diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/http.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index e715dd499..de2bb032e 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -321,14 +321,17 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ /** check result of host subprotocol detection - + if "detected" in flow == 0 then "detected" = "guess" else "guess" = "detected" **/ - if(flow->detected_protocol_stack[1] == 0) { - flow->detected_protocol_stack[1] = flow->guessed_protocol_id; - if(flow->detected_protocol_stack[0] == 0) - flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; + if(flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN) { + /* Avoid putting as subprotocol a "core" protocol such as SSL or DNS */ + if(ndpi_struct->proto_defaults[flow->guessed_protocol_id].can_have_a_subprotocol == 0) { + flow->detected_protocol_stack[1] = flow->guessed_protocol_id; + if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) + flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; + } } else { if(flow->detected_protocol_stack[1] != flow->guessed_protocol_id) @@ -336,7 +339,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ if(flow->detected_protocol_stack[0] != flow->guessed_host_protocol_id) flow->guessed_host_protocol_id = flow->detected_protocol_stack[0]; } - + if((flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) && ((ndpi_struct->http_dont_dissect_response) || flow->http_detected) && (packet->http_origin.len > 0)) { |