packet-http.c

   1 /* packet-http.c
   2  * Routines for HTTP packet disassembly
   3  *
   4  * Guy Harris <guy@alum.mit.edu>
   5  *
   6  * Copyright 2002, Tim Potter <tpot@samba.org>
   7  * Copyright 1999, Andrew Tridgell <tridge@samba.org>
   8  *
   9  * $Id: packet-http.c,v 1.60 2002/12/02 23:43:26 guy Exp $
  10  *
  11  * Ethereal - Network traffic analyzer
  12  * By Gerald Combs <gerald@ethereal.com>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #include <string.h>
  35 #include <ctype.h>
  36
  37 #include <glib.h>
  38 #include <epan/packet.h>
  39 #include <epan/strutil.h>
  40
  41 #include "packet-http.h"
  42
  43 typedef enum _http_type {
  44         HTTP_REQUEST,
  45         HTTP_RESPONSE,
  46         HTTP_NOTIFICATION,
  47         HTTP_OTHERS
  48 } http_type_t;
  49
  50 static int proto_http = -1;
  51 static int hf_http_notification = -1;
  52 static int hf_http_response = -1;
  53 static int hf_http_request = -1;
  54
  55 static gint ett_http = -1;
  56 static gint ett_http_ntlmssp = -1;
  57
  58 static dissector_handle_t data_handle;
  59 static dissector_handle_t http_handle;
  60
  61 #define TCP_PORT_HTTP                   80
  62 #define TCP_PORT_PROXY_HTTP             3128
  63 #define TCP_PORT_PROXY_ADMIN_HTTP       3132
  64 #define TCP_ALT_PORT_HTTP               8080
  65
  66 /*
  67  * SSDP is implemented atop HTTP (yes, it really *does* run over UDP).
  68  */
  69 #define TCP_PORT_SSDP                   1900
  70 #define UDP_PORT_SSDP                   1900
  71
  72 /*
  73  * Protocols implemented atop HTTP.
  74  */
  75 typedef enum {
  76         PROTO_HTTP,             /* just HTTP */
  77         PROTO_SSDP              /* Simple Service Discovery Protocol */
  78 } http_proto_t;
  79
  80 static int is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type);
  81
  82 static dissector_table_t subdissector_table;
  83 static heur_dissector_list_t heur_subdissector_list;
  84
  85 static dissector_handle_t ntlmssp_handle=NULL;
  86
  87 /* Decode a base64 string in-place - simple and slow algorithm.
  88    Return length of result. Taken from rproxy/librsync/base64.c by
  89    Andrew Tridgell. */
  90
  91 static size_t base64_decode(char *s)
  92 {
  93         static const char b64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
  94         int bit_offset, byte_offset, idx, i, n;
  95         unsigned char *d = (unsigned char *)s;
  96         char *p;
  97
  98         n=i=0;
  99
 100         while (*s && (p=strchr(b64, *s))) {
 101                 idx = (int)(p - b64);
 102                 byte_offset = (i*6)/8;
 103                 bit_offset = (i*6)%8;
 104                 d[byte_offset] &= ~((1<<(8-bit_offset))-1);
 105                 if (bit_offset < 3) {
 106                         d[byte_offset] |= (idx << (2-bit_offset));
 107                         n = byte_offset+1;
 108                 } else {
 109                         d[byte_offset] |= (idx >> (bit_offset-2));
 110                         d[byte_offset+1] = 0;
 111                         d[byte_offset+1] |= (idx << (8-(bit_offset-2))) & 0xFF;
 112                         n = byte_offset+2;
 113                 }
 114                 s++; i++;
 115         }
 116
 117         return n;
 118 }
 119
 120 /* Return a tvb that contains the binary representation of a base64
 121    string */
 122
 123 static tvbuff_t *
 124 base64_to_tvb(const char *base64)
 125 {
 126         tvbuff_t *tvb;
 127         char *data = g_strdup(base64);
 128         size_t len;
 129
 130         len = base64_decode(data);
 131         tvb = tvb_new_real_data(data, len, len);
 132
 133         tvb_set_free_cb(tvb, g_free);
 134
 135         return tvb;
 136 }
 137
 138 static void
 139 dissect_http_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 140     const char *line)
 141 {
 142         tvbuff_t *ntlmssp_tvb;
 143
 144         ntlmssp_tvb = base64_to_tvb(line);
 145         tvb_set_child_real_data_tvbuff(tvb, ntlmssp_tvb);
 146         add_new_data_source(pinfo, ntlmssp_tvb, "NTLMSSP Data");
 147
 148         call_dissector(ntlmssp_handle, ntlmssp_tvb, pinfo, tree);
 149 }
 150
 151 /*
 152  * Some headers that we dissect more deeply - Microsoft's abomination
 153  * called NTLMSSP over HTTP.
