epan/dissectors/packet-multipart.c

   1 /* packet-multipart.c
   2  * Routines for multipart media encapsulation dissection
   3  * Copyright 2004, Anders Broman.
   4  * Copyright 2004, Olivier Biot.
   5  *
   6  * $Id$
   7  *
   8  * Refer to the AUTHORS file or the AUTHORS section in the man page
   9  * for contacting the author(s) of this file.
  10  *
  11  * Wireshark - Network traffic analyzer
  12  * By Gerald Combs <gerald@wireshark.org>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  29  *
  30  * References for "media-type multipart/mixed :
  31  * http://www.iana.org/assignments/media-types/index.html
  32  * http://www.rfc-editor.org/rfc/rfc2045.txt
  33  * http://www.rfc-editor.org/rfc/rfc2046.txt
  34  * http://www.rfc-editor.org/rfc/rfc2047.txt
  35  * http://www.rfc-editor.org/rfc/rfc2048.txt
  36  * http://www.rfc-editor.org/rfc/rfc2049.txt
  37  *
  38  * Part of the code is modeled from the SIP and HTTP dissectors
  39  *
  40  * General format of a MIME multipart document:
  41  *              [ preamble line-end ]
  42  *              dash-boundary transport-padding line-end
  43  *              body-part
  44  *              *encapsulation
  45  *              close-delimiter transport-padding
  46  *              [ line-end epilogue ]
  47  *
  48  * Where:
  49  *              dash-boundary     := "--" boundary
  50  *              encapsulation     := delimiter transport-padding line-end body-part
  51  *              delimiter         := line-end body-part
  52  *              close-delimiter   := delimiter "--"
  53  *              body-part         := MIME-part-headers [ line-end *OCTET ]
  54  *              transport-padding := *LWSP-char
  55  *
  56  * Note that line-end is often a LF instead of a CRLF.
  57 */
  58
  59 #ifdef HAVE_CONFIG_H
  60 #include "config.h"
  61 #endif
  62
  63 #include <stdio.h>
  64 #include <stdlib.h>
  65 #include <string.h>
  66 #include <epan/prefs.h>
  67 #include <glib.h>
  68 #include <ctype.h>
  69 #include <epan/emem.h>
  70
  71 #include <epan/packet.h>
  72
  73 /* Dissector table for media requiring special attention in multipart
  74  * encapsulation. */
  75 static dissector_table_t multipart_media_subdissector_table;
  76
  77 /* Initialize the protocol and registered fields */
  78 static int proto_multipart = -1;
  79
  80 /* Initialize the subtree pointers */
  81 static gint ett_multipart = -1;
  82 static gint ett_multipart_main = -1;
  83 static gint ett_multipart_body = -1;
  84
  85 /* Not sure that compact_name exists for multipart, but choose to keep
  86  * the structure from SIP dissector, all the content- is also from SIP */
  87
  88
  89 typedef struct {
  90         const char *name;
  91         const char *compact_name;
  92 } multipart_header_t;
  93
  94 static const multipart_header_t multipart_headers[] = {
  95         { "Unknown-header", NULL },             /* Pad so that the real headers start at index 1 */
  96         { "Content-Disposition", NULL },
  97         { "Content-Encoding", "e" },
  98         { "Content-Id", NULL },
  99         { "Content-Language", NULL },
 100         { "Content-Length", "l" },
 101         { "Content-Transfer-Encoding", NULL },
 102         { "Content-Type", "c" },
 103 };
 104
 105 #define POS_CONTENT_DISPOSITION                 1
 106 #define POS_CONTENT_ENCODING                    2
 107 #define POS_CONTENT_ID                                  3
 108 #define POS_CONTENT_LANGUAGE                    4
 109 #define POS_CONTENT_LENGTH                              5
 110 #define POS_CONTENT_TRANSFER_ENCODING   6
 111 #define POS_CONTENT_TYPE                                7
 112
 113 /* Initialize the header fields */
 114 static gint hf_multipart_type = -1;
 115 static gint hf_multipart_part = -1;
 116
 117 static gint hf_header_array[] = {
 118         -1, /* "Unknown-header" - Pad so that the real headers start at index 1 */
 119         -1, /* "Content-Disposition" */
 120         -1, /* "Content-Encoding" */
 121         -1, /* "Content-Id" */
 122         -1, /* "Content-Language" */
 123         -1, /* "Content-Length" */
 124         -1, /* "Content-Transfer-Encoding" */
 125         -1, /* "Content-Type" */
 126 };
 127
 128 /* Define media_type/Content type table */
 129 static dissector_table_t media_type_dissector_table;
 130
 131 /* Data and media dissector handles */
 132 static dissector_handle_t data_handle;
 133 static dissector_handle_t media_handle;
 134
 135 /* Determins if bodies with no media type dissector shoud be displayed
 136  * as raw text, may cause problems with images sound etc
 137  * TODO improve to check for different content types ?
