nDPi now finally honours dissection of HTTP responses

2 files changed, 158 insertions, 135 deletions

diff --git a/src/lib/protocols/apple_push.c b/src/lib/protocols/apple_push.c
index 6930dba86..45346e07b 100644
--- a/src/lib/protocols/apple_push.c
+++ b/src/lib/protocols/apple_push.c
@@ -31,20 +31,22 @@ static void ndpi_check_apple_push(struct ndpi_detection_module_struct *ndpi_stru
 				  struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
 
-  /* https://support.apple.com/en-us/HT203609 */
-  if(((ntohl(packet->iph->saddr) & 0xFF000000 /* 255.0.0.0 */) == 0x11000000 /* 17.0.0.0/8 */)
-     || ((ntohl(packet->iph->daddr) & 0xFF000000 /* 255.0.0.0 */) == 0x11000000 /* 17.0.0.0/8 */)) {
-    u_int16_t apple_push_port       = ntohs(5223);
-    u_int16_t notification_apn_port = ntohs(2195);
-    u_int16_t apn_feedback_port     = ntohs(2196);
-
-    if(((packet->tcp->source == apple_push_port) || (packet->tcp->dest == apple_push_port))
-       || ((packet->tcp->source == notification_apn_port) || (packet->tcp->dest == notification_apn_port))
-       || ((packet->tcp->source == apn_feedback_port) || (packet->tcp->dest == apn_feedback_port))
-       ) {
-      NDPI_LOG_INFO(ndpi_struct, "found apple_push\n");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_APPLE_PUSH, NDPI_PROTOCOL_UNKNOWN);
-      return;
+  if(packet->iph) {
+    /* https://support.apple.com/en-us/HT203609 */
+    if(((ntohl(packet->iph->saddr) & 0xFF000000 /* 255.0.0.0 */) == 0x11000000 /* 17.0.0.0/8 */)
+       || ((ntohl(packet->iph->daddr) & 0xFF000000 /* 255.0.0.0 */) == 0x11000000 /* 17.0.0.0/8 */)) {
+      u_int16_t apple_push_port       = ntohs(5223);
+      u_int16_t notification_apn_port = ntohs(2195);
+      u_int16_t apn_feedback_port     = ntohs(2196);
+	
+      if(((packet->tcp->source == apple_push_port) || (packet->tcp->dest == apple_push_port))
+	 || ((packet->tcp->source == notification_apn_port) || (packet->tcp->dest == notification_apn_port))
+	 || ((packet->tcp->source == apn_feedback_port) || (packet->tcp->dest == apn_feedback_port))
+	 ) {
+	NDPI_LOG_INFO(ndpi_struct, "found apple_push\n");
+	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_APPLE_PUSH, NDPI_PROTOCOL_UNKNOWN);
+	return;
+      }
     }
   }
 
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 09b816129..e92701072 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -28,27 +28,41 @@
 #include "ndpi_api.h"
 #include "lruc.h"
 
-/* global variables used for 1kxun protocol and iqiyi service */
-
 static void ndpi_int_http_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
 					 struct ndpi_flow_struct *flow,
 					 u_int16_t category) {
-
+#ifdef DEBUG
+  printf("[%s] [http_dont_dissect_response: %u]->> %s\n", __FUNCTION__,
+	 ndpi_struct->http_dont_dissect_response, flow->http.response_status_code);
+#endif
+  
   if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
     /* This is HTTP and it is not a sub protocol (e.g. skype or dropbox) */
 
     ndpi_search_tcp_or_udp(ndpi_struct, flow);
 
