JSON dissector changed into heuristic dissector.

To check if a payload is json, the library libjsmn has been added to the source tree, with its licence (MIT).
TODO: the libjsmn can be used to extract tokens in the standard dissection other than heurisitic part.

HPFEEDS dissector has also been changed in order to leverage the new json dissector.

Bug: 10834
Change-Id: Ib1df2a699982dbdd2b5418e97edbdb5cbd9c8978
Reviewed-on: https://code.wireshark.org/review/6350
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>

11 files changed, 693 insertions, 67 deletions

diff --git a/configure.ac b/configure.ac
index 4c4854e12c..bbc02208a9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3061,6 +3061,7 @@ AC_OUTPUT(
   epan/dissectors/dcerpc/Makefile
   epan/dissectors/pidl/Makefile
   epan/ftypes/Makefile
+  epan/jsmn/Makefile
   epan/nghttp2/Makefile
   epan/wmem/Makefile
   epan/wslua/Makefile
diff --git a/epan/CMakeLists.txt b/epan/CMakeLists.txt
index 855f28d598..ccbae86d20 100644
--- a/epan/CMakeLists.txt
+++ b/epan/CMakeLists.txt
@@ -1514,6 +1514,11 @@ set(WMEM_FILES
 )
 source_group(wmem FILES ${WMEM_FILES})
 
+set(JSMN_FILES
+	jsmn/jsmn.c
+)
+source_group(jsmn FILES ${JSMN_FILES})
+
 set(NGHTTP2_FILES
 	nghttp2/nghttp2_buf.c
 	nghttp2/nghttp2_hd.c
@@ -1686,6 +1691,7 @@ set(CLEAN_FILES
 	${DISSECTOR_SUPPORT_SRC}
 	${LIBWIRESHARK_ASM_FILES}
 	${WMEM_FILES}
+	${JSMN_FILES}
 	${NGHTTP2_FILES}
 	${WSLUA_FILES}
 )
@@ -1708,6 +1714,7 @@ add_library(epan ${LINK_MODE_LIB}
 	${DFILTER_FILES}
 	${FTYPE_FILES}
 	${WMEM_FILES}
+	${JSMN_FILES}
 	${NGHTTP2_FILES}
 	${WSLUA_FILES}
 	${DISSECTOR_FILES}
@@ -1737,6 +1744,7 @@ file(GLOB DFILTER_HEADERS dfilter/*.h ../tools/lemon/cppmagic.h)
 file(GLOB D_HEADERS dissectors/*.h)
 file(GLOB FTYPES_HEADERS ftypes/*.h)
 file(GLOB WMEM_HEADERS wmem/*.h)
+file(GLOB JSMN_HEADERS jsmn/*.h)
 file(GLOB NGHTTP2_HEADERS nghttp2/*.h)
 file(MAKE_DIRECTORY ${ABICHECK_TMPDIR}
 	${ABICHECK_TMPDIR}/epan
@@ -1746,6 +1754,7 @@ file(MAKE_DIRECTORY ${ABICHECK_TMPDIR}
 	${ABICHECK_TMPDIR}/dissectors
 	${ABICHECK_TMPDIR}/ftypes
 	${ABICHECK_TMPDIR}/wmem
+	${ABICHECK_TMPDIR}/jsmn
 	${ABICHECK_TMPDIR}/nghttp2)
 
 file(COPY ../color.h ../register.h DESTINATION ${ABICHECK_TMPDIR})
@@ -1756,6 +1765,7 @@ file(COPY ${DFILTER_HEADERS} DESTINATION ${ABICHECK_TMPDIR}/dfilter)
 file(COPY ${D_HEADERS} DESTINATION ${ABICHECK_TMPDIR}/dissectors)
 file(COPY ${FTYPES_HEADERS} DESTINATION ${ABICHECK_TMPDIR}/ftypes)
 file(COPY ${WMEM_HEADERS} DESTINATION ${ABICHECK_TMPDIR}/wmem)
+file(COPY ${JSMN_HEADERS} DESTINATION ${ABICHECK_TMPDIR}/jsmn)
 file(COPY ${NGHTTP2_HEADERS} DESTINATION ${ABICHECK_TMPDIR}/nghttp2)
 
 add_custom_command(OUTPUT libwireshark.abi.tar.gz
@@ -1772,10 +1782,10 @@ add_custom_command(OUTPUT libwireshark.abi.tar.gz
 		${ABICHECK_TMPDIR}/epan/* ${ABICHECK_TMPDIR}/compress/*
 		${ABICHECK_TMPDIR}/dfilter/* ${ABICHECK_TMPDIR}/dissectors/*
 		${ABICHECK_TMPDIR}/ftypes/* ${ABICHECK_TMPDIR}/wmem/*
-		${ABICHECK_TMPDIR}/nghttp2/*
+		${ABICHECK_TMPDIR}/jsmn/* ${ABICHECK_TMPDIR}/nghttp2/*
 	DEPENDS ${HEADERS}
 		${CRYPT_HEADERS} ${COMPRESS_HEADERS} ${DFILTER_HEADERS} ${D_HEADERS}
-		${FTYPES_HEADERS} ${WMEM_HEADERS} ${NGHTTP2_HEADERS} epan)
+		${FTYPES_HEADERS} ${WMEM_HEADERS} ${JSMN_HEADERS} ${NGHTTP2_HEADERS} epan)
 
