packet-http.c

   1 /* packet-http.c
   2  * Routines for HTTP packet disassembly
   3  *
   4  * Guy Harris <guy@alum.mit.edu>
   5  *
   6  * Copyright 2002, Tim Potter <tpot@samba.org>
   7  * Copyright 1999, Andrew Tridgell <tridge@samba.org>
   8  *
   9  * $Id: packet-http.c,v 1.54 2002/08/14 00:40:14 tpot Exp $
  10  *
  11  * Ethereal - Network traffic analyzer
  12  * By Gerald Combs <gerald@ethereal.com>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  28  */
  29
  30 #ifdef HAVE_CONFIG_H
  31 #include "config.h"
  32 #endif
  33
  34 #include <string.h>
  35 #include <ctype.h>
  36
  37 #include <glib.h>
  38 #include <epan/packet.h>
  39 #include <epan/strutil.h>
  40
  41 #include "packet-http.h"
  42
  43 typedef enum _http_type {
  44         HTTP_REQUEST,
  45         HTTP_RESPONSE,
  46         HTTP_NOTIFICATION,
  47         HTTP_OTHERS
  48 } http_type_t;
  49
  50 static int proto_http = -1;
  51 static int hf_http_notification = -1;
  52 static int hf_http_response = -1;
  53 static int hf_http_request = -1;
  54
  55 static gint ett_http = -1;
  56 static gint ett_http_ntlmssp = -1;
  57
  58 static dissector_handle_t data_handle;
  59 static dissector_handle_t http_handle;
  60
  61 #define TCP_PORT_HTTP                   80
  62 #define TCP_PORT_PROXY_HTTP             3128
  63 #define TCP_PORT_PROXY_ADMIN_HTTP       3132
  64 #define TCP_ALT_PORT_HTTP               8080
  65
  66 /*
  67  * SSDP is implemented atop HTTP (yes, it really *does* run over UDP).
  68  */
  69 #define TCP_PORT_SSDP                   1900
  70 #define UDP_PORT_SSDP                   1900
  71
  72 /*
  73  * Some headers that we dissect more deeply - Microsoft's abomination
  74  * called NTLMSSP over HTTP.
  75  */
  76 #define NTLMSSP_AUTH    "Authorization: NTLM "
  77 #define NTLMSSP_WWWAUTH "WWW-Authenticate: NTLM "
  78
  79 /*
  80  * Protocols implemented atop HTTP.
  81  */
  82 typedef enum {
  83         PROTO_HTTP,             /* just HTTP */
  84         PROTO_SSDP              /* Simple Service Discovery Protocol */
  85 } http_proto_t;
  86
  87 static int is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type);
  88
  89 static dissector_table_t subdissector_table;
  90 static heur_dissector_list_t heur_subdissector_list;
  91
  92 static dissector_handle_t ntlmssp_handle=NULL;
  93
  94 /* Decode a base64 string in-place - simple and slow algorithm.
  95    Return length of result. Taken from rproxy/librsync/base64.c by
  96    Andrew Tridgell. */
  97
  98 static size_t base64_decode(char *s)
  99 {
 100         const char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 101         int bit_offset, byte_offset, idx, i, n;
 102         unsigned char *d = (unsigned char *)s;
 103         char *p;
 104
 105         n=i=0;
 106
 107         while (*s && (p=strchr(b64, *s))) {
 108                 idx = (int)(p - b64);
 109                 byte_offset = (i*6)/8;
 110                 bit_offset = (i*6)%8;
 111                 d[byte_offset] &= ~((1<<(8-bit_offset))-1);
 112                 if (bit_offset < 3) {
 113                         d[byte_offset] |= (idx << (2-bit_offset));
 114                         n = byte_offset+1;
 115                 } else {
 116                         d[byte_offset] |= (idx >> (bit_offset-2));
 117                         d[byte_offset+1] = 0;
 118                         d[byte_offset+1] |= (idx << (8-(bit_offset-2))) & 0xFF;
 119                         n = byte_offset+2;
 120                 }
 121                 s++; i++;
 122         }
 123
 124         return n;
 125 }
 126
 127 /* Return a tvb that contains the binary representation of a base64
 128    string */
 129
 130 static tvbuff_t *
 131 base64_to_tvb(char *base64)
 132 {
 133         tvbuff_t *tvb;
 134         char *data = g_strdup(base64);
 135         size_t len;
 136
 137         len = base64_decode(data);
 138         tvb = tvb_new_real_data(data, len, len);
 139
 140         tvb_set_free_cb(tvb, g_free);
 141
 142         return tvb;
 143 }
 144
 145 static void
 146 dissect_http_ntlmssp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, char *line)
