[HTTP_DECODER]bugfix for http header exceed maximum

16 files changed, 313 insertions, 75 deletions

diff --git a/src/http_decoder/http_decoder_half.c b/src/http_decoder/http_decoder_half.c
index 45c936d..b95486a 100644
--- a/src/http_decoder/http_decoder_half.c
+++ b/src/http_decoder/http_decoder_half.c
@@ -785,4 +785,13 @@ int http_decoder_half_data_get_decompress_body(struct http_decoder_half_data *da
     body->str = data->decompress_body;
     body->str_len = data->decompress_body_len;
     return 0;
+}
+
+void http_decoder_half_data_dump(struct http_decoder_half *half)
+{
+    if (NULL == half || NULL == half->ref_data) {
+        return;
+    }
+
+    http_decoder_table_dump(half->ref_data->table);
 }
\ No newline at end of file
diff --git a/src/http_decoder/http_decoder_half.h b/src/http_decoder/http_decoder_half.h
index a856929..f682c8f 100644
--- a/src/http_decoder/http_decoder_half.h
+++ b/src/http_decoder/http_decoder_half.h
@@ -80,7 +80,9 @@ int http_decoder_half_data_get_raw_body(struct http_decoder_half_data *data,
                                         struct hstring *body);
 
 int http_decoder_half_data_get_decompress_body(struct http_decoder_half_data *data,
-                                                       struct hstring *body);
+                                               struct hstring *body);
+
+void http_decoder_half_data_dump(struct http_decoder_half *half);
 
 #ifdef __cplusplus
 }
diff --git a/src/http_decoder/http_decoder_string.c b/src/http_decoder/http_decoder_string.c
index ce7c2db..4b5b104 100644
--- a/src/http_decoder/http_decoder_string.c
+++ b/src/http_decoder/http_decoder_string.c
@@ -98,17 +98,17 @@ void http_decoder_string_commit(struct http_decoder_string *rstr)
     switch (rstr->state) {
         case STRING_STATE_REFER:
             if (rstr->cache.str_len) {
-            http_decoder_string_cache(rstr);
+                http_decoder_string_cache(rstr);
 
-            rstr->commit.str = rstr->cache.str;
-            rstr->commit.str_len = rstr->cache.str_len;
-            // not overwrite rstr->cache.str
+                rstr->commit.str = rstr->cache.str;
+                rstr->commit.str_len = rstr->cache.str_len;
+                // not overwrite rstr->cache.str
             } else {
-            rstr->commit.str = rstr->refer.str;
-            rstr->commit.str_len = rstr->refer.str_len;
+                rstr->commit.str = rstr->refer.str;
+                rstr->commit.str_len = rstr->refer.str_len;
 
-            rstr->refer.str = NULL;
-            rstr->refer.str_len = 0;
+                rstr->refer.str = NULL;
+                rstr->refer.str_len = 0;
             }
             break;
         case STRING_STATE_CACHE:
diff --git a/src/http_decoder/http_decoder_table.c b/src/http_decoder/http_decoder_table.c
index 615c193..5523375 100644
--- a/src/http_decoder/http_decoder_table.c
+++ b/src/http_decoder/http_decoder_table.c
@@ -159,10 +159,8 @@ void http_decoder_table_refer(struct http_decoder_table *table, enum http_item t
         break;
     case HTTP_ITEM_HDRKEY:
         if (table->header_index >= table->header_size) {
-            table->headers = (struct http_decoder_header *)realloc(table->headers,
-                                                                   table->header_size * 2);
-            assert(table->headers);
-
+            table->headers = REALLOC(struct http_decoder_header, table->headers,
+                                     table->header_size * 2);
             table->header_size *= 2;
             for (size_t i = table->header_index; i < table->header_size; i++) {
                 header = &table->headers[i];
@@ -304,54 +302,6 @@ void http_decoder_table_reset(struct http_decoder_table *table, enum http_item t
     }
 }
 
