot.
8 * Refer to the AUTHORS file or the AUTHORS section in the man page
9 * for contacting the author(s) of this file.
11 * Wireshark - Network traffic analyzer
12 * By Gerald Combs <gerald@wireshark.org>
13 * Copyright 1998 Gerald Combs
16 * This program is free software; you can redistribute it and/or
17 * modify it under the terms of the GNU General Public License
18 * as published by the Free Software Foundation; either version 2
19 * of the License, or (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, write to the Free Software
28 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
30 * References for "media-type multipart/mixed :
31 * http://www.iana.org/assignments/media-types/index.html
32 * http://www.rfc-editor.org/rfc/rfc2045.txt
33 * http://www.rfc-editor.org/rfc/rfc2046.txt
34 * http://www.rfc-editor.org/rfc/rfc2047.txt
35 * http://www.rfc-editor.org/rfc/rfc2048.txt
36 * http://www.rfc-editor.org/rfc/rfc2049.txt
38 * Part of the code is modeled from the SIP and HTTP dissectors
40 * General format of a MIME multipart document:
41 * [ preamble line-end ]
42 * dash-boundary transport-padding line-end
45 * close-delimiter transport-padding
46 * [ line-end epilogue ]
49 * dash-boundary := "--" boundary
50 * encapsulation := delimiter transport-padding line-end body-part
51 * delimiter := line-end body-part
52 * close-delimiter := delimiter "--"
53 * body-part := MIME-part-headers [ line-end *OCTET ]
54 * transport-padding := *LWSP-char
56 * Note that line-end is often a LF instead of a CRLF.
66 #include <epan/prefs.h>
69 #include <epan/base64.h>
70 #include <epan/emem.h>
72 #include <epan/packet.h>
74 #include "packet-imf.h"
76 /* Dissector table for media requiring special attention in multipart
78 static dissector_table_t multipart_media_subdissector_table;
80 /* Initialize the protocol and registered fields */
81 static int proto_multipart = -1;
83 /* Initialize the subtree pointers */
84 static gint ett_multipart = -1;
85 static gint ett_multipart_main = -1;
86 static gint ett_multipart_body = -1;
88 /* Not sure that compact_name exists for multipart, but choose to keep
89 * the structure from SIP dissector, all the content- is also from SIP */
94 const char *compact_name;
97 static const multipart_header_t multipart_headers[] = {
98 { "Unknown-header", NULL }, /* Pad so that the real headers start at index 1 */
99 { "Content-Disposition", NULL },
100 { "Content-Encoding", "e" },
101 { "Content-Id", NULL },
102 { "Content-Language", NULL },
103 { "Content-Length", "l" },
104 { "Content-Transfer-Encoding", NULL },
105 { "Content-Type", "c" },
108 #define POS_CONTENT_DISPOSITION 1
109 #define POS_CONTENT_ENCODING 2
110 #define POS_CONTENT_ID 3
111 #define POS_CONTENT_LANGUAGE 4
112 #define POS_CONTENT_LENGTH 5
113 #define POS_CONTENT_TRANSFER_ENCODING 6
114 #define POS_CONTENT_TYPE 7
116 /* Initialize the header fields */
117 static gint hf_multipart_type = -1;
118 static gint hf_multipart_part = -1;
120 static gint hf_header_array[] = {
121 -1, /* "Unknown-header" - Pad so that the real headers start at index 1 */
122 -1, /* "Content-Disposition" */
123 -1, /* "Content-Encoding" */
124 -1, /* "Content-Id" */
125 -1, /* "Content-Language" */
126 -1, /* "Content-Length" */
127 -1, /* "Content-Transfer-Encoding" */
128 -1, /* "Content-Type" */
131 /* Define media_type/Content type table */
132 static dissector_table_t media_type_dissector_table;
134 /* Data and media dissector handles */
135 static dissector_handle_t data_handle;
136 static dissector_handle_t media_handle;
138 /* Determins if bodies with no media type dissector shoud be displayed
139 * as raw text, may cause problems with images sound etc
140 * TODO improve to check for different content types ?
