Improved HTTP line parsing if request splitted into multiple packets.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index dd6d39c88..9ac26785c 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -805,6 +805,13 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
         return;
       }
 
+      /* try to get some additional request header info even if the packet may not be HTTP */
+      ndpi_parse_packet_line_info(ndpi_struct, flow);
+      if (packet->http_num_headers > 0) {
+        check_content_type_and_change_protocol(ndpi_struct, flow);
+        return;
+      }
+
       NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
       http_bitmask_exclude_other(flow);
       return;