2 * Routines for AJP13 dissection
3 * Copyright 2002, Christopher K. St. John <cks@distributopia.com>
5 * $Id: packet-ajp13.c,v 1.10 2003/03/26 21:47:34 guy Exp $
7 * Ethereal - Network traffic analyzer
8 * By Gerald Combs <gerald@ethereal.com>
9 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
36 #include <epan/packet.h>
37 #include <epan/conversation.h>
38 #include "packet-tcp.h"
42 /* IMPORTANT IMPLEMENTATION NOTES
44 * You need to be looking at: jk/doc/AJP13.html in the
45 * jakarta-tomcat-connectors repository.
47 * If you're an ethereal dissector guru, then you can skip the rest of
48 * this. I'm writing it all down because I've written 3 dissectors so
49 * far and every time I've forgotten it all and had to re-learn it
50 * from scratch. Not this time, damnit.
52 * Dissector routines get called in two phases:
54 * The first phase is an in-order traversal of every incoming
55 * frame. Since we know it's in-order, we can set up a "conversational
56 * state" that records context-sensitive stuff like "was there a
57 * content-length in the previous request". During this first pass
58 * through the data, the "tree" parameter might be null, or not. For
59 * the regular gui-based ethereal, it's null, which means we don't
60 * actually display the dissected data in the gui quite yet. For the
61 * text based interface, we might do the parsing and display both in
64 * The second phase happens when the data is actually displayed. In
65 * this pase the "tree" param is non-null, so you've got a hook to
66 * hang the parsed-out display data on. Since there might be gigabytes
67 * worth of capture data, the display code only calls the dissector
68 * for the stuff the user actually clicks on. So you have to assume
69 * the dissector is getting called on random frames, you can't depend
70 * on ordering anymore.
72 * But some parts of the AJP13 capture stream are context sensitive.
73 * That's no big deal during the first in-order pass, but the second
74 * phase requires us to display any random frame correctly. So during
75 * the first in-order phase we create a per-frame user data structure
76 * and attach it to the frame using p_add_proto_data.
78 * Since AJP13 is a TCP/IP based protocol, writing a dissector for it
79 * requires addressing several other issues:
81 * 1) TCP/IP segments can get retransmitted or be sent out of
82 * order. Users don't normally care, because the low-level kernel
83 * networking code takes care of reassembling them properly. But we're
84 * looking at raw network packets, aren't we? The stuff on the
85 * wire. Ethereal has been getting better and better at helping
86 * dissectors with this. I'm a little fuzzy on the details, but my
87 * uderstanding is that ethereal now contains a fairly substantial
88 * user-space TCP/IP stack so it can re-assemble the data. But I might
89 * be wrong. Since AJP13 is going to be used either on the loopback
90 * interface or on a LAN, it isn't likely to be a big issues anyway.
92 * 2) AJP13 packets (PDU's or protocol data unit's in
93 * networking-speak) don't necessarily line up with TCP segments. That
94 * is, one TCP segment can have more than one AJP13 PDU, or one AJP13
95 * PDU can stretch across multiple TCP segments. Assembling them is
96 * obviously possible, but a royal pain. During the "phase one"
97 * in-order pass you have to keep track of a bunch of offsets and
98 * store which PDU goes with which TCP segment. Luckly, recent
99 * (0.9.4+) versions of ethereal provide the "tcp_dissect_pdus()"
100 * function that takes care of much of the work. See the comments in
101 * packet-tcp.c, the example code in packet-dns.c, or check the
102 * ethereal-dev archives for details.
104 * 3) Ethereal isn't guaranteed to see all the data. I'm a little
105 * unclear on all the possible failure modes, but it comes down to: a)
106 * Not your fault: it's an imperfect world, we're eavesdroppers, and
107 * stuff happens. We might totally miss packets or get garbled
108 * data. Or b) Totally your fault: you turn on the capture during the
109 * middle of an AJP13 conversation and the capture starts out with
110 * half an AJP13 PDU. This code doesn't currently handle either case
111 * very well, but you can get arbitrarily clever. Like: put in tests
112 * to see if this packet has reasonable field values, and if it
113 * doesn't, walk the offset ahead until we see a matching magic number
114 * field, then re-test. But we don't do that now, and since we're
115 * using tcp_dissect_pdu's, I'm not sure how to do it.