 # By default the name for a library with target name epan will be libepan,
 # but Ethereal is now named Wireshark
diff --git a/epan/Makefile.am b/epan/Makefile.am
index bf0c6e4be7..f8bc3ebc07 100644
--- a/epan/Makefile.am
+++ b/epan/Makefile.am
@@ -33,7 +33,7 @@ wslua_dir =
 wslua_dist_dir = wslua
 endif		# HAVE_LIBLUA
 
-SUBDIRS = compress crypt ftypes dfilter dissectors nghttp2 wmem $(wslua_dir)
+SUBDIRS = compress crypt ftypes dfilter dissectors jsmn nghttp2 wmem $(wslua_dir)
 
 DIST_SUBDIRS = $(SUBDIRS) $(wslua_dist_dir)
 
@@ -126,7 +126,8 @@ libwireshark_la_LIBADD = \
 	libwireshark_asmopt.la crypt/libairpdcap.la \
 	ftypes/libftypes.la dfilter/libdfilter.la dissectors/libdissectors.la \
 	dissectors/libdirtydissectors.la dissectors/libfiledissectors.la \
-	nghttp2/libnghttp2.la wmem/libwmem.la $(wslua_lib) @SOCKET_LIBS@ @NSL_LIBS@ \
+	jsmn/libjsmn.la nghttp2/libnghttp2.la wmem/libwmem.la $(wslua_lib) \
+	@SOCKET_LIBS@ @NSL_LIBS@ \
 	@C_ARES_LIBS@ @ADNS_LIBS@ @LIBGCRYPT_LIBS@ @LIBGNUTLS_LIBS@ \
 	@KRB5_LIBS@ @SSL_LIBS@ @LIBSMI_LDFLAGS@ @GEOIP_LIBS@ \
 	${top_builddir}/wiretap/libwiretap.la @GLIB_LIBS@ \
@@ -136,7 +137,8 @@ libwireshark_la_DEPENDENCIES = \
 	libwireshark_generated.la compress/liblzxpress.la\
 	libwireshark_asmopt.la crypt/libairpdcap.la \
 	ftypes/libftypes.la dfilter/libdfilter.la dissectors/libdissectors.la \
-	dissectors/libdirtydissectors.la nghttp2/libnghttp2.la wmem/libwmem.la $(wslua_lib) \
+	dissectors/libdirtydissectors.la jsmn/libjsmn.la nghttp2/libnghttp2.la \
+	wmem/libwmem.la $(wslua_lib) \
 	${top_builddir}/wsutil/libwsutil.la \
 	${top_builddir}/wiretap/libwiretap.la
 
diff --git a/epan/Makefile.nmake b/epan/Makefile.nmake
index f0ad957250..47d5bcca4b 100644
--- a/epan/Makefile.nmake
+++ b/epan/Makefile.nmake
@@ -71,6 +71,7 @@ libwireshark_LIBS = \
 	dfilter\dfilter.lib \
 	wmem\wmem.lib \
 	$(WSLUA_LIB) \
+	jsmn\jsmn.lib \
 	nghttp2\nghttp2.lib \
 	dissectors\dissectors.lib
 
@@ -91,17 +92,17 @@ DOXYGEN_DEP=doxygen
 !ENDIF
 
 !IFDEF ENABLE_LIBWIRESHARK
-all: compress crypt ftypes dfilter wmem $(WSLUA_DIR) nghttp2 dissectors libwireshark.dll
+all: compress crypt ftypes dfilter wmem $(WSLUA_DIR) jsmn nghttp2 dissectors libwireshark.dll
 !ELSE
-all: compress crypt ftypes dfilter wmem $(WSLUA_DIR) nghttp2 dissectors libwireshark.lib
+all: compress crypt ftypes dfilter wmem $(WSLUA_DIR) jsmn nghttp2 dissectors libwireshark.lib
 !ENDIF
 
