packet-http.c

   1 /* packet-http.c
   2  * Routines for HTTP packet disassembly
   3  *
   4  * Guy Harris <guy@alum.mit.edu>
   5  *
   6  * $Id: packet-http.c,v 1.30 2000/11/21 22:40:40 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@zing.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  *
  27  *
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #ifdef HAVE_SYS_TYPES_H
  35 #include <sys/types.h>
  36 #endif
  37
  38 #include <string.h>
  39 #include <ctype.h>
  40
  41 #include <glib.h>
  42 #include "packet.h"
  43 #include "strutil.h"
  44
  45 typedef enum _http_type {
  46         HTTP_REQUEST,
  47         HTTP_RESPONSE,
  48         HTTP_OTHERS
  49 } http_type_t;
  50
  51 static int proto_http = -1;
  52 static int hf_http_response = -1;
  53 static int hf_http_request = -1;
  54
  55 static gint ett_http = -1;
  56
  57 #define TCP_PORT_HTTP                   80
  58 #define TCP_PORT_PROXY_HTTP             3128
  59 #define TCP_PORT_PROXY_ADMIN_HTTP       3132
  60 #define TCP_ALT_PORT_HTTP               8080
  61
  62 static int is_http_request_or_reply(const u_char *data, int linelen, http_type_t *type);
  63
  64 static dissector_handle_t ipp_handle;
  65
  66 void
  67 dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  68 {
  69         gboolean        is_ipp = (pinfo->srcport == 631 || pinfo->destport == 631);
  70         proto_tree      *http_tree = NULL;
  71         proto_item      *ti = NULL;
  72         gint            offset = 0;
  73         const u_char    *line;
  74         gint            next_offset;
  75         const u_char    *linep, *lineend;
  76         int             linelen;
  77         u_char          c;
  78         http_type_t     http_type;
  79         int             datalen;
  80
  81         CHECK_DISPLAY_AS_DATA(proto_http, tvb, pinfo, tree);
  82
  83         pinfo->current_proto = "HTTP";
  84
  85         if (check_col(pinfo->fd, COL_PROTOCOL))
  86                 col_set_str(pinfo->fd, COL_PROTOCOL, is_ipp ? "IPP" : "HTTP");
  87         if (check_col(pinfo->fd, COL_INFO)) {
  88                 /*
  89                  * Put the first line from the buffer into the summary
  90                  * if it's an HTTP request or reply (but leave out the
  91                  * line terminator).
  92                  * Otherwise, just call it a continuation.
  93                  */
  94                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset);
  95                 line = tvb_get_ptr(tvb, offset, linelen);
  96                 http_type = HTTP_OTHERS;        /* type not known yet */
  97                 if (is_http_request_or_reply(line, linelen, &http_type))
  98                         col_add_str(pinfo->fd, COL_INFO,
  99                             format_text(line, linelen));
 100                 else
 101                         col_set_str(pinfo->fd, COL_INFO, "Continuation");
 102         }
 103
 104         if (tree) {
 105                 ti = proto_tree_add_item(tree, proto_http, tvb, offset,
 106                     tvb_length_remaining(tvb, offset), FALSE);
 107                 http_tree = proto_item_add_subtree(ti, ett_http);
 108
 109                 /*
 110                  * Process the packet data, a line at a time.
 111                  */
 112                 http_type = HTTP_OTHERS;        /* type not known yet */
 113                 while (tvb_offset_exists(tvb, offset)) {
 114                         /*
 115                          * Find the end of the line.
 116                          */
 117                         linelen = tvb_find_line_end(tvb, offset, -1,
 118                             &next_offset);
 119
 120                         /*
 121                          * Get a buffer that refers to the line.
 122                          */
 123                         line = tvb_get_ptr(tvb, offset, linelen);
 124                         lineend = line + linelen;
 125
 126                         /*
 127                          * OK, does it look like an HTTP request or
 128                          * response?
 129                          */
 130                         if (is_http_request_or_reply(line, linelen, &http_type))
 131                                 goto is_http;
 132
 133                         /*
 134                          * No.  Does it look like a blank line (as would
 135                          * appear at the end of an HTTP request)?
 136                          */
 137                         if (linelen == 0)
 138                                 goto is_http;
 139
 140                         /*
 141                          * No.  Does it look like a MIME header?
 142                          */
 143                         linep = line;
 144                         while (linep < lineend) {
 145                                 c = *linep++;
 146                                 if (!isprint(c))
 147                                         break;  /* not printable, not a MIME header */
 148                                 switch (c) {
 149
 150                                 case '(':
 151                                 case ')':
 152                                 case '<':
 153                                 case '>':
 154                                 case '@':
 155                                 case ',':
 156                                 case ';':
 157                                 case '\\':
 158                                 case '"':
 159                                 case '/':
 160                                 case '[':
 161                                 case ']':
 162                                 case '?':
 163                                 case '=':
 164                                 case '{':
 165                                 case '}':
 166                                         /*
 167                                          * It's a tspecial, so it's not
 168                                          * part of a token, so it's not
 169                                          * a field name for the beginning
 170                                          * of a MIME header.
 171                                          */
 172                                         goto not_http;
 173
 174                                 case ':':
 175                                         /*
 176                                          * This ends the token; we consider
 177                                          * this to be a MIME header.