142 static gboolean display_unknown_body_as_text = FALSE;
143 static gboolean remove_base64_encoding = FALSE;
147 const char *type; /* Type of multipart */
148 char *boundary; /* Boundary string (enclosing quotes removed if any) */
149 guint boundary_length; /* Length of the boundary string */
155 find_first_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
156 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary);
158 find_next_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
159 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary);
161 process_preamble(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
162 gint boundary_len, gboolean *last_boundary);
164 process_body_part(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
165 gint boundary_len, packet_info *pinfo, gint start,
166 gboolean *last_boundary);
168 is_known_multipart_header(const char *header_str, guint len);
170 index_of_char(const char *str, const char c);
172 unfold_and_compact_mime_header(const char *lines, gint *first_colon_offset);
175 /* Return a tvb that contains the binary representation of a base64
179 base64_decode(packet_info *pinfo, tvbuff_t *b64_tvb, char *name)
185 data = g_strdup(tvb_get_ephemeral_string(b64_tvb, 0, tvb_length_remaining(b64_tvb, 0)));
187 len = epan_base64_decode(data);
188 tvb = tvb_new_real_data((const guint8 *)data, len, len);
190 tvb_set_free_cb(tvb, g_free);
192 add_new_data_source(pinfo, tvb, name);
198 * Unfold and clean up a MIME-like header, and process LWS as follows:
199 * o Preserves LWS in quoted text
200 * o Remove LWS before and after a separator
201 * o Remove trailing LWS
202 * o Replace other LWS with a single space
203 * Set value to the start of the value
204 * Return the cleaned-up RFC2822 header (buffer must be freed).
207 unfold_and_compact_mime_header(const char *lines, gint *first_colon_offset)
209 const char *p = lines;
212 char sep_seen = 0; /* Did we see a separator ":;," */
213 char lws = FALSE; /* Did we see LWS (incl. folding) */
216 if (! lines) return NULL;
219 ret = g_malloc(strlen(lines) + 1);
224 lws = FALSE; /* Prevent leading LWS from showing up */
225 if (colon == -1) {/* First colon */
228 *(q++) = sep_seen = c;
230 } else if (c == ';' || c == ',' || c == '=') {
231 lws = FALSE; /* Prevent leading LWS from showing up */
232 *(q++) = sep_seen = c;
234 } else if (c == ' ' || c == '\t') {
237 } else if (c == '\n') {
238 lws = FALSE; /* Skip trailing LWS */
240 if (c == ' ' || c == '\t') { /* Header unfolding */
244 *q = c = 0; /* Stop */
247 } else if (c == '\r') {
252 if (c == ' ' || c == '\t') { /* Header unfolding */
256 *q = c = 0; /* Stop */
259 } else if (c == ' ' || c == '\t') { /* Header unfolding */
263 *q = c = 0; /* Stop */
266 } else if (c == '"') { /* Start of quoted-string */
272 p++; /* Skip closing quote */
276 /* if already zero terminated now, rewind one char to avoid an "off by one" */
280 } else { /* Regular character */
301 *first_colon_offset = colon;
305 /* Return the index of a given char in the given string,
306 * or -1 if not found.
309 index_of_char(const char *str, const char c)
314 while (*p && *p != c) {
324 static char *find_parameter(char *parameters, const char *key, int *retlen)
330 if(!parameters || !*parameters || !key || !(keylen = strlen(key)))
331 /* we won't be able to find anything */
338 while ((*p) && isspace((guchar)*p))
339 p++; /* Skip white space */
341 if (strncasecmp(p, key, keylen) == 0)
343 /* Skip to next parameter */
349 p++; /* Skip semicolon */
358 * Process the parameter value
360 if (start[0] == '"') {
362 * Parameter value is a quoted-string
364 start++; /* Skip the quote */
365 len = index_of_char(start, '"');
374 * Look for end of boundary
378 if (*p == ';' || isspace((guchar)*p))
391 /* Retrieve the media information from pinfo->private_data,
392 * and compute the boundary string and its length.
