epan/req_resp_hdrs.c

   1 /* req_resp_hdrs.c
   2  * Routines handling protocols with a request/response line, headers,
   3  * a blank line, and an optional body.
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include <epan/strutil.h>
  33 #include <string.h>
  34
  35 #include <epan/req_resp_hdrs.h>
  36
  37 #ifdef NEED_G_ASCII_STRCASECMP_H
  38 #include "g_ascii_strcasecmp.h"
  39 #endif
  40
  41 /*
  42  * Optionally do reassembly of the request/response line, headers, and body.
  43  */
  44 gboolean
  45 req_resp_hdrs_do_reassembly(tvbuff_t *tvb, const int offset, packet_info *pinfo,
  46     const gboolean desegment_headers, const gboolean desegment_body)
  47 {
  48         gint            next_offset;
  49         gint            next_offset_sav;
  50         gint            length_remaining, reported_length_remaining;
  51         int             linelen;
  52         gchar           *header_val;
  53         long int        content_length;
  54         gboolean        content_length_found = FALSE;
  55         gboolean        content_type_found = FALSE;
  56         gboolean        chunked_encoding = FALSE;
  57         gboolean        keepalive_found = FALSE;
  58
  59         /*
  60          * Do header desegmentation if we've been told to.
  61          *
  62          * RFC 2616 defines HTTP messages as being either of the
  63          * Request or the Response type
  64          * (HTTP-message = Request | Response).
  65          * Request and Response are defined as:
  66          *     Request = Request-Line
  67          *         *(( general-header
  68          *         | request-header
  69          *         | entity-header ) CRLF)
  70          *         CRLF
  71          *         [ message-body ]
  72          *     Response = Status-Line
  73          *         *(( general-header
  74          *         | response-header
  75          *         | entity-header ) CRLF)
  76          *         CRLF
  77          *         [ message-body ]
  78          * that's why we can always assume two consecutive line
  79          * endings (we allow CR, LF, or CRLF, as some clients
  80          * or servers might not use a full CRLF) to mark the end
  81          * of the headers.  The worst thing that would happen
  82          * otherwise would be the packet not being desegmented
  83          * or being interpreted as only headers.
  84          *
  85          * RFC 2326 says RTSP works the same way; RFC 3261 says SIP
  86          * works the same way.
  87          */
  88
  89         /*
  90          * If header desegmentation is activated, check that all
  91          * headers are in this tvbuff (search for an empty line
  92          * marking end of headers) or request one more byte (we
  93          * don't know how many bytes we'll need, so we just ask
  94          * for one).
  95          */
  96         if (desegment_headers && pinfo->can_desegment) {
  97                 next_offset = offset;
  98                 for (;;) {
  99                         next_offset_sav = next_offset;
 100
 101                         reported_length_remaining =
 102                             tvb_reported_length_remaining(tvb, next_offset);
 103
 104                         /*
 105                          * Request one more byte if there're no
 106                          * bytes left in the reported data (if there're
 107                          * bytes left in the reported data, but not in
 108                          * the available data, requesting more bytes
 109                          * won't help, as those bytes weren't captured).
 110                          */
 111                         if (reported_length_remaining < 1) {
 112                                 pinfo->desegment_offset = offset;
 113                                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 114                                 return FALSE;
 115                         }
 116
 117                         length_remaining = tvb_length_remaining(tvb,
 118                             next_offset);
 119
 120                         /*
 121                          * Request one more byte if we cannot find a
 122                          * header (i.e. a line end).
 123                          */
 124                         linelen = tvb_find_line_end(tvb, next_offset,
 125                             -1, &next_offset, TRUE);
 126                         if (linelen == -1 &&
 127                             length_remaining >= reported_length_remaining) {
 128                                 /*
 129                                  * Not enough data; ask for one more
 130                                  * byte.
 131                                  */
 132                                 pinfo->desegment_offset = offset;
 133                                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 134                                 return FALSE;
 135                         }
 136
 137                         if (linelen == 0) {
 138                                 /*
 139                                  * We found the end of the headers.
 140                                  */
 141                                 break;
 142                         }
 143
 144                         /*
 145                          * Is this a Content-Length or Transfer-Encoding
 146                          * header?  If not, it either means that we are in
 147                          * a different header line, or that we are
 148                          * at the end of the headers, or that there
 149                          * isn't enough data; the two latter cases
 150                          * have already been handled above.