 154  */
 155 static gboolean
 156 check_ntlmssp_auth(proto_item *hdr_item, tvbuff_t *tvb, packet_info *pinfo,
 157     const char *text)
 158 {
 159         static const char *headers[] = {
 160                 "Authorization: NTLM ",
 161                 "Authorization: Negotiate ",
 162                 "WWW-Authenticate: NTLM ",
 163                 "WWW-Authenticate: Negotiate ",
 164                 "Proxy-Authenticate: NTLM ",
 165                 "Proxy-Authorization: NTLM ",
 166                 NULL
 167         };
 168         const char **header;
 169         size_t hdrlen;
 170         proto_tree *hdr_tree;
 171
 172         for (header = &headers[0]; *header != NULL; header++) {
 173                 hdrlen = strlen(*header);
 174                 if (strncmp(text, *header, hdrlen) == 0) {
 175                         if (hdr_item != NULL) {
 176                                 hdr_tree = proto_item_add_subtree(hdr_item,
 177                                     ett_http_ntlmssp);
 178                         } else
 179                                 hdr_tree = NULL;
 180                         text += hdrlen;
 181                         dissect_http_ntlmssp(tvb, pinfo, hdr_tree, text);
 182                         return TRUE;
 183                 }
 184         }
 185         return FALSE;
 186 }
 187
 188 static void
 189 dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 190 {
 191         http_proto_t    proto;
 192         char            *proto_tag;
 193         proto_tree      *http_tree = NULL;
 194         proto_item      *ti = NULL;
 195         gint            offset = 0;
 196         const guchar    *line;
 197         gint            next_offset;
 198         const guchar    *linep, *lineend;
 199         int             linelen;
 200         guchar          c;
 201         http_type_t     http_type;
 202         int             datalen;
 203         char            *text;
 204         proto_item      *hdr_item;
 205
 206         switch (pinfo->match_port) {
 207
 208         case TCP_PORT_SSDP:     /* TCP_PORT_SSDP = UDP_PORT_SSDP */
 209                 proto = PROTO_SSDP;
 210                 proto_tag = "SSDP";
 211                 break;
 212
 213         default:
 214                 proto = PROTO_HTTP;
 215                 proto_tag = "HTTP";
 216                 break;
 217         }
 218
 219         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 220                 col_set_str(pinfo->cinfo, COL_PROTOCOL, proto_tag);
 221         if (check_col(pinfo->cinfo, COL_INFO)) {
 222                 /*
 223                  * Put the first line from the buffer into the summary
 224                  * if it's an HTTP request or reply (but leave out the
 225                  * line terminator).
 226                  * Otherwise, just call it a continuation.
 227                  *
 228                  * Note that "tvb_find_line_end()" will return a value that
 229                  * is not longer than what's in the buffer, so the
 230                  * "tvb_get_ptr()" call won't throw an exception.
 231                  */
 232                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset,
 233                     FALSE);
 234                 line = tvb_get_ptr(tvb, offset, linelen);
 235                 http_type = HTTP_OTHERS;        /* type not known yet */
 236                 if (is_http_request_or_reply(line, linelen, &http_type))
 237                         col_add_str(pinfo->cinfo, COL_INFO,
 238                             format_text(line, linelen));
 239                 else
 240                         col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
 241         }
 242
 243         if (tree) {
 244                 ti = proto_tree_add_item(tree, proto_http, tvb, offset, -1,
 245                     FALSE);
 246                 http_tree = proto_item_add_subtree(ti, ett_http);
 247         }
 248
 249         /*
 250          * Process the packet data, a line at a time.
 251          */
 252         http_type = HTTP_OTHERS;        /* type not known yet */
 253         while (tvb_offset_exists(tvb, offset)) {
 254                 /*
 255                  * Find the end of the line.