-void http_decoder_table_remove(struct http_decoder_table *table)
-{
-    if (NULL == table) {
-        return;
-    }
-
-    if (http_decoder_string_state(&table->uri) == STRING_STATE_COMMIT) {
-        http_decoder_string_reset(&table->uri);
-    }
-
-    if (http_decoder_string_state(&table->status) == STRING_STATE_COMMIT) {
-        http_decoder_string_reset(&table->status);
-    }
-
-    if (http_decoder_string_state(&table->method) == STRING_STATE_COMMIT) {
-        http_decoder_string_reset(&table->method);
-    }
-
-    if (http_decoder_string_state(&table->version) == STRING_STATE_COMMIT) {
-        http_decoder_string_reset(&table->version);
-    }
-
-    if (http_decoder_string_state(&table->body) == STRING_STATE_COMMIT) {
-        http_decoder_string_reset(&table->body);
-    }
-
-    for (size_t i = 0; i <= table->header_index; i++) {
-        struct http_decoder_header *header = &table->headers[i];
-        if (http_decoder_string_state(&header->key) == STRING_STATE_COMMIT &&
-            http_decoder_string_state(&header->val) == STRING_STATE_COMMIT) {
-            http_decoder_string_reset(&header->key);
-            http_decoder_string_reset(&header->val);
-        }
-    }
-
-    if (table->header_index != 0) {
-        struct http_decoder_header *last_header =
-            &table->headers[table->header_index];
-        if (http_decoder_string_state(&last_header->key) == STRING_STATE_CACHE ||
-            http_decoder_string_state(&last_header->val) == STRING_STATE_CACHE) {
-            memmove(&table->headers[0], last_header, sizeof(struct http_decoder_header));
-            memset(last_header, 0, sizeof(struct http_decoder_header));
-        }
-
-        table->header_index = 0;
-    }
-}
-
 void http_decoder_table_dump(struct http_decoder_table *table)
 {
     if (NULL == table) {
@@ -364,7 +314,7 @@ void http_decoder_table_dump(struct http_decoder_table *table)
     http_decoder_string_dump(&table->version, "version");
     http_decoder_string_dump(&table->body, "body");
 
-    for (size_t i = 0; i <= table->header_index; i++) {
+    for (size_t i = 0; i < table->header_index; i++) {
         struct http_decoder_header *header = &table->headers[i];
         http_decoder_string_dump(&header->key, "key");
         http_decoder_string_dump(&header->val, "val");
@@ -430,14 +380,15 @@ int http_decoder_table_get_header(struct http_decoder_table *table, struct hstri
 
     int header_cnt = 0;
     for (int i = 0; i < table->header_index && header_cnt < array_size; i++) {
-        struct http_decoder_header *header = &table->headers[i];
-        if (http_decoder_string_state(&header->key) == STRING_STATE_COMMIT &&
-            http_decoder_string_state(&header->val) == STRING_STATE_COMMIT) {
+        struct http_decoder_header *tmp_header = &table->headers[i];
+        if (http_decoder_string_state(&tmp_header->key) == STRING_STATE_COMMIT &&
+            http_decoder_string_state(&tmp_header->val) == STRING_STATE_COMMIT) {
             struct hstring tmp_key;
-            http_decoder_string_get(&header->key, &tmp_key);
+            http_decoder_string_get(&tmp_header->key, &tmp_key);
 
-            if (tmp_key.str_len == key->str_len && strncasecmp(tmp_key.str, key->str, key->str_len) == 0) {
-                http_decoder_string_get(&header->val, &header_array[header_cnt++].val);
+            if (tmp_key.str_len == key->str_len &&
+                0 == strncasecmp(tmp_key.str, key->str, key->str_len)) {
+                http_decoder_string_get(&tmp_header->val, &header_array[header_cnt++].val);
             }
         }
     }
@@ -456,11 +407,11 @@ int http_decoder_table_iter_header(struct http_decoder_table *table,
         return 0;
     }
 