393 * Return a pointer to a filled-in multipart_info_t, or NULL on failure.
395 * Boundary delimiters must not appear within the encapsulated material,
396 * and must be no longer than 70 characters, not counting the two
397 * leading hyphens. (quote from rfc2046)
399 static multipart_info_t *
400 get_multipart_info(packet_info *pinfo)
404 multipart_info_t *m_info = NULL;
405 const char *type = pinfo->match_string;
409 if ((type == NULL) || (pinfo->private_data == NULL)) {
411 * We need both a content type AND parameters
412 * for multipart dissection.
417 /* Clean up the parameters */
418 parameters = unfold_and_compact_mime_header(pinfo->private_data, &dummy);
420 start = find_parameter(parameters, "boundary=", &len);
428 * There is a value for the boundary string
430 m_info = g_malloc(sizeof(multipart_info_t));
432 m_info->boundary = g_strndup(start, len);
433 m_info->boundary_length = len;
440 cleanup_multipart_info(void *data)
442 multipart_info_t *m_info = data;
444 if (m_info->boundary)
445 g_free(m_info->boundary);
451 * The first boundary does not implicitly contain the leading
454 * Return the offset to the 1st byte of the boundary delimiter line.
455 * Set boundary_line_len to the length of the entire boundary delimiter.
456 * Set last_boundary to TRUE if we've seen the last-boundary delimiter.
459 find_first_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
460 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary)
462 gint offset = start, next_offset, line_len, boundary_start;
464 while (tvb_length_remaining(tvb, offset + 2 + boundary_len) > 0) {
465 boundary_start = offset;
466 if (((tvb_strneql(tvb, offset, (const guint8 *)"--", 2) == 0)
467 && (tvb_strneql(tvb, offset + 2, boundary, boundary_len) == 0)))
469 /* Boundary string; now check if last */
470 if ((tvb_length_remaining(tvb, offset + 2 + boundary_len + 2) >= 0)
471 && (tvb_strneql(tvb, offset + 2 + boundary_len,
472 (const guint8 *)"--", 2) == 0)) {
473 *last_boundary = TRUE;
475 *last_boundary = FALSE;
477 /* Look for line end of the boundary line */
478 line_len = tvb_find_line_end(tvb, offset, -1, &offset, FALSE);
479 if (line_len == -1) {
480 *boundary_line_len = -1;
482 *boundary_line_len = offset - boundary_start;
484 return boundary_start;
486 line_len = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
487 if (line_len == -1) {
490 offset = next_offset;
497 * Unless the first boundary, subsequent boundaries include a line-end sequence
498 * before the dashed boundary string.
500 * Return the offset to the 1st byte of the boundary delimiter line.
501 * Set boundary_line_len to the length of the entire boundary delimiter.
502 * Set last_boundary to TRUE if we've seen the last-boundary delimiter.
505 find_next_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
506 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary)
508 gint offset = start, next_offset, line_len, boundary_start;
510 while (tvb_length_remaining(tvb, offset + 2 + boundary_len) > 0) {
511 line_len = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
512 if (line_len == -1) {
515 boundary_start = offset + line_len;
516 if (((tvb_strneql(tvb, next_offset, (const guint8 *)"--", 2) == 0)
517 && (tvb_strneql(tvb, next_offset + 2, boundary, boundary_len) == 0)))
519 /* Boundary string; now check if last */
520 if ((tvb_length_remaining(tvb, next_offset + 2 + boundary_len + 2) >= 0)
521 && (tvb_strneql(tvb, next_offset + 2 + boundary_len,
522 (const guint8 *)"--", 2) == 0)) {
523 *last_boundary = TRUE;
525 *last_boundary = FALSE;
527 /* Look for line end of the boundary line */
528 line_len = tvb_find_line_end(tvb, next_offset, -1, &offset, FALSE);
529 if (line_len == -1) {
530 *boundary_line_len = -1;
532 *boundary_line_len = offset - boundary_start;
534 return boundary_start;
536 offset = next_offset;
543 * Process the multipart preamble:
544 * [ preamble line-end ] dashed-boundary transport-padding line-end
546 * Return the offset to the start of the first body-part.