 256                  */
 257                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset,
 258                     FALSE);
 259
 260                 /*
 261                  * Get a buffer that refers to the line.
 262                  */
 263                 line = tvb_get_ptr(tvb, offset, linelen);
 264                 lineend = line + linelen;
 265
 266                 /*
 267                  * OK, does it look like an HTTP request or response?
 268                  */
 269                 if (is_http_request_or_reply(line, linelen, &http_type))
 270                         goto is_http;
 271
 272                 /*
 273                  * No.  Does it look like a blank line (as would appear
 274                  * at the end of an HTTP request)?
 275                  */
 276                 if (linelen == 0)
 277                         goto is_http;
 278
 279                 /*
 280                  * No.  Does it look like a MIME header?
 281                  */
 282                 linep = line;
 283                 while (linep < lineend) {
 284                         c = *linep++;
 285                         if (!isprint(c))
 286                                 break;  /* not printable, not a MIME header */
 287                         switch (c) {
 288
 289                         case '(':
 290                         case ')':
 291                         case '<':
 292                         case '>':
 293                         case '@':
 294                         case ',':
 295                         case ';':
 296                         case '\\':
 297                         case '"':
 298                         case '/':
 299                         case '[':
 300                         case ']':
 301                         case '?':
 302                         case '=':
 303                         case '{':
 304                         case '}':
 305                                 /*
 306                                  * It's a tspecial, so it's not part of a
 307                                  * token, so it's not a field name for the
 308                                  * beginning of a MIME header.
 309                                  */
 310                                 goto not_http;
 311
 312                         case ':':
 313                                 /*
 314                                  * This ends the token; we consider this
 315                                  * to be a MIME header.
 316                                  */
 317                                 goto is_http;
 318                         }
 319                 }
 320
 321         not_http:
 322                 /*
 323                  * We don't consider this part of an HTTP request or
 324                  * reply, so we don't display it.
 325                  * (Yeah, that means we don't display, say, a text/http
 326                  * page, but you can get that from the data pane.)
 327                  */
 328                 break;
 329
 330         is_http:
 331                 /*
 332                  * Put this line.
 333                  */
 334                 text = tvb_format_text(tvb, offset, next_offset - offset);
 335                 if (tree) {
 336                         hdr_item = proto_tree_add_text(http_tree, tvb, offset,
 337                             next_offset - offset, "%s", text);
 338                 } else
 339                         hdr_item = NULL;
 340                 check_ntlmssp_auth(hdr_item, tvb, pinfo, text);
 341                 offset = next_offset;
 342         }
 343
 344         if (tree) {
 345                 switch (http_type) {
 346
 347                 case HTTP_NOTIFICATION:
 348                         proto_tree_add_boolean_hidden(http_tree,
 349                             hf_http_notification, tvb, 0, 0, 1);
 350                         break;
 351
 352                 case HTTP_RESPONSE:
 353                         proto_tree_add_boolean_hidden(http_tree,
 354                             hf_http_response, tvb, 0, 0, 1);
 355                         break;
 356
 357                 case HTTP_REQUEST:
 358                         proto_tree_add_boolean_hidden(http_tree,
 359                             hf_http_request, tvb, 0, 0, 1);
 360                         break;
 361
 362                 case HTTP_OTHERS:
 363                 default:
 364                         break;
 365                 }
 366         }
 367
 368         datalen = tvb_length_remaining(tvb, offset);
 369         if (datalen > 0) {
 370                 tvbuff_t *next_tvb = tvb_new_subset(tvb, offset, -1, -1);
 371
 372                 /*
 373                  * OK, has some subdissector asked that they be called
 374                  * if something was on some particular port?
 375                  */
 376                 if (dissector_try_port(subdissector_table, pinfo->match_port,
 377                     next_tvb, pinfo, tree)) {
 378                         /*
 379                          * Yes.  Fix up the top-level item so that it
 380                          * doesn't include the stuff for that protocol.
 381                          */
 382                         if (ti != NULL)
 383                                 proto_item_set_len(ti, offset);
 384                 } else if(dissector_try_heuristic(heur_subdissector_list,
 385                                                   next_tvb,pinfo,tree)){
 386                         /*
 387                          * Yes.  Fix up the top-level item so that it
 388                          * doesn't include the stuff for that protocol.