 # For use when making libwireshark.dll
 libwireshark.lib: libwireshark.dll
 libwireshark.exp: libwireshark.dll
 
-libwireshark.dll: ..\config.h $(LIBWIRESHARK_OBJECTS) compress crypt ftypes dfilter wmem $(WSLUA_DIR) nghttp2 dissectors $(DOXYGEN_DEP) $(EXTRA_OBJECTS) \
-		crypt\airpdcap.lib ftypes\ftypes.lib dfilter\dfilter.lib wmem\wmem.lib dissectors\dissectors.lib $(WSLUA_LIB) nghttp2\nghttp2.lib ..\image\libwireshark.res
+libwireshark.dll: ..\config.h $(LIBWIRESHARK_OBJECTS) compress crypt ftypes dfilter wmem $(WSLUA_DIR) jsmn nghttp2 dissectors $(DOXYGEN_DEP) $(EXTRA_OBJECTS) \
+		crypt\airpdcap.lib ftypes\ftypes.lib dfilter\dfilter.lib wmem\wmem.lib dissectors\dissectors.lib $(WSLUA_LIB) jsmn\jsmn.lib nghttp2\nghttp2.lib ..\image\libwireshark.res
 	@echo Linking libwireshark.dll
 	$(link) $(dlllflags) $(conlibsdll) shell32.lib psapi.lib \
 		$(LOCAL_LDFLAGS) $(DLL_LDFLAGS) \
@@ -111,8 +112,8 @@ libwireshark.dll: ..\config.h $(LIBWIRESHARK_OBJECTS) compress crypt ftypes dfil
 		dissectors\register.obj \
 		$(EXTRA_OBJECTS)
 
-libwireshark.lib	: ..\config.h $(LIBWIRESHARK_OBJECTS) compress crypt ftypes dfilter wmem $(WSLUA_DIR) nghttp2 dissectors $(DOXYGEN_DEP) $(EXTRA_OBJECTS) \
-		crypt\airpdcap.lib ftypes\ftypes.lib dfilter\dfilter.lib wmem\wmem.lib $(WSLUA_LIB) nghttp2\nghttp2.lib dissectors\dissectors.lib
+libwireshark.lib	: ..\config.h $(LIBWIRESHARK_OBJECTS) compress crypt ftypes dfilter wmem $(WSLUA_DIR) jsmn nghttp2 dissectors $(DOXYGEN_DEP) $(EXTRA_OBJECTS) \
+		crypt\airpdcap.lib ftypes\ftypes.lib dfilter\dfilter.lib wmem\wmem.lib $(WSLUA_LIB) jsmn\jsmn.lib nghttp2\nghttp2.lib dissectors\dissectors.lib
 	link /lib /out:libwireshark.lib $(LIBWIRESHARK_OBJECTS) \
 		$(EXTRA_OBJECTS)
 
@@ -143,6 +144,8 @@ clean:  clean-local
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
 	cd ../wslua
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
+	cd ../jsmn
+	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
 	cd ../nghttp2
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake clean
 	cd ..
@@ -179,6 +182,8 @@ distclean: distclean-local
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
 	cd ../wslua
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
+	cd ../jsmn
+	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
 	cd ../nghttp2
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake distclean
 	cd ..
@@ -200,6 +205,8 @@ maintainer-clean: maintainer-clean-local
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
 	cd ../wslua
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
+	cd ../jsmn
+	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
 	cd ../nghttp2
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake maintainer-clean
 	cd ..
@@ -239,6 +246,11 @@ wslua:: ..\config.h
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
 	cd ..
 
+jsmn:: ..\config.h
+	cd jsmn
+	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
+	cd ..
+
 nghttp2:: ..\config.h
 	cd nghttp2
 	$(MAKE) /$(MAKEFLAGS) -f Makefile.nmake
diff --git a/epan/dissectors/packet-hpfeeds.c b/epan/dissectors/packet-hpfeeds.c
index f98cd1f7f7..d08fa6eb72 100644
--- a/epan/dissectors/packet-hpfeeds.c
+++ b/epan/dissectors/packet-hpfeeds.c
@@ -38,9 +38,12 @@
 void proto_register_hpfeeds(void);
 void proto_reg_handoff_hpfeeds(void);
 
+static heur_dissector_list_t heur_subdissector_list;
+
 /* Preferences */
 static guint hpfeeds_port_pref = 0;
 static gboolean hpfeeds_desegment = TRUE;
+static gboolean try_heuristic = TRUE;
 
 static int proto_hpfeeds = -1;
 
@@ -98,25 +101,6 @@ static const value_string opcode_vals[] = {
     { 0,              NULL },
 };
 
-/*
-*
-* These values are the channel used by "most" spread and used honeypots
-* In case we have publish message in one of these channel we can decode
-* payload completely
-*
-*/
-static const value_string chan_vals[] = {
-    { CH_DIONAEA_CAPTURE, "dionaea.capture" },
-    { CH_DIONAEA_DCE, "dionaea.dcerpcrequests" },
-    { CH_DIONAEA_SHELLCODE, "dionaea.shellcodeprofiles" },
-    { CH_DIONAEA_UINQUE, "mwbinary.dionaea.sensorunique" },
-    { CH_DIONAEA_CONNECTIONS, "dionaea.connections" },
-    { CH_KIPPO_SESSIONS, "kippo.sessions" },
-    { CH_GEOLOC_EVENTS, "geoloc.events" },
-    { CH_GLASTOPF_EVENTS, "glastopf.events" },
-    { CH_EINVAL, NULL }
-};
-
 static void
 dissect_hpfeeds_error_pdu(tvbuff_t *tvb, proto_tree *tree, guint offset)
 {
@@ -169,49 +153,35 @@ dissect_hpfeeds_publish_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
     guint offset)
 {
     guint8 len = 0;
+    heur_dtbl_entry_t *hdtbl_entry;
     guint8 *strptr = NULL;
-    gint8 channel = CH_EINVAL;
-    tvbuff_t *json_tvb = NULL;
+    tvbuff_t *next_tvb;
 