549 process_preamble(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
550 gint boundary_len, gboolean *last_boundary)
552 gint boundary_start, boundary_line_len, body_part_start;
555 boundary_start = find_first_boundary(tvb, 0, boundary, boundary_len,
556 &boundary_line_len, last_boundary);
557 if (boundary_start == 0) {
559 proto_tree_add_text(tree, tvb, boundary_start, boundary_line_len,
560 "First boundary: %s",
561 tvb_format_text(tvb, boundary_start, boundary_line_len));
563 return boundary_start + boundary_line_len;
564 } else if (boundary_start > 0) {
565 if (boundary_line_len > 0) {
566 gint body_part_start = boundary_start + boundary_line_len;
569 if (body_part_start > 0) {
570 proto_tree_add_text(tree, tvb, 0, body_part_start,
573 proto_tree_add_text(tree, tvb, boundary_start,
574 boundary_line_len, "First boundary: %s",
575 tvb_format_text(tvb, boundary_start,
578 return body_part_start;
585 * Process a multipart body-part:
586 * MIME-part-headers [ line-end *OCTET ]
587 * line-end dashed-boundary transport-padding line-end
589 * If applicable, call a media subdissector.
591 * Return the offset to the start of the next body-part.
594 process_body_part(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
595 gint boundary_len, packet_info *pinfo, gint start,
596 gboolean *last_boundary)
598 proto_tree *subtree = NULL;
599 proto_item *ti = NULL;
600 gint offset = start, next_offset;
601 char *parameters = NULL;
602 gint body_start, boundary_start, boundary_line_len;
604 char *content_type_str = NULL;
605 char *content_encoding_str = NULL;
606 char *filename = NULL;
607 char *typename = NULL;
609 gboolean last_field = FALSE;
612 ti = proto_tree_add_item(tree, hf_multipart_part, tvb, start, 0, FALSE);
613 subtree = proto_item_add_subtree(ti, ett_multipart_body);
616 * Process the MIME-part-headers
625 next_offset = imf_find_field_end(tvb, offset, tvb_length_remaining(tvb, offset), &last_field);
627 hdr_str = tvb_get_ephemeral_string(tvb, offset, next_offset - offset);
629 header_str = unfold_and_compact_mime_header(hdr_str, &colon_offset);
630 if (colon_offset <= 0) {
632 proto_tree_add_text(subtree, tvb, offset, next_offset - offset,
634 tvb_format_text(tvb, offset, next_offset - offset));
639 /* Split header name from header value */
640 header_str[colon_offset] = '\0';
641 hf_index = is_known_multipart_header(header_str, colon_offset);
643 if (hf_index == -1) {
645 proto_tree_add_text(subtree, tvb, offset,
646 next_offset - offset,
648 tvb_format_text(tvb, offset, next_offset - offset));
651 char *value_str = header_str + colon_offset + 1;
654 proto_tree_add_string_format(subtree,
655 hf_header_array[hf_index], tvb,
656 offset, next_offset - offset,
657 (const char *)value_str, "%s",
658 tvb_format_text(tvb, offset, next_offset - offset));
662 case POS_CONTENT_TYPE:
664 /* The Content-Type starts at colon_offset + 1 */
665 gint semicolon_offset = index_of_char(
668 if (semicolon_offset > 0) {
669 value_str[semicolon_offset] = '\0';
670 parameters = ep_strdup(value_str + semicolon_offset + 1);