 138  */
 139 static gboolean display_unknown_body_as_text = FALSE;
 140
 141
 142 typedef struct {
 143         const char *type; /* Type of multipart */
 144         char *boundary; /* Boundary string (enclosing quotes removed if any) */
 145         guint boundary_length; /* Length of the boundary string */
 146 } multipart_info_t;
 147
 148
 149
 150 static gint
 151 find_first_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
 152                 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary);
 153 static gint
 154 find_next_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
 155                 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary);
 156 static gint
 157 process_preamble(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
 158                 gint boundary_len, gboolean *last_boundary);
 159 static gint
 160 process_body_part(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
 161                 gint boundary_len, packet_info *pinfo, gint start,
 162                 gboolean *last_boundary);
 163 static gint
 164 is_known_multipart_header(const char *header_str, guint len);
 165 static gint
 166 index_of_char(const char *str, const char c);
 167 char *
 168 unfold_and_compact_mime_header(const char *lines, gint *first_colon_offset);
 169
 170 /*
 171  * Unfold and clean up a MIME-like header, and process LWS as follows:
 172  *              o Preserves LWS in quoted text
 173  *              o Remove LWS before and after a separator
 174  *              o Remove trailing LWS
 175  *              o Replace other LWS with a single space
 176  * Set value to the start of the value
 177  * Return the cleaned-up RFC2822 header (buffer must be freed).
 178  */
 179 char *
 180 unfold_and_compact_mime_header(const char *lines, gint *first_colon_offset)
 181 {
 182         const char *p = lines;
 183         char c;
 184         char *ret, *q;
 185         char sep_seen = 0; /* Did we see a separator ":;," */
 186         char lws = FALSE; /* Did we see LWS (incl. folding) */
 187         gint colon = -1;
 188
 189         if (! lines) return NULL;
 190
 191         c = *p;
 192         ret = g_malloc(strlen(lines) + 1);
 193         q = ret;
 194
 195         while (c) {
 196                 if (c == ':') {
 197                         lws = FALSE; /* Prevent leading LWS from showing up */
 198                         if (colon == -1) {/* First colon */
 199                                 colon = q - ret;
 200                         }
 201                         *(q++) = sep_seen = c;
 202                         p++;
 203                 } else if (c == ';' || c == ',' || c == '=') {
 204                         lws = FALSE; /* Prevent leading LWS from showing up */
 205                         *(q++) = sep_seen = c;
 206                         p++;
 207                 } else if (c == ' ' || c == '\t') {
 208                         lws = TRUE;
 209                         p++;
 210                 } else if (c == '\n') {
 211                         lws = FALSE; /* Skip trailing LWS */
 212                         if ((c = *(p+1))) {
 213                                 if (c == ' ' || c == '\t') { /* Header unfolding */
 214                                         lws = TRUE;
 215                                         p += 2;
 216                                 } else {
 217                                         *q = c = 0; /* Stop */
 218                                 }
 219                         }
 220                 } else if (c == '\r') {
 221                         lws = FALSE;
 222                         if ((c = *(p+1))) {
 223                                 if (c == '\n') {
 224                                         if ((c = *(p+2))) {
 225                                                 if (c == ' ' || c == '\t') { /* Header unfolding */
 226                                                         lws = TRUE;
 227                                                         p += 3;
 228                                                 } else {
 229                                                         *q = c = 0; /* Stop */
 230                                                 }
 231                                         }
 232                                 } else if (c == ' ' || c == '\t') { /* Header unfolding */
 233                                         lws = TRUE;
 234                                         p += 2;
 235                                 } else {
 236                                         *q = c = 0; /* Stop */
 237                                 }
 238                         }
 239                 } else if (c == '"') { /* Start of quoted-string */
 240                         lws = FALSE;
 241                         *(q++) = c;
 242                         while (c) {
 243                                 c = *(q++) = *(++p);
 244                                 if (c == '"') {
 245                                         p++; /* Skip closing quote */
 246                                         break;
 247                                 }
 248                         }
 249                         /* if already zero terminated now, rewind one char to avoid an "off by one" */
 250                         if(c == 0) {
 251                                 q--;
 252                         }
 253                 } else { /* Regular character */
 254                         if (sep_seen) {
 255                                 sep_seen = 0;
 256                                 lws = FALSE;
 257                         } else {
 258                                 if (lws) {
 259                                         *(q++) = ' ';
 260                                         lws = FALSE;
 261                                 }
 262                         }
 263                         lws = FALSE;
 264                         *(q++) = c;
 265                         p++; /* OK */
 266                 }
 267
 268                 if (c) {
 269                         c = *p;
 270                 }
 271         }
 272         *q = 0;
 273
 274         *first_colon_offset = colon;
 275         return (ret);
 276 }
 277
 278 /* Return the index of a given char in the given string,
 279  * or -1 if not found.