     /* If no custom protocol has been detected */
-
     if(flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
       ndpi_int_reset_protocol(flow);
-      ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_HTTP);
+      flow->http_upper_protocol = flow->guessed_host_protocol_id, flow->http_lower_protocol = NDPI_PROTOCOL_HTTP;
     } else
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_UNKNOWN);
-    
-    flow->http_detected = 1, flow->guessed_category = category;
+      flow->http_upper_protocol = NDPI_PROTOCOL_HTTP, flow->http_lower_protocol = NDPI_PROTOCOL_UNKNOWN;
+
+    if(ndpi_struct->http_dont_dissect_response)
+      ndpi_set_detected_protocol(ndpi_struct, flow, flow->http_upper_protocol, flow->http_lower_protocol);
+    else {
+      flow->detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN, flow->detected_protocol_stack[1] = NDPI_PROTOCOL_UNKNOWN;
+      flow->packet.detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN, flow->packet.detected_protocol_stack[1] = NDPI_PROTOCOL_UNKNOWN;
+    }
+  } else {
+    if((!ndpi_struct->http_dont_dissect_response) && (flow->http.response_status_code[0] == '\0')) {
+      flow->http_upper_protocol = flow->detected_protocol_stack[0], flow->http_lower_protocol = flow->detected_protocol_stack[1];
+      flow->detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN, flow->detected_protocol_stack[1] = NDPI_PROTOCOL_UNKNOWN;
+      flow->packet.detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN, flow->packet.detected_protocol_stack[1] = NDPI_PROTOCOL_UNKNOWN;
+    }
   }
+
+  flow->http_detected = 1, flow->guessed_category = category;
 }
 
 #ifdef NDPI_CONTENT_CATEGORY_FLASH
@@ -79,7 +93,7 @@ static void avi_check_http_payload(struct ndpi_detection_module_struct *ndpi_str
 
 
   NDPI_LOG_DBG2(ndpi_struct, "called avi_check_http_payload: %u %u %u\n",
-	   packet->empty_line_position_set, flow->l4.tcp.http_empty_line_seen, packet->empty_line_position);
+		packet->empty_line_position_set, flow->l4.tcp.http_empty_line_seen, packet->empty_line_position);
 
   if(packet->empty_line_position_set == 0 && flow->l4.tcp.http_empty_line_seen == 0)
     return;
@@ -125,7 +139,7 @@ static void teamviewer_check_http_payload(struct ndpi_detection_module_struct *n
   const u_int8_t *pos;
 
   NDPI_LOG_DBG2(ndpi_struct, "called teamviewer_check_http_payload: %u %u %u\n",
-	   packet->empty_line_position_set, flow->l4.tcp.http_empty_line_seen, packet->empty_line_position);
+		packet->empty_line_position_set, flow->l4.tcp.http_empty_line_seen, packet->empty_line_position);
 
   if(packet->empty_line_position_set == 0 || (packet->empty_line_position + 5) > (packet->payload_packet_len))
     return;
@@ -171,10 +185,10 @@ static void setHttpUserAgent(struct ndpi_detection_module_struct *ndpi_struct,
 
 static void parseHttpSubprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
   if((flow->l4.tcp.http_stage == 0) || (flow->http.url && flow->http_detected)) {
-      char *double_col = strchr((char*)flow->host_server_name, ':');
-      ndpi_protocol_match_result ret_match;
-      
-      if(double_col) double_col[0] = '\0';
+    char *double_col = strchr((char*)flow->host_server_name, ':');
+    ndpi_protocol_match_result ret_match;
+
+    if(double_col) double_col[0] = '\0';
 
     /**
        NOTE
@@ -198,6 +212,13 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
   struct ndpi_packet_struct *packet = &flow->packet;
   u_int8_t a;
 
+  if((!ndpi_struct->http_dont_dissect_response) && flow->http_detected && (flow->http.response_status_code[0] != 0)) {
+    ndpi_set_detected_protocol(ndpi_struct, flow, flow->http_upper_protocol, flow->http_lower_protocol);
+#ifdef DEBUG
+    printf("[%s] [http_dont_dissect_response: %u]->> %s\n", __FUNCTION__, ndpi_struct->http_dont_dissect_response, flow->http.response_status_code);
+#endif
+    return;
+  }
 
 #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI)
   /* PPStream */
@@ -277,8 +298,8 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
   if(packet->user_agent_line.ptr != NULL && packet->user_agent_line.len != 0) {
     /**
        Format examples:
-         Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) ....
-         Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
+       Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) ....
+       Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
     */
     if(packet->user_agent_line.len > 7) {
       char ua[256];
@@ -308,22 +329,22 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
 	      if(token && (token[0] == ' ')) token++; /* Skip space */
 
 	      if(token
-		     && ((strcmp(token, "U") == 0)
-		         || (strncmp(token, "MSIE", 4) == 0))) {
-		    token = strsep(&parent, ";");
-		    if(token && (token[0] == ' ')) token++; /* Skip space */
+		 && ((strcmp(token, "U") == 0)
+		     || (strncmp(token, "MSIE", 4) == 0))) {
+		token = strsep(&parent, ";");
+		if(token && (token[0] == ' ')) token++; /* Skip space */
 