 389                          */
 390                         if (ti != NULL)
 391                                 proto_item_set_len(ti, offset);
 392                 } else {
 393                         call_dissector(data_handle,
 394                             tvb_new_subset(tvb, offset, -1, -1), pinfo,
 395                             http_tree);
 396                 }
 397         }
 398 }
 399
 400 /*
 401  * XXX - this won't handle HTTP 0.9 replies, but they're all data
 402  * anyway.
 403  */
 404 static int
 405 is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type)
 406 {
 407         int isHttpRequestOrReply = FALSE;
 408
 409         /*
 410          * From RFC 2774 - An HTTP Extension Framework
 411          *
 412          * Support the command prefix that identifies the presence of
 413          * a "mandatory" header.
 414          */
 415         if (linelen >= 2 && strncmp(data, "M-", 2) == 0) {
 416                 data += 2;
 417                 linelen -= 2;
 418         }
 419
 420         /*
 421          * From draft-cohen-gena-client-01.txt, available from the uPnP forum:
 422          *      NOTIFY, SUBSCRIBE, UNSUBSCRIBE
 423          *
 424          * From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
 425          *      SEARCH
 426          */
 427         if (linelen >= 5 && strncmp(data, "HTTP/", 5) == 0) {
 428                 *type = HTTP_RESPONSE;
 429                 isHttpRequestOrReply = TRUE;    /* response */
 430         } else {
 431                 const guchar * ptr = (const guchar *)data;
 432                 int              index = 0;
 433
 434                 /* Look for the space following the Method */
 435                 while (index < linelen) {
 436                         if (*ptr == ' ')
 437                                 break;
 438                         else {
 439                                 ptr++;
 440                                 index++;
 441                         }
 442                 }
 443
 444                 /* Check the methods that have same length */
 445                 switch (index) {
 446
 447                 case 3:
 448                         if (strncmp(data, "GET", index) == 0 ||
 449                             strncmp(data, "PUT", index) == 0) {
 450                                 *type = HTTP_REQUEST;
 451                                 isHttpRequestOrReply = TRUE;
 452                         }
 453                         break;
 454
 455                 case 4:
 456                         if (strncmp(data, "COPY", index) == 0 ||
 457                             strncmp(data, "HEAD", index) == 0 ||
 458                             strncmp(data, "LOCK", index) == 0 ||
 459                             strncmp(data, "MOVE", index) == 0 ||
 460                             strncmp(data, "POLL", index) == 0 ||
 461                             strncmp(data, "POST", index) == 0) {
 462                                 *type = HTTP_REQUEST;
 463                                 isHttpRequestOrReply = TRUE;
 464                         }
 465                         break;
 466
 467                 case 5:
 468                         if (strncmp(data, "BCOPY", index) == 0 ||
 469                                 strncmp(data, "BMOVE", index) == 0 ||
 470                                 strncmp(data, "MKCOL", index) == 0 ||
 471                                 strncmp(data, "TRACE", index) == 0) {
 472                                 *type = HTTP_REQUEST;
 473                                 isHttpRequestOrReply = TRUE;
 474                         }
 475                         break;
 476
 477                 case 6:
 478                         if (strncmp(data, "DELETE", index) == 0 ||
 479                                 strncmp(data, "SEARCH", index) == 0 ||
 480                                 strncmp(data, "UNLOCK", index) == 0) {
 481                                 *type = HTTP_REQUEST;
 482                                 isHttpRequestOrReply = TRUE;
 483                         }
 484                         else if (strncmp(data, "NOTIFY", index) == 0) {
 485                                 *type = HTTP_NOTIFICATION;
 486                                 isHttpRequestOrReply = TRUE;
 487                         }
 488                         break;
 489
 490                 case 7:
 491                         if (strncmp(data, "BDELETE", index) == 0 ||
 492                             strncmp(data, "CONNECT", index) == 0 ||
 493                             strncmp(data, "OPTIONS", index) == 0) {
 494                                 *type = HTTP_REQUEST;
 495                                 isHttpRequestOrReply = TRUE;
 496                         }
 497                         break;
 498
 499                 case 8:
 500                         if (strncmp(data, "PROPFIND", index) == 0) {
 501                                 *type = HTTP_REQUEST;
 502                                 isHttpRequestOrReply = TRUE;