 280  */
 281 static gint
 282 index_of_char(const char *str, const char c)
 283 {
 284         gint len = 0;
 285         const char *p = str;
 286
 287         while (*p && *p != c) {
 288                 p++;
 289                 len++;
 290         }
 291
 292         if (*p)
 293                 return len;
 294         return -1;
 295 }
 296
 297 /* Retrieve the media information from pinfo->private_data,
 298  * and compute the boundary string and its length.
 299  * Return a pointer to a filled-in multipart_info_t, or NULL on failure.
 300  *
 301  * Boundary delimiters must not appear within the encapsulated material,
 302  * and must be no longer than 70 characters, not counting the two
 303  * leading hyphens. (quote from rfc2046)
 304  */
 305 static multipart_info_t *
 306 get_multipart_info(packet_info *pinfo)
 307 {
 308         const char *start, *p;
 309         int len = 0;
 310         multipart_info_t *m_info = NULL;
 311         const char *type = pinfo->match_string;
 312         char *parameters;
 313         gint dummy;
 314
 315         if ((type == NULL) || (pinfo->private_data == NULL)) {
 316                 /*
 317                  * We need both a content type AND parameters
 318                  * for multipart dissection.
 319                  */
 320                 return NULL;
 321         }
 322
 323         /* Clean up the parameters */
 324         parameters = unfold_and_compact_mime_header(pinfo->private_data, &dummy);
 325
 326         /*
 327          * Process the private data
 328          * The parameters must contain the boundary string
 329          */
 330         p = parameters;
 331         while (*p) {
 332                 if (strncasecmp(p, "boundary=", 9) == 0)
 333                         break;
 334                 /* Skip to next parameter */
 335                 p = strchr(p, ';');
 336                 if (p == NULL)
 337                 {
 338                         g_free(parameters);
 339                         return NULL;
 340                 }
 341                 p++; /* Skip semicolon */
 342                 while ((*p) && isspace((guchar)*p))
 343                         p++; /* Skip white space */
 344         }
 345         start = p + 9;
 346         if (start[0] == 0) {
 347                 g_free(parameters);
 348                 return NULL;
 349         }
 350
 351         /*
 352          * Process the parameter value
 353          */
 354         if (start[0] == '"') {
 355                 /*
 356                  * Boundary string is a quoted-string
 357                  */
 358                 start++; /* Skip the quote */
 359                 len = index_of_char(start, '"');
 360                 if (len < 0) {
 361                         /*
 362                          * No closing quote
 363                          */
 364                         g_free(parameters);
 365                         return NULL;
 366                 }
 367         } else {
 368                 /*
 369                  * Look for end of boundary
 370                  */
 371                 p = start;
 372                 while (*p) {
 373                         if (*p == ';' || isspace((guchar)*p))
 374                                 break;
 375                         p++;
 376                         len++;
 377                 }
 378         }
 379         /*
 380          * There is a value for the boundary string
 381          */
 382         m_info = g_malloc(sizeof(multipart_info_t));
 383         m_info->type = type;
 384         m_info->boundary = g_strndup(start, len);
 385         m_info->boundary_length = len;
 386         g_free(parameters);
 387
 388         return m_info;
 389 }
 390
 391 static void
 392 cleanup_multipart_info(void *data)
 393 {
 394         multipart_info_t *m_info = data;
 395         if (m_info) {
 396                 if (m_info->boundary)
 397                         g_free(m_info->boundary);
 398                 g_free(m_info);
 399         }
 400 }
 401
 402 /*
 403  * The first boundary does not implicitly contain the leading
 404  * line-end sequence.
 405  *
 406  * Return the offset to the 1st byte of the boundary delimiter line.
 407  * Set boundary_line_len to the length of the entire boundary delimiter.
 408  * Set last_boundary to TRUE if we've seen the last-boundary delimiter.