-		    if(token && (strncmp(token, "Update", 6)  == 0)) {
-		      token = strsep(&parent, ";");
+		if(token && (strncmp(token, "Update", 6)  == 0)) {
+		  token = strsep(&parent, ";");
 
-		      if(token && (token[0] == ' ')) token++; /* Skip space */
+		  if(token && (token[0] == ' ')) token++; /* Skip space */
 
-		      if(token && (strncmp(token, "AOL", 3)  == 0)) {
+		  if(token && (strncmp(token, "AOL", 3)  == 0)) {
 
-		        token = strsep(&parent, ";");
-		        if(token && (token[0] == ' ')) token++; /* Skip space */
-		      }
-		    }
+		    token = strsep(&parent, ";");
+		    if(token && (token[0] == ' ')) token++; /* Skip space */
+		  }
+		}
 	      }
 	    }
 
@@ -340,7 +361,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     }
 
     NDPI_LOG_DBG2(ndpi_struct, "User Agent Type line found %.*s\n",
-	     packet->user_agent_line.len, packet->user_agent_line.ptr);
+		  packet->user_agent_line.len, packet->user_agent_line.ptr);
   }
 
   /* check for host line */
@@ -348,37 +369,37 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     u_int len;
 
     NDPI_LOG_DBG2(ndpi_struct, "HOST line found %.*s\n",
-	     packet->host_line.len, packet->host_line.ptr);
+		  packet->host_line.len, packet->host_line.ptr);
 
     /* call ndpi_match_host_subprotocol to see if there is a match with known-host HTTP subprotocol */
     if((ndpi_struct->http_dont_dissect_response) || flow->http_detected) {
       ndpi_protocol_match_result ret_match;
-      
+
       ndpi_match_host_subprotocol(ndpi_struct, flow,
 				  (char*)packet->host_line.ptr,
 				  packet->host_line.len,
 				  &ret_match,
 				  NDPI_PROTOCOL_HTTP);
     }
-    
+
     /* Copy result for nDPI apps */
     if(!ndpi_struct->disable_metadata_export) {
       len = ndpi_min(packet->host_line.len, sizeof(flow->host_server_name)-1);
       strncpy((char*)flow->host_server_name, (char*)packet->host_line.ptr, len);
       flow->host_server_name[len] = '\0';
     }
-    
+
     flow->server_id = flow->dst;
 
     if(packet->forwarded_line.ptr) {
-        len = ndpi_min(packet->forwarded_line.len, sizeof(flow->protos.http.nat_ip)-1);
-	if(!ndpi_struct->disable_metadata_export) {
-	  strncpy((char*)flow->protos.http.nat_ip, (char*)packet->forwarded_line.ptr, len);
-	  flow->protos.http.nat_ip[len] = '\0';
-	}
+      len = ndpi_min(packet->forwarded_line.len, sizeof(flow->protos.http.nat_ip)-1);
+      if(!ndpi_struct->disable_metadata_export) {
+	strncpy((char*)flow->protos.http.nat_ip, (char*)packet->forwarded_line.ptr, len);
+	flow->protos.http.nat_ip[len] = '\0';
+      }
     }
 
-    if(ndpi_struct->http_dont_dissect_response)
+    if(!ndpi_struct->http_dont_dissect_response)
       parseHttpSubprotocol(ndpi_struct, flow);
 
     /**
@@ -403,26 +424,28 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
        && ((ndpi_struct->http_dont_dissect_response) || flow->http_detected)
        && (packet->http_origin.len > 0)) {
       ndpi_protocol_match_result ret_match;
-      
+
       ndpi_match_host_subprotocol(ndpi_struct, flow,
 				  (char *)packet->http_origin.ptr,
 				  packet->http_origin.len,
 				  &ret_match,
 				  NDPI_PROTOCOL_HTTP);
     }
-    
+
     if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
       if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_HTTP) {
-	NDPI_LOG_INFO(ndpi_struct, "found HTTP/%s\n", 
-		    ndpi_get_proto_name(ndpi_struct, packet->detected_protocol_stack[0]));
+	NDPI_LOG_INFO(ndpi_struct, "found HTTP/%s\n",
+		      ndpi_get_proto_name(ndpi_struct, packet->detected_protocol_stack[0]));
 	ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0]);
 	return; /* We have identified a sub-protocol so we're done */
       }
     }
   }
 
