epan/req_resp_hdrs.c

   1 /* req_resp_hdrs.c
   2  * Routines handling protocols with a request/response line, headers,
   3  * a blank line, and an optional body.
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include <epan/strutil.h>
  33 #include <string.h>
  34
  35 #include <epan/req_resp_hdrs.h>
  36
  37 /*
  38  * Optionally do reassembly of the request/response line, headers, and body.
  39  */
  40 gboolean
  41 req_resp_hdrs_do_reassembly(tvbuff_t *tvb, int offset, packet_info *pinfo,
  42     gboolean desegment_headers, gboolean desegment_body)
  43 {
  44         gint            next_offset;
  45         gint            next_offset_sav;
  46         gint            length_remaining, reported_length_remaining;
  47         int             linelen;
  48         gchar           *header_val;
  49         long int        content_length;
  50         gboolean        content_length_found = FALSE;
  51         gboolean        content_type_found = FALSE;
  52         gboolean        chunked_encoding = FALSE;
  53         gboolean        keepalive_found = FALSE;
  54
  55         /*
  56          * Do header desegmentation if we've been told to.
  57          *
  58          * RFC 2616 defines HTTP messages as being either of the
  59          * Request or the Response type
  60          * (HTTP-message = Request | Response).
  61          * Request and Response are defined as:
  62          *     Request = Request-Line
  63          *         *(( general-header
  64          *         | request-header
  65          *         | entity-header ) CRLF)
  66          *         CRLF
  67          *         [ message-body ]
  68          *     Response = Status-Line
  69          *         *(( general-header
  70          *         | response-header
  71          *         | entity-header ) CRLF)
  72          *         CRLF
  73          *         [ message-body ]
  74          * that's why we can always assume two consecutive line
  75          * endings (we allow CR, LF, or CRLF, as some clients
  76          * or servers might not use a full CRLF) to mark the end
  77          * of the headers.  The worst thing that would happen
  78          * otherwise would be the packet not being desegmented
  79          * or being interpreted as only headers.
  80          *
  81          * RFC 2326 says RTSP works the same way; RFC 3261 says SIP
  82          * works the same way.
  83          */
  84
  85         /*
  86          * If header desegmentation is activated, check that all
  87          * headers are in this tvbuff (search for an empty line
  88          * marking end of headers) or request one more byte (we
  89          * don't know how many bytes we'll need, so we just ask
  90          * for one).
  91          */
  92         if (desegment_headers && pinfo->can_desegment) {
  93                 next_offset = offset;
  94                 for (;;) {
  95                         next_offset_sav = next_offset;
  96
  97                         length_remaining = tvb_length_remaining(tvb,
  98                             next_offset);
  99                         reported_length_remaining =
 100                             tvb_reported_length_remaining(tvb, next_offset);
 101
 102                         /*
 103                          * Request one more byte if there're no
 104                          * bytes left in the reported data (if there're
 105                          * bytes left in the reported data, but not in
 106                          * the available data, requesting more bytes
 107                          * won't help, as those bytes weren't captured).
 108                          */
 109                         if (reported_length_remaining < 1) {
 110                                 pinfo->desegment_offset = offset;
 111                                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 112                                 return FALSE;
 113                         }
 114
 115                         /*
 116                          * Request one more byte if we cannot find a
 117                          * header (i.e. a line end).
 118                          */
 119                         linelen = tvb_find_line_end(tvb, next_offset,
 120                             -1, &next_offset, TRUE);
 121                         if (linelen == -1 &&
 122                             length_remaining >= reported_length_remaining) {
 123                                 /*
 124                                  * Not enough data; ask for one more
 125                                  * byte.
 126                                  */
 127                                 pinfo->desegment_offset = offset;
 128                                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 129                                 return FALSE;
 130                         } else if (linelen == 0) {
 131                                 /*
 132                                  * We found the end of the headers.
 133                                  */
 134                                 break;
 135                         }
 136
 137                         /*
 138                          * Is this a Content-Length or Transfer-Encoding
 139                          * header?  If not, it either means that we are in
 140                          * a different header line, or that we are
 141                          * at the end of the headers, or that there
 142                          * isn't enough data; the two latter cases
 143                          * have already been handled above.
 144                          */
 145                         if (desegment_body) {
 146                                 /*
 147                                  * Check if we've found Content-Length.