 409  */
 410 static gint
 411 find_first_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
 412                 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary)
 413 {
 414         gint offset = start, next_offset, line_len, boundary_start;
 415
 416         while (tvb_length_remaining(tvb, offset + 2 + boundary_len) > 0) {
 417                 boundary_start = offset;
 418                 if (((tvb_strneql(tvb, offset, (const guint8 *)"--", 2) == 0)
 419                                         && (tvb_strneql(tvb, offset + 2, boundary,      boundary_len) == 0)))
 420                 {
 421                         /* Boundary string; now check if last */
 422                         if ((tvb_length_remaining(tvb, offset + 2 + boundary_len + 2) >= 0)
 423                                         && (tvb_strneql(tvb, offset + 2 + boundary_len,
 424                                                         (const guint8 *)"--", 2) == 0)) {
 425                                 *last_boundary = TRUE;
 426                         } else {
 427                                 *last_boundary = FALSE;
 428                         }
 429                         /* Look for line end of the boundary line */
 430                         line_len =  tvb_find_line_end(tvb, offset, -1, &offset, FALSE);
 431                         if (line_len == -1) {
 432                                 *boundary_line_len = -1;
 433                         } else {
 434                                 *boundary_line_len = offset - boundary_start;
 435                         }
 436                         return boundary_start;
 437                 }
 438                 line_len =  tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
 439                 if (line_len == -1) {
 440                         return -1;
 441                 }
 442                 offset = next_offset;
 443         }
 444
 445         return -1;
 446 }
 447
 448 /*
 449  * Unless the first boundary, subsequent boundaries include a line-end sequence
 450  * before the dashed boundary string.
 451  *
 452  * Return the offset to the 1st byte of the boundary delimiter line.
 453  * Set boundary_line_len to the length of the entire boundary delimiter.
 454  * Set last_boundary to TRUE if we've seen the last-boundary delimiter.
 455  */
 456 static gint
 457 find_next_boundary(tvbuff_t *tvb, gint start, const guint8 *boundary,
 458                 gint boundary_len, gint *boundary_line_len, gboolean *last_boundary)
 459 {
 460         gint offset = start, next_offset, line_len, boundary_start;
 461
 462         while (tvb_length_remaining(tvb, offset + 2 + boundary_len) > 0) {
 463                 line_len =  tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
 464                 if (line_len == -1) {
 465                         return -1;
 466                 }
 467                 boundary_start = offset + line_len;
 468                 if (((tvb_strneql(tvb, next_offset, (const guint8 *)"--", 2) == 0)
 469                                         && (tvb_strneql(tvb, next_offset + 2, boundary, boundary_len) == 0)))
 470                 {
 471                         /* Boundary string; now check if last */
 472                         if ((tvb_length_remaining(tvb, next_offset + 2 + boundary_len + 2) >= 0)
 473                                         && (tvb_strneql(tvb, next_offset + 2 + boundary_len,
 474                                                         (const guint8 *)"--", 2) == 0)) {
 475                                 *last_boundary = TRUE;
 476                         } else {
 477                                 *last_boundary = FALSE;
 478                         }
 479                         /* Look for line end of the boundary line */
 480                         line_len =  tvb_find_line_end(tvb, next_offset, -1, &offset, FALSE);
 481                         if (line_len == -1) {
 482                                 *boundary_line_len = -1;
 483                         } else {
 484                                 *boundary_line_len = offset - boundary_start;
 485                         }
 486                         return boundary_start;
 487                 }
 488                 offset = next_offset;
 489         }
 490
 491         return -1;
 492 }
 493
 494 /*
 495  * Process the multipart preamble:
 496  *              [ preamble line-end ] dashed-boundary transport-padding line-end
 497  *
 498  * Return the offset to the start of the first body-part.