121 * Request/response header codes. Common headers are stored as ints in
122 * an effort to improve performance. Why can't we just have one big
126 static const value_string req_header_codes[] = {
128 { 0x02, "accept-charset" },
129 { 0x03, "accept-encoding" },
130 { 0x04, "accept-language" },
131 { 0x05, "authorization" },
132 { 0x06, "connection" },
133 { 0x07, "content-type" },
134 { 0x08, "content-length" },
140 { 0x0E, "user-agent" },
144 static const value_string rsp_header_codes[] = {
145 { 0x01, "Content-Type" },
146 { 0x02, "Content-Language" },
147 { 0x03, "Content-Length" },
149 { 0x05, "Last-Modified" },
150 { 0x06, "Location" },
151 { 0x07, "Set-Cookie" },
152 { 0x08, "Set-Cookie2" },
153 { 0x09, "Servlet-Engine" },
155 { 0x0B, "WWW-Authenticate" },
159 static const value_string mtype_codes[] = {
162 { 2, "FORWARD REQUEST" },
163 { 3, "SEND BODY CHUNK" },
164 { 4, "SEND HEADERS" },
165 { 5, "END RESPONSE" },
166 { 6, "GET BODY CHUNK" },
171 static const value_string http_method_codes[] = {
188 { 17, "VERSION-CONTROL" },
191 { 20, "UNCHECKOUT" },
197 static int proto_ajp13 = -1;
198 static int hf_ajp13_magic = -1;
199 static int hf_ajp13_len = -1;
200 static int hf_ajp13_code = -1;
201 static int hf_ajp13_method = -1;
202 static int hf_ajp13_ver = -1;
203 static int hf_ajp13_uri = -1;
204 static int hf_ajp13_raddr = -1;
205 static int hf_ajp13_rhost = -1;
206 static int hf_ajp13_srv = -1;
207 static int hf_ajp13_port = -1;
208 static int hf_ajp13_sslp = -1;
209 static int hf_ajp13_nhdr = -1;
210 static int hf_ajp13_hname = -1;
211 static int hf_ajp13_hval = -1;
212 static int hf_ajp13_rlen = -1;
213 static int hf_ajp13_reusep = -1;
214 static int hf_ajp13_rstatus= -1;
215 static int hf_ajp13_rsmsg = -1;
216 static int hf_ajp13_data = -1;
217 static gint ett_ajp13 = -1;
220 typedef struct ajp13_conv_data {
222 gboolean was_get_body_chunk; /* XXX - not used */
225 static GMemChunk *ajp13_conv_data_chunk = NULL;
227 typedef struct ajp13_frame_data {
228 gboolean is_request_body;
231 static GMemChunk *ajp13_frame_data_chunk = NULL;
233 static int ajp13_packet_init_count = 100;
235 /* ajp13, in sort of a belt-and-suspenders move, encodes strings with
236 * both a leading length field, and a trailing null. Mostly, see
237 * AJPv13.html. The returned length _includes_ the trailing null, if
240 * XXX - is there a tvbuff routine to handle this?
243 get_nstring(tvbuff_t *tvb, gint offset, guint8* cbuf, size_t cbuflen)
248 len = tvb_get_ntohs(tvb, offset);
255 if (copylen > cbuflen - 1)
256 copylen = cbuflen - 1;
257 tvb_memcpy(tvb, cbuf, offset+2, copylen);
258 cbuf[copylen] = '\0';
266 /* dissect a response. more work to do here.