 148                                  */
 149                                 if (tvb_strncaseeql(tvb, next_offset_sav,
 150                                     "Content-Length:", 15) == 0) {
 151                                         header_val = tvb_get_ephemeral_string(tvb,
 152                                             next_offset_sav + 15,
 153                                             linelen - 15);
 154                                         if (sscanf(header_val,
 155                                             "%li", &content_length)
 156                                             == 1)
 157                                                 content_length_found = TRUE;
 158                                 } else if (tvb_strncaseeql(tvb, next_offset_sav,
 159                                     "Content-Type:", 13) == 0) {
 160                                         content_type_found = TRUE;
 161                                 } else if (tvb_strncaseeql(tvb, next_offset_sav,
 162                                     "Connection:", 11) == 0) {
 163                                         /* Check for keep-alive */
 164                                         header_val = tvb_get_ephemeral_string(tvb,
 165                                             next_offset_sav + 11,
 166                                             linelen - 11);
 167                                         if(header_val){
 168                                                 while(*header_val==' '){
 169                                                         header_val++;
 170                                                 }
 171                                                 if(!strncasecmp(header_val, "Keep-Alive", 10)){
 172                                                         keepalive_found = TRUE;
 173                                                 }
 174                                         }
 175                                 } else if (tvb_strncaseeql(tvb,
 176                                             next_offset_sav,
 177                                             "Transfer-Encoding:", 18) == 0) {
 178                                         /*
 179                                          * Find out if this Transfer-Encoding is
 180                                          * chunked.  It should be, since there
 181                                          * really aren't any other types, but
 182                                          * RFC 2616 allows for them.
 183                                          */
 184                                         gchar *p;
 185                                         gint len;
 186
 187                                         header_val = tvb_get_ephemeral_string(tvb,
 188                                             next_offset_sav + 18, linelen - 18);
 189                                         p = header_val;
 190                                         len = strlen(header_val);
 191                                         /* Skip white space */
 192                                         while (p < header_val + len &&
 193                                             (*p == ' ' || *p == '\t'))
 194                                                 p++;
 195                                         if (p <= header_val + len) {
 196                                                 if (strncasecmp(p, "chunked", 7)
 197                                                     == 0) {
 198                                                         /*
 199                                                          * Don't bother looking
 200                                                          * for extensions;
 201                                                          * since we don't
 202                                                          * understand them,
 203                                                          * they should be
 204                                                          * ignored.
 205                                                          */
 206                                                         chunked_encoding = TRUE;
 207                                                 }
 208                                         }
 209                                 }
 210                         }
 211                 }
 212         }
 213
 214         /*
 215          * The above loop ends when we reached the end of the headers, so
 216          * there should be content_length bytes after the 4 terminating bytes
 217          * and next_offset points to after the end of the headers.
 218          */
 219         if (desegment_body) {
 220                 if (content_length_found) {
 221                         /* next_offset has been set to the end of the headers */
 222                         if (!tvb_bytes_exist(tvb, next_offset, content_length)) {
 223                                 length_remaining = tvb_length_remaining(tvb,
 224                                     next_offset);
 225                                 reported_length_remaining =
 226                                     tvb_reported_length_remaining(tvb, next_offset);
 227                                 if (length_remaining < reported_length_remaining) {
 228                                         /*
 229                                          * It's a waste of time asking for more
 230                                          * data, because that data wasn't captured.
 231                                          */
 232                                         return TRUE;
 233                                 }
 234                                 if (length_remaining == -1)
 235                                         length_remaining = 0;
 236                                 pinfo->desegment_offset = offset;
 237                                 pinfo->desegment_len =
 238                                     content_length - length_remaining;
 239                                 return FALSE;
 240                         }
 241                 } else if (chunked_encoding) {
 242                         /*
 243                          * This data is chunked, so we need to keep pulling
 244                          * data until we reach the end of the stream, or a
 245                          * zero sized chunk.
 246                          *
 247                          * XXX
 248                          * This doesn't bother with trailing headers; I don't
 249                          * think they are really used, and we'd have to use
 250                          * is_http_request_or_reply() to determine if it was
 251                          * a trailing header, or the start of a new response.