     len = tvb_get_guint8(tvb, offset);
-    proto_tree_add_item(tree, hf_hpfeeds_ident_len, tvb, offset, 1,
-        ENC_BIG_ENDIAN);
+    proto_tree_add_item(tree, hf_hpfeeds_ident_len, tvb, offset, 1, ENC_BIG_ENDIAN);
     offset += 1;
-    proto_tree_add_item(tree, hf_hpfeeds_ident, tvb, offset, len,
-        ENC_ASCII|ENC_NA);
+    proto_tree_add_item(tree, hf_hpfeeds_ident, tvb, offset, len, ENC_ASCII|ENC_NA);
     offset += len;
     len = tvb_get_guint8(tvb, offset);
-    proto_tree_add_item(tree, hf_hpfeeds_chan_len, tvb, offset, 1,
-        ENC_BIG_ENDIAN);
+    proto_tree_add_item(tree, hf_hpfeeds_chan_len, tvb, offset, 1, ENC_BIG_ENDIAN);
     offset += 1;
 
-    /* get the channel name as ephemeral string just to make an attempt
-    *  in order to decode more payload if channel is "well known"
-    */
+    /* get the channel name as ephemeral string to pass it to the json decoder */
     strptr = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, len, ENC_ASCII);
-    proto_tree_add_item(tree, hf_hpfeeds_channel, tvb, offset, len,
-        ENC_ASCII|ENC_NA);
+    proto_tree_add_item(tree, hf_hpfeeds_channel, tvb, offset, len, ENC_ASCII|ENC_NA);
     offset += len;
-    channel = str_to_val(strptr, chan_vals, CH_EINVAL);
-    switch (channel) {
-        case CH_DIONAEA_CAPTURE:
-        case CH_DIONAEA_DCE:
-        case CH_DIONAEA_SHELLCODE:
-        case CH_DIONAEA_UINQUE:
-        case CH_DIONAEA_CONNECTIONS:
-        case CH_KIPPO_SESSIONS:
-        case CH_GLASTOPF_EVENTS:
-        case CH_GEOLOC_EVENTS:
-            json_tvb = tvb_new_subset_remaining(tvb, offset);
-            call_dissector_with_data(json_hdl, json_tvb, pinfo, tree, strptr);
-        break;
-        default:
-            proto_tree_add_item(tree, hf_hpfeeds_payload, tvb, offset, -1,
-                ENC_NA);
-        break;
-    }
 
+    next_tvb = tvb_new_subset_remaining(tvb, offset);
+
+    /* try the heuristic dissectors */
+    if (try_heuristic) {
+        if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree, &hdtbl_entry, strptr)) {
+            return;
+        }
+    }
 
+    /* heuristic failed. Print remaining bytes as flat payload */
+    proto_tree_add_item(tree, hf_hpfeeds_payload, tvb, offset, -1, ENC_NA);
 }
 
 static void
@@ -300,7 +270,7 @@ dissect_hpfeeds_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* d
         }
     }
 
-    return tvb_length(tvb);
+    return tvb_captured_length(tvb);
 }
 
 static int
@@ -312,7 +282,7 @@ dissect_hpfeeds(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 
     tcp_dissect_pdus(tvb, pinfo, tree, hpfeeds_desegment, HPFEEDS_HDR_LEN,
         get_hpfeeds_pdu_len, dissect_hpfeeds_pdu, data);
-    return tvb_length(tvb);
+    return tvb_captured_length(tvb);
 }
 
 void
@@ -413,6 +383,8 @@ proto_register_hpfeeds(void)
         "hpfeeds"       /* abbrev     */
         );
 
+    heur_subdissector_list = register_heur_dissector_list("hpfeeds");
+
     proto_register_field_array(proto_hpfeeds, hf, array_length(hf));
     proto_register_subtree_array(ett, array_length(ett));
     expert_hpfeeds = expert_register_protocol(proto_hpfeeds);
@@ -432,6 +404,11 @@ proto_register_hpfeeds(void)
         "Dissector TCP port",
         "Set the TCP port for HPFEEDS messages",
         10, &hpfeeds_port_pref);
+
+    prefs_register_bool_preference(hpfeeds_module, "try_heuristic",
+        "Try heuristic sub-dissectors",
+        "Try to decode the payload using an heuristic sub-dissector",
+        &try_heuristic);
 }
 
 void
diff --git a/epan/dissectors/packet-json.c b/epan/dissectors/packet-json.c
index 914a90f8b6..9a2c5899d1 100644
--- a/epan/dissectors/packet-json.c
+++ b/epan/dissectors/packet-json.c
@@ -31,6 +31,7 @@
 
 #include <epan/packet.h>
 #include <epan/tvbparse.h>
+#include <epan/jsmn/jsmn.h>
 