 499  */
 500 static gint
 501 process_preamble(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
 502                 gint boundary_len, gboolean *last_boundary)
 503 {
 504         gint boundary_start, boundary_line_len, body_part_start;
 505
 506         body_part_start = 0;
 507         boundary_start = find_first_boundary(tvb, 0, boundary, boundary_len,
 508                         &boundary_line_len, last_boundary);
 509         if (boundary_start == 0) {
 510                 if (tree) {
 511                         proto_tree_add_text(tree, tvb, boundary_start, boundary_line_len,
 512                                         "First boundary: %s",
 513                                         tvb_format_text(tvb, boundary_start, boundary_line_len));
 514                 }
 515                 return boundary_start + boundary_line_len;
 516         } else if (boundary_start > 0) {
 517                 if (boundary_line_len > 0) {
 518                         gint body_part_start = boundary_start + boundary_line_len;
 519
 520                         if (tree) {
 521                                 if (body_part_start > 0) {
 522                                         proto_tree_add_text(tree, tvb, 0, body_part_start,
 523                                                         "Preamble");
 524                                 }
 525                                 proto_tree_add_text(tree, tvb, boundary_start,
 526                                                 boundary_line_len, "First boundary: %s",
 527                                                 tvb_format_text(tvb, boundary_start,
 528                                                         boundary_line_len));
 529                         }
 530                         return body_part_start;
 531                 }
 532         }
 533         return -1;
 534 }
 535
 536 /*
 537  * Process a multipart body-part:
 538  *              MIME-part-headers [ line-end *OCTET ]
 539  *              line-end dashed-boundary transport-padding line-end
 540  *
 541  * If applicable, call a media subdissector.
 542  *
 543  * Return the offset to the start of the next body-part.
 544  */
 545 static gint
 546 process_body_part(proto_tree *tree, tvbuff_t *tvb, const guint8 *boundary,
 547                 gint boundary_len, packet_info *pinfo, gint start,
 548                 gboolean *last_boundary)
 549 {
 550         proto_tree *subtree = NULL;
 551         proto_item *ti = NULL;
 552         gint offset = start, next_offset;
 553         gint line_len = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
 554         char *parameters = NULL;
 555         gint body_start, boundary_start, boundary_line_len;
 556
 557         char *content_type_str = NULL;
 558
 559         if (tree) {
 560                 ti = proto_tree_add_item(tree, hf_multipart_part, tvb, start, 0, FALSE);
 561                 subtree = proto_item_add_subtree(ti, ett_multipart_body);
 562         }
 563         /*
 564          * Process the MIME-part-headers
 565          */
 566
 567         while (line_len > 0)
 568         {
 569                 gint colon_offset;
 570                 char *hdr_str = tvb_get_ephemeral_string(tvb, offset, next_offset - offset);
 571                 char *header_str;
 572
 573                 header_str = unfold_and_compact_mime_header(hdr_str, &colon_offset);
 574                 if (colon_offset <= 0) {
 575                         if (tree) {
 576                                 proto_tree_add_text(subtree, tvb, offset, next_offset - offset,
 577                                                 "%s",
 578                                                 tvb_format_text(tvb, offset, next_offset - offset));
 579                         }
 580                 } else {
 581                         gint hf_index;
 582
 583                         /* Split header name from header value */
 584                         header_str[colon_offset] = '\0';
 585                         hf_index = is_known_multipart_header(header_str, colon_offset);
 586
 587                         if (hf_index == -1) {
 588                                 if (tree) {
 589                                         proto_tree_add_text(subtree, tvb, offset,
 590                                                         next_offset - offset,
 591                                                         "%s",
 592                                                         tvb_format_text(tvb, offset, next_offset - offset));
 593                                 }
 594                         } else {
 595                                 char *value_str = header_str + colon_offset + 1;
 596
 597                                 if (tree) {
 598                                         proto_tree_add_string_format(subtree,
 599                                                         hf_header_array[hf_index], tvb,
 600                                                         offset, next_offset - offset,
 601                                                         (const char *)value_str, "%s",
 602                                                         tvb_format_text(tvb, offset, next_offset - offset));
 603                                 }
 604
 605                                 switch (hf_index) {
 606                                         case POS_CONTENT_TYPE:
 607                                                 {
 608                                                         /* The Content-Type starts at colon_offset + 1 */
 609                                                         gint semicolon_offset = index_of_char(
 610                                                                         value_str, ';');
 611
 612                                                         if (semicolon_offset > 0) {
 613                                                                 value_str[semicolon_offset] = '\0';
 614                                                                 parameters = ep_strdup(value_str + semicolon_offset + 1);
 615                                                         } else {
 616                                                                 parameters = NULL;
 617                                                         }
 618 #if GLIB_MAJOR_VERSION < 2
 619                                                         content_type_str = g_strdup(value_str);
 620                                                         g_strdown(content_type_str);
 621 #else
 622                                                         content_type_str = g_ascii_strdown(value_str, -1);
 623 #endif
 624                                                         /* Show content-type in root 'part' label */