269 display_rsp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *ajp13_tree)
271 gchar* msg_code = NULL;
274 char mcode_buf[1024];
280 proto_tree_add_item(ajp13_tree, hf_ajp13_magic, tvb, pos, 2, 0);
286 proto_tree_add_item(ajp13_tree, hf_ajp13_len, tvb, pos, 2, 0);
291 mcode = tvb_get_guint8(tvb, pos);
292 msg_code = val_to_str(mcode, mtype_codes, "UNKNOWN");
293 sprintf(mcode_buf, "(%d) %s", mcode, msg_code);
295 proto_tree_add_string(ajp13_tree, hf_ajp13_code, tvb, pos, 1, mcode_buf);
298 if(check_col(pinfo->cinfo, COL_INFO))
299 col_append_str(pinfo->cinfo, COL_INFO, msg_code);
303 proto_tree_add_item(ajp13_tree, hf_ajp13_reusep, tvb, pos, 1, 0);
306 } else if (mcode == 4) {
308 guint8 rsmsg_bytes[8*1024]; /* DANGER WILL ROBINSON */
313 /* HTTP RESPONSE STATUS CODE
315 rcode_num = tvb_get_ntohs(tvb, pos);
317 proto_tree_add_item(ajp13_tree, hf_ajp13_rstatus, tvb, pos, 2, 0);
319 if(check_col(pinfo->cinfo, COL_INFO))
320 col_append_fstr(pinfo->cinfo, COL_INFO, ":%d", rcode_num);
322 /* HTTP RESPONSE STATUS MESSAGE
324 rsmsg_len = get_nstring(tvb, pos, rsmsg_bytes, sizeof rsmsg_bytes);
327 proto_tree_add_item(ajp13_tree, hf_ajp13_rsmsg, tvb, pos, rsmsg_len, 0);
329 /* dangerous assumption that we can just %s out raw bytes */
330 if(check_col(pinfo->cinfo, COL_INFO))
331 col_append_fstr(pinfo->cinfo, COL_INFO, " %s", rsmsg_bytes);
335 nhdr = tvb_get_ntohs(tvb, pos);
337 proto_tree_add_item(ajp13_tree, hf_ajp13_nhdr, tvb, pos, 2, 0);
342 for(i=0; i<nhdr; i++) {
352 guint8 hname_bytes[1024];
353 gchar hname_value[8*1024];
357 hcd = tvb_get_guint8(tvb, pos);
361 hid = tvb_get_guint8(tvb, pos);
364 hname = val_to_str(hid, rsp_header_codes, "UNKNOWN");
365 /* Content-Length header (encoded by 0x08) is special */
369 int hname_len = get_nstring(tvb, pos, hname_bytes, sizeof hname_bytes);
372 hname = (gchar*)hname_bytes; /* VERY EVIL */
380 hval_len = get_nstring(tvb, pos, hval, sizeof hval);
385 sprintf(hname_value, "%s : %s", hname, hval);
386 proto_tree_add_string(ajp13_tree, hf_ajp13_hval, tvb, orig_pos, dp, hname_value);
390 } else if (mcode == 6) {
392 proto_tree_add_item(ajp13_tree, hf_ajp13_rlen, tvb, pos, 2, 0);
396 /* MESSAGE DATA (COPOUT)
399 proto_tree_add_item(ajp13_tree, hf_ajp13_data, tvb, pos+2, -1, 0);
405 /* dissect a request body. see AJPv13.html, but the idea is that these
406 * packets, unlike all other packets, have no type field. you just
407 * sort of have to know that they're coming based on the previous
411 display_req_body(tvbuff_t *tvb, proto_tree *ajp13_tree)
413 /*printf("ajp13:display_req_body()\n");*/
417 guint8 body_bytes[128*1024]; /* DANGER WILL ROBINSON */
423 proto_tree_add_item(ajp13_tree, hf_ajp13_magic, tvb, pos, 2, 0);
428 proto_tree_add_item(ajp13_tree, hf_ajp13_len, tvb, pos, 2, 0);
433 body_len = get_nstring(tvb, pos, body_bytes, sizeof body_bytes);
434 proto_tree_add_item(ajp13_tree, hf_ajp13_data, tvb, pos+2, body_len-1, 0);
440 /* note that even if ajp13_tree is null on the first pass, we still
441 * need to dissect the packet in order to determine if there is a
442 * content-length, and thus if there is a subsequent automatic
443 * request-body transmitted in the next request packet. if there is a
444 * content-length, we record the fact in the conversation context.
