1 files changed, 42 insertions, 5 deletions

diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 48dab0d38..5f62d730f 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -28,6 +28,22 @@
 #include "ndpi_api.h"
 #include <stdlib.h>
 
+static const char* binary_file_mimes[] = {
+  "exe",
+  "vnd.ms-cab-compressed",
+  "vnd.microsoft.portable-executable"
+  "x-msdownload",
+  "x-dosexec",
+  NULL
+};
+
+static const char* binary_file_ext[] = {
+  ".exe",
+  ".msi",
+  ".cab",
+  NULL
+};
+
 static void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct,
 				 struct ndpi_flow_struct *flow);
 
@@ -91,14 +107,35 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo
       if(ndpi_strncasestr(app, "mpeg", app_len_avail) != NULL) {
 	flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_STREAMING;
 	return(flow->category);
-      } else if(ndpi_strncasestr(app, "exe", app_len_avail) != NULL) {
-	flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT;
-	NDPI_SET_BIT_16(flow->risk, NDPI_BINARY_APPLICATION_TRANSFER); 
-	NDPI_LOG_INFO(ndpi_struct, "found executable HTTP transfer\n");
-	return(flow->category);
+      } else {
+  for (int i = 0; binary_file_mimes[i] != NULL; i++) {
+    if (ndpi_strncasestr(app, binary_file_mimes[i], app_len_avail) != NULL) {
+      flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT;
+      NDPI_SET_BIT_16(flow->risk, NDPI_BINARY_APPLICATION_TRANSFER);
+      NDPI_LOG_INFO(ndpi_struct, "found executable HTTP transfer");
+      return(flow->category);
+    }
+  }
       }
     }
 
+    /* check for attachment */
+  if (packet->content_disposition_line.len > 0) {
+    uint8_t attachment_len = sizeof("attachment; filename");
+    if (packet->content_disposition_line.len > attachment_len) {
+      uint8_t filename_len = packet->content_disposition_line.len - attachment_len;
+      for (int i = 0; binary_file_ext[i] != NULL; i++) {
+        if (ndpi_strncasestr((const char*)&packet->content_disposition_line.ptr[attachment_len],
+            binary_file_ext[i], filename_len)) {
+          printf("got %s\n", binary_file_ext[i]);
+          flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT;
+          NDPI_SET_BIT_16(flow->risk, NDPI_BINARY_APPLICATION_TRANSFER);
+          NDPI_LOG_INFO(ndpi_struct, "found executable HTTP transfer");
+          return(flow->category);
+        }
+      }
+    }
+  }
     switch(packet->content_line.ptr[0]) {
     case 'a':
       if(strncasecmp((const char *)packet->content_line.ptr, "audio",