 625                                                         proto_item_append_text(ti, " (%s)", content_type_str);
 626                                                 }
 627                                                 break;
 628
 629                                         default:
 630                                                 break;
 631                                 }
 632                         }
 633                 }
 634                 g_free(header_str);
 635                 offset = next_offset;
 636                 line_len = tvb_find_line_end(tvb, offset, -1, &next_offset, FALSE);
 637         }
 638         if (line_len < 0) {
 639                 /* ERROR */
 640                 return -1;
 641         }
 642         proto_tree_add_text(subtree, tvb, offset, next_offset - offset,
 643                         "%s", tvb_format_text(tvb, offset, next_offset - offset));
 644
 645         body_start = next_offset;
 646
 647         /*
 648          * Process the body
 649          */
 650
 651         boundary_start = find_next_boundary(tvb, body_start, boundary, boundary_len,
 652                         &boundary_line_len, last_boundary);
 653         if (boundary_start > 0) {
 654                 gint body_len = boundary_start - body_start;
 655                 tvbuff_t *tmp_tvb = tvb_new_subset(tvb, body_start,
 656                                 body_len, body_len);
 657
 658                 if (content_type_str) {
 659                         /*
 660                          * subdissection
 661                          */
 662                         void *save_private_data = pinfo->private_data;
 663                         gboolean dissected;
 664
 665                         pinfo->private_data = parameters;
 666                         /*
 667                          * First try the dedicated multipart dissector table
 668                          */
 669                         dissected = dissector_try_string(multipart_media_subdissector_table,
 670                                                 content_type_str, tmp_tvb, pinfo, subtree);
 671                         if (! dissected) {
 672                                 /*
 673                                  * Fall back to the default media dissector table
 674                                  */
 675                                 dissected = dissector_try_string(media_type_dissector_table,
 676                                                 content_type_str, tmp_tvb, pinfo, subtree);
 677                         }
 678                         if (! dissected) {
 679                                 const char *save_match_string = pinfo->match_string;
 680                                 pinfo->match_string = content_type_str;
 681                                 call_dissector(media_handle, tmp_tvb, pinfo, subtree);
 682                                 pinfo->match_string = save_match_string;
 683                         }
 684                         pinfo->private_data = save_private_data;
 685                         g_free(content_type_str);
 686                         content_type_str = NULL;
 687                         parameters = NULL; /* Shares same memory as content_type_str */
 688                 } else {
 689                         call_dissector(data_handle, tmp_tvb, pinfo, subtree);
 690                 }
 691                 if (tree) {
 692                         proto_item_set_len(ti, boundary_start - start);
 693                         if (*last_boundary == TRUE) {
 694                                 proto_tree_add_text(tree, tvb,
 695                                                 boundary_start, boundary_line_len,
 696                                                 "Last boundary: %s",
 697                                                 tvb_format_text(tvb, boundary_start,
 698                                                         boundary_line_len));
 699                         } else {
 700                                 proto_tree_add_text(tree, tvb,
 701                                                 boundary_start, boundary_line_len,
 702                                                 "Boundary: %s",
 703                                                 tvb_format_text(tvb, boundary_start,
 704                                                         boundary_line_len));
 705                         }
 706                 }
 707                 return boundary_start + boundary_line_len;
 708         }
 709
 710         return -1;
 711 }
 712
 713 /*
 714  * Call this method to actually dissect the multipart body.
 715  * NOTE - Only do so if a boundary string has been found!
 716  */
 717 static void dissect_multipart(tvbuff_t *tvb, packet_info *pinfo,
 718                 proto_tree *tree)
 719 {
 720         proto_tree *subtree = NULL;
 721         proto_item *ti = NULL;
 722         multipart_info_t *m_info = get_multipart_info(pinfo);
 723         gint header_start = 0;
 724         guint8 *boundary;
 725         gint boundary_len;
 726         gint offset = 0;
 727         gboolean last_boundary = FALSE;
 728
 729         if (m_info == NULL) {
 730                 /*
 731                  * We can't get the required multipart information
 732                  */
 733                 proto_tree_add_text(tree, tvb, 0, -1,
 734                                 "The multipart dissector could not find "
 735                                 "the required boundary parameter.");
 736                 call_dissector(data_handle, tvb, pinfo, tree);
 737                 return;
 738         }
 739         boundary = (guint8 *)m_info->boundary;
 740         boundary_len = m_info->boundary_length;
 741         /* Clean up the memory if an exception is thrown */
 742         /* CLEANUP_PUSH(cleanup_multipart_info, m_info); */
 743
 744         /* Add stuff to the protocol tree */
 745         if (tree) {
 746                 proto_item *type_ti;
 747                 ti = proto_tree_add_item(tree, proto_multipart,
 748                                 tvb, 0, -1, FALSE);
 749                 subtree = proto_item_add_subtree(ti, ett_multipart);
 750                 proto_item_append_text(ti, ", Type: %s, Boundary: \"%s\"",
 751                                 m_info->type, m_info->boundary);
 752
 753                 /* Show multi-part type as a generated field */
 754                 type_ti = proto_tree_add_string(subtree, hf_multipart_type,
 755                                                 tvb, 0, 0, pinfo->match_string);
 756                 PROTO_ITEM_SET_GENERATED(type_ti);
 757         }
 758
 759         /*
 760          * Make no entries in Protocol column and Info column on summary display,
 761          * but stop sub-dissectors from clearing entered text in summary display.