-    struct http_decoder_header *tmp_decoder_header = &table->headers[table->header_iter++];
-    if (http_decoder_string_state(&tmp_decoder_header->key) == STRING_STATE_COMMIT &&
-        http_decoder_string_state(&tmp_decoder_header->val) == STRING_STATE_COMMIT) {
-        http_decoder_string_get(&tmp_decoder_header->key, &header->key);
-        http_decoder_string_get(&tmp_decoder_header->val, &header->val);
+    struct http_decoder_header *tmp_header = &table->headers[table->header_iter++];
+    if (http_decoder_string_state(&tmp_header->key) == STRING_STATE_COMMIT &&
+        http_decoder_string_state(&tmp_header->val) == STRING_STATE_COMMIT) {
+        http_decoder_string_get(&tmp_header->key, &header->key);
+        http_decoder_string_get(&tmp_header->val, &header->val);
         return 1;
     }
 
diff --git a/src/http_decoder/http_decoder_table.h b/src/http_decoder/http_decoder_table.h
index 41ee12f..3457151 100644
--- a/src/http_decoder/http_decoder_table.h
+++ b/src/http_decoder/http_decoder_table.h
@@ -51,8 +51,6 @@ void http_decoder_table_commit(struct http_decoder_table *table,
 void http_decoder_table_reset(struct http_decoder_table *table,
                               enum http_item type);
 
-void http_decoder_table_remove(struct http_decoder_table *table);
-
 void http_decoder_table_dump(struct http_decoder_table *table);
 
 int http_decoder_table_get_uri(struct http_decoder_table *table,
diff --git a/test/http_decoder/CMakeLists.txt b/test/http_decoder/CMakeLists.txt
index 5221630..1a388ed 100644
--- a/test/http_decoder/CMakeLists.txt
+++ b/test/http_decoder/CMakeLists.txt
@@ -76,6 +76,21 @@ add_test(NAME HTTP_REQ_1BYTE_SLIDING_WINDOW_TEST COMMAND ${TEST_MAIN} ${CMAKE_CU
 add_test(NAME HTTP_RES_1BYTE_SLIDING_WINDOW_TEST COMMAND ${TEST_MAIN} ${CMAKE_CURRENT_SOURCE_DIR}/test_result_json/http_res_1byte_sliding_window.json
          -f "find ${CMAKE_CURRENT_SOURCE_DIR}/http_pcap/ -name http_res_1byte_sliding_window.pcap|sort -V" WORKING_DIRECTORY ${TEST_RUN_DIR})
 