 252                          */
 253                         gboolean done_chunking = FALSE;
 254
 255                         while (!done_chunking) {
 256                                 gint chunk_size = 0;
 257                                 gint chunk_offset = 0;
 258                                 gchar *chunk_string = NULL;
 259                                 gchar *c = NULL;
 260
 261                                 length_remaining = tvb_length_remaining(tvb,
 262                                     next_offset);
 263                                 reported_length_remaining =
 264                                     tvb_reported_length_remaining(tvb,
 265                                     next_offset);
 266
 267                                 if (reported_length_remaining < 1) {
 268                                         pinfo->desegment_offset = offset;
 269                                         pinfo->desegment_len = 1;
 270                                         return FALSE;
 271                                 }
 272
 273                                 linelen = tvb_find_line_end(tvb, next_offset,
 274                                                 -1, &chunk_offset, TRUE);
 275
 276                                 if (linelen == -1 &&
 277                                     length_remaining >=
 278                                     reported_length_remaining) {
 279                                          pinfo->desegment_offset = offset;
 280                                          pinfo->desegment_len = 2;
 281                                          return FALSE;
 282                                 }
 283
 284                                 /* We have a line with the chunk size in it.*/
 285                                 chunk_string = tvb_get_ephemeral_string(tvb, next_offset,
 286                                     linelen);
 287                                 c = chunk_string;
 288
 289                                 /*
 290                                  * We don't care about the extensions.
 291                                  */
 292                                 if ((c = strchr(c, ';'))) {
 293                                         *c = '\0';
 294                                 }
 295
 296                                 if ((sscanf(chunk_string, "%x",
 297                                     &chunk_size) < 0) || chunk_size < 0) {
 298                                         /* We couldn't get the chunk size,
 299                                          * so stop trying.
 300                                          */
 301                                         return TRUE;
 302                                 }
 303
 304                                 if (chunk_size == 0) {
 305                                         /*
 306                                          * This is the last chunk.  Let's pull in the
 307                                          * trailing CRLF.
 308                                          */
 309                                         linelen = tvb_find_line_end(tvb,
 310                                             chunk_offset, -1, &chunk_offset, TRUE);
 311
 312                                         if (linelen == -1 &&
 313                                             length_remaining >=
 314                                             reported_length_remaining) {
 315                                                 pinfo->desegment_offset = offset;
 316                                                 pinfo->desegment_len = 1;
 317                                                 return FALSE;
 318                                         }
 319
 320                                         pinfo->desegment_offset = chunk_offset;
 321                                         pinfo->desegment_len = 0;
 322                                         done_chunking = TRUE;
 323                                 } else {
 324                                         /*
 325                                          * Skip to the next chunk if we
 326                                          * already have it
 327                                          */
 328                                         if (reported_length_remaining >
 329                                                 chunk_size) {
 330
 331                                                 next_offset = chunk_offset
 332                                                     + chunk_size + 2;
 333                                         } else {
 334                                                 /*
 335                                                  * Fetch this chunk, plus the
 336                                                  * trailing CRLF.
 337                                                  */
 338                                                 pinfo->desegment_offset = offset;
 339                                                 pinfo->desegment_len =
 340                                                     chunk_size + 1 -
 341                                                     reported_length_remaining;
 342                                                 return FALSE;
 343                                         }
 344                                 }
 345
 346                         }
 347                 } else if (content_type_found && pinfo->can_desegment) {
 348                         /* We found a content-type but no content-length.
 349                          * This is probably a HTTP header for a session with
 350                          * only one HTTP PDU and where the content spans
 351                          * until the end of the tcp session, unless there
 352                          * is a keepalive header present in which case we
 353                          * assume there is no message body at all and thus
 354                          * we wont do any reassembly.
 355                          * Set up tcp reassembly until the end of this session.
 356                          */
 357                         length_remaining = tvb_length_remaining(tvb, next_offset);
 358                         reported_length_remaining = tvb_reported_length_remaining(tvb, next_offset);
 359                         if (length_remaining < reported_length_remaining) {
 360                                 /*
 361                                  * It's a waste of time asking for more
 362                                  * data, because that data wasn't captured.
 363                                  */
 364                                 return TRUE;
 365                         }
 366
 367                         if (keepalive_found) {
 368                                 /* We have a keep-alive but no content-length.
 369                                  * Assume there is no message body and dont
 370                                  * do any reassembly.
 371                                  */
 372                                 return TRUE;
 373                         }
 374
 375                         pinfo->desegment_offset = offset;
 376                         pinfo->desegment_len = DESEGMENT_UNTIL_FIN;
 377
 378                         return FALSE;
 379                 }
 380
 381         }
 382
 383         /*
 384          * No further desegmentation needed.
 385          */
 386         return TRUE;
 387 }