 #include <wsutil/str_util.h>
 #include <wsutil/unicode-utils.h>
@@ -40,6 +41,8 @@ void proto_reg_handoff_json(void);
 
 static dissector_handle_t json_handle;
 
+static int proto_json = -1;
+
 static gint ett_json = -1;
 static gint ett_json_array = -1;
 static gint ett_json_object = -1;
@@ -154,7 +157,7 @@ dissect_json(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 	proto_item_set_len(ti, offset);
 
 	/* if we have some unparsed data, pass to data-text-lines dissector (?) */
-	if (tvb_length_remaining(tvb, offset) > 0) {
+	if (tvb_reported_length_remaining(tvb, offset) > 0) {
 		tvbuff_t *next_tvb;
 
 		next_tvb = tvb_new_subset_remaining(tvb, offset);
@@ -164,7 +167,7 @@ dissect_json(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data)
 		col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ", "(%s)", data_name);
 	}
 
-	return tvb_length(tvb);
+	return tvb_captured_length(tvb);
 }
 
 static void before_object(void *tvbparse_data, const void *wanted_data _U_, tvbparse_elem_t *tok) {
@@ -564,6 +567,25 @@ static void init_json_parser(void) {
 	/* XXX, heur? */
 }
 
+/* This function leverages the libjsmn to undestand if the payload is json or not
+*/
+static gboolean
+dissect_json_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
+{
+	guint len = tvb_captured_length(tvb);
+	guint8* buf = tvb_get_string_enc(wmem_packet_scope(), tvb, 0, len, ENC_ASCII);
+
+	jsmn_parser p;
+	/* We expect no more than 1024 tokens */
+	jsmntok_t* t = (jsmntok_t*)wmem_alloc_array(wmem_packet_scope(), jsmntok_t, 1024);
+
+	jsmn_init(&p);
+	if (jsmn_parse(&p, buf, len, t, sizeof(t)/sizeof(t[0])) < 0) {
+		return FALSE;
+	}
+	return (dissect_json(tvb, pinfo, tree, data) != 0);
+}
+
 void
 proto_register_json(void)
 {
@@ -588,8 +610,6 @@ proto_register_json(void)
 	};
 #endif
 
-	int proto_json;
-
 	proto_json = proto_register_protocol("JavaScript Object Notation", "JSON", "json");
 	hfi_json = proto_registrar_get_nth(proto_json);
 