+#if 0
   if(!ndpi_struct->http_dont_dissect_response && flow->http_detected)
     parseHttpSubprotocol(ndpi_struct, flow);
+#endif
 
   if(flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN)
     flow->guessed_protocol_id = NDPI_PROTOCOL_HTTP;
@@ -430,7 +453,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
   /* check for accept line */
   if(packet->accept_line.ptr != NULL) {
     NDPI_LOG_DBG2(ndpi_struct, "Accept line found %.*s\n",
-	     packet->accept_line.len, packet->accept_line.ptr);
+		  packet->accept_line.len, packet->accept_line.ptr);
     if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask,
 					NDPI_PROTOCOL_RTSP) != 0) {
       rtsp_parse_packet_acceptline(ndpi_struct, flow);
@@ -438,26 +461,28 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
   }
 
   /* search for line startin with "Icy-MetaData" */
-    for (a = 0; a < packet->parsed_lines; a++) {
+  for (a = 0; a < packet->parsed_lines; a++) {
     if(packet->line[a].len > 11 && memcmp(packet->line[a].ptr, "Icy-MetaData", 12) == 0) {
-    NDPI_LOG_INFO(ndpi_struct, "found MPEG: Icy-MetaData\n");
-    ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_CONTENT_CATEGORY_MPEG);
-    return;
-  }
+      NDPI_LOG_INFO(ndpi_struct, "found MPEG: Icy-MetaData\n");
+      ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_CONTENT_CATEGORY_MPEG);
+      return;
+    }
   }
 
   if(packet->content_line.ptr != NULL && packet->content_line.len != 0) {
     NDPI_LOG_DBG2(ndpi_struct, "Content Type line found %.*s\n",
-	     packet->content_line.len, packet->content_line.ptr);
+		  packet->content_line.len, packet->content_line.ptr);
 
     if((ndpi_struct->http_dont_dissect_response) || flow->http_detected) {
       ndpi_protocol_match_result ret_match;
-      
+
       ndpi_match_content_subprotocol(ndpi_struct, flow,
 				     (char*)packet->content_line.ptr, packet->content_line.len,
 				     &ret_match, NDPI_PROTOCOL_HTTP);
     }
   }
+
+  ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0]);
 }
 
 static void check_http_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
@@ -486,22 +511,22 @@ static void check_http_payload(struct ndpi_detection_module_struct *ndpi_struct,
 #define STATIC_STRING_L(a) {.str=a, .len=sizeof(a)-1 }
 
 static struct l_string {
-	const char *str;
-	size_t     len;
+  const char *str;
+  size_t     len;
 } http_methods[] = {
-	STATIC_STRING_L("GET "),
-	STATIC_STRING_L("POST "),
-	STATIC_STRING_L("OPTIONS "),
-	STATIC_STRING_L("HEAD "),
-	STATIC_STRING_L("PUT "),
-	STATIC_STRING_L("DELETE "),
-	STATIC_STRING_L("CONNECT "),
-	STATIC_STRING_L("PROPFIND "),
-	STATIC_STRING_L("REPORT ") };
+		    STATIC_STRING_L("GET "),
+		    STATIC_STRING_L("POST "),
+		    STATIC_STRING_L("OPTIONS "),
+		    STATIC_STRING_L("HEAD "),
+		    STATIC_STRING_L("PUT "),
+		    STATIC_STRING_L("DELETE "),
+		    STATIC_STRING_L("CONNECT "),
+		    STATIC_STRING_L("PROPFIND "),
+		    STATIC_STRING_L("REPORT ") };
 static const char *http_fs = "CDGHOPR";
 
 static uint8_t non_ctrl(uint8_t c) {
-	return c < 32 ? '.':c;
+  return c < 32 ? '.':c;
 }
 
 static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
@@ -510,9 +535,9 @@ static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *nd
   int i;
 