 178                                          */
 179                                         goto is_http;
 180                                 }
 181                         }
 182
 183                 not_http:
 184                         /*
 185                          * We don't consider this part of an HTTP request or
 186                          * reply, so we don't display it.
 187                          * (Yeah, that means we don't display, say, a
 188                          * text/http page, but you can get that from the
 189                          * data pane.)
 190                          */
 191                         break;
 192
 193                 is_http:
 194                         /*
 195                          * Put this line.
 196                          */
 197                         proto_tree_add_text(http_tree, tvb, offset,
 198                             next_offset - offset, "%s",
 199                             tvb_format_text(tvb, offset, next_offset - offset));
 200                         offset = next_offset;
 201                 }
 202
 203                 switch (http_type) {
 204
 205                 case HTTP_RESPONSE:
 206                         proto_tree_add_boolean_hidden(http_tree,
 207                             hf_http_response, tvb, 0, 0, 1);
 208                         break;
 209
 210                 case HTTP_REQUEST:
 211                         proto_tree_add_boolean_hidden(http_tree,
 212                             hf_http_request, tvb, 0, 0, 1);
 213                         break;
 214
 215                 case HTTP_OTHERS:
 216                 default:
 217                         break;
 218                 }
 219         }
 220
 221         datalen = tvb_length_remaining(tvb, offset);
 222         if (datalen > 0) {
 223                 if (is_ipp) {
 224                         tvbuff_t *new_tvb = tvb_new_subset(tvb, offset, -1, -1);
 225
 226                         /*
 227                          * Fix up the top-level item so that it doesn't
 228                          * include the IPP stuff.
 229                          */
 230                         if (ti != NULL)
 231                                 proto_item_set_len(ti, offset);
 232
 233                         call_dissector(ipp_handle, new_tvb, pinfo, tree);
 234                 } else
 235                         dissect_data(tvb, offset, pinfo, http_tree);
 236         }
 237 }
 238
 239 /*
 240  * XXX - this won't handle HTTP 0.9 replies, but they're all data
 241  * anyway.
 242  */
 243 static int
 244 is_http_request_or_reply(const u_char *data, int linelen, http_type_t *type)
 245 {
 246         if (linelen >= 4) {
 247                 if (strncmp(data, "GET ", 4) == 0 ||
 248                     strncmp(data, "PUT ", 4) == 0) {
 249                         if (*type == HTTP_OTHERS)
 250                                 *type = HTTP_REQUEST;
 251                         return TRUE;
 252                 }
 253         }
 254         if (linelen >= 5) {
 255                 if (strncmp(data, "HEAD ", 5) == 0 ||
 256                     strncmp(data, "POST ", 5) == 0) {
 257                         if (*type == HTTP_OTHERS)
 258                                 *type = HTTP_REQUEST;
 259                         return TRUE;
 260                 }
 261                 if (strncmp(data, "HTTP/", 5) == 0) {
 262                         if (*type == HTTP_OTHERS)
 263                                 *type = HTTP_RESPONSE;
 264                         return TRUE;    /* response */
 265                 }
 266         }
 267         if (linelen >= 6) {
 268                 if (strncmp(data, "TRACE ", 6) == 0) {
 269                         if (*type == HTTP_OTHERS)
 270                                 *type = HTTP_REQUEST;
 271                         return TRUE;
 272                 }
 273         }
 274         if (linelen >= 7) {
 275                 if (strncmp(data, "DELETE ", 7) == 0) {
 276                         if (*type == HTTP_OTHERS)
 277                                 *type = HTTP_REQUEST;
 278                         return TRUE;
 279                 }
 280         }
 281         if (linelen >= 8) {
 282                 if (strncmp(data, "OPTIONS ", 8) == 0 ||
 283                     strncmp(data, "CONNECT ", 8) == 0) {
 284                         if (*type == HTTP_OTHERS)
 285                                 *type = HTTP_REQUEST;
 286                         return TRUE;
 287                 }
 288         }
 289         return FALSE;
 290 }
 291
 292 void
 293 proto_register_http(void)
 294 {
 295         static hf_register_info hf[] = {
 296             { &hf_http_response,
 297               { "Response",             "http.response",
 298                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 299                 "TRUE if HTTP response" }},
 300             { &hf_http_request,
 301               { "Request",              "http.request",
 302                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 303                 "TRUE if HTTP request" }},
 304         };
 305         static gint *ett[] = {
 306                 &ett_http,
 307         };
 308
 309         proto_http = proto_register_protocol("Hypertext Transfer Protocol",
 310             "http");
 311         proto_register_field_array(proto_http, hf, array_length(hf));
 312         proto_register_subtree_array(ett, array_length(ett));
 313 }
 314
 315 void
 316 proto_reg_handoff_http(void)
 317 {
 318         dissector_add("tcp.port", TCP_PORT_HTTP, dissect_http);
 319         dissector_add("tcp.port", TCP_ALT_PORT_HTTP, dissect_http);
 320         dissector_add("tcp.port", TCP_PORT_PROXY_HTTP, dissect_http);
 321         dissector_add("tcp.port", TCP_PORT_PROXY_ADMIN_HTTP, dissect_http);
 322
 323         /*
 324          * Get a handle for the IPP dissector.
 325          */
 326         ipp_handle = find_dissector("ipp");
 327 }