674 #if GLIB_MAJOR_VERSION < 2
675 content_type_str = g_strdup(value_str);
676 g_strdown(content_type_str);
678 content_type_str = g_ascii_strdown(value_str, -1);
680 /* Show content-type in root 'part' label */
681 proto_item_append_text(ti, " (%s)", content_type_str);
683 /* find the "name" parameter in case we don't find a content disposition "filename" */
684 if((typename = find_parameter(parameters, "name=", &len)) != NULL) {
685 typename = g_strndup(typename, len);
691 case POS_CONTENT_TRANSFER_ENCODING:
693 /* The Content-Transfeing starts at colon_offset + 1 */
694 gint cr_offset = index_of_char(value_str, '\r');
697 value_str[cr_offset] = '\0';
699 #if GLIB_MAJOR_VERSION < 2
700 content_encoding_str = g_strdup(value_str);
701 g_strdown(content_encoding_str);
703 content_encoding_str = g_ascii_strdown(value_str, -1);
707 case POS_CONTENT_DISPOSITION:
709 /* find the "filename" parameter */
710 if((filename = find_parameter(value_str, "filename=", &len)) != NULL) {
711 filename = g_strndup(filename, len);
721 offset = next_offset;
724 body_start = next_offset;
730 boundary_start = find_next_boundary(tvb, body_start, boundary, boundary_len,
731 &boundary_line_len, last_boundary);
732 if (boundary_start > 0) {
733 gint body_len = boundary_start - body_start;
734 tvbuff_t *tmp_tvb = tvb_new_subset(tvb, body_start,
737 if (content_type_str) {
742 void *save_private_data = pinfo->private_data;
746 * Try and remove any content transfer encoding so that each sub-dissector
747 * doesn't have to do it itself
751 if(content_encoding_str && remove_base64_encoding) {
753 if(!strncasecmp(content_encoding_str, "base64", 6))
754 tmp_tvb = base64_decode(pinfo, tmp_tvb, filename ? filename : (typename ? typename : content_type_str));
758 pinfo->private_data = parameters;
760 * First try the dedicated multipart dissector table
762 dissected = dissector_try_string(multipart_media_subdissector_table,
763 content_type_str, tmp_tvb, pinfo, subtree);
766 * Fall back to the default media dissector table
768 dissected = dissector_try_string(media_type_dissector_table,
769 content_type_str, tmp_tvb, pinfo, subtree);
772 const char *save_match_string = pinfo->match_string;
773 pinfo->match_string = content_type_str;
774 call_dissector(media_handle, tmp_tvb, pinfo, subtree);
775 pinfo->match_string = save_match_string;
777 pinfo->private_data = save_private_data;
778 g_free(content_type_str);
779 content_type_str = NULL;
780 parameters = NULL; /* Shares same memory as content_type_str */
782 call_dissector(data_handle, tmp_tvb, pinfo, subtree);
785 proto_item_set_len(ti, boundary_start - start);
786 if (*last_boundary == TRUE) {
787 proto_tree_add_text(tree, tvb,
788 boundary_start, boundary_line_len,
790 tvb_format_text(tvb, boundary_start,
793 proto_tree_add_text(tree, tvb,
794 boundary_start, boundary_line_len,
796 tvb_format_text(tvb, boundary_start,
806 return boundary_start + boundary_line_len;
813 * Call this method to actually dissect the multipart body.
814 * NOTE - Only do so if a boundary string has been found!