 151                          */
 152                         if (desegment_body) {
 153                                 /*
 154                                  * Check if we've found Content-Length.
 155                                  */
 156                                 if (tvb_strncaseeql(tvb, next_offset_sav,
 157                                     "Content-Length:", 15) == 0) {
 158                                         header_val = tvb_get_ephemeral_string(tvb,
 159                                             next_offset_sav + 15,
 160                                             linelen - 15);
 161                                         if (sscanf(header_val,
 162                                             "%li", &content_length)
 163                                             == 1)
 164                                                 content_length_found = TRUE;
 165                                 } else if (tvb_strncaseeql(tvb, next_offset_sav,
 166                                     "Content-Type:", 13) == 0) {
 167                                         content_type_found = TRUE;
 168                                 } else if (tvb_strncaseeql(tvb, next_offset_sav,
 169                                     "Connection:", 11) == 0) {
 170                                         /* Check for keep-alive */
 171                                         header_val = tvb_get_ephemeral_string(tvb,
 172                                             next_offset_sav + 11,
 173                                             linelen - 11);
 174                                         if(header_val){
 175                                                 while(*header_val==' '){
 176                                                         header_val++;
 177                                                 }
 178                                                 if(!g_ascii_strncasecmp(header_val, "Keep-Alive", 10)){
 179                                                         keepalive_found = TRUE;
 180                                                 }
 181                                         }
 182                                 } else if (tvb_strncaseeql(tvb,
 183                                             next_offset_sav,
 184                                             "Transfer-Encoding:", 18) == 0) {
 185                                         /*
 186                                          * Find out if this Transfer-Encoding is
 187                                          * chunked.  It should be, since there
 188                                          * really aren't any other types, but
 189                                          * RFC 2616 allows for them.
 190                                          */
 191                                         gchar *p;
 192                                         guint len;
 193
 194                                         header_val = tvb_get_ephemeral_string(tvb,
 195                                             next_offset_sav + 18, linelen - 18);
 196                                         p = header_val;
 197                                         len = strlen(header_val);
 198                                         /* Skip white space */
 199                                         while (p < header_val + len &&
 200                                             (*p == ' ' || *p == '\t'))
 201                                                 p++;
 202                                         if (p <= header_val + len) {
 203                                                 if (g_ascii_strncasecmp(p, "chunked", 7)
 204                                                     == 0) {
 205                                                         /*
 206                                                          * Don't bother looking
 207                                                          * for extensions;
 208                                                          * since we don't
 209                                                          * understand them,
 210                                                          * they should be
 211                                                          * ignored.
 212                                                          */
 213                                                         chunked_encoding = TRUE;
 214                                                 }
 215                                         }
 216                                 }
 217                         }
 218                 }
 219         }
 220
 221         /*
 222          * The above loop ends when we reached the end of the headers, so
 223          * there should be content_length bytes after the 4 terminating bytes
 224          * and next_offset points to after the end of the headers.
 225          */
 226         if (desegment_body) {
 227                 if (content_length_found) {
 228                         /* next_offset has been set to the end of the headers */
 229                         if (!tvb_bytes_exist(tvb, next_offset, content_length)) {
 230                                 length_remaining = tvb_length_remaining(tvb,
 231                                     next_offset);
 232                                 reported_length_remaining =
 233                                     tvb_reported_length_remaining(tvb, next_offset);
 234                                 if (length_remaining < reported_length_remaining) {
 235                                         /*
 236                                          * It's a waste of time asking for more
 237                                          * data, because that data wasn't captured.
 238                                          */
 239                                         return TRUE;
 240                                 }
 241                                 if (length_remaining == -1)
 242                                         length_remaining = 0;
 243                                 pinfo->desegment_offset = offset;
 244                                 pinfo->desegment_len =
 245                                     content_length - length_remaining;
 246                                 return FALSE;
 247                         }
 248                 } else if (chunked_encoding) {
 249                         /*
 250                          * This data is chunked, so we need to keep pulling
 251                          * data until we reach the end of the stream, or a
 252                          * zero sized chunk.
 253                          *
 254                          * XXX
 255                          * This doesn't bother with trailing headers; I don't
 256                          * think they are really used, and we'd have to use
 257                          * is_http_request_or_reply() to determine if it was
 258                          * a trailing header, or the start of a new response.
