packet-http.c

   1 /* packet-http.c
   2  * Routines for HTTP packet disassembly
   3  *
   4  * Guy Harris <guy@alum.mit.edu>
   5  *
   6  * $Id: packet-http.c,v 1.47 2002/04/01 21:12:30 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #ifdef HAVE_SYS_TYPES_H
  32 #include <sys/types.h>
  33 #endif
  34
  35 #include <string.h>
  36 #include <ctype.h>
  37
  38 #include <glib.h>
  39 #include <epan/packet.h>
  40 #include <epan/strutil.h>
  41
  42 #include "packet-http.h"
  43
  44 typedef enum _http_type {
  45         HTTP_REQUEST,
  46         HTTP_RESPONSE,
  47         HTTP_NOTIFICATION,
  48         HTTP_OTHERS
  49 } http_type_t;
  50
  51 static int proto_http = -1;
  52 static int hf_http_notification = -1;
  53 static int hf_http_response = -1;
  54 static int hf_http_request = -1;
  55
  56 static gint ett_http = -1;
  57
  58 static dissector_handle_t data_handle;
  59 static dissector_handle_t http_handle;
  60
  61 #define TCP_PORT_HTTP                   80
  62 #define TCP_PORT_PROXY_HTTP             3128
  63 #define TCP_PORT_PROXY_ADMIN_HTTP       3132
  64 #define TCP_ALT_PORT_HTTP               8080
  65
  66 /*
  67  * SSDP is implemented atop HTTP (yes, it really *does* run over UDP).
  68  */
  69 #define TCP_PORT_SSDP                   1900
  70 #define UDP_PORT_SSDP                   1900
  71
  72 /*
  73  * Protocols implemented atop HTTP.
  74  */
  75 typedef enum {
  76         PROTO_HTTP,             /* just HTTP */
  77         PROTO_SSDP              /* Simple Service Discovery Protocol */
  78 } http_proto_t;
  79
  80 static int is_http_request_or_reply(const u_char *data, int linelen, http_type_t *type);
  81
  82 static dissector_table_t subdissector_table;
  83 static heur_dissector_list_t heur_subdissector_list;
  84
  85 static void
  86 dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  87 {
  88         http_proto_t    proto;
  89         char            *proto_tag;
  90         proto_tree      *http_tree = NULL;
  91         proto_item      *ti = NULL;
  92         gint            offset = 0;
  93         const u_char    *line;
  94         gint            next_offset;
  95         const u_char    *linep, *lineend;
  96         int             linelen;
  97         u_char          c;
  98         http_type_t     http_type;
  99         int             datalen;
 100
 101         switch (pinfo->match_port) {
 102
 103         case TCP_PORT_SSDP:     /* TCP_PORT_SSDP = UDP_PORT_SSDP */
 104                 proto = PROTO_SSDP;
 105                 proto_tag = "SSDP";
 106                 break;
 107
 108         default:
 109                 proto = PROTO_HTTP;
 110                 proto_tag = "HTTP";
 111                 break;
 112         }
 113
 114         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 115                 col_set_str(pinfo->cinfo, COL_PROTOCOL, proto_tag);
 116         if (check_col(pinfo->cinfo, COL_INFO)) {
 117                 /*
 118                  * Put the first line from the buffer into the summary
 119                  * if it's an HTTP request or reply (but leave out the
 120                  * line terminator).
 121                  * Otherwise, just call it a continuation.
 122                  *
 123                  * Note that "tvb_find_line_end()" will return a value that
 124                  * is not longer than what's in the buffer, so the
 125                  * "tvb_get_ptr()" call won't throw an exception.
 126                  */
 127                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset);
 128                 line = tvb_get_ptr(tvb, offset, linelen);
 129                 http_type = HTTP_OTHERS;        /* type not known yet */
 130                 if (is_http_request_or_reply(line, linelen, &http_type))
 131                         col_add_str(pinfo->cinfo, COL_INFO,
 132                             format_text(line, linelen));
 133                 else
 134                         col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
 135         }
 136
 137         if (tree) {
 138                 ti = proto_tree_add_item(tree, proto_http, tvb, offset, -1,
 139                     FALSE);
 140                 http_tree = proto_item_add_subtree(ti, ett_http);
 141         }
 142
 143         /*
 144          * Process the packet data, a line at a time.
