Improve HTTP detection heuristic (#7228)

* Improve HTTP checking heuristic

* fix changelog

* Fix checking

* [autofix.ci] apply automated fixes

* simplify condition

---------

Co-authored-by: Fata Nugraha <fata.nugraha@grabtaxi.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Maximilian Hils <github@maximilianhils.com>

CHANGELOG.md

@@ -7,6 +7,8 @@
 
 ## Unreleased: mitmproxy next
 
+- Tighten HTTP detection heuristic to better support custom TCP-based protocols.
+  ([#7228](https://github.com/mitmproxy/mitmproxy/pull/7228), @fatanugraha)
 
 ## 02 October 2024: mitmproxy 11.0.0
 

mitmproxy/addons/next_layer.py

@@ -182,9 +182,10 @@ class NextLayer:
         probably_no_http = (
             # the first three bytes should be the HTTP verb, so A-Za-z is expected.
             len(data_client) < 3
-            # HTTP would require whitespace before the first newline
-            # if we have neither whitespace nor a newline, it's also unlikely to be HTTP.
-            or (data_client.find(b" ") >= data_client.find(b"\n"))
+            # HTTP would require whitespace...
+            or b" " not in data_client
+            # ...and that whitespace needs to be in the first line.
+            or (data_client.find(b" ") > data_client.find(b"\n"))
             or not data_client[:3].isalpha()
             # a server greeting would be uncharacteristic.
             or data_server

test/mitmproxy/addons/test_next_layer.py

@@ -103,7 +103,7 @@ dns_query = bytes.fromhex("002a01000001000000000000076578616d706c6503636f6d00000
 
 # Custom protocol with just base64-encoded messages
 # https://github.com/mitmproxy/mitmproxy/pull/7087
-custom_base64_proto = b"AAAAAAAAAAAAAAAAAAAAAA=="
+custom_base64_proto = b"AAAAAAAAAAAAAAAAAAAAAA==\n"
 
 http_get = b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n"
 http_get_absolute = b"GET http://example.com/ HTTP/1.1\r\n\r\n"