 259                          */
 260                         gboolean done_chunking = FALSE;
 261
 262                         while (!done_chunking) {
 263                                 gint chunk_size = 0;
 264                                 gint chunk_offset = 0;
 265                                 gchar *chunk_string = NULL;
 266                                 gchar *c = NULL;
 267
 268                                 reported_length_remaining =
 269                                     tvb_reported_length_remaining(tvb,
 270                                     next_offset);
 271
 272                                 if (reported_length_remaining < 1) {
 273                                         pinfo->desegment_offset = offset;
 274                                         pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 275                                         return FALSE;
 276                                 }
 277
 278                                 length_remaining = tvb_length_remaining(tvb,
 279                                     next_offset);
 280
 281                                 linelen = tvb_find_line_end(tvb, next_offset,
 282                                                 -1, &chunk_offset, TRUE);
 283
 284                                 if (linelen == -1 &&
 285                                     length_remaining >=
 286                                     reported_length_remaining) {
 287                                          pinfo->desegment_offset = offset;
 288                                          pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 289                                          return FALSE;
 290                                 }
 291
 292                                 /* We have a line with the chunk size in it.*/
 293                                 chunk_string = tvb_get_ephemeral_string(tvb, next_offset,
 294                                     linelen);
 295                                 c = chunk_string;
 296
 297                                 /*
 298                                  * We don't care about the extensions.
 299                                  */
 300                                 if ((c = strchr(c, ';'))) {
 301                                         *c = '\0';
 302                                 }
 303
 304                                 if ((sscanf(chunk_string, "%x",
 305                                     &chunk_size) < 0) || chunk_size < 0) {
 306                                         /* We couldn't get the chunk size,
 307                                          * so stop trying.
 308                                          */
 309                                         return TRUE;
 310                                 }
 311
 312                                 if (chunk_size == 0) {
 313                                         /*
 314                                          * This is the last chunk.  Let's pull in the
 315                                          * trailing CRLF.
 316                                          */
 317                                         linelen = tvb_find_line_end(tvb,
 318                                             chunk_offset, -1, &chunk_offset, TRUE);
 319
 320                                         if (linelen == -1 &&
 321                                             length_remaining >=
 322                                             reported_length_remaining) {
 323                                                 pinfo->desegment_offset = offset;
 324                                                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 325                                                 return FALSE;
 326                                         }
 327
 328                                         pinfo->desegment_offset = chunk_offset;
 329                                         pinfo->desegment_len = 0;
 330                                         done_chunking = TRUE;
 331                                 } else {
 332                                         /*
 333                                          * Skip to the next chunk if we
 334                                          * already have it
 335                                          */
 336                                         if (reported_length_remaining >
 337                                                 chunk_size) {
 338
 339                                                 next_offset = chunk_offset
 340                                                     + chunk_size + 2;
 341                                         } else {
 342                                                 /*
 343                                                  * Fetch this chunk, plus the
 344                                                  * trailing CRLF.
 345                                                  */
 346                                                 pinfo->desegment_offset = offset;
 347                                                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
 348                                                 return FALSE;
 349                                         }
 350                                 }
 351
 352                         }
 353                 } else if (content_type_found && pinfo->can_desegment) {
 354                         /* We found a content-type but no content-length.
 355                          * This is probably a HTTP header for a session with
 356                          * only one HTTP PDU and where the content spans
 357                          * until the end of the tcp session, unless there
 358                          * is a keepalive header present in which case we
 359                          * assume there is no message body at all and thus
 360                          * we wont do any reassembly.
 361                          * Set up tcp reassembly until the end of this session.
 362                          */
 363                         length_remaining = tvb_length_remaining(tvb, next_offset);
 364                         reported_length_remaining = tvb_reported_length_remaining(tvb, next_offset);
 365                         if (length_remaining < reported_length_remaining) {
 366                                 /*
 367                                  * It's a waste of time asking for more
 368                                  * data, because that data wasn't captured.
 369                                  */
 370                                 return TRUE;
 371                         }
 372
 373                         if (keepalive_found) {
 374                                 /* We have a keep-alive but no content-length.
 375                                  * Assume there is no message body and dont
 376                                  * do any reassembly.
 377                                  */
 378                                 return TRUE;
 379                         }
 380
 381                         pinfo->desegment_offset = offset;
 382                         pinfo->desegment_len = DESEGMENT_UNTIL_FIN;
 383
 384                         return FALSE;
 385                 }
 386
 387         }
 388
 389         /*
 390          * No further desegmentation needed.
 391          */
 392         return TRUE;
 393 }