 145          */
 146         http_type = HTTP_OTHERS;        /* type not known yet */
 147         while (tvb_offset_exists(tvb, offset)) {
 148                 /*
 149                  * Find the end of the line.
 150                  */
 151                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset);
 152
 153                 /*
 154                  * Get a buffer that refers to the line.
 155                  */
 156                 line = tvb_get_ptr(tvb, offset, linelen);
 157                 lineend = line + linelen;
 158
 159                 /*
 160                  * OK, does it look like an HTTP request or response?
 161                  */
 162                 if (is_http_request_or_reply(line, linelen, &http_type))
 163                         goto is_http;
 164
 165                 /*
 166                  * No.  Does it look like a blank line (as would appear
 167                  * at the end of an HTTP request)?
 168                  */
 169                 if (linelen == 0)
 170                         goto is_http;
 171
 172                 /*
 173                  * No.  Does it look like a MIME header?
 174                  */
 175                 linep = line;
 176                 while (linep < lineend) {
 177                         c = *linep++;
 178                         if (!isprint(c))
 179                                 break;  /* not printable, not a MIME header */
 180                         switch (c) {
 181
 182                         case '(':
 183                         case ')':
 184                         case '<':
 185                         case '>':
 186                         case '@':
 187                         case ',':
 188                         case ';':
 189                         case '\\':
 190                         case '"':
 191                         case '/':
 192                         case '[':
 193                         case ']':
 194                         case '?':
 195                         case '=':
 196                         case '{':
 197                         case '}':
 198                                 /*
 199                                  * It's a tspecial, so it's not part of a
 200                                  * token, so it's not a field name for the
 201                                  * beginning of a MIME header.
 202                                  */
 203                                 goto not_http;
 204
 205                         case ':':
 206                                 /*
 207                                  * This ends the token; we consider this
 208                                  * to be a MIME header.
 209                                  */
 210                                 goto is_http;
 211                         }
 212                 }
 213
 214         not_http:
 215                 /*
 216                  * We don't consider this part of an HTTP request or
 217                  * reply, so we don't display it.
 218                  * (Yeah, that means we don't display, say, a text/http
 219                  * page, but you can get that from the data pane.)
 220                  */
 221                 break;
 222
 223         is_http:
 224                 /*
 225                  * Put this line.
 226                  */
 227                 if (tree) {
 228                         proto_tree_add_text(http_tree, tvb, offset,
 229                             next_offset - offset, "%s",
 230                             tvb_format_text(tvb, offset, next_offset - offset));
 231                 }
 232                 offset = next_offset;
 233         }
 234
 235         if (tree) {
 236                 switch (http_type) {
 237
 238                 case HTTP_NOTIFICATION:
 239                         proto_tree_add_boolean_hidden(http_tree,
 240                             hf_http_notification, tvb, 0, 0, 1);
 241                         break;
 242
 243                 case HTTP_RESPONSE:
 244                         proto_tree_add_boolean_hidden(http_tree,
 245                             hf_http_response, tvb, 0, 0, 1);
 246                         break;
 247
 248                 case HTTP_REQUEST:
 249                         proto_tree_add_boolean_hidden(http_tree,
 250                             hf_http_request, tvb, 0, 0, 1);
 251                         break;
 252
 253                 case HTTP_OTHERS:
 254                 default:
 255                         break;
 256                 }
 257         }
 258
 259         datalen = tvb_length_remaining(tvb, offset);
 260         if (datalen > 0) {
 261                 tvbuff_t *next_tvb = tvb_new_subset(tvb, offset, -1, -1);
 262
 263                 /*
 264                  * OK, has some subdissector asked that they be called
 265                  * if something was on some particular port?
 266                  */
 267                 if (dissector_try_port(subdissector_table, pinfo->match_port,
 268                     next_tvb, pinfo, tree)) {
 269                         /*
 270                          * Yes.  Fix up the top-level item so that it
 271                          * doesn't include the stuff for that protocol.
 272                          */
 273                         if (ti != NULL)
 274                                 proto_item_set_len(ti, offset);
 275                 } else if(dissector_try_heuristic(heur_subdissector_list,
 276                                                   next_tvb,pinfo,tree)){
 277                         /*
 278                          * Yes.  Fix up the top-level item so that it
 279                          * doesn't include the stuff for that protocol.
