req_resp_hdrs.c

   1 /* req_resp_hdrs.c
   2  * Routines handling protocols with a request/response line, headers,
   3  * a blank line, and an optional body.
   4  *
   5  * $Id$
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include <epan/strutil.h>
  33 #include <string.h>
  34
  35 #include "req_resp_hdrs.h"
  36
  37 /*
  38  * Optionally do reassembly of the request/response line, headers, and body.
  39  */
  40 gboolean
  41 req_resp_hdrs_do_reassembly(tvbuff_t *tvb, packet_info *pinfo,
  42     gboolean desegment_headers, gboolean desegment_body)
  43 {
  44         gint            offset = 0;
  45         gint            next_offset;
  46         gint            next_offset_sav;
  47         gint            length_remaining, reported_length_remaining;
  48         int             linelen;
  49         gchar           *header_val;
  50         long int        content_length;
  51         gboolean        content_length_found = FALSE;
  52         gboolean        chunked_encoding = FALSE;
  53
  54         /*
  55          * Do header desegmentation if we've been told to.
  56          *
  57          * RFC 2616 defines HTTP messages as being either of the
  58          * Request or the Response type
  59          * (HTTP-message = Request | Response).
  60          * Request and Response are defined as:
  61          *     Request = Request-Line
  62          *         *(( general-header
  63          *         | request-header
  64          *         | entity-header ) CRLF)
  65          *         CRLF
  66          *         [ message-body ]
  67          *     Response = Status-Line
  68          *         *(( general-header
  69          *         | response-header
  70          *         | entity-header ) CRLF)
  71          *         CRLF
  72          *         [ message-body ]
  73          * that's why we can always assume two consecutive line
  74          * endings (we allow CR, LF, or CRLF, as some clients
  75          * or servers might not use a full CRLF) to mark the end
  76          * of the headers.  The worst thing that would happen
  77          * otherwise would be the packet not being desegmented
  78          * or being interpreted as only headers.
  79          *
  80          * RFC 2326 says RTSP works the same way; RFC 3261 says SIP
  81          * works the same way.
  82          */
  83
  84         /*
  85          * If header desegmentation is activated, check that all
  86          * headers are in this tvbuff (search for an empty line
  87          * marking end of headers) or request one more byte (we
  88          * don't know how many bytes we'll need, so we just ask
  89          * for one).
  90          */
  91         if (desegment_headers && pinfo->can_desegment) {
  92                 next_offset = offset;
  93                 for (;;) {
  94                         next_offset_sav = next_offset;
  95
  96                         length_remaining = tvb_length_remaining(tvb,
  97                             next_offset);
  98                         reported_length_remaining =
  99                             tvb_reported_length_remaining(tvb, next_offset);
 100
 101                         /*
 102                          * Request one more byte if there're no
 103                          * bytes left in the reported data (if there're
 104                          * bytes left in the reported data, but not in
 105                          * the available data, requesting more bytes
 106                          * won't help, as those bytes weren't captured).
 107                          */
 108                         if (reported_length_remaining < 1) {
 109                                 pinfo->desegment_offset = offset;
 110                                 pinfo->desegment_len = 1;
 111                                 return FALSE;
 112                         }
 113
 114                         /*
 115                          * Request one more byte if we cannot find a
 116                          * header (i.e. a line end).
 117                          */
 118                         linelen = tvb_find_line_end(tvb, next_offset,
 119                             -1, &next_offset, TRUE);
 120                         if (linelen == -1 &&
 121                             length_remaining >= reported_length_remaining) {
 122                                 /*
 123                                  * Not enough data; ask for one more
 124                                  * byte.
 125                                  */
 126                                 pinfo->desegment_offset = offset;
 127                                 pinfo->desegment_len = 1;
 128                                 return FALSE;
 129                         } else if (linelen == 0) {
 130                                 /*
 131                                  * We found the end of the headers.
 132                                  */
 133                                 break;
 134                         }
 135
 136                         /*
 137                          * Is this a Content-Length or Transfer-Encoding
 138                          * header?  If not, it either means that we are in
 139                          * a different header line, or that we are
 140                          * at the end of the headers, or that there
 141                          * isn't enough data; the two latter cases
 142                          * have already been handled above.
 143                          */
 144                         if (desegment_body) {
 145                                 /*
 146                                  * Check if we've found Content-Length.
 147                                  */
 148                                 if (tvb_strncaseeql(tvb, next_offset_sav,
 149                                     "Content-Length:", 15) == 0) {
 150                                         header_val = tvb_get_string(tvb,
 151                                             next_offset_sav + 15,
 152                                             linelen - 15);
 153                                         if (sscanf(header_val,
 154                                             "%li", &content_length)
 155                                             == 1)
 156                                                 content_length_found = TRUE;
 157                                         g_free(header_val);
 158                                 } else if (tvb_strncaseeql(tvb,
 159                                             next_offset_sav,
 160                                             "Transfer-Encoding:", 18) == 0) {
 161                                         /*
 162                                          * Find out if this Transfer-Encoding is
 163                                          * chunked.  It should be, since there
 164                                          * really aren't any other types, but
 165                                          * RFC 2616 allows for them.
 166                                          */
 167                                         gchar *p;
 168                                         gint len;
 169
 170                                         header_val = tvb_get_string(tvb,
 171                                             next_offset_sav + 18, linelen - 18);
 172                                         p = header_val;
 173                                         len = strlen(header_val);
 174                                         /* Skip white space */
 175                                         while (p < header_val + len &&
 176                                             (*p == ' ' || *p == '\t'))
 177                                                 p++;
 178                                         if (p <= header_val + len) {
 179                                                 if (strncasecmp(p, "chunked", 7)
 180                                                     == 0) {
 181                                                         /*
 182                                                          * Don't bother looking
 183                                                          * for extensions;
 184                                                          * since we don't
 185                                                          * understand them,
 186                                                          * they should be
 187                                                          * ignored.
