I've been needing the ability to filter on the HTTP method in HTTP
packets; e.g., I want to see all HTTP POST's. Attached is a patch which
adds the http.method field. Instead of just checking this in I'm asking
for a review since 1) I haven't checked in any ethereal code in a looong
time, and 2) maybe it's wrong.
thanks,
--gilbert
Index: packet-http.c
===================================================================
RCS file: /usr/local/cvsroot/ethereal/packet-http.c,v
retrieving revision 1.63
diff -u -r1.63 packet-http.c
--- packet-http.c 30 May 2003 03:11:44 -0000 1.63
+++ packet-http.c 7 Jun 2003 18:45:11 -0000
@@ -53,6 +53,7 @@
static int hf_http_response = -1;
static int hf_http_request = -1;
static int hf_http_basic = -1;
+static int hf_http_method = -1;
static gint ett_http = -1;
static gint ett_http_ntlmssp = -1;
@@ -79,7 +80,8 @@
PROTO_SSDP /* Simple Service Discovery Protocol */
} http_proto_t;
-static int is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type);
+static int is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type,
+ tvbuff_t *tvb, proto_tree *tree);
static dissector_table_t subdissector_table;
static heur_dissector_list_t heur_subdissector_list;
@@ -232,7 +234,7 @@
FALSE);
line = tvb_get_ptr(tvb, offset, linelen);
http_type = HTTP_OTHERS; /* type not known yet */
- if (is_http_request_or_reply(line, linelen, &http_type))
+ if (is_http_request_or_reply(line, linelen, &http_type, NULL, NULL))
col_add_str(pinfo->cinfo, COL_INFO,
format_text(line, linelen));
else
@@ -265,7 +267,7 @@
/*
* OK, does it look like an HTTP request or response?
*/
- if (is_http_request_or_reply(line, linelen, &http_type))
+ if (is_http_request_or_reply(line, linelen, &http_type, tvb, http_tree))
goto is_http;
/*
@@ -423,7 +425,8 @@
* anyway.
*/
static int
-is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type)
+is_http_request_or_reply(const guchar *data, int linelen, http_type_t *type,
+ tvbuff_t *tvb, proto_tree *tree)
{
int isHttpRequestOrReply = FALSE;
@@ -552,6 +555,10 @@
default:
break;
}
+
+ if (tree && isHttpRequestOrReply) {
+ proto_tree_add_item(tree, hf_http_method, tvb, 0, index, FALSE);
+ }
}
return isHttpRequestOrReply;
@@ -576,6 +583,10 @@
{ &hf_http_basic,
{ "Credentials", "http.authbasic",
FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }},
+ { &hf_http_method,
+ { "Method", "http.method",
+ FT_STRING, BASE_NONE, NULL, 0x0,
+ "HTTP method", HFILL }},
};
static gint *ett[] = {
&ett_http,