 762          */
 763         if (check_col(pinfo->cinfo, COL_INFO))
 764                 col_set_fence(pinfo->cinfo, COL_INFO);
 765
 766         offset = 0;
 767
 768         /*
 769          * Process the multipart preamble
 770          */
 771         header_start = process_preamble(subtree, tvb, boundary,
 772                         boundary_len, &last_boundary);
 773         if (header_start == -1) {
 774                 call_dissector(data_handle, tvb, pinfo, subtree);
 775                 /* Clean up the dynamically allocated memory */
 776                 cleanup_multipart_info(m_info);
 777                 return;
 778         }
 779         /*
 780          * Process the encapsulated bodies
 781          */
 782         while (last_boundary == FALSE) {
 783                 header_start = process_body_part(subtree, tvb, boundary, boundary_len,
 784                                 pinfo, header_start, &last_boundary);
 785                 if (header_start == -1) {
 786                         /* Clean up the dynamically allocated memory */
 787                         cleanup_multipart_info(m_info);
 788                         return;
 789                 }
 790         }
 791         /*
 792          * Process the multipart trailer
 793          */
 794         if (tree) {
 795                 if (tvb_length_remaining(tvb, header_start) > 0) {
 796                         proto_tree_add_text(subtree, tvb, header_start, -1, "Trailer");
 797                 }
 798         }
 799         /* Clean up the dynamically allocated memory */
 800         cleanup_multipart_info(m_info);
 801         return;
 802 }
 803
 804 /* Returns index of method in multipart_headers */
 805 static gint
 806 is_known_multipart_header(const char *header_str, guint len)
 807 {
 808         guint i;
 809
 810         for (i = 1; i < array_length(multipart_headers); i++) {
 811                 if (len == strlen(multipart_headers[i].name) &&
 812                     strncasecmp(header_str, multipart_headers[i].name, len) == 0)
 813                         return i;
 814                 if (multipart_headers[i].compact_name != NULL &&
 815                     len == strlen(multipart_headers[i].compact_name) &&
 816                     strncasecmp(header_str, multipart_headers[i].compact_name, len) == 0)
 817                         return i;
 818         }
 819
 820         return -1;
 821 }
 822
 823 /*
 824  * Register the protocol with Wireshark.
 825  *
 826  * This format is required because a script is used to build the C function
 827  * that calls all the protocol registration.
 828  */
 829
 830 void
 831 proto_register_multipart(void)
 832 {
 833
 834 /* Setup list of header fields  See Section 1.6.1 for details */
 835         static hf_register_info hf[] = {
 836                 { &hf_multipart_type,
 837                         {       "Type",
 838                                 "mime_multipart.type",
 839                                 FT_STRING, BASE_NONE, NULL, 0x00,
 840                                 "MIME multipart encapsulation type", HFILL
 841                         }
 842                 },
 843                 { &hf_multipart_part,
 844                         {       "Encapsulated multipart part",
 845                                 "mime_multipart.part",
 846                                 FT_STRING, BASE_NONE, NULL, 0x00,
 847                                 "Encapsulated multipart part", HFILL
 848                         }
 849                 },
 850                 { &hf_header_array[POS_CONTENT_DISPOSITION],
 851                         {       "Content-Disposition",
 852                                 "mime_multipart.header.content-disposition",
 853                                 FT_STRING, BASE_NONE, NULL, 0x00,
 854                                 "RFC 2183: Content-Disposition Header", HFILL
 855                         }
 856                 },
 857                 { &hf_header_array[POS_CONTENT_ENCODING],
 858                         {       "Content-Encoding",
 859                                 "mime_multipart.header.content-encoding",
 860                                 FT_STRING, BASE_NONE, NULL, 0x00,
 861                                 "Content-Encoding Header", HFILL
 862                         }
 863                 },
 864                 { &hf_header_array[POS_CONTENT_ID],
 865                         {       "Content-Id",
 866                                 "mime_multipart.header.content-id",
 867                                 FT_STRING, BASE_NONE, NULL, 0x00,
 868                                 "RFC 2045: Content-Id Header", HFILL
 869                         }
 870                 },
 871                 { &hf_header_array[POS_CONTENT_LANGUAGE],
 872                         {       "Content-Language",
 873                                 "mime_multipart.header.content-language",
 874                                 FT_STRING, BASE_NONE, NULL, 0x00,