 280                          */
 281                         if (ti != NULL)
 282                                 proto_item_set_len(ti, offset);
 283                 } else
 284                         call_dissector(data_handle,tvb_new_subset(tvb, offset,-1,tvb_reported_length_remaining(tvb,offset)), pinfo, http_tree);
 285         }
 286 }
 287
 288 /*
 289  * XXX - this won't handle HTTP 0.9 replies, but they're all data
 290  * anyway.
 291  */
 292 static int
 293 is_http_request_or_reply(const u_char *data, int linelen, http_type_t *type)
 294 {
 295         int isHttpRequestOrReply = FALSE;
 296
 297         /*
 298          * From RFC 2774 - An HTTP Extension Framework
 299          *
 300          * Support the command prefix that identifies the presence of
 301          * a "mandatory" header.
 302          */
 303         if (linelen >= 2 && strncmp(data, "M-", 2) == 0) {
 304                 data += 2;
 305                 linelen -= 2;
 306         }
 307
 308         /*
 309          * From draft-cohen-gena-client-01.txt, available from the uPnP forum:
 310          *      NOTIFY, SUBSCRIBE, UNSUBSCRIBE
 311          *
 312          * From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
 313          *      SEARCH
 314          */
 315         if (linelen >= 5 && strncmp(data, "HTTP/", 5) == 0) {
 316                 *type = HTTP_RESPONSE;
 317                 isHttpRequestOrReply = TRUE;    /* response */
 318         } else {
 319                 u_char * ptr = (u_char *)data;
 320                 int              index = 0;
 321
 322                 /* Look for the space following the Method */
 323                 while (index < linelen) {
 324                         if (*ptr == ' ')
 325                                 break;
 326                         else {
 327                                 ptr++;
 328                                 index++;
 329                         }
 330                 }
 331
 332                 /* Check the methods that have same length */
 333                 switch (index) {
 334
 335                 case 3:
 336                         if (strncmp(data, "GET", index) == 0 ||
 337                             strncmp(data, "PUT", index) == 0) {
 338                                 *type = HTTP_REQUEST;
 339                                 isHttpRequestOrReply = TRUE;
 340                         }
 341                         break;
 342
 343                 case 4:
 344                         if (strncmp(data, "COPY", index) == 0 ||
 345                             strncmp(data, "HEAD", index) == 0 ||
 346                             strncmp(data, "LOCK", index) == 0 ||
 347                             strncmp(data, "MOVE", index) == 0 ||
 348                             strncmp(data, "POLL", index) == 0 ||
 349                             strncmp(data, "POST", index) == 0) {
 350                                 *type = HTTP_REQUEST;
 351                                 isHttpRequestOrReply = TRUE;
 352                         }
 353                         break;
 354
 355                 case 5:
 356                         if (strncmp(data, "BCOPY", index) == 0 ||
 357                                 strncmp(data, "BMOVE", index) == 0 ||
 358                                 strncmp(data, "MKCOL", index) == 0 ||
 359                                 strncmp(data, "TRACE", index) == 0) {
 360                                 *type = HTTP_REQUEST;
 361                                 isHttpRequestOrReply = TRUE;
 362                         }
 363                         break;
 364
 365                 case 6:
 366                         if (strncmp(data, "DELETE", index) == 0 ||
 367                                 strncmp(data, "SEARCH", index) == 0 ||
 368                                 strncmp(data, "UNLOCK", index) == 0) {
 369                                 *type = HTTP_REQUEST;
 370                                 isHttpRequestOrReply = TRUE;
 371                         }
 372                         else if (strncmp(data, "NOTIFY", index) == 0) {
 373                                 *type = HTTP_NOTIFICATION;
 374                                 isHttpRequestOrReply = TRUE;
 375                         }
 376                         break;
 377
 378                 case 7:
 379                         if (strncmp(data, "BDELETE", index) == 0 ||
 380                             strncmp(data, "CONNECT", index) == 0 ||
 381                             strncmp(data, "OPTIONS", index) == 0) {
 382                                 *type = HTTP_REQUEST;
 383                                 isHttpRequestOrReply = TRUE;
 384                         }
 385                         break;
 386
 387                 case 8:
 388                         if (strncmp(data, "PROPFIND", index) == 0) {
 389                                 *type = HTTP_REQUEST;