   NDPI_LOG_DBG2(ndpi_struct, "====>>>> HTTP: %c%c%c%c [len: %u]\n",
-	   non_ctrl(packet->payload[0]), non_ctrl(packet->payload[1]),
-	   non_ctrl(packet->payload[2]), non_ctrl(packet->payload[3]),
-	   packet->payload_packet_len);
+		non_ctrl(packet->payload[0]), non_ctrl(packet->payload[1]),
+		non_ctrl(packet->payload[2]), non_ctrl(packet->payload[3]),
+		packet->payload_packet_len);
 
   /* Check first char */
   if(!strchr(http_fs,packet->payload[0])) return 0;
@@ -520,11 +545,11 @@ static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *nd
      FIRST PAYLOAD PACKET FROM CLIENT
   **/
   for(i=0; i < sizeof(http_methods)/sizeof(http_methods[0]); i++) {
-	if(packet->payload_packet_len >= http_methods[i].len &&
-	   memcmp(packet->payload,http_methods[i].str,http_methods[i].len) == 0) {
-		NDPI_LOG_DBG2(ndpi_struct, "HTTP: %sFOUND\n",http_methods[i].str);
-		return http_methods[i].len;
-	}
+    if(packet->payload_packet_len >= http_methods[i].len &&
+       memcmp(packet->payload,http_methods[i].str,http_methods[i].len) == 0) {
+      NDPI_LOG_DBG2(ndpi_struct, "HTTP: %sFOUND\n",http_methods[i].str);
+      return http_methods[i].len;
+    }
   }
   return 0;
 }
@@ -556,7 +581,7 @@ static void http_bitmask_exclude_other(struct ndpi_flow_struct *flow)
 /*************************************************************************************************/
 
 static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct,
-				struct ndpi_flow_struct *flow) {       
+				struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
   u_int16_t filename_start; /* the filename in the request method line, e.g., "GET filename_start..."*/
 
@@ -586,7 +611,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
         flow->l4.tcp.http_stage = 1;
 	return;
       }
-      
+
       if((packet->payload_packet_len == 40) && (flow->l4.tcp.http_stage == 0)) {
         /*
 	  -> QR O06L0072-6L91-4O43-857J-K8OO172L6L51
@@ -600,11 +625,11 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
 	   && (packet->payload[21] == '-')
 	   && (packet->payload[26] == '-')
 	   && (packet->payload[39] == 0x0A)
-		)
-		flow->l4.tcp.http_stage = 1;
-	return;	      
+	   )
+	  flow->l4.tcp.http_stage = 1;
+	return;
       }
-      
+
       if((packet->payload_packet_len == 23) && (memcmp(packet->payload, "<policy-file-request/>", 23) == 0)) {
         /*
           <policy-file-request/>
@@ -617,8 +642,8 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
         ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_UNKNOWN);
 
 	if(ndpi_struct->ookla_cache == NULL)
-	  ndpi_struct->ookla_cache = lruc_new(4*1024, 1024);	 	
-	
+	  ndpi_struct->ookla_cache = lruc_new(4*1024, 1024);
+
 	if(ndpi_struct->ookla_cache != NULL) {
 	  u_int8_t *dummy = (u_int8_t*)ndpi_malloc(sizeof(u_int8_t));
 
@@ -629,23 +654,23 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
 	      lruc_set((lruc*)ndpi_struct->ookla_cache, (void*)&packet->iph->daddr, 4, dummy, 1);
 	  }
 	}
-	
+
         return;
       }
-      
+
       NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
       http_bitmask_exclude_other(flow);
       return;
     }
 
     NDPI_LOG_DBG2(ndpi_struct,
-	     "Filename HTTP found: %d, we look for line info..\n", filename_start);
+		  "Filename HTTP found: %d, we look for line info..\n", filename_start);
 
     ndpi_parse_packet_line_info(ndpi_struct, flow);
 
     if(packet->parsed_lines <= 1) {
       NDPI_LOG_DBG2(ndpi_struct,
-	       "Found just one line, we will look further for the next packet...\n");
+		    "Found just one line, we will look further for the next packet...\n");
 
       packet->http_method.ptr = packet->line[0].ptr;
       packet->http_method.len = filename_start - 1;
@@ -656,10 +681,10 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
     }
 