 147 {
 148         tvbuff_t *ntlmssp_tvb;
 149
 150         ntlmssp_tvb = base64_to_tvb(line);
 151         tvb_set_child_real_data_tvbuff(tvb, ntlmssp_tvb);
 152         add_new_data_source(pinfo, ntlmssp_tvb, "NTLMSSP Data");
 153
 154         call_dissector(ntlmssp_handle, ntlmssp_tvb, pinfo, tree);
 155
 156         tvb_free(ntlmssp_tvb);
 157 }
 158
 159 static void
 160 dissect_http(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 161 {
 162         http_proto_t    proto;
 163         char            *proto_tag;
 164         proto_tree      *http_tree = NULL;
 165         proto_item      *ti = NULL;
 166         gint            offset = 0;
 167         const guchar    *line;
 168         gint            next_offset;
 169         const guchar    *linep, *lineend;
 170         int             linelen;
 171         guchar          c;
 172         http_type_t     http_type;
 173         int             datalen;
 174
 175         switch (pinfo->match_port) {
 176
 177         case TCP_PORT_SSDP:     /* TCP_PORT_SSDP = UDP_PORT_SSDP */
 178                 proto = PROTO_SSDP;
 179                 proto_tag = "SSDP";
 180                 break;
 181
 182         default:
 183                 proto = PROTO_HTTP;
 184                 proto_tag = "HTTP";
 185                 break;
 186         }
 187
 188         if (check_col(pinfo->cinfo, COL_PROTOCOL))
 189                 col_set_str(pinfo->cinfo, COL_PROTOCOL, proto_tag);
 190         if (check_col(pinfo->cinfo, COL_INFO)) {
 191                 /*
 192                  * Put the first line from the buffer into the summary
 193                  * if it's an HTTP request or reply (but leave out the
 194                  * line terminator).
 195                  * Otherwise, just call it a continuation.
 196                  *
 197                  * Note that "tvb_find_line_end()" will return a value that
 198                  * is not longer than what's in the buffer, so the
 199                  * "tvb_get_ptr()" call won't throw an exception.
 200                  */
 201                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset,
 202                     FALSE);
 203                 line = tvb_get_ptr(tvb, offset, linelen);
 204                 http_type = HTTP_OTHERS;        /* type not known yet */
 205                 if (is_http_request_or_reply(line, linelen, &http_type))
 206                         col_add_str(pinfo->cinfo, COL_INFO,
 207                             format_text(line, linelen));
 208                 else
 209                         col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
 210         }
 211
 212         if (tree) {
 213                 ti = proto_tree_add_item(tree, proto_http, tvb, offset, -1,
 214                     FALSE);
 215                 http_tree = proto_item_add_subtree(ti, ett_http);
 216         }
 217
 218         /*
 219          * Process the packet data, a line at a time.
 220          */
 221         http_type = HTTP_OTHERS;        /* type not known yet */
 222         while (tvb_offset_exists(tvb, offset)) {
 223                 /*
 224                  * Find the end of the line.
 225                  */
 226                 linelen = tvb_find_line_end(tvb, offset, -1, &next_offset,
 227                     FALSE);
 228
 229                 /*
 230                  * Get a buffer that refers to the line.
 231                  */
 232                 line = tvb_get_ptr(tvb, offset, linelen);
 233                 lineend = line + linelen;
 234
 235                 /*
 236                  * OK, does it look like an HTTP request or response?
 237                  */
 238                 if (is_http_request_or_reply(line, linelen, &http_type))
 239                         goto is_http;
 240
 241                 /*
 242                  * No.  Does it look like a blank line (as would appear
 243                  * at the end of an HTTP request)?
 244                  */
 245                 if (linelen == 0)
 246                         goto is_http;
 247
 248                 /*
 249                  * No.  Does it look like a MIME header?