 875                                 "Content-Language Header", HFILL
 876                         }
 877                 },
 878                 { &hf_header_array[POS_CONTENT_LENGTH],
 879                         {       "Content-Length",
 880                                 "mime_multipart.header.content-length",
 881                                 FT_STRING, BASE_NONE, NULL, 0x0,
 882                                 "Content-Length Header", HFILL
 883                         }
 884                 },
 885                 { &hf_header_array[POS_CONTENT_TRANSFER_ENCODING],
 886                         {       "Content-Transfer-Encoding",
 887                                 "mime_multipart.header.content-transfer-encoding",
 888                                 FT_STRING, BASE_NONE, NULL, 0x00,
 889                                 "RFC 2045: Content-Transfer-Encoding Header", HFILL
 890                         }
 891                 },
 892                 { &hf_header_array[POS_CONTENT_TYPE],
 893                         {       "Content-Type",
 894                                 "mime_multipart.header.content-type",
 895                                 FT_STRING, BASE_NONE,NULL,0x0,
 896                                 "Content-Type Header", HFILL
 897                         }
 898                 },
 899         };
 900
 901         /*
 902          * Preferences
 903          */
 904         module_t *multipart_module;
 905
 906         /*
 907          * Setup protocol subtree array
 908          */
 909         static gint *ett[] = {
 910                 &ett_multipart,
 911                 &ett_multipart_main,
 912                 &ett_multipart_body,
 913         };
 914
 915         /*
 916          * Register the protocol name and description
 917          */
 918         proto_multipart = proto_register_protocol(
 919                         "MIME Multipart Media Encapsulation",
 920                         "MIME multipart",
 921                         "mime_multipart");
 922
 923         /*
 924          * Required function calls to register
 925          * the header fields and subtrees used.
 926          */
 927         proto_register_field_array(proto_multipart, hf, array_length(hf));
 928         proto_register_subtree_array(ett, array_length(ett));
 929
 930         /*
 931          * Get the content type and Internet media type table
 932          */
 933         media_type_dissector_table = find_dissector_table("media_type");
 934
 935         multipart_module = prefs_register_protocol(proto_multipart, NULL);
 936
 937         prefs_register_bool_preference(multipart_module,
 938                         "display_unknown_body_as_text",
 939                         "Display bodies without media type as text",
 940                         "Display multipart bodies with no media type dissector"
 941                         " as raw text (may cause problems with binary data).",
 942                         &display_unknown_body_as_text);
 943
 944         /*
 945          * Dissectors requiring different behavior in cases where the media
 946          * is contained in a multipart entity should register their multipart
 947          * dissector in the dissector table below, which is similar to the
 948          * "media_type" dissector table defined in the HTTP dissector code.
 949          */
 950         multipart_media_subdissector_table = register_dissector_table(
 951                         "multipart_media_type",
 952                         "Internet media type (for multipart processing)",
 953                         FT_STRING, BASE_NONE);
 954 }
 955
 956
 957 /* If this dissector uses sub-dissector registration add a registration routine.
 958    This format is required because a script is used to find these routines and
 959    create the code that calls these routines.
 960 */
 961 void
 962 proto_reg_handoff_multipart(void)
 963 {
 964         dissector_handle_t multipart_handle;
 965
 966         /*
 967          * When we cannot display the data, call the data dissector.
 968          * When there is no dissector for the given media, call the media dissector.
 969          */
 970         data_handle = find_dissector("data");
 971         media_handle = find_dissector("media");
 972
 973         /*
 974          * Handle for multipart dissection
 975          */
 976         multipart_handle = create_dissector_handle(
 977                         dissect_multipart, proto_multipart);
 978
 979         dissector_add_string("media_type",
 980                         "multipart/mixed", multipart_handle);
 981         dissector_add_string("media_type",
 982                         "multipart/related", multipart_handle);
 983         dissector_add_string("media_type",
 984                         "multipart/alternative", multipart_handle);
 985         dissector_add_string("media_type",
 986                         "multipart/form-data", multipart_handle);
 987
 988 }