+add_test(NAME HTTP_BASIC_AUTH_TEST COMMAND ${TEST_MAIN} ${CMAKE_CURRENT_SOURCE_DIR}/test_result_json/http_basic_auth.json
+         -f "find ${CMAKE_CURRENT_SOURCE_DIR}/http_pcap/ -name http_basic_auth.pcap|sort -V" WORKING_DIRECTORY ${TEST_RUN_DIR})
+
+add_test(NAME HTTP_NO_LENGTH_TEST COMMAND ${TEST_MAIN} ${CMAKE_CURRENT_SOURCE_DIR}/test_result_json/http_no_length.json
+         -f "find ${CMAKE_CURRENT_SOURCE_DIR}/http_pcap/ -name http_no_length.pcap|sort -V" WORKING_DIRECTORY ${TEST_RUN_DIR})
+
+add_test(NAME HTTP_POST_FORM_TEST COMMAND ${TEST_MAIN} ${CMAKE_CURRENT_SOURCE_DIR}/test_result_json/http_post_form.json
+         -f "find ${CMAKE_CURRENT_SOURCE_DIR}/http_pcap/ -name http_post_form.pcap|sort -V" WORKING_DIRECTORY ${TEST_RUN_DIR})
+
+add_test(NAME HTTP_TCP_SEQ_ISSUE_TEST COMMAND ${TEST_MAIN} ${CMAKE_CURRENT_SOURCE_DIR}/test_result_json/http_tcp_seq_issue.json
+         -f "find ${CMAKE_CURRENT_SOURCE_DIR}/http_pcap/ -name http_tcp_seq_issue.pcap|sort -V" WORKING_DIRECTORY ${TEST_RUN_DIR})
+
+add_test(NAME HTTP_WRAPPED_HEADER_TEST COMMAND ${TEST_MAIN} ${CMAKE_CURRENT_SOURCE_DIR}/test_result_json/http_wrapped_header.json
+         -f "find ${CMAKE_CURRENT_SOURCE_DIR}/http_pcap/ -name http_wrapped_header.pcap|sort -V" WORKING_DIRECTORY ${TEST_RUN_DIR})
+
 set_tests_properties(HTTP_GET_SINGLE_TRANS_TEST
                      HTTP_GET_MULTI_TRANS_TEST
                      HTTP_GET_REQ_PIPELINE_TEST
@@ -90,4 +105,9 @@ set_tests_properties(HTTP_GET_SINGLE_TRANS_TEST
                      NON_HTTP_TEST
                      HTTP_REQ_1BYTE_SLIDING_WINDOW_TEST
                      HTTP_RES_1BYTE_SLIDING_WINDOW_TEST
+                     HTTP_BASIC_AUTH_TEST
+                     HTTP_NO_LENGTH_TEST
+                     HTTP_POST_FORM_TEST
+                     HTTP_TCP_SEQ_ISSUE_TEST
+                     HTTP_WRAPPED_HEADER_TEST
                      PROPERTIES FIXTURES_REQUIRED TestFixture)
\ No newline at end of file
diff --git a/test/http_decoder/http_pcap/http_basic_auth.pcap b/test/http_decoder/http_pcap/http_basic_auth.pcap
new file mode 100644
index 0000000..29ee701
--- /dev/null
+++ b/test/http_decoder/http_pcap/http_basic_auth.pcap
diff --git a/test/http_decoder/http_pcap/http_no_length.pcap b/test/http_decoder/http_pcap/http_no_length.pcap
new file mode 100644
index 0000000..28e6881
--- /dev/null
+++ b/test/http_decoder/http_pcap/http_no_length.pcap
diff --git a/test/http_decoder/http_pcap/http_post_form.pcap b/test/http_decoder/http_pcap/http_post_form.pcap
new file mode 100644
index 0000000..0136e05
--- /dev/null
+++ b/test/http_decoder/http_pcap/http_post_form.pcap
diff --git a/test/http_decoder/http_pcap/http_tcp_seq_issue.pcap b/test/http_decoder/http_pcap/http_tcp_seq_issue.pcap
new file mode 100644
index 0000000..78c7fcd
--- /dev/null
+++ b/test/http_decoder/http_pcap/http_tcp_seq_issue.pcap
diff --git a/test/http_decoder/http_pcap/http_wrapped_header.pcap b/test/http_decoder/http_pcap/http_wrapped_header.pcap
new file mode 100644
index 0000000..537bffa
--- /dev/null
+++ b/test/http_decoder/http_pcap/http_wrapped_header.pcap
diff --git a/test/http_decoder/test_result_json/http_basic_auth.json b/test/http_decoder/test_result_json/http_basic_auth.json
new file mode 100644
index 0000000..2e38ba0
--- /dev/null
+++ b/test/http_decoder/test_result_json/http_basic_auth.json
@@ -0,0 +1,37 @@
+[
+    {
+        "Tuple4": "10.0.0.2.1087>10.0.0.1.2082",
+        "method": "GET",
+        "uri": "/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxx/xxxxxxxxxxxxxxxxxxxx.js",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Host": "10.000.000.001:1234",
+        "User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/32.0",
+        "Accept": "*/*",
+        "Accept-Language": "en-GB,en;q=0.5",
+        "Accept-Encoding": "gzip, deflate",
+        "Referer": "http://10.000.000.001:1234/zzzzzzzzzzzzzzzz/zzzzzzzz/zz/zzzzzzzzz/index.html",
+        "Cookie": "zzzzzzzzzzzzzzzzzz=auto; cprelogin=no; cpsession=zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz; langedit=; lang=",
