Split HTTP request from response Content-Type. Request Content-Type should be present with POSTs and not with other methods such as GET

3 files changed, 40 insertions, 13 deletions

diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 41c4ba087..16587ef90 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1222,7 +1222,7 @@ struct ndpi_flow_struct {
   */
   struct {
     ndpi_http_method method;
-    char *url, *content_type, *user_agent;
+    char *url, *content_type /* response */, *request_content_type /* e.g. for POST */, *user_agent;
     u_int8_t num_request_headers, num_response_headers;
     u_int8_t request_version; /* 0=1.0 and 1=1.1. Create an enum for this? */
     u_int16_t response_status_code; /* 200, 404, etc. */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index a94d94215..6f536952a 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -3695,18 +3695,27 @@ static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_str
 	  ndpi_free(flow->http.url);
 	  flow->http.url = NULL;
 	}
+
 	if(flow->http.content_type) {
 	  ndpi_free(flow->http.content_type);
 	  flow->http.content_type = NULL;
 	}
+
+	if(flow->http.request_content_type) {
+	  ndpi_free(flow->http.request_content_type);
+	  flow->http.request_content_type = NULL;
+	}
+
 	if(flow->http.user_agent) {
 	  ndpi_free(flow->http.user_agent);
 	  flow->http.user_agent = NULL;
 	}
+
 	if(flow->kerberos_buf.pktbuf) {
 	  ndpi_free(flow->kerberos_buf.pktbuf);
 	  flow->kerberos_buf.pktbuf = NULL;
 	}
+
 	if(flow->l4.tcp.tls.message.buffer) {
 	  ndpi_free(flow->l4.tcp.tls.message.buffer);
 	  flow->l4.tcp.tls.message.buffer = NULL;
@@ -6317,6 +6326,9 @@ void ndpi_free_flow_data(struct ndpi_flow_struct *flow) {
     if(flow->http.content_type)
       ndpi_free(flow->http.content_type);
 
+    if(flow->http.request_content_type)
+      ndpi_free(flow->http.request_content_type);
+
     if(flow->http.user_agent)
       ndpi_free(flow->http.user_agent);
 
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 63f68a0f4..4e1d60d4a 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -631,19 +631,34 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     NDPI_LOG_DBG2(ndpi_struct, "Content Type line found %.*s\n",
 		  packet->content_line.len, packet->content_line.ptr);
 
-    if((flow->http.content_type == NULL) && (packet->content_line.len > 0)) {
-      int len = packet->content_line.len + 1;
-
-      flow->http.content_type = ndpi_malloc(len);
-      if(flow->http.content_type) {
-	strncpy(flow->http.content_type, (char*)packet->content_line.ptr,
-		packet->content_line.len);
-	flow->http.content_type[packet->content_line.len] = '\0';
-
-	flow->guessed_category = flow->category = ndpi_http_check_content(ndpi_struct, flow);
+    if(flow->http.response_status_code == 0) {
+      /* Request */
+      if((flow->http.request_content_type == NULL) && (packet->content_line.len > 0)) {
+	int len = packet->content_line.len + 1;
+	
+	flow->http.request_content_type = ndpi_malloc(len);
+	if(flow->http.request_content_type) {
+	  strncpy(flow->http.request_content_type, (char*)packet->content_line.ptr,
+		  packet->content_line.len);
+	  flow->http.request_content_type[packet->content_line.len] = '\0';
+	}
       }
-    }
-
+    } else {
+      /* Response */
+      if((flow->http.content_type == NULL) && (packet->content_line.len > 0)) {
+	int len = packet->content_line.len + 1;
+	
+	flow->http.content_type = ndpi_malloc(len);
+	if(flow->http.content_type) {
+	  strncpy(flow->http.content_type, (char*)packet->content_line.ptr,
+		  packet->content_line.len);
+	  flow->http.content_type[packet->content_line.len] = '\0';
+	  
+	  flow->guessed_category = flow->category = ndpi_http_check_content(ndpi_struct, flow);
+	}
+      }
+    }    
+    
     if(flow->http_detected) {
       ndpi_protocol_match_result ret_match;