     NDPI_LOG_DBG2(ndpi_struct,
-	     "Found more than one line, we look further for the next packet...\n");
+		  "Found more than one line, we look further for the next packet...\n");
 
     if(packet->line[0].len >= (9 + filename_start)
-        && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) { /* Request line complete. Ex. "GET / HTTP/1.1" */
+       && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) { /* Request line complete. Ex. "GET / HTTP/1.1" */
 
       packet->http_url_name.ptr = &packet->payload[filename_start];
       packet->http_url_name.len = packet->line[0].len - (filename_start + 9);
@@ -669,14 +694,13 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
 
       // Set the HTTP requested version: 0=HTTP/1.0 and 1=HTTP/1.1
       if(memcmp(&packet->line[0].ptr[packet->line[0].len - 1], "1", 1) == 0)
-          flow->http.request_version = 1;
+	flow->http.request_version = 1;
       else
-          flow->http.request_version = 0;
+	flow->http.request_version = 0;
 
       /* Set the first found headers in request */
       flow->http.num_request_headers = packet->http_num_headers;
 
-
       /* Check for Ookla */
       if((packet->referer_line.len > 0)
 	 && ndpi_strnstr((const char *)packet->referer_line.ptr, "www.speedtest.net", packet->referer_line.len)) {
@@ -686,22 +710,22 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
       /* Check for additional field introduced by Steam */
       int x = 1;
       if(packet->line[x].len >= 11 && (memcmp(packet->line[x].ptr, "x-steam-sid", 11)) == 0) {
-	    NDPI_LOG_INFO(ndpi_struct, "found STEAM\n");
-	    ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_STEAM);
-	    check_content_type_and_change_protocol(ndpi_struct, flow);
-	    return;
+	NDPI_LOG_INFO(ndpi_struct, "found STEAM\n");
+	ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_STEAM);
+	check_content_type_and_change_protocol(ndpi_struct, flow);
+	return;
       }
 
       /* Check for additional field introduced by Facebook */
       x = 1;
       while(packet->line[x].len != 0) {
-	    if(packet->line[x].len >= 12 && (memcmp(packet->line[x].ptr, "X-FB-SIM-HNI", 12)) == 0) {
-	      NDPI_LOG_INFO(ndpi_struct, "found FACEBOOK\n");
-	      ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_FACEBOOK);
-	      check_content_type_and_change_protocol(ndpi_struct, flow);
-	      return;
-	    }
-	    x++;
+	if(packet->line[x].len >= 12 && (memcmp(packet->line[x].ptr, "X-FB-SIM-HNI", 12)) == 0) {
+	  NDPI_LOG_INFO(ndpi_struct, "found FACEBOOK\n");
+	  ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_FACEBOOK);
+	  check_content_type_and_change_protocol(ndpi_struct, flow);
+	  return;
+	}
+	x++;
       }
 
 #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI)
@@ -746,23 +770,23 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
 	}
       }
 #endif
-      
+
       if((packet->http_url_name.len > 7)
-          && (!strncmp((const char*) packet->http_url_name.ptr, "http://", 7))) {
+	 && (!strncmp((const char*) packet->http_url_name.ptr, "http://", 7))) {
         NDPI_LOG_INFO(ndpi_struct, "found HTTP_PROXY\n");
         ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_PROXY);
         check_content_type_and_change_protocol(ndpi_struct, flow);
       }
 
       if(filename_start == 8 && (memcmp(packet->payload, "CONNECT ", 8) == 0)) {
-	    /* nathan@getoffmalawn.com */
+	/* nathan@getoffmalawn.com */
         NDPI_LOG_INFO(ndpi_struct, "found HTTP_CONNECT\n");
         ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_CONNECT);
         check_content_type_and_change_protocol(ndpi_struct, flow);
       }
 