816 static void dissect_multipart(tvbuff_t *tvb, packet_info *pinfo,
819 proto_tree *subtree = NULL;
820 proto_item *ti = NULL;
821 multipart_info_t *m_info = get_multipart_info(pinfo);
822 gint header_start = 0;
826 gboolean last_boundary = FALSE;
828 if (m_info == NULL) {
830 * We can't get the required multipart information
832 proto_tree_add_text(tree, tvb, 0, -1,
833 "The multipart dissector could not find "
834 "the required boundary parameter.");
835 call_dissector(data_handle, tvb, pinfo, tree);
838 boundary = (guint8 *)m_info->boundary;
839 boundary_len = m_info->boundary_length;
840 /* Clean up the memory if an exception is thrown */
841 /* CLEANUP_PUSH(cleanup_multipart_info, m_info); */
843 /* Add stuff to the protocol tree */
846 ti = proto_tree_add_item(tree, proto_multipart,
848 subtree = proto_item_add_subtree(ti, ett_multipart);
849 proto_item_append_text(ti, ", Type: %s, Boundary: \"%s\"",
850 m_info->type, m_info->boundary);
852 /* Show multi-part type as a generated field */
853 type_ti = proto_tree_add_string(subtree, hf_multipart_type,
854 tvb, 0, 0, pinfo->match_string);
855 PROTO_ITEM_SET_GENERATED(type_ti);
859 * Make no entries in Protocol column and Info column on summary display,
860 * but stop sub-dissectors from clearing entered text in summary display.
862 if (check_col(pinfo->cinfo, COL_INFO))
863 col_set_fence(pinfo->cinfo, COL_INFO);
868 * Process the multipart preamble
870 header_start = process_preamble(subtree, tvb, boundary,
871 boundary_len, &last_boundary);
872 if (header_start == -1) {
873 call_dissector(data_handle, tvb, pinfo, subtree);
874 /* Clean up the dynamically allocated memory */
875 cleanup_multipart_info(m_info);
879 * Process the encapsulated bodies
881 while (last_boundary == FALSE) {
882 header_start = process_body_part(subtree, tvb, boundary, boundary_len,
883 pinfo, header_start, &last_boundary);
884 if (header_start == -1) {
885 /* Clean up the dynamically allocated memory */
886 cleanup_multipart_info(m_info);
891 * Process the multipart trailer
894 if (tvb_length_remaining(tvb, header_start) > 0) {
895 proto_tree_add_text(subtree, tvb, header_start, -1, "Trailer");
898 /* Clean up the dynamically allocated memory */
899 cleanup_multipart_info(m_info);
903 /* Returns index of method in multipart_headers */
905 is_known_multipart_header(const char *header_str, guint len)
909 for (i = 1; i < array_length(multipart_headers); i++) {
910 if (len == strlen(multipart_headers[i].name) &&
911 strncasecmp(header_str, multipart_headers[i].name, len) == 0)
913 if (multipart_headers[i].compact_name != NULL &&
914 len == strlen(multipart_headers[i].compact_name) &&
915 strncasecmp(header_str, multipart_headers[i].compact_name, len) == 0)
923 * Register the protocol with Wireshark.
925 * This format is required because a script is used to build the C function
926 * that calls all the protocol registration.