+        "Authorization": "Basic dXNlcnJycnI6cGFzc3dvcmRkZGRk",
+        "Connection": "keep-alive",
+        "If-Modified-Since": "Wed, 29 Oct 2014 01:11:13 GMT",
+        "name": "HTTP_DECODER_RESULT_1"
+    },
+    {
+        "Tuple4": "10.0.0.2.1087>10.0.0.1.2082",
+        "res_version": "1.1",
+        "res_status": "Not Modified",
+        "major_version": 1,
+        "minor_version": 1,
+        "status_code": 304,
+        "Server": "cpsrvd/11.44.1.19",
+        "X-Keep-Alive-Count": "1",
+        "Connection": "Keep-Alive",
+        "Keep-Alive": "timeout=70, max=200",
+        "Date": "Wed, 29 Oct 2014 17:35:08 GMT",
+        "Cache-Control": "max-age=5184000, public",
+        "Expires": "Sun, 28 Dec 2014 17:35:07 GMT",
+        "name": "HTTP_DECODER_RESULT_2"
+    }
+]
\ No newline at end of file
diff --git a/test/http_decoder/test_result_json/http_no_length.json b/test/http_decoder/test_result_json/http_no_length.json
new file mode 100644
index 0000000..61613ea
--- /dev/null
+++ b/test/http_decoder/test_result_json/http_no_length.json
@@ -0,0 +1,40 @@
+[
+    {
+        "Tuple4": "10.0.0.1.50384>10.0.0.2.80",
+        "method": "GET",
+        "uri": "/js/xxxxxx.js",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Host": "xxxxxxx.xxxxxx.xx",
+        "User-Agent": "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3",
+        "Accept": "*/*",
+        "Accept-Language": "en-us,en;q=0.5",
+        "Accept-Encoding": "gzip,deflate",
+        "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
+        "Keep-Alive": "115",
+        "Connection": "keep-alive",
+        "Referer": "http://www.xxxxxxxx.com/xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxx.html",
+        "Cookie": "trafic_ranking=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+        "name": "HTTP_DECODER_RESULT_1"
+    },
+    {
+        "Tuple4": "10.0.0.1.50384>10.0.0.2.80",
+        "res_version": "1.0",
+        "res_status": "OK",
+        "major_version": 1,
+        "minor_version": 0,
+        "status_code": 200,
+        "Date": "Mon, 10 May 2010 08:31:02 GMT",
+        "Server": "Apache",
+        "Content-type": "application/x-javascript",
+        "Expires": "Thu, 11 Jan 1973 16:00:00 GMT",
+        "Last-Modified": "Mon, 10 May 2010 08:31:02 GMT",
+        "Cache-Control": "no-store, no-cache, must-revalidate, post-check=0, pre-check=0",
+        "Pragma": "no-cache",
+        "P3P": "policyref=\"/w3c/p3p.xml\", CP=\"ALL IND DSP COR ADM CONo CUR IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI\"",
+        "Set-Cookie": "trafic_ranking=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; expires=Sun, 11-Jan-2037 14:00:00 GMT; path=/; domain=.xxxxxx.xx",
+        "connection": "close",
+        "name": "HTTP_DECODER_RESULT_2"
+    }
+]
\ No newline at end of file
diff --git a/test/http_decoder/test_result_json/http_post_form.json b/test/http_decoder/test_result_json/http_post_form.json
new file mode 100644
index 0000000..c728970
--- /dev/null
+++ b/test/http_decoder/test_result_json/http_post_form.json
@@ -0,0 +1,94 @@
+[
+    {
+        "Tuple4": "192.168.8.97.11371>192.168.57.14.8080",
+        "method": "GET",
+        "uri": "/fileupload/",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Host": "192.168.57.14:8080",
+        "Connection": "keep-alive",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
+        "User-Agent": "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36",
+        "Accept-Encoding": "gzip,deflate,sdch",
+        "Accept-Language": "zh-CN,zh;q=0.8",
+        "Cookie": "JSESSIONID=969AC5FBD069EE6218EB10513726B244; JSESSIONID=400CC78DF5784F303702CC7F02C6122C",
+        "name": "HTTP_DECODER_RESULT_1"
+    },
+    {
+        "Tuple4": "192.168.8.97.11371>192.168.57.14.8080",
+        "res_version": "1.1",
+        "res_status": "OK",
+        "major_version": 1,
+        "minor_version": 1,
+        "status_code": 200,
+        "Server": "Apache-Coyote/1.1",