@@ -604,6 +624,8 @@ proto_register_json(void)
 void
 proto_reg_handoff_json(void)
 {
+	heur_dissector_add("hpfeeds", dissect_json_heur, proto_json);
+
 	dissector_add_string("media_type", "application/json", json_handle); /* RFC 4627 */
 	dissector_add_string("media_type", "application/json-rpc", json_handle); /* JSON-RPC over HTTP */
 	dissector_add_string("media_type", "application/jsonrequest", json_handle); /* JSON-RPC over HTTP */
diff --git a/epan/jsmn/Makefile.am b/epan/jsmn/Makefile.am
new file mode 100644
index 0000000000..1c42904463
--- /dev/null
+++ b/epan/jsmn/Makefile.am
@@ -0,0 +1,64 @@
+# Makefile.am
+# Automake file for libjsmn library
+#
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+if HAVE_WARNINGS_AS_ERRORS
+AM_CFLAGS = -Werror
+endif
+
+include Makefile.common
+
+AM_CPPFLAGS = \
+	-I$(top_srcdir) \
+	$(LIBJSMN_CFLAGS)
+
+noinst_LTLIBRARIES = libjsmn.la
+
+CLEANFILES = \
+	libjsmn.a	\
+	libjsmn.la	\
+	*~
+
+DISTCLEANFILES =
+
+MAINTAINERCLEANFILES =	\
+	Makefile.in
+
+libjsmn_la_SOURCES =	\
+	$(LIBJSMN_SRC)	\
+	$(LIBJSMN_INCLUDES)
+
+EXTRA_DIST = \
+	Makefile.common	\
+	Makefile.nmake	\
+	LICENSE
+
+#
+# Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+#
+# Local variables:
+# c-basic-offset: 8
+# tab-width: 8
+# indent-tabs-mode: t
+# End:
+#
+# vi: set shiftwidth=8 tabstop=8 noexpandtab:
+# :indentSize=8:tabSize=8:noTabs=false:
+#
diff --git a/epan/jsmn/Makefile.common b/epan/jsmn/Makefile.common
new file mode 100644
index 0000000000..280edd542b
--- /dev/null
+++ b/epan/jsmn/Makefile.common
@@ -0,0 +1,38 @@
+# Makefile.common
+#     Contains the stuff from Makefile.am and Makefile.nmake that is
+#     a) common to both files and
+#     b) portable between both files
+#
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+LIBJSMN_SRC = jsmn.c
+LIBNGHTTP2_INCLUDES = jsmn.h
+
+#
+# Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+#
+# Local variables:
+# c-basic-offset: 8
+# tab-width: 8
+# indent-tabs-mode: t
+# End:
+#
+# vi: set shiftwidth=8 tabstop=8 noexpandtab:
+# :indentSize=8:tabSize=8:noTabs=false:
+#
diff --git a/epan/jsmn/Makefile.nmake b/epan/jsmn/Makefile.nmake
new file mode 100644
index 0000000000..f657ea5f6d
--- /dev/null
+++ b/epan/jsmn/Makefile.nmake
@@ -0,0 +1,44 @@
+## Makefile for building jsmn.lib with Microsoft C and nmake
+## Use: $(MAKE) /$(MAKEFLAGS) -f makefile.nmake
+#
+
+include ..\..\config.nmake
+
+include Makefile.common
+
+############### no need to modify below this line #########
+
+CFLAGS=$(WARNINGS_ARE_ERRORS) $(STANDARD_CFLAGS) \
+	 /I. /Ijsmn /I../.. $(GLIB_CFLAGS) -DWS_BUILD_DLL
+
+.c.obj::
+	$(CC) $(CFLAGS)  -Fd.\ -c $<
+
+OBJECTS = $(LIBJSMN_SRC:.c=.obj)
+
+jsmn.lib: $(OBJECTS)
+	link /lib /out:jsmn.lib $(OBJECTS)
+
+clean:
+	rm -f $(OBJECTS) jsmn.lib *.nativecodeanalysis.xml *.pdb *.sbr
+
+distclean: clean
+
+maintainer-clean: distclean
+
+checkapi:
+	$(PERL) ../../tools/checkAPIs.pl -g termoutput -build \
+	$(LIBJSMN_INCLUDES)
+
+#
+# Editor modelines  -  https://www.wireshark.org/tools/modelines.html
+#
+# Local variables:
+# c-basic-offset: 8
+# tab-width: 8
+# indent-tabs-mode: t
+# End:
+#
+# vi: set shiftwidth=8 tabstop=8 noexpandtab:
+# :indentSize=8:tabSize=8:noTabs=false:
+#
diff --git a/epan/jsmn/jsmn.c b/epan/jsmn/jsmn.c
new file mode 100644
index 0000000000..478e6c457f
--- /dev/null
+++ b/epan/jsmn/jsmn.c
@@ -0,0 +1,345 @@
+/*
+ * Copyright (c) 2010 Serge A. Zaitsev
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <stdlib.h>
+
+#include "jsmn.h"
+
+/**
+ * Allocates a fresh unused token from the token pull.
+ */
+static jsmntok_t *jsmn_alloc_token(jsmn_parser *parser,
+		jsmntok_t *tokens, size_t num_tokens) {
+	jsmntok_t *tok;
+	if (parser->toknext >= num_tokens) {
+		return NULL;
+	}
+	tok = &tokens[parser->toknext++];
+	tok->start = tok->end = -1;
+	tok->size = 0;
+#ifdef JSMN_PARENT_LINKS
+	tok->parent = -1;
+#endif
+	return tok;
+}
+
+/**
+ * Fills token type and boundaries.
+ */
+static void jsmn_fill_token(jsmntok_t *token, jsmntype_t type,
+                            int start, int end) {
+	token->type = type;
+	token->start = start;
+	token->end = end;
+	token->size = 0;
+}
+
+/**
+ * Fills next available token with JSON primitive.
+ */
+static int jsmn_parse_primitive(jsmn_parser *parser, const char *js,
+		size_t len, jsmntok_t *tokens, size_t num_tokens) {
+	jsmntok_t *token;
+	int start;
+
+	start = parser->pos;
+
+	for (; parser->pos < len && js[parser->pos] != '\0'; parser->pos++) {
+		switch (js[parser->pos]) {
+#ifndef JSMN_STRICT
