From c0732eda45884de91e0c221e9dd23eeec364bf68 Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Fri, 5 Aug 2022 14:14:38 +0200
Subject: HTTP: improve sub-classification (#1696)

Content-matched sub-protocols (DASH, IPP, MPEGDASH...) shouldn't
ovewrite the previous master protocol (if any; usually HTTP).

Furthermore. the HTTP dissector shouldn't update the classification
(in the extra-dissection code path) if a content-matched sub-protocols
has already been found.

This commit should address the first part of the changes described in #1687.
---
 src/lib/protocols/mpegdash.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

(limited to 'src/lib/protocols/mpegdash.c')

diff --git a/src/lib/protocols/mpegdash.c b/src/lib/protocols/mpegdash.c
index 0e2ac1944..147057ac3 100644
--- a/src/lib/protocols/mpegdash.c
+++ b/src/lib/protocols/mpegdash.c
@@ -31,15 +31,9 @@
 static void ndpi_int_mpegdash_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
                                              struct ndpi_flow_struct *flow)
 {
-  if (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN ||
-      flow->guessed_host_protocol_id == NDPI_PROTOCOL_HTTP)
-  {
-    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MPEGDASH, NDPI_PROTOCOL_HTTP,
-                               NDPI_CONFIDENCE_DPI);
-  } else {
-    ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_MPEGDASH,
-                               NDPI_CONFIDENCE_DPI);
-  }
+  NDPI_LOG_INFO(ndpi_struct, "found MpegDash\n");
+  ndpi_set_detected_protocol_keeping_master(ndpi_struct, flow, NDPI_PROTOCOL_MPEGDASH,
+					    NDPI_CONFIDENCE_DPI);
 }
 
 void ndpi_search_mpegdash_http(struct ndpi_detection_module_struct *ndpi_struct,
-- 
cgit v1.2.3