 250                  */
 251                 linep = line;
 252                 while (linep < lineend) {
 253                         c = *linep++;
 254                         if (!isprint(c))
 255                                 break;  /* not printable, not a MIME header */
 256                         switch (c) {
 257
 258                         case '(':
 259                         case ')':
 260                         case '<':
 261                         case '>':
 262                         case '@':
 263                         case ',':
 264                         case ';':
 265                         case '\\':
 266                         case '"':
 267                         case '/':
 268                         case '[':
 269                         case ']':
 270                         case '?':
 271                         case '=':
 272                         case '{':
 273                         case '}':
 274                                 /*
 275                                  * It's a tspecial, so it's not part of a
 276                                  * token, so it's not a field name for the
 277                                  * beginning of a MIME header.
 278                                  */
 279                                 goto not_http;
 280
 281                         case ':':
 282                                 /*
 283                                  * This ends the token; we consider this
 284                                  * to be a MIME header.
 285                                  */
 286                                 goto is_http;
 287                         }
 288                 }
 289
 290         not_http:
 291                 /*
 292                  * We don't consider this part of an HTTP request or
 293                  * reply, so we don't display it.
 294                  * (Yeah, that means we don't display, say, a text/http
 295                  * page, but you can get that from the data pane.)
 296                  */
 297                 break;
 298
 299         is_http:
 300                 /*
 301                  * Put this line.
 302                  */
 303                 if (tree) {
 304                         proto_tree *hdr_tree;
 305                         proto_item *hdr_item;
 306                         char *text;
 307
 308                         text = tvb_format_text(tvb, offset, next_offset - offset);
 309
 310                         hdr_item = proto_tree_add_text(http_tree, tvb, offset,
 311                             next_offset - offset, "%s", text);
 312
 313                         if (strncmp(text, NTLMSSP_AUTH, strlen(NTLMSSP_AUTH)) == 0) {
 314                                 hdr_tree = proto_item_add_subtree(
 315                                         hdr_item, ett_http_ntlmssp);
 316                                 text += strlen(NTLMSSP_AUTH);
 317                                 dissect_http_ntlmssp(tvb, pinfo, hdr_tree, text);
 318                         }
 319
 320                         if (strncmp(text, NTLMSSP_WWWAUTH, strlen(NTLMSSP_WWWAUTH)) == 0) {
 321                                 hdr_tree = proto_item_add_subtree(
 322                                         hdr_item, ett_http_ntlmssp);
 323                                 text += strlen(NTLMSSP_WWWAUTH);
 324                                 dissect_http_ntlmssp(tvb, pinfo, hdr_tree, text);
 325                         }
 326                 }
 327                 offset = next_offset;
 328         }
 329
 330         if (tree) {
 331                 switch (http_type) {
 332
 333                 case HTTP_NOTIFICATION:
 334                         proto_tree_add_boolean_hidden(http_tree,
 335                             hf_http_notification, tvb, 0, 0, 1);
 336                         break;
 337
 338                 case HTTP_RESPONSE:
 339                         proto_tree_add_boolean_hidden(http_tree,
 340                             hf_http_response, tvb, 0, 0, 1);
 341                         break;
 342
 343                 case HTTP_REQUEST:
 344                         proto_tree_add_boolean_hidden(http_tree,
 345                             hf_http_request, tvb, 0, 0, 1);
 346                         break;
 347
 348                 case HTTP_OTHERS:
 349                 default:
 350                         break;
 351                 }
 352         }
 353
 354         datalen = tvb_length_remaining(tvb, offset);
 355         if (datalen > 0) {
 356                 tvbuff_t *next_tvb = tvb_new_subset(tvb, offset, -1, -1);
 357
 358                 /*
 359                  * OK, has some subdissector asked that they be called
 360                  * if something was on some particular port?
 361                  */
 362                 if (dissector_try_port(subdissector_table, pinfo->match_port,
 363                     next_tvb, pinfo, tree)) {
 364                         /*
 365                          * Yes.  Fix up the top-level item so that it
 366                          * doesn't include the stuff for that protocol.
 367                          */
 368                         if (ti != NULL)
 369                                 proto_item_set_len(ti, offset);
 370                 } else if(dissector_try_heuristic(heur_subdissector_list,
 371                                                   next_tvb,pinfo,tree)){
 372                         /*
 373                          * Yes.  Fix up the top-level item so that it
 374                          * doesn't include the stuff for that protocol.