445 * ref the top of this file for comments explaining the multi-pass
449 display_req_forward(tvbuff_t *tvb, packet_info *pinfo,
450 proto_tree *ajp13_tree,
470 proto_tree_add_item(ajp13_tree, hf_ajp13_magic, tvb, pos, 2, 0);
474 proto_tree_add_item(ajp13_tree, hf_ajp13_len, tvb, pos, 2, 0);
479 cod = tvb_get_guint8(tvb, 4);
481 gchar* msg_code = NULL;
482 char mcode_buf[1024];
483 msg_code = val_to_str(cod, mtype_codes, "UNKNOWN");
484 sprintf(mcode_buf, "(%d) %s", cod, msg_code);
485 proto_tree_add_string(ajp13_tree, hf_ajp13_code, tvb, pos, 1, mcode_buf);
489 /* HTTP METHOD (ENCODED AS INTEGER)
492 gchar* meth_code = NULL;
493 meth = tvb_get_guint8(tvb, pos);
494 meth_code = val_to_str(meth, http_method_codes, "UNKNOWN");
496 char mcode_buf[1024];
497 sprintf(mcode_buf, "(%d) %s", meth, meth_code);
498 proto_tree_add_string(ajp13_tree, hf_ajp13_method, tvb, pos, 1, mcode_buf);
500 if(check_col(pinfo->cinfo, COL_INFO))
501 col_append_str(pinfo->cinfo, COL_INFO, meth_code);
505 /* HTTP VERSION STRING
507 ver_len = get_nstring(tvb, pos, ver, sizeof ver);
508 pos+=2; /* skip over size */
510 proto_tree_add_item(ajp13_tree, hf_ajp13_ver, tvb, pos, ver_len, 0);
511 pos=pos+ver_len; /* skip over chars + trailing null */
515 uri_len = get_nstring(tvb, pos, uri, sizeof uri);
516 pos+=2; /* skip over size */
518 proto_tree_add_item(ajp13_tree, hf_ajp13_uri, tvb, pos, uri_len, 0);
519 pos=pos+uri_len; /* skip over chars + trailing null */
522 if(check_col(pinfo->cinfo, COL_INFO))
523 col_append_fstr(pinfo->cinfo, COL_INFO, " %s %s", uri, ver);
528 raddr_len = get_nstring(tvb, pos, raddr, sizeof raddr);
529 pos+=2; /* skip over size */
531 proto_tree_add_item(ajp13_tree, hf_ajp13_raddr, tvb, pos, raddr_len, 0);
532 pos=pos+raddr_len; /* skip over chars + trailing null */
536 rhost_len = get_nstring(tvb, pos, rhost, sizeof rhost);
537 pos+=2; /* skip over size */
539 proto_tree_add_item(ajp13_tree, hf_ajp13_rhost, tvb, pos, rhost_len, 0);
540 pos=pos+rhost_len; /* skip over chars + trailing null */
544 srv_len = get_nstring(tvb, pos, srv, sizeof srv);
545 pos+=2; /* skip over size */
547 proto_tree_add_item(ajp13_tree, hf_ajp13_srv, tvb, pos, srv_len, 0);
548 pos=pos+srv_len; /* skip over chars + trailing null */
553 proto_tree_add_item(ajp13_tree, hf_ajp13_port, tvb, pos, 2, 0);
559 proto_tree_add_item(ajp13_tree, hf_ajp13_sslp, tvb, pos, 1, 0);
564 nhdr = tvb_get_ntohs(tvb, pos);
567 proto_tree_add_item(ajp13_tree, hf_ajp13_nhdr, tvb, pos, 2, 0);
569 cd->content_length = 0;
573 for(i=0; i<nhdr; i++) {
583 guint8 hname_bytes[1024];
587 hcd = tvb_get_guint8(tvb, pos);
591 hid = tvb_get_guint8(tvb, pos);
594 hname = val_to_str(hid, req_header_codes, "UNKNOWN");
598 int hname_len = get_nstring(tvb, pos, hname_bytes, sizeof hname_bytes);
601 hname = (gchar*)hname_bytes; /* VERY EVIL */
609 hval_len = get_nstring(tvb, pos, hval, sizeof hval);
614 proto_tree_add_string_format(ajp13_tree, hf_ajp13_hval,
615 tvb, orig_pos, dp, hname,
616 "%s: %s", hname, hval);
620 cd->content_length = cl;
627 /* main dissector function. ethereal calls it for segments in both