930 proto_register_multipart(void)
933 /* Setup list of header fields See Section 1.6.1 for details */
934 static hf_register_info hf[] = {
935 { &hf_multipart_type,
937 "mime_multipart.type",
938 FT_STRING, BASE_NONE, NULL, 0x00,
939 "MIME multipart encapsulation type", HFILL
942 { &hf_multipart_part,
943 { "Encapsulated multipart part",
944 "mime_multipart.part",
945 FT_STRING, BASE_NONE, NULL, 0x00,
946 "Encapsulated multipart part", HFILL
949 { &hf_header_array[POS_CONTENT_DISPOSITION],
950 { "Content-Disposition",
951 "mime_multipart.header.content-disposition",
952 FT_STRING, BASE_NONE, NULL, 0x00,
953 "RFC 2183: Content-Disposition Header", HFILL
956 { &hf_header_array[POS_CONTENT_ENCODING],
957 { "Content-Encoding",
958 "mime_multipart.header.content-encoding",
959 FT_STRING, BASE_NONE, NULL, 0x00,
960 "Content-Encoding Header", HFILL
963 { &hf_header_array[POS_CONTENT_ID],
965 "mime_multipart.header.content-id",
966 FT_STRING, BASE_NONE, NULL, 0x00,
967 "RFC 2045: Content-Id Header", HFILL
970 { &hf_header_array[POS_CONTENT_LANGUAGE],
971 { "Content-Language",
972 "mime_multipart.header.content-language",
973 FT_STRING, BASE_NONE, NULL, 0x00,
974 "Content-Language Header", HFILL
977 { &hf_header_array[POS_CONTENT_LENGTH],
979 "mime_multipart.header.content-length",
980 FT_STRING, BASE_NONE, NULL, 0x0,
981 "Content-Length Header", HFILL
984 { &hf_header_array[POS_CONTENT_TRANSFER_ENCODING],
985 { "Content-Transfer-Encoding",
986 "mime_multipart.header.content-transfer-encoding",
987 FT_STRING, BASE_NONE, NULL, 0x00,
988 "RFC 2045: Content-Transfer-Encoding Header", HFILL
991 { &hf_header_array[POS_CONTENT_TYPE],
993 "mime_multipart.header.content-type",
994 FT_STRING, BASE_NONE,NULL,0x0,
995 "Content-Type Header", HFILL
1003 module_t *multipart_module;
1006 * Setup protocol subtree array
1008 static gint *ett[] = {
1010 &ett_multipart_main,
1011 &ett_multipart_body,
1015 * Register the protocol name and description
1017 proto_multipart = proto_register_protocol(
1018 "MIME Multipart Media Encapsulation",
1023 * Required function calls to register
1024 * the header fields and subtrees used.
1026 proto_register_field_array(proto_multipart, hf, array_length(hf));
1027 proto_register_subtree_array(ett, array_length(ett));
1030 * Get the content type and Internet media type table
1032 media_type_dissector_table = find_dissector_table("media_type");
1034 multipart_module = prefs_register_protocol(proto_multipart, NULL);
1036 prefs_register_bool_preference(multipart_module,
1037 "display_unknown_body_as_text",
1038 "Display bodies without media type as text",
1039 "Display multipart bodies with no media type dissector"
1040 " as raw text (may cause problems with binary data).",
1041 &display_unknown_body_as_text);
1043 prefs_register_bool_preference(multipart_module,
1044 "remove_base64_encoding",
1045 "Remove base64 encoding from bodies",
1046 "Remove any base64 content-transfer encoding from bodies. "
1047 "This supports export of the body and its further dissection.",
1048 &remove_base64_encoding);
1051 * Dissectors requiring different behavior in cases where the media
1052 * is contained in a multipart entity should register their multipart
1053 * dissector in the dissector table below, which is similar to the
1054 * "media_type" dissector table defined in the HTTP dissector code.
1056 multipart_media_subdissector_table = register_dissector_table(
1057 "multipart_media_type",
1058 "Internet media type (for multipart processing)",
1059 FT_STRING, BASE_NONE);
1063 /* If this dissector uses sub-dissector registration add a registration routine.
1064 This format is required because a script is used to find these routines and
1065 create the code that calls these routines.
1068 proto_reg_handoff_multipart(void)
1070 dissector_handle_t multipart_handle;
1073 * When we cannot display the data, call the data dissector.
1074 * When there is no dissector for the given media, call the media dissector.
1076 data_handle = find_dissector("data");
1077 media_handle = find_dissector("media");
1080 * Handle for multipart dissection
1082 multipart_handle = create_dissector_handle(
1083 dissect_multipart, proto_multipart);
1085 dissector_add_string("media_type",
1086 "multipart/mixed", multipart_handle);
1087 dissector_add_string("media_type",
1088 "multipart/related", multipart_handle);
1089 dissector_add_string("media_type",
1090 "multipart/alternative", multipart_handle);
1091 dissector_add_string("media_type",
1092 "multipart/form-data", multipart_handle);