 375                          */
 376                         if (ti != NULL)
 377                                 proto_item_set_len(ti, offset);
 378                 } else {
 379                         call_dissector(data_handle,
 380                             tvb_new_subset(tvb, offset, -1, -1), pinfo,
 381                             http_tree);
 382                 }
 383         }
 384 }
 385
 386 /*
 387  * XXX - this won't handle HTTP 0.9 replies, but they're all data
 388  * anyway.
 389  */
 390 static int
 391 is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type)
 392 {
 393         int isHttpRequestOrReply = FALSE;
 394
 395         /*
 396          * From RFC 2774 - An HTTP Extension Framework
 397          *
 398          * Support the command prefix that identifies the presence of
 399          * a "mandatory" header.
 400          */
 401         if (linelen >= 2 && strncmp(data, "M-", 2) == 0) {
 402                 data += 2;
 403                 linelen -= 2;
 404         }
 405
 406         /*
 407          * From draft-cohen-gena-client-01.txt, available from the uPnP forum:
 408          *      NOTIFY, SUBSCRIBE, UNSUBSCRIBE
 409          *
 410          * From draft-ietf-dasl-protocol-00.txt, a now vanished Microsoft draft:
 411          *      SEARCH
 412          */
 413         if (linelen >= 5 && strncmp(data, "HTTP/", 5) == 0) {
 414                 *type = HTTP_RESPONSE;
 415                 isHttpRequestOrReply = TRUE;    /* response */
 416         } else {
 417                 guchar * ptr = (guchar *)data;
 418                 int              index = 0;
 419
 420                 /* Look for the space following the Method */
 421                 while (index < linelen) {
 422                         if (*ptr == ' ')
 423                                 break;
 424                         else {
 425                                 ptr++;
 426                                 index++;
 427                         }
 428                 }
 429
 430                 /* Check the methods that have same length */
 431                 switch (index) {
 432
 433                 case 3:
 434                         if (strncmp(data, "GET", index) == 0 ||
 435                             strncmp(data, "PUT", index) == 0) {
 436                                 *type = HTTP_REQUEST;
 437                                 isHttpRequestOrReply = TRUE;
 438                         }
 439                         break;
 440
 441                 case 4:
 442                         if (strncmp(data, "COPY", index) == 0 ||
 443                             strncmp(data, "HEAD", index) == 0 ||
 444                             strncmp(data, "LOCK", index) == 0 ||
 445                             strncmp(data, "MOVE", index) == 0 ||
 446                             strncmp(data, "POLL", index) == 0 ||
 447                             strncmp(data, "POST", index) == 0) {
 448                                 *type = HTTP_REQUEST;
 449                                 isHttpRequestOrReply = TRUE;
 450                         }
 451                         break;
 452
 453                 case 5:
 454                         if (strncmp(data, "BCOPY", index) == 0 ||
 455                                 strncmp(data, "BMOVE", index) == 0 ||
 456                                 strncmp(data, "MKCOL", index) == 0 ||
 457                                 strncmp(data, "TRACE", index) == 0) {
 458                                 *type = HTTP_REQUEST;
 459                                 isHttpRequestOrReply = TRUE;
 460                         }
 461                         break;
 462
 463                 case 6:
 464                         if (strncmp(data, "DELETE", index) == 0 ||
 465                                 strncmp(data, "SEARCH", index) == 0 ||
 466                                 strncmp(data, "UNLOCK", index) == 0) {
 467                                 *type = HTTP_REQUEST;
 468                                 isHttpRequestOrReply = TRUE;
 469                         }
 470                         else if (strncmp(data, "NOTIFY", index) == 0) {
 471                                 *type = HTTP_NOTIFICATION;
 472                                 isHttpRequestOrReply = TRUE;
 473                         }
 474                         break;
 475
 476                 case 7:
 477                         if (strncmp(data, "BDELETE", index) == 0 ||
 478                             strncmp(data, "CONNECT", index) == 0 ||
 479                             strncmp(data, "OPTIONS", index) == 0) {
 480                                 *type = HTTP_REQUEST;
 481                                 isHttpRequestOrReply = TRUE;
 482                         }
 483                         break;
 484
 485                 case 8:
 486                         if (strncmp(data, "PROPFIND", index) == 0) {
 487                                 *type = HTTP_REQUEST;
 488                                 isHttpRequestOrReply = TRUE;