631 dissect_ajp13_tcp_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
635 conversation_t *conv = NULL;
636 ajp13_conv_data *cd = NULL;
637 proto_tree *ajp13_tree = NULL;
638 ajp13_frame_data* fd = NULL;
640 /* conversational state really only does us good during the first
643 conv = find_conversation(&pinfo->src, &pinfo->dst, pinfo->ptype,
644 pinfo->srcport, pinfo->destport, 0);
646 conv = conversation_new(&pinfo->src, &pinfo->dst, pinfo->ptype,
647 pinfo->srcport, pinfo->destport, 0);
649 cd = (ajp13_conv_data*)conversation_get_proto_data(conv, proto_ajp13);
651 cd = (ajp13_conv_data*)g_mem_chunk_alloc(ajp13_conv_data_chunk);
652 cd->content_length = 0;
653 cd->was_get_body_chunk = FALSE;
654 conversation_add_proto_data(conv, proto_ajp13, cd);
657 /* we use the per segment user data to record the conversational
658 * state for use later on when we're called out of order (see
659 * comments at top of this file)
661 fd = (ajp13_frame_data*)p_get_proto_data(pinfo->fd, proto_ajp13);
663 /*printf("ajp13:dissect_ajp13_common():no frame data, adding");*/
664 /* since there's no per-packet user data, this must be the first
665 * time we've see the packet, and it must be the first "in order"
666 * pass through the data.
668 fd = (ajp13_frame_data*)g_mem_chunk_alloc(ajp13_frame_data_chunk);
669 p_add_proto_data(pinfo->fd, proto_ajp13, fd);
670 fd->is_request_body = FALSE;
671 if (cd->content_length) {
672 /* this is screwy, see AJPv13.html. the idea is that if the
673 * request has a body (as determined by the content-length
674 * header), then there's always an immediate follow-up PDU with
675 * no GET_BODY_CHUNK from the container.
677 fd->is_request_body = TRUE;
681 if (check_col(pinfo->cinfo, COL_INFO))
682 col_clear(pinfo->cinfo, COL_INFO);
684 mag = tvb_get_ntohs(tvb, 0);
685 len = tvb_get_ntohs(tvb, 2);
687 if (check_col(pinfo->cinfo, COL_PROTOCOL))
688 col_set_str(pinfo->cinfo, COL_PROTOCOL, "AJP13");
689 if (check_col(pinfo->cinfo, COL_INFO)) {
690 if (mag == 0x1234 && !fd->is_request_body)
691 col_append_fstr(pinfo->cinfo, COL_INFO, "%d:REQ:", conv->index);
692 else if (mag == 0x1234 && fd->is_request_body)
693 col_append_fstr(pinfo->cinfo, COL_INFO, "%d:REQ:Body", conv->index);
694 else if (mag == 0x4142)
695 col_append_fstr(pinfo->cinfo, COL_INFO, "%d:RSP:", conv->index);
697 col_set_str(pinfo->cinfo, COL_INFO, "AJP13 Error?");
702 ti = proto_tree_add_item(tree, proto_ajp13, tvb, 0, tvb_length(tvb), FALSE);
703 ajp13_tree = proto_item_add_subtree(ti, ett_ajp13);
708 if (fd->is_request_body)
709 display_req_body(tvb, ajp13_tree);
711 display_req_forward(tvb, pinfo, ajp13_tree, cd);
713 } else if (mag == 0x4142) {
715 display_rsp(tvb, pinfo, ajp13_tree);
722 /* given the first chunk of the AJP13 pdu, extract out and return the
723 * packet length. see comments in packet-tcp.c:tcp_dissect_pdus().
726 get_ajp13_pdu_len(tvbuff_t *tvb, int offset)
730 magic = tvb_get_ntohs(tvb, offset);
731 plen = tvb_get_ntohs(tvb, offset+2);
738 /* Code to actually dissect the packets.