 390                                 isHttpRequestOrReply = TRUE;
 391                         }
 392                         break;
 393
 394                 case 9:
 395                         if (strncmp(data, "SUBSCRIBE", index) == 0) {
 396                                 *type = HTTP_NOTIFICATION;
 397                                 isHttpRequestOrReply = TRUE;
 398                         } else if (strncmp(data, "PROPPATCH", index) == 0 ||
 399                             strncmp(data, "BPROPFIND", index) == 0) {
 400                                 *type = HTTP_REQUEST;
 401                                 isHttpRequestOrReply = TRUE;
 402                         }
 403                         break;
 404
 405                 case 10:
 406                         if (strncmp(data, "BPROPPATCH", index) == 0) {
 407                                 *type = HTTP_REQUEST;
 408                                 isHttpRequestOrReply = TRUE;
 409                         }
 410                         break;
 411
 412                 case 11:
 413                         if (strncmp(data, "UNSUBSCRIBE", index) == 0) {
 414                                 *type = HTTP_NOTIFICATION;
 415                                 isHttpRequestOrReply = TRUE;
 416                         }
 417                         break;
 418
 419                 default:
 420                         break;
 421                 }
 422         }
 423
 424         return isHttpRequestOrReply;
 425 }
 426
 427
 428 void
 429 proto_register_http(void)
 430 {
 431         static hf_register_info hf[] = {
 432             { &hf_http_notification,
 433               { "Notification",         "http.notification",
 434                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 435                 "TRUE if HTTP notification", HFILL }},
 436             { &hf_http_response,
 437               { "Response",             "http.response",
 438                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 439                 "TRUE if HTTP response", HFILL }},
 440             { &hf_http_request,
 441               { "Request",              "http.request",
 442                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 443                 "TRUE if HTTP request", HFILL }},
 444         };
 445         static gint *ett[] = {
 446                 &ett_http,
 447         };
 448
 449         proto_http = proto_register_protocol("Hypertext Transfer Protocol",
 450             "HTTP", "http");
 451         proto_register_field_array(proto_http, hf, array_length(hf));
 452         proto_register_subtree_array(ett, array_length(ett));
 453
 454         register_dissector("http", dissect_http, proto_http);
 455         http_handle = find_dissector("http");
 456
 457         /*
 458          * Dissectors shouldn't register themselves in this table;
 459          * instead, they should call "http_dissector_add()", and
 460          * we'll register the port number they specify as a port
 461          * for HTTP, and register them in our subdissector table.
 462          *
 463          * This only works for protocols such as IPP that run over
 464          * HTTP on a specific non-HTTP port.
 465          */
 466         subdissector_table = register_dissector_table("http.port",
 467             "TCP port for protocols using HTTP", FT_UINT16, BASE_DEC);
 468
 469         /*
 470          * Heuristic dissectors SHOULD register themselves in
 471          * this table using the standard heur_dissector_add()
 472          * function.
 473          */
 474
 475         register_heur_dissector_list("http",&heur_subdissector_list);
 476
 477 }
 478
 479 /*
 480  * Called by dissectors for protocols that run atop HTTP/TCP.
 481  */
 482 void
 483 http_dissector_add(guint32 port, dissector_handle_t handle)
 484 {
 485         /*
 486          * Register ourselves as the handler for that port number
 487          * over TCP.
 488          */
 489         dissector_add("tcp.port", port, http_handle);
 490
 491         /*
 492          * And register them in *our* table for that port.
 493          */
 494         dissector_add("http.port", port, handle);
 495 }
 496
 497 void
 498 proto_reg_handoff_http(void)
 499 {
 500         data_handle = find_dissector("data");
 501         dissector_add("tcp.port", TCP_PORT_HTTP, http_handle);
 502         dissector_add("tcp.port", TCP_ALT_PORT_HTTP, http_handle);
 503         dissector_add("tcp.port", TCP_PORT_PROXY_HTTP, http_handle);
 504         dissector_add("tcp.port", TCP_PORT_PROXY_ADMIN_HTTP, http_handle);
 505
 506         /*
 507          * XXX - is there anything to dissect in the body of an SSDP
 508          * request or reply?  I.e., should there be an SSDP dissector?
 509          */
 510         dissector_add("tcp.port", TCP_PORT_SSDP, http_handle);
 511         dissector_add("udp.port", UDP_PORT_SSDP, http_handle);
 512 }