Wireshark · Ethereal-dev: [Ethereal-dev] HTTP basic authorization credentials base 64 decode patch

[tz <tz1@xxxxxxx>]

This adds a Credentials:  Username:Password entry for Basic 
authorization decoded from the base 64 string.

I've seen instances where Proxy-authorization had the lowercase A for 
basic, and maybe this should also be corrected for the NTLM versions.

--- ethereal-0.9.12/packet-http.c	Mon Feb 24 22:15:41 2003
+++ packet-http.c	Sat May 17 08:04:10 2003
@@ -51,6 +51,7 @@
 static int hf_http_notification = -1;
 static int hf_http_response = -1;
 static int hf_http_request = -1;
+static int hf_http_basic = -1;

 static gint ett_http = -1;
 static gint ett_http_ntlmssp = -1;
@@ -163,6 +165,10 @@
 		"WWW-Authenticate: Negotiate ",
 		"Proxy-Authenticate: NTLM ",
 		"Proxy-Authorization: NTLM ",
+		NULL,
+		"Authorization: Basic ",
+		"Proxy-Authorization: Basic ",
+		"Proxy-authorization: Basic ",
 		NULL
 	};
 	const char **header;
@@ -182,6 +187,25 @@
 			return TRUE;
 		}
 	}
+	for (header++; *header != NULL; header++) {
+	    char *data;
+		hdrlen = strlen(*header);
+		if (strncmp(text, *header, hdrlen) == 0) {
+			if (hdr_item != NULL) {
+				hdr_tree = proto_item_add_subtree(hdr_item,
+				    ett_http_ntlmssp);
+			} else
+				hdr_tree = NULL;
+			text += hdrlen;
+
+			data = g_strdup(text);
+			base64_decode(data);
+			add_new_data_source(pinfo, tvb, "Basic Auth");
+			proto_tree_add_string(hdr_tree,hf_http_basic, tvb, 0, 0, data);
+
+			return TRUE;
+		}
+	}
 	return FALSE;
 }

@@ -574,6 +598,9 @@
 	      { "Request",		"http.request",
 		FT_BOOLEAN, BASE_NONE, NULL, 0x0,
 		"TRUE if HTTP request", HFILL }},
+	    { &hf_http_basic,
+	      { "Credentials",		"http.authbasic",
+		FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
 	};
 	static gint *ett[] = {
 		&ett_http,