+			/* In strict mode primitive must be followed by "," or "}" or "]" */
+			case ':':
+#endif
+			case '\t' : case '\r' : case '\n' : case ' ' :
+			case ','  : case ']'  : case '}' :
+				goto found;
+		}
+		if (js[parser->pos] < 32 || js[parser->pos] >= 127) {
+			parser->pos = start;
+			return JSMN_ERROR_INVAL;
+		}
+	}
+#ifdef JSMN_STRICT
+	/* In strict mode primitive must be followed by a comma/object/array */
+	parser->pos = start;
+	return JSMN_ERROR_PART;
+#endif
+
+found:
+	if (tokens == NULL) {
+		parser->pos--;
+		return 0;
+	}
+	token = jsmn_alloc_token(parser, tokens, num_tokens);
+	if (token == NULL) {
+		parser->pos = start;
+		return JSMN_ERROR_NOMEM;
+	}
+	jsmn_fill_token(token, JSMN_PRIMITIVE, start, parser->pos);
+#ifdef JSMN_PARENT_LINKS
+	token->parent = parser->toksuper;
+#endif
+	parser->pos--;
+	return 0;
+}
+
+/**
+ * Filsl next token with JSON string.
+ */
+static int jsmn_parse_string(jsmn_parser *parser, const char *js,
+		size_t len, jsmntok_t *tokens, size_t num_tokens) {
+	jsmntok_t *token;
+
+	int start = parser->pos;
+
+	parser->pos++;
+
+	/* Skip starting quote */
+	for (; parser->pos < len && js[parser->pos] != '\0'; parser->pos++) {
+		char c = js[parser->pos];
+
+		/* Quote: end of string */
+		if (c == '\"') {
+			if (tokens == NULL) {
+				return 0;
+			}
+			token = jsmn_alloc_token(parser, tokens, num_tokens);
+			if (token == NULL) {
+				parser->pos = start;
+				return JSMN_ERROR_NOMEM;
+			}
+			jsmn_fill_token(token, JSMN_STRING, start+1, parser->pos);
+#ifdef JSMN_PARENT_LINKS
+			token->parent = parser->toksuper;
+#endif
+			return 0;
+		}
+
+		/* Backslash: Quoted symbol expected */
+		if (c == '\\' && parser->pos + 1 < len) {
+			int i;
+			parser->pos++;
+			switch (js[parser->pos]) {
+				/* Allowed escaped symbols */
+				case '\"': case '/' : case '\\' : case 'b' :
+				case 'f' : case 'r' : case 'n'  : case 't' :
+					break;
+				/* Allows escaped symbol \uXXXX */
+				case 'u':
+					parser->pos++;
+					for(i = 0; i < 4 && parser->pos < len && js[parser->pos] != '\0'; i++) {
+						/* If it isn't a hex character we have an error */
+						if(!((js[parser->pos] >= 48 && js[parser->pos] <= 57) || /* 0-9 */
+									(js[parser->pos] >= 65 && js[parser->pos] <= 70) || /* A-F */
+									(js[parser->pos] >= 97 && js[parser->pos] <= 102))) { /* a-f */
+							parser->pos = start;
+							return JSMN_ERROR_INVAL;
+						}
+						parser->pos++;
+					}
+					parser->pos--;
+					break;
+				/* Unexpected symbol */
+				default:
+					parser->pos = start;
+					return JSMN_ERROR_INVAL;
+			}
+		}
+	}
+	parser->pos = start;
+	return JSMN_ERROR_PART;
+}
+
+/**
+ * Parse JSON string and fill tokens.
+ */
+int jsmn_parse(jsmn_parser *parser, const char *js, size_t len,
+		jsmntok_t *tokens, unsigned int num_tokens) {
+	int r;
+	int i;
+	jsmntok_t *token;
+	int count = 0;
+
+	for (; parser->pos < len && js[parser->pos] != '\0'; parser->pos++) {
+		char c;
+		jsmntype_t type;
+
+		c = js[parser->pos];
+		switch (c) {
+			case '{': case '[':
+				count++;
+				if (tokens == NULL) {
+					break;
+				}
+				token = jsmn_alloc_token(parser, tokens, num_tokens);
+				if (token == NULL)
+					return JSMN_ERROR_NOMEM;
+				if (parser->toksuper != -1) {
+					tokens[parser->toksuper].size++;
+#ifdef JSMN_PARENT_LINKS
+					token->parent = parser->toksuper;
+#endif
+				}
+				token->type = (c == '{' ? JSMN_OBJECT : JSMN_ARRAY);
+				token->start = parser->pos;
+				parser->toksuper = parser->toknext - 1;
+				break;
+			case '}': case ']':
+				if (tokens == NULL)
+					break;
+				type = (c == '}' ? JSMN_OBJECT : JSMN_ARRAY);
+#ifdef JSMN_PARENT_LINKS
+				if (parser->toknext < 1) {
+					return JSMN_ERROR_INVAL;
+				}
+				token = &tokens[parser->toknext - 1];
+				for (;;) {
+					if (token->start != -1 && token->end == -1) {
+						if (token->type != type) {
+							return JSMN_ERROR_INVAL;
+						}
+						token->end = parser->pos + 1;
+						parser->toksuper = token->parent;
+						break;
+					}
+					if (token->parent == -1) {
+						break;
+					}
+					token = &tokens[token->parent];
+				}
+#else
+				for (i = parser->toknext - 1; i >= 0; i--) {
+					token = &tokens[i];
+					if (token->start != -1 && token->end == -1) {
+						if (token->type != type) {
+							return JSMN_ERROR_INVAL;
+						}
+						parser->toksuper = -1;
+						token->end = parser->pos + 1;
+						break;
+					}
+				}
+				/* Error if unmatched closing bracket */
+				if (i == -1) return JSMN_ERROR_INVAL;
+				for (; i >= 0; i--) {
+					token = &tokens[i];