+        "Content-Type": "text/html;charset=UTF-8",
+        "Content-Length": "468",
+        "Date": "Thu, 28 Mar 2019 08:13:33 GMT",
+        "name": "HTTP_DECODER_RESULT_2"
+    },
+    {
+        "Tuple4": "192.168.8.97.11371>192.168.57.14.8080",
+        "method": "GET",
+        "uri": "/fileupload/",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Host": "192.168.57.14:8080",
+        "Connection": "keep-alive",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
+        "User-Agent": "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36",
+        "Accept-Encoding": "gzip,deflate,sdch",
+        "Accept-Language": "zh-CN,zh;q=0.8",
+        "Cookie": "JSESSIONID=969AC5FBD069EE6218EB10513726B244; JSESSIONID=400CC78DF5784F303702CC7F02C6122C",
+        "name": "HTTP_DECODER_RESULT_3"
+    },
+    {
+        "Tuple4": "192.168.8.97.11371>192.168.57.14.8080",
+        "res_version": "1.1",
+        "res_status": "OK",
+        "major_version": 1,
+        "minor_version": 1,
+        "status_code": 200,
+        "Server": "Apache-Coyote/1.1",
+        "Content-Type": "text/html;charset=UTF-8",
+        "Content-Length": "468",
+        "Date": "Thu, 28 Mar 2019 08:13:33 GMT",
+        "name": "HTTP_DECODER_RESULT_4"
+    },
+    {
+        "Tuple4": "192.168.8.97.11371>192.168.57.14.8080",
+        "method": "POST",
+        "uri": "/fileupload/servlet/UploadHandleServlet",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Host": "192.168.57.14:8080",
+        "Connection": "keep-alive",
+        "Content-Length": "449",
+        "Cache-Control": "max-age=0",
+        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
+        "Origin": "http://192.168.57.14:8080",
+        "User-Agent": "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.154 Safari/537.36",
+        "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryAe47vGj7ybAe6RwO",
+        "Referer": "http://192.168.57.14:8080/fileupload/",
+        "Accept-Encoding": "gzip,deflate,sdch",
+        "Accept-Language": "zh-CN,zh;q=0.8",
+        "Cookie": "JSESSIONID=969AC5FBD069EE6218EB10513726B244; JSESSIONID=400CC78DF5784F303702CC7F02C6122C",
+        "name": "HTTP_DECODER_RESULT_5"
+    },
+    {
+        "Tuple4": "192.168.8.97.11371>192.168.57.14.8080",
+        "res_version": "1.1",
+        "res_status": "OK",
+        "major_version": 1,
+        "minor_version": 1,
+        "status_code": 200,
+        "Server": "Apache-Coyote/1.1",
+        "Content-Type": "text/html;charset=UTF-8",
+        "Content-Length": "144",
+        "Date": "Thu, 28 Mar 2019 08:13:37 GMT",
+        "name": "HTTP_DECODER_RESULT_6"
+    }
+]
\ No newline at end of file
diff --git a/test/http_decoder/test_result_json/http_tcp_seq_issue.json b/test/http_decoder/test_result_json/http_tcp_seq_issue.json
new file mode 100644
index 0000000..fc82348
--- /dev/null
+++ b/test/http_decoder/test_result_json/http_tcp_seq_issue.json
@@ -0,0 +1,42 @@
+[
+    {
+        "Tuple4": "10.11.12.13.54162>13.12.11.10.80",
+        "method": "POST",
+        "uri": "/xxxxxxxxx/xxxxxx/xxxxxxxxxxx/xxxxxxxxxx/xxx/xxxxxxxxx.xxx?Command=FileUpload&Type=File&CurrentFolder=%2F",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Connection": "Keep-Alive",
+        "Content-Type": "multipart/form-data; boundary=----7df271da040a",
+        "Accept": "*/*",
+        "Referer": "http://xxx.xxxxxxxxxxxx.xxx.xx/xxxxxxxxx/xxxxxx/xxxxxxxxxxx/xxxxxxxxxx/xxx/xxxxxxxxx.xxx?Command=FileUpload&Type=File&CurrentFolder=%2F",
+        "User-Agent": "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)",
+        "Content-Length": "300",
+        "Host": "xxx.xxxxxxxxxxxx.xxx.xx",
+        "name": "HTTP_DECODER_RESULT_1"
+    },
+    {
+        "Tuple4": "10.11.12.13.54162>13.12.11.10.80",
+        "res_version": "1.1",
+        "res_status": "OK",
+        "major_version": 1,
+        "minor_version": 1,
+        "status_code": 200,
+        "Date": "Tue, 28 May 2019 00:51:19 GMT",
