Add dissector table for negotiated WebSocket protocol

This adds the possibility to filter on the negotiated WebSocket
protocol from the upgrade response as well as on a specific TCP port

Bug: 12298
Change-Id: I8e0b785cec0b8c71ec558b74ac07c81194268b38
Signed-off-by: Gregor Jasny <gjasny@googlemail.com>
Reviewed-on: https://code.wireshark.org/review/14645
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>

3 files changed, 20 insertions, 3 deletions

diff --git a/epan/dissectors/packet-http.c b/epan/dissectors/packet-http.c
index ba44f06f8b..695d970a6e 100644
--- a/epan/dissectors/packet-http.c
+++ b/epan/dissectors/packet-http.c
@@ -2328,6 +2328,7 @@ typedef struct {
 #define HDR_HOST		7
 #define HDR_UPGRADE		8
 #define HDR_COOKIE		9
+#define HDR_WEBSOCKET_PROTOCOL	10
 
 static const header_info headers[] = {
 	{ "Authorization", &hf_http_authorization, HDR_AUTHORIZATION },
@@ -2354,7 +2355,7 @@ static const header_info headers[] = {
 	{ "Sec-WebSocket-Accept", &hf_http_sec_websocket_accept, HDR_NO_SPECIAL },
 	{ "Sec-WebSocket-Extensions", &hf_http_sec_websocket_extensions, HDR_NO_SPECIAL },
 	{ "Sec-WebSocket-Key", &hf_http_sec_websocket_key, HDR_NO_SPECIAL },
-	{ "Sec-WebSocket-Protocol", &hf_http_sec_websocket_protocol, HDR_NO_SPECIAL },
+	{ "Sec-WebSocket-Protocol", &hf_http_sec_websocket_protocol, HDR_WEBSOCKET_PROTOCOL },
 	{ "Sec-WebSocket-Version", &hf_http_sec_websocket_version, HDR_NO_SPECIAL },
 	{ "Set-Cookie", &hf_http_set_cookie, HDR_NO_SPECIAL },
 	{ "Last-Modified", &hf_http_last_modified, HDR_NO_SPECIAL },
@@ -2796,6 +2797,12 @@ process_header(tvbuff_t *tvb, int offset, int next_offset,
 			}
 			break;
 
+		case HDR_WEBSOCKET_PROTOCOL:
+			if (http_type == HTTP_RESPONSE) {
+				conv_data->websocket_protocol = wmem_strndup(wmem_file_scope(), value, value_len);
+			}
+			break;
+
 		}
 	}
 }
diff --git a/epan/dissectors/packet-http.h b/epan/dissectors/packet-http.h
index 833447477a..c6411aa757 100644
--- a/epan/dissectors/packet-http.h
+++ b/epan/dissectors/packet-http.h
@@ -77,6 +77,7 @@ typedef struct _http_conv_t {
 	/** the number of requests on the conversation. */
 	guint32  req_res_num;
 	guint8   upgrade;
+	gchar   *websocket_protocol;	/* Negotiated WebSocket protocol */
 	/* Server address and port, known after first server response */
 	guint16 server_port;
 	address server_addr;
diff --git a/epan/dissectors/packet-websocket.c b/epan/dissectors/packet-websocket.c
index 7cd332b583..19579203d7 100644
--- a/epan/dissectors/packet-websocket.c
+++ b/epan/dissectors/packet-websocket.c
@@ -123,6 +123,7 @@ static const value_string ws_close_status_code_vals[] = {
 };
 
 static dissector_table_t port_subdissector_table;
+static dissector_table_t protocol_subdissector_table;
 static heur_dissector_list_t heur_subdissector_list;
 
 #define MAX_UNMASKED_LEN (1024 * 256)
@@ -196,8 +197,13 @@ dissect_websocket_data_frame(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
   if (conv) {
     http_conv = (http_conv_t *)conversation_get_proto_data(conv, proto_http);
 
-    if (http_conv)
-      handle = dissector_get_uint_handle(port_subdissector_table, http_conv->server_port);
+    if (http_conv) {
+      if (http_conv->websocket_protocol) {
+        handle = dissector_get_string_handle(protocol_subdissector_table, http_conv->websocket_protocol);
+      } else if (!handle) {
+        handle = dissector_get_uint_handle(port_subdissector_table, http_conv->server_port);
+      }
+    }
   }
 
   if (handle) {
@@ -535,6 +541,9 @@ proto_register_websocket(void)
   port_subdissector_table = register_dissector_table("ws.port",
       "TCP port for protocols using WebSocket", proto_websocket, FT_UINT16, BASE_DEC, DISSECTOR_TABLE_NOT_ALLOW_DUPLICATE);
 
+  protocol_subdissector_table = register_dissector_table("ws.protocol",
+      "Negotiated WebSocket protocol", proto_websocket, FT_STRING, BASE_NONE, DISSECTOR_TABLE_NOT_ALLOW_DUPLICATE);
+
   proto_register_field_array(proto_websocket, hf, array_length(hf));
   proto_register_subtree_array(ett, array_length(ett));
   expert_websocket = expert_register_protocol(proto_websocket);