added feature to extract filename from http attachment

example/ndpiReader.c

@@ -1769,6 +1769,9 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
     if(flow->http.user_agent[0] != '\0')
       fprintf(out, "[User-Agent: %s]", flow->http.user_agent);
 
+    if(flow->http.filename[0] != '\0')
+      fprintf(out, "[Filename: %s]", flow->http.filename);
+
     if(flow->risk) {
       u_int i;
       u_int16_t cli_score, srv_score;

example/reader_util.c

@@ -1382,6 +1382,7 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
     ndpi_snprintf(flow->http.server, sizeof(flow->http.server), "%s", flow->ndpi_flow->http.server ? flow->ndpi_flow->http.server : "");
     ndpi_snprintf(flow->http.request_content_type, sizeof(flow->http.request_content_type), "%s", flow->ndpi_flow->http.request_content_type ? flow->ndpi_flow->http.request_content_type : "");
     ndpi_snprintf(flow->http.nat_ip, sizeof(flow->http.nat_ip), "%s", flow->ndpi_flow->http.nat_ip ? flow->ndpi_flow->http.nat_ip : "");
+    ndpi_snprintf(flow->http.filename, sizeof(flow->http.filename), "%s", flow->ndpi_flow->http.filename ? flow->ndpi_flow->http.filename : "");
   }
 
   ndpi_snprintf(flow->http.user_agent,

example/reader_util.h

@@ -282,7 +282,7 @@ typedef struct ndpi_flow_info {
   } ssh_tls;
 
   struct {
-    char url[256], request_content_type[64], content_type[64], user_agent[256], server[128], nat_ip[32];
+    char url[256], request_content_type[64], content_type[64], user_agent[256], server[128], nat_ip[32], filename[256];
     u_int response_status_code;
   } http;
 

src/include/ndpi_typedefs.h

@@ -1450,6 +1450,7 @@ struct ndpi_flow_struct {
     char *url, *content_type /* response */, *request_content_type /* e.g. for POST */, *user_agent, *server;
     char *detected_os; /* Via HTTP/QUIC User-Agent */
     char *nat_ip; /* Via HTTP X-Forwarded-For */
+    char *filename; /* Via HTTP Content-Disposition */
   } http;
 
   ndpi_multimedia_flow_type flow_multimedia_type;

src/lib/ndpi_main.c

@@ -5348,6 +5348,9 @@ void ndpi_free_flow_data(struct ndpi_flow_struct* flow) {
     if(flow->http.server)
       ndpi_free(flow->http.server);
 
+    if(flow->http.filename)
+      ndpi_free(flow->http.filename);
+
     if(flow->kerberos_buf.pktbuf)
       ndpi_free(flow->kerberos_buf.pktbuf);
 

src/lib/protocols/http.c

@@ -276,7 +276,7 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo
 		flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT;
 		ndpi_set_binary_application_transfer(ndpi_struct, flow, str);
 		NDPI_LOG_INFO(ndpi_struct, "Found executable HTTP transfer");
-		return(flow->category);
+		//return(flow->category);
 	      }
 	    }
 	  }
@@ -291,6 +291,17 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo
       if(packet->content_disposition_line.len > attachment_len) {
 	u_int8_t filename_len = packet->content_disposition_line.len - attachment_len;
 	int i;
+  if(packet->content_disposition_line.ptr[attachment_len] == '\"'){
+    //case: filename="file_name"
+    flow->http.filename = (char*)malloc((filename_len-3)*sizeof(char));
+    flow->http.filename = strncpy(flow->http.filename, (char*)packet->content_disposition_line.ptr+attachment_len+1, filename_len-2);
+  }
+  else{
+    //case: filename=file_name
+    flow->http.filename = (char*)malloc((filename_len-1)*sizeof(char));
+    flow->http.filename = strncpy(flow->http.filename, (char*)packet->content_disposition_line.ptr+attachment_len, filename_len);
+  }
+
 
 	if(filename_len > ATTACHMENT_LEN) {
 	  attachment_len += filename_len-ATTACHMENT_LEN-1;
@@ -1292,6 +1303,10 @@ static void reset(struct ndpi_detection_module_struct *ndpi_struct,
     ndpi_free(flow->http.nat_ip);
     flow->http.nat_ip = NULL;
   }
+  if(flow->http.filename) {
+    ndpi_free(flow->http.filename);
+    flow->http.filename = NULL;
+  }
 
   /* Reset flow risks. We should reset only those risks triggered by
      the previous HTTP response... */