+					if (token->start != -1 && token->end == -1) {
+						parser->toksuper = i;
+						break;
+					}
+				}
+#endif
+				break;
+			case '\"':
+				r = jsmn_parse_string(parser, js, len, tokens, num_tokens);
+				if (r < 0) return r;
+				count++;
+				if (parser->toksuper != -1 && tokens != NULL)
+					tokens[parser->toksuper].size++;
+				break;
+			case '\t' : case '\r' : case '\n' : case ' ':
+				break;
+			case ':':
+				parser->toksuper = parser->toknext - 1;
+				break;
+			case ',':
+				if (tokens != NULL &&
+						tokens[parser->toksuper].type != JSMN_ARRAY &&
+						tokens[parser->toksuper].type != JSMN_OBJECT) {
+#ifdef JSMN_PARENT_LINKS
+					parser->toksuper = tokens[parser->toksuper].parent;
+#else
+					for (i = parser->toknext - 1; i >= 0; i--) {
+						if (tokens[i].type == JSMN_ARRAY || tokens[i].type == JSMN_OBJECT) {
+							if (tokens[i].start != -1 && tokens[i].end == -1) {
+								parser->toksuper = i;
+								break;
+							}
+						}
+					}
+#endif
+				}
+				break;
+#ifdef JSMN_STRICT
+			/* In strict mode primitives are: numbers and booleans */
+			case '-': case '0': case '1' : case '2': case '3' : case '4':
+			case '5': case '6': case '7' : case '8': case '9':
+			case 't': case 'f': case 'n' :
+				/* And they must not be keys of the object */
+				if (tokens != NULL) {
+					jsmntok_t *t = &tokens[parser->toksuper];
+					if (t->type == JSMN_OBJECT ||
+							(t->type == JSMN_STRING && t->size != 0)) {
+						return JSMN_ERROR_INVAL;
+					}
+				}
+#else
+			/* In non-strict mode every unquoted value is a primitive */
+			default:
+#endif
+				r = jsmn_parse_primitive(parser, js, len, tokens, num_tokens);
+				if (r < 0) return r;
+				count++;
+				if (parser->toksuper != -1 && tokens != NULL)
+					tokens[parser->toksuper].size++;
+				break;
+
+#ifdef JSMN_STRICT
+			/* Unexpected char in strict mode */
+			default:
+				return JSMN_ERROR_INVAL;
+#endif
+		}
+	}
+
+	for (i = parser->toknext - 1; i >= 0; i--) {
+		/* Unmatched opened object or array */
+		if (tokens[i].start != -1 && tokens[i].end == -1) {
+			return JSMN_ERROR_PART;
+		}
+	}
+
+	return count;
+}
+
+/**
+ * Creates a new parser based over a given  buffer with an array of tokens
+ * available.
+ */
+void jsmn_init(jsmn_parser *parser) {
+	parser->pos = 0;
+	parser->toknext = 0;
+	parser->toksuper = -1;
+}
+
+/*
+ * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=4 expandtab:
+ * :indentSize=4:tabSize=4:noTabs=true:
+ */
diff --git a/epan/jsmn/jsmn.h b/epan/jsmn/jsmn.h
new file mode 100644
index 0000000000..9644f42380
--- /dev/null
+++ b/epan/jsmn/jsmn.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2010 Serge A. Zaitsev
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef __JSMN_H_
+#define __JSMN_H_
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * JSON type identifier. Basic types are:
+ * 	o Object
+ * 	o Array
+ * 	o String
+ * 	o Other primitive: number, boolean (true/false) or null
+ */
+typedef enum {
+	JSMN_PRIMITIVE = 0,
+	JSMN_OBJECT = 1,
+	JSMN_ARRAY = 2,
+	JSMN_STRING = 3
+} jsmntype_t;
+
+typedef enum {
+	/* Not enough tokens were provided */
+	JSMN_ERROR_NOMEM = -1,
+	/* Invalid character inside JSON string */
+	JSMN_ERROR_INVAL = -2,
+	/* The string is not a full JSON packet, more bytes expected */
+	JSMN_ERROR_PART = -3
+} jsmnerr_t;
+
+/**
+ * JSON token description.
+ * type  type (object, array, string etc.)
+ * start start position in JSON data string
+ * end   end position in JSON data string
+ * size  the size of the token
+ */
+typedef struct {
+	jsmntype_t type;
+	int start;
+	int end;
+	int size;
+#ifdef JSMN_PARENT_LINKS
+	int parent;
+#endif
+} jsmntok_t;
+
+/**
+ * JSON parser. Contains an array of token blocks available. Also stores
+ * the string being parsed now and current position in that string
+ */
+typedef struct {
+	unsigned int pos; /* offset in the JSON string */
+	unsigned int toknext; /* next token to allocate */
+	int toksuper; /* superior token node, e.g parent object or array */
+} jsmn_parser;
+
+/**
+ * Create JSON parser over an array of tokens
+ */
+void jsmn_init(jsmn_parser *parser);
+
+/**
+ * Run JSON parser. It parses a JSON data string into and array of tokens, each describing
+ * a single JSON object.
+ */
+int jsmn_parse(jsmn_parser *parser, const char *js, size_t len,
+		jsmntok_t *tokens, unsigned int num_tokens);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __JSMN_H_ */
+
+/*
+ * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=4 expandtab:
+ * :indentSize=4:tabSize=4:noTabs=true:
+ */