 188                                                          */
 189                                                         chunked_encoding = TRUE;
 190                                                 }
 191                                         }
 192                                         g_free(header_val);
 193                                 }
 194                         }
 195                 }
 196         }
 197
 198         /*
 199          * The above loop ends when we reached the end of the headers, so
 200          * there should be content_length bytes after the 4 terminating bytes
 201          * and next_offset points to after the end of the headers.
 202          */
 203         if (desegment_body) {
 204                 if (content_length_found) {
 205                         /* next_offset has been set to the end of the headers */
 206                         if (!tvb_bytes_exist(tvb, next_offset, content_length)) {
 207                                 length_remaining = tvb_length_remaining(tvb,
 208                                     next_offset);
 209                                 reported_length_remaining =
 210                                     tvb_reported_length_remaining(tvb, next_offset);
 211                                 if (length_remaining < reported_length_remaining) {
 212                                         /*
 213                                          * It's a waste of time asking for more
 214                                          * data, because that data wasn't captured.
 215                                          */
 216                                         return TRUE;
 217                                 }
 218                                 if (length_remaining == -1)
 219                                         length_remaining = 0;
 220                                 pinfo->desegment_offset = offset;
 221                                 pinfo->desegment_len =
 222                                     content_length - length_remaining;
 223                                 return FALSE;
 224                         }
 225                 } else if (chunked_encoding) {
 226                         /*
 227                          * This data is chunked, so we need to keep pulling
 228                          * data until we reach the end of the stream, or a
 229                          * zero sized chunk.
 230                          *
 231                          * XXX
 232                          * This doesn't bother with trailing headers; I don't
 233                          * think they are really used, and we'd have to use
 234                          * is_http_request_or_reply() to determine if it was
 235                          * a trailing header, or the start of a new response.
 236                          */
 237                         gboolean done_chunking = FALSE;
 238
 239                         while (!done_chunking) {
 240                                 gint chunk_size = 0;
 241                                 gint chunk_offset = 0;
 242                                 gchar *chunk_string = NULL;
 243                                 gchar *c = NULL;
 244
 245                                 length_remaining = tvb_length_remaining(tvb,
 246                                     next_offset);
 247                                 reported_length_remaining =
 248                                     tvb_reported_length_remaining(tvb,
 249                                     next_offset);
 250
 251                                 if (reported_length_remaining < 1) {
 252                                         pinfo->desegment_offset = offset;
 253                                         pinfo->desegment_len = 1;
 254                                         return FALSE;
 255                                 }
 256
 257                                 linelen = tvb_find_line_end(tvb, next_offset,
 258                                                 -1, &chunk_offset, TRUE);
 259
 260                                 if (linelen == -1 &&
 261                                     length_remaining >=
 262                                     reported_length_remaining) {
 263                                          pinfo->desegment_offset = offset;
 264                                          pinfo->desegment_len = 2;
 265                                          return FALSE;
 266                                 }
 267
 268                                 /* We have a line with the chunk size in it.*/
 269                                 chunk_string = tvb_get_string(tvb, next_offset,
 270                                     linelen);
 271                                 c = chunk_string;
 272
 273                                 /*
 274                                  * We don't care about the extensions.
 275                                  */
 276                                 if ((c = strchr(c, ';'))) {
 277                                         *c = '\0';
 278                                 }
 279
 280                                 if ((sscanf(chunk_string, "%x",
 281                                     &chunk_size) < 0) || chunk_size < 0) {
 282                                         /* We couldn't get the chunk size,
 283                                          * so stop trying.
 284                                          */
 285                                         return TRUE;
 286                                 }
 287
 288                                 if (chunk_size == 0) {
 289                                         /*
 290                                          * This is the last chunk.  Let's pull in the
 291                                          * trailing CRLF.
 292                                          */
 293                                         linelen = tvb_find_line_end(tvb,
 294                                             chunk_offset, -1, &chunk_offset, TRUE);
 295
 296                                         if (linelen == -1 &&
 297                                             length_remaining >=
 298                                             reported_length_remaining) {
 299                                                 pinfo->desegment_offset = offset;
 300                                                 pinfo->desegment_len = 1;
 301                                                 return FALSE;
 302                                         }
 303
 304                                         pinfo->desegment_offset = chunk_offset;
 305                                         pinfo->desegment_len = 0;
 306                                         done_chunking = TRUE;
 307                                 } else {
 308                                         /*
 309                                          * Skip to the next chunk if we
 310                                          * already have it
 311                                          */
 312                                         if (reported_length_remaining >
 313                                                 chunk_size) {
 314
 315                                                 next_offset = chunk_offset
 316                                                     + chunk_size + 2;
 317                                         } else {
 318                                                 /*
 319                                                  * Fetch this chunk, plus the
 320                                                  * trailing CRLF.
 321                                                  */
 322                                                 pinfo->desegment_offset = offset;
 323                                                 pinfo->desegment_len =
 324                                                     chunk_size + 1 -
 325                                                     reported_length_remaining;
 326                                                 return FALSE;
 327                                         }
 328                                 }
 329
 330                         }
 331                 }
 332
 333         }
 334
 335         /*
 336          * No further desegmentation needed.
 337          */
 338         return TRUE;
 339 }