+        "P3P": "policyref=\"https://policies.xxxxx.com/w3c/p3p.xml\", CP=\"CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV\"",
+        "Set-Cookie": "xx=xxxxxxxxxxxxx&x=x&x=xx; expires=Wed, 27-May-2020 00:51:19 GMT; path=/; domain=.xxx.xx; secure",
+        "Cache-Control": "max-age=3600, private",
+        "Vary": "Accept-Encoding",
+        "Content-Length": "3388",
+        "Content-Type": "text/html; charset=UTF-8",
+        "Age": "0",
+        "Connection": "keep-alive",
+        "Server": "ATS",
+        "X-Frame-Options": "DENY",
+        "X-Content-Type-Options": "nosniff",
+        "X-XSS-Protection": "1; mode=block",
+        "Referrer-Policy": "strict-origin-when-cross-origin",
+        "Content-Security-Policy": "sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri https://xxx.xxxxx.xxx/xxxxxx/xxx?xxx=xxxxxxx",
+        "name": "HTTP_DECODER_RESULT_2"
+    }
+]
\ No newline at end of file
diff --git a/test/http_decoder/test_result_json/http_wrapped_header.json b/test/http_decoder/test_result_json/http_wrapped_header.json
new file mode 100644
index 0000000..fac220b
--- /dev/null
+++ b/test/http_decoder/test_result_json/http_wrapped_header.json
@@ -0,0 +1,45 @@
+[
+    {
+        "Tuple4": "10.0.0.1.61462>10.0.0.2.80",
+        "method": "GET",
+        "uri": "/x/xx/xxxxxxxxxxxxxxxxxxx/x/xxxxxx/xxxxxxxxxxxxxxx?xxx=1&xxx=1&x=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&vmf=xxxxxxxxxx.xxx.xxx.xxx&ce=UTF-8&ns=xxxxxxxxxx&pageName=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&g=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.jsp&r=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&events=xxxxxxxxxxxxxxxxxxxxxxxxxxx&products=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&v1=xxxxxxxxxxxxxxx&v2=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&v17=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_cxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&c49=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&AQE=1",
+        "req_version": "1.1",
+        "major_version": 1,
+        "minor_version": 1,
+        "Host": "xxxxx.xxxxxxxx.xxxxxxxxxx.xxx",
+        "Connection": "keep-alive",
+        "Accept": "image/webp,*/*;q=0.8",
+        "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36",
+        "Referer": "http://www.xxxxxxxxxx.xxx/xx/xxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxx.jsp",
+        "Accept-Encoding": "gzip,deflate,sdch",
+        "Accept-Language": "en-US,en;q=0.8,en-GB;q=0.6",
+        "Cookie": "xxxxxxxxxxxxxxxxxxx=ie; xxxxxxxxxxxxxxxxxxxxxx=true; lp=xxxxxx; rememberUn=false; xxx.xxxxxxxxxx.xxxxxxxxxx=xx; xxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; autocomplete=1; xxxx=xxxx; xxxx=xxxxv1|xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; xxxxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+        "name": "HTTP_DECODER_RESULT_1"
+    },
+    {
+        "Tuple4": "10.0.0.1.61462>10.0.0.2.80",
+        "res_version": "1.1",
+        "res_status": "OK",
+        "major_version": 1,
+        "minor_version": 1,
+        "status_code": 200,
+        "Date": "Mon, 30 Jun 2014 13:35:21 GMT",
+        "Server": "xxxxxxxxxxxxxxxxx",
+        "Access-Control-Allow-Origin": "*",
+        "Set-Cookie": "xxxx=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; Expires=Wed, 29 Jun 2016 13:35:21 GMT; Domain=.xxxxxxxxxx.xxx; Path=/",
+        "X-C": "ms-4.9",
+        "Expires": "Sun, 29 Jun 2014 13:35:21 GMT",
+        "Last-Modified": "Tue, 01 Jul 2014 13:35:21 GMT",
+        "Cache-Control": "no-cache, no-store, max-age=0, no-transform, private",
+        "Pragma": "no-cache",
+        "ETag": "\"xxxxxxxxxxxxxxxxxxxxxx\"",
+        "Vary": "*",
+        "P3P": "policyref=\"/w3c/p3p.xml\", CP=\"NOI DSP COR NID PSA OUR IND COM NAV STA\"",
+        "xserver": "xxxxxx",
+        "Content-Length": "43",
+        "Keep-Alive": "timeout=15",
+        "Connection": "Keep-Alive",
+        "Content-Type": "image/gif",
+        "name": "HTTP_DECODER_RESULT_2"
+    }
+]
\ No newline at end of file