 489                         }
 490                         break;
 491
 492                 case 9:
 493                         if (strncmp(data, "SUBSCRIBE", index) == 0) {
 494                                 *type = HTTP_NOTIFICATION;
 495                                 isHttpRequestOrReply = TRUE;
 496                         } else if (strncmp(data, "PROPPATCH", index) == 0 ||
 497                             strncmp(data, "BPROPFIND", index) == 0) {
 498                                 *type = HTTP_REQUEST;
 499                                 isHttpRequestOrReply = TRUE;
 500                         }
 501                         break;
 502
 503                 case 10:
 504                         if (strncmp(data, "BPROPPATCH", index) == 0) {
 505                                 *type = HTTP_REQUEST;
 506                                 isHttpRequestOrReply = TRUE;
 507                         }
 508                         break;
 509
 510                 case 11:
 511                         if (strncmp(data, "UNSUBSCRIBE", index) == 0) {
 512                                 *type = HTTP_NOTIFICATION;
 513                                 isHttpRequestOrReply = TRUE;
 514                         }
 515                         break;
 516
 517                 default:
 518                         break;
 519                 }
 520         }
 521
 522         return isHttpRequestOrReply;
 523 }
 524
 525
 526 void
 527 proto_register_http(void)
 528 {
 529         static hf_register_info hf[] = {
 530             { &hf_http_notification,
 531               { "Notification",         "http.notification",
 532                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 533                 "TRUE if HTTP notification", HFILL }},
 534             { &hf_http_response,
 535               { "Response",             "http.response",
 536                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 537                 "TRUE if HTTP response", HFILL }},
 538             { &hf_http_request,
 539               { "Request",              "http.request",
 540                 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 541                 "TRUE if HTTP request", HFILL }},
 542         };
 543         static gint *ett[] = {
 544                 &ett_http,
 545                 &ett_http_ntlmssp,
 546         };
 547
 548         proto_http = proto_register_protocol("Hypertext Transfer Protocol",
 549             "HTTP", "http");
 550         proto_register_field_array(proto_http, hf, array_length(hf));
 551         proto_register_subtree_array(ett, array_length(ett));
 552
 553         register_dissector("http", dissect_http, proto_http);
 554         http_handle = find_dissector("http");
 555
 556         /*
 557          * Dissectors shouldn't register themselves in this table;
 558          * instead, they should call "http_dissector_add()", and
 559          * we'll register the port number they specify as a port
 560          * for HTTP, and register them in our subdissector table.
 561          *
 562          * This only works for protocols such as IPP that run over
 563          * HTTP on a specific non-HTTP port.
 564          */
 565         subdissector_table = register_dissector_table("http.port",
 566             "TCP port for protocols using HTTP", FT_UINT16, BASE_DEC);
 567
 568         /*
 569          * Heuristic dissectors SHOULD register themselves in
 570          * this table using the standard heur_dissector_add()
 571          * function.
 572          */
 573
 574         register_heur_dissector_list("http",&heur_subdissector_list);
 575
 576 }
 577
 578 /*
 579  * Called by dissectors for protocols that run atop HTTP/TCP.
 580  */
 581 void
 582 http_dissector_add(guint32 port, dissector_handle_t handle)
 583 {
 584         /*
 585          * Register ourselves as the handler for that port number
 586          * over TCP.
 587          */
 588         dissector_add("tcp.port", port, http_handle);
 589
 590         /*
 591          * And register them in *our* table for that port.
 592          */
 593         dissector_add("http.port", port, handle);
 594 }
 595
 596 void
 597 proto_reg_handoff_http(void)
 598 {
 599         data_handle = find_dissector("data");
 600         dissector_add("tcp.port", TCP_PORT_HTTP, http_handle);
 601         dissector_add("tcp.port", TCP_ALT_PORT_HTTP, http_handle);
 602         dissector_add("tcp.port", TCP_PORT_PROXY_HTTP, http_handle);
 603         dissector_add("tcp.port", TCP_PORT_PROXY_ADMIN_HTTP, http_handle);
 604
 605         /*
 606          * XXX - is there anything to dissect in the body of an SSDP
 607          * request or reply?  I.e., should there be an SSDP dissector?
 608          */
 609         dissector_add("tcp.port", TCP_PORT_SSDP, http_handle);
 610         dissector_add("udp.port", UDP_PORT_SSDP, http_handle);
 611
 612         ntlmssp_handle = find_dissector("ntlmssp");
 613 }