 503                         }
 504                         break;
 505
 506                 case 9:
 507                         if (strncmp(data, "SUBSCRIBE", index) == 0) {
 508                                 *type = HTTP_NOTIFICATION;
 509                                 isHttpRequestOrReply = TRUE;
 510                         } else if (strncmp(data, "PROPPATCH", index) == 0 ||
 511                             strncmp(data, "BPROPFIND", index) == 0) {
 512                                 *type = HTTP_REQUEST;
 513                                 isHttpRequestOrReply = TRUE;
 514                         }
 515                         break;
 516
 517                 case 10:
 518                         if (strncmp(data, "BPROPPATCH", index) == 0) {
 519                                 *type = HTTP_REQUEST;
 520                                 isHttpRequestOrReply = TRUE;
 521                         }
 522                         break;
 523
 524                 case 11:
 525                         if (strncmp(data, "UNSUBSCRIBE", index) == 0) {
 526                                 *type = HTTP_NOTIFICATION;
 527                                 isHttpRequestOrReply = TRUE;
 528                         }
 529                         break;
 530
 531                 default:
 532                         break;
 533                 }
 534         }
 535
 536         return isHttpRequestOrReply;
 537 }
 538
 539 void
 540 proto_register_http(void)
 541 {
 542         static hf_register_info hf[] = {
 543             { &hf_http_notification,
 544               { "Notification",         "http.notification",
 545                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 546                 "TRUE if HTTP notification", HFILL }},
 547             { &hf_http_response,
 548               { "Response",             "http.response",
 549                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 550                 "TRUE if HTTP response", HFILL }},
 551             { &hf_http_request,
 552               { "Request",              "http.request",
 553                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 554                 "TRUE if HTTP request", HFILL }},
 555         };
 556         static gint *ett[] = {
 557                 &ett_http,
 558                 &ett_http_ntlmssp,
 559         };
 560
 561         proto_http = proto_register_protocol("Hypertext Transfer Protocol",
 562             "HTTP", "http");
 563         proto_register_field_array(proto_http, hf, array_length(hf));
 564         proto_register_subtree_array(ett, array_length(ett));
 565
 566         register_dissector("http", dissect_http, proto_http);
 567         http_handle = find_dissector("http");
 568
 569         /*
 570          * Dissectors shouldn't register themselves in this table;
 571          * instead, they should call "http_dissector_add()", and
 572          * we'll register the port number they specify as a port
 573          * for HTTP, and register them in our subdissector table.
 574          *
 575          * This only works for protocols such as IPP that run over
 576          * HTTP on a specific non-HTTP port.
 577          */
 578         subdissector_table = register_dissector_table("http.port",
 579             "TCP port for protocols using HTTP", FT_UINT16, BASE_DEC);
 580
 581         /*
 582          * Heuristic dissectors SHOULD register themselves in
 583          * this table using the standard heur_dissector_add()
 584          * function.
 585          */
 586
 587         register_heur_dissector_list("http",&heur_subdissector_list);
 588
 589 }
 590
 591 /*
 592  * Called by dissectors for protocols that run atop HTTP/TCP.
 593  */
 594 void
 595 http_dissector_add(guint32 port, dissector_handle_t handle)
 596 {
 597         /*
 598          * Register ourselves as the handler for that port number
 599          * over TCP.
 600          */
 601         dissector_add("tcp.port", port, http_handle);
 602
 603         /*
 604          * And register them in *our* table for that port.
 605          */
 606         dissector_add("http.port", port, handle);
 607 }
 608
 609 void
 610 proto_reg_handoff_http(void)
 611 {
 612         data_handle = find_dissector("data");
 613         dissector_add("tcp.port", TCP_PORT_HTTP, http_handle);
 614         dissector_add("tcp.port", TCP_ALT_PORT_HTTP, http_handle);
 615         dissector_add("tcp.port", TCP_PORT_PROXY_HTTP, http_handle);
 616         dissector_add("tcp.port", TCP_PORT_PROXY_ADMIN_HTTP, http_handle);
 617
 618         /*
 619          * XXX - is there anything to dissect in the body of an SSDP
 620          * request or reply?  I.e., should there be an SSDP dissector?
 621          */
 622         dissector_add("tcp.port", TCP_PORT_SSDP, http_handle);
 623         dissector_add("udp.port", UDP_PORT_SSDP, http_handle);
 624
 625         ntlmssp_handle = find_dissector("ntlmssp");
 626 }