[Ian Abel <ianabel@xxxxxxxxxxxxx>]

Hi,

The attached file should fix the following two bugs in the AJP dissector.

1) The dissector doesn't know about CPING/CPONG
2) The dissector misinterprets multiple requests in one connection if a 
prior request has a Body request part.

Yours,

Ian

--
Ian Abel <ianabel@xxxxxxxxxxxxx>
Systems Analyst
Tel: +44 (0) 845 666 7778 
http://www.mxtelecom.com/

Index: packet-ajp13.c
===================================================================
--- packet-ajp13.c	(revision 18763)
+++ packet-ajp13.c	(working copy)
@@ -168,6 +168,8 @@
   { 5, "END RESPONSE" },
   { 6, "GET BODY CHUNK" },
   { 7, "SHUTDOWN" },
+  { 9, "CPONG" },
+  {10, "CPING" },
   { 0, NULL }
 };
 
@@ -393,6 +395,8 @@
       proto_tree_add_item(ajp13_tree, hf_ajp13_rlen, tvb, pos, 2, 0);
     pos+=2;
 
+  } else if ( mcode == 9 ) {
+
   } else {
     /* MESSAGE DATA (COPOUT)
      */
@@ -409,10 +413,18 @@
  * packets.
  */
 static void
-display_req_body(tvbuff_t *tvb, proto_tree *ajp13_tree)
+display_req_body(tvbuff_t *tvb, proto_tree *ajp13_tree, ajp13_conv_data* cd)
 {
   /*printf("ajp13:display_req_body()\n");*/
 
+  /*
+   * In a resued connection this is never reset.
+   */
+  guint16 content_length;
+
+  content_length = tvb_get_ntohs( tvb, 4 );
+  cd->content_length -= content_length;
+
   if (ajp13_tree) {
 
     guint8 body_bytes[128*1024]; /* DANGER WILL ROBINSON */
@@ -487,6 +499,11 @@
     proto_tree_add_string(ajp13_tree, hf_ajp13_code, tvb, pos, 1, mcode_buf);
   }
   pos+=1;
+  if ( cod == 10 ) {
+    if(check_col(pinfo->cinfo, COL_INFO))
+      col_append_str(pinfo->cinfo, COL_INFO, "CPING" );
+    return;
+  }
 
   /* HTTP METHOD (ENCODED AS INTEGER)
    */
@@ -712,7 +729,7 @@
   if (mag == 0x1234) {
 
     if (fd->is_request_body)
-      display_req_body(tvb, ajp13_tree);
+      display_req_body(tvb, ajp13_tree, cd);
     else
       display_req_forward(tvb, pinfo, ajp13_tree, cd);