741 dissect_ajp13(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
743 /* Set up structures needed to add the protocol subtree and manage it
745 tcp_dissect_pdus(tvb, pinfo, tree,
746 TRUE, /* desegment or not */
747 4, /* magic + length */
748 get_ajp13_pdu_len, /* use first 4, calc data len */
749 dissect_ajp13_tcp_pdu); /* the naive dissector */
755 ajp13_init_protocol(void)
757 if (ajp13_conv_data_chunk)
758 g_mem_chunk_destroy(ajp13_conv_data_chunk);
759 if (ajp13_frame_data_chunk)
760 g_mem_chunk_destroy(ajp13_frame_data_chunk);
762 ajp13_conv_data_chunk = g_mem_chunk_new("ajp13_conv_data_chunk",
763 sizeof(ajp13_conv_data),
764 ajp13_packet_init_count * sizeof(ajp13_conv_data),
767 ajp13_frame_data_chunk = g_mem_chunk_new("ajp13_frame_data_chunk",
768 sizeof(ajp13_frame_data),
769 ajp13_packet_init_count * sizeof(ajp13_frame_data),
774 proto_register_ajp13(void)
776 static hf_register_info hf[] = {
778 { "Magic", "ajp13.magic", FT_BYTES, BASE_HEX, NULL, 0x0, "Magic Number",
782 { "Length", "ajp13.len", FT_UINT16, BASE_DEC, NULL, 0x0, "Data Length",
786 { "Code", "ajp13.code", FT_STRING, BASE_DEC, NULL, 0x0, "Type Code",
790 { "Method", "ajp13.method", FT_STRING, BASE_DEC, NULL, 0x0, "HTTP Method",
794 { "Version", "ajp13.ver", FT_STRING, BASE_DEC, NULL, 0x0, "HTTP Version",
798 { "URI", "ajp13.uri", FT_STRING, BASE_DEC, NULL, 0x0, "HTTP URI",
802 { "RADDR", "ajp13.raddr", FT_STRING, BASE_DEC, NULL, 0x0, "Remote Address",
806 { "RHOST", "ajp13.rhost", FT_STRING, BASE_DEC, NULL, 0x0, "Remote Host",
810 { "SRV", "ajp13.srv", FT_STRING, BASE_DEC, NULL, 0x0, "Server",
814 { "PORT", "ajp13.port", FT_UINT16, BASE_DEC, NULL, 0x0, "Port",
818 { "SSLP", "ajp13.sslp", FT_UINT8, BASE_DEC, NULL, 0x0, "Is SSL?",
822 { "NHDR", "ajp13.nhdr", FT_UINT16, BASE_DEC, NULL, 0x0, "Num Headers",
826 { "HNAME", "ajp13.hname", FT_STRING, BASE_DEC, NULL, 0x0, "Header Name",
830 { "HVAL", "ajp13.hval", FT_STRING, BASE_DEC, NULL, 0x0, "Header Value",
834 { "RLEN", "ajp13.rlen", FT_UINT16, BASE_DEC, NULL, 0x0, "Requested Length",
838 { "REUSEP", "ajp13.reusep", FT_UINT8, BASE_DEC, NULL, 0x0, "Reuse Connection?",
842 { "RSTATUS", "ajp13.rstatus", FT_UINT16, BASE_DEC, NULL, 0x0, "HTTP Status Code",
846 { "RSMSG", "ajp13.rmsg", FT_STRING, BASE_DEC, NULL, 0x0, "HTTP Status Message",
850 { "Data", "ajp13.data", FT_STRING, BASE_DEC, NULL, 0x0, "Data",
855 static gint *ett[] = {
859 /* Register the protocol name and description
861 proto_ajp13 = proto_register_protocol("Apache JServ Protocol v1.3", "AJP13", "ajp13");
863 proto_register_field_array(proto_ajp13, hf, array_length(hf));
864 proto_register_subtree_array(ett, array_length(ett));
866 register_init_routine(&ajp13_init_protocol);
872 proto_reg_handoff_ajp13(void)
874 dissector_handle_t ajp13_handle;
875 ajp13_handle = create_dissector_handle(dissect_ajp13, proto_ajp13);
876 dissector_add("tcp.port", 8009, ajp13_handle);