       NDPI_LOG_DBG2(ndpi_struct,
-          "HTTP START Found, we will look for sub-protocols (content and host)...\n");
+		    "HTTP START Found, we will look for sub-protocols (content and host)...\n");
 
       if(packet->host_line.ptr != NULL) {
         /**
@@ -775,11 +799,11 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
         if(ndpi_struct->http_dont_dissect_response) {
           if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) /* No subprotocol found */
 	    NDPI_LOG_INFO(ndpi_struct, "found HTTP\n");
-            ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP);
+	  ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP);
         } else {
           flow->http_detected = 1;
           NDPI_LOG_DBG2(ndpi_struct,
-               "HTTP START Found, we will look further for the response...\n");
+			"HTTP START Found, we will look further for the response...\n");
           flow->l4.tcp.http_stage = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2
         }
 
@@ -790,23 +814,21 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
 
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
     http_bitmask_exclude_other(flow);
-
   } else if((flow->l4.tcp.http_stage == 1) || (flow->l4.tcp.http_stage == 2)) {
-
     NDPI_LOG_DBG2(ndpi_struct, "HTTP stage %u: \n", flow->l4.tcp.http_stage);
-    
+
     if((packet->payload_packet_len == 34) && (flow->l4.tcp.http_stage == 1)) {
       if((packet->payload[5] == ' ') && (packet->payload[9] == ' ')) {
 	goto ookla_found;
       }
     }
-    
+
     if((packet->payload_packet_len > 6) && memcmp(packet->payload, "HELLO ", 6) == 0) {
-       /* This looks like Ookla */
+      /* This looks like Ookla */
       goto ookla_found;
     } else
-      NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OOKLA);    
-    
+      NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OOKLA);
+
     /**
        At first check, if this is for sure a response packet (in another direction. If not, if HTTP is detected do nothing now and return,
        otherwise check the second packet for the HTTP request
@@ -817,7 +839,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
         return;
 
       NDPI_LOG_DBG2(ndpi_struct,
-	       " SECOND PAYLOAD TRAFFIC FROM CLIENT, FIRST PACKET MIGHT HAVE BEEN HTTP...UNKNOWN TRAFFIC, HERE FOR HTTP again.. \n");
+		    " SECOND PAYLOAD TRAFFIC FROM CLIENT, FIRST PACKET MIGHT HAVE BEEN HTTP...UNKNOWN TRAFFIC, HERE FOR HTTP again.. \n");
 
       ndpi_parse_packet_line_info(ndpi_struct, flow);
 
@@ -839,14 +861,14 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
       }
       // http://www.slideshare.net/DSPIP/rtsp-analysis-wireshark
       if(packet->line[0].len >= 9
-          && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) {
+	 && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) {
 
         NDPI_LOG_INFO(ndpi_struct, "found HTTP\n");
         ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP);
         check_content_type_and_change_protocol(ndpi_struct, flow);
 
         NDPI_LOG_DBG2(ndpi_struct,
-		 "HTTP START Found in 2. packet, we will look further for the response....\n");
+		      "HTTP START Found in 2. packet, we will look further for the response....\n");
         flow->http_detected = 1;
       }
 
@@ -879,9 +901,8 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
     ndpi_parse_packet_line_info(ndpi_struct, flow);
     check_content_type_and_change_protocol(ndpi_struct, flow);
 
-    if(packet->packet_direction == 1 /* server -> client */){
-        flow->http.num_response_headers += packet->http_num_headers; /* flow structs are initialized with zeros */
-    }
+    if(packet->packet_direction == 1 /* server -> client */)
+      flow->http.num_response_headers += packet->http_num_headers; /* flow structs are initialized with zeros */
 
     if(packet->empty_line_position_set != 0 || flow->l4.tcp.http_empty_line_seen == 1) {
       NDPI_LOG_DBG2(ndpi_struct, "empty line. check_http_payload\n");
@@ -905,8 +926,8 @@ void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct,
   }
 
   if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
-     return;
-   }
+    return;
+  }
 
   NDPI_LOG_DBG(ndpi_struct, "search HTTP\n");
   ndpi_check_http_tcp(ndpi_struct, flow);
@@ -935,7 +956,7 @@ char* ndpi_get_http_url(struct ndpi_detection_module_struct *ndpi_mod,
 /* ********************************* */
 
 char* ndpi_get_http_content_type(struct ndpi_detection_module_struct *ndpi_mod,
-			       struct ndpi_flow_struct *flow) {
+				 struct ndpi_flow_struct *flow) {
   if((!flow) || (!flow->http.content_type))
     return("");
   else