Follow-up of 2093ac5bf (#2451)

4 files changed, 10 insertions, 6 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index aca43f8f1..6f4994153 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -349,11 +349,9 @@ u_int16_t ndpi_map_ndpi_id_to_user_proto_id(struct ndpi_detection_module_struct
   NDPI_LOG_DBG2(ndpi_str, "[DEBUG] ***** %s(%u)\n", __FUNCTION__, ndpi_proto_id);
 #endif
 
-  /*
   if(!ndpi_str)
     return(0);
-  */
-  
+
   if(ndpi_proto_id < NDPI_MAX_SUPPORTED_PROTOCOLS)
     return(ndpi_proto_id);
   else if(ndpi_proto_id < ndpi_str->ndpi_num_supported_protocols) {
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index b8f0a3978..e549a910f 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -220,7 +220,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
       u_int32_t unused;
 
       /* TODO: we should switch to the demultiplexing-code in stun dissector */
-      if(!is_stun(ndpi_struct, flow, &app_proto) &&
+      if(is_stun(ndpi_struct, flow, &app_proto) != 0 &&
          !is_dtls(packet->payload, packet->payload_packet_len, &unused)) {
         flow->l4.udp.rtp_stage = 0;
         flow->l4.udp.rtcp_stage = 0;
diff --git a/src/lib/protocols/sip.c b/src/lib/protocols/sip.c
index 23a88ebf8..670933167 100644
--- a/src/lib/protocols/sip.c
+++ b/src/lib/protocols/sip.c
@@ -69,6 +69,12 @@ void ndpi_search_sip(struct ndpi_detection_module_struct *ndpi_struct, struct nd
     }
   }
 
+  if(payload_len == 5 && memcmp(packet_payload, "hello", 5) == 0) {
+    NDPI_LOG_INFO(ndpi_struct, "found sip via HELLO (kind of ping)\n");
+    ndpi_int_sip_add_connection(ndpi_struct, flow);
+    return;
+  }
+
   if(payload_len >= 14) {    
     if((memcmp(packet_payload, "NOTIFY ", 7) == 0 || memcmp(packet_payload, "notify ", 7) == 0)
        && (memcmp(&packet_payload[7], "SIP:", 4) == 0 || memcmp(&packet_payload[7], "sip:", 4) == 0)) {
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 4d4fec6db..aca6540fc 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -663,7 +663,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct,
   /* RFC9443 */
   if(first_byte <= 3) {
     NDPI_LOG_DBG(ndpi_struct, "Still STUN\n");
-    if(is_stun(ndpi_struct, flow, &app_proto)) { /* To extract other metadata */
+    if(is_stun(ndpi_struct, flow, &app_proto) == 1) { /* To extract other metadata */
       if(is_new_subclassification_better(ndpi_struct, flow, app_proto)) {
         ndpi_int_stun_add_connection(ndpi_struct, flow, app_proto, __get_master(flow));
       }
@@ -991,7 +991,7 @@ static void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, s
   }
 
   /* TODO: can we stop earlier? */
-  if((rc == -1) || (flow->packet_counter > 8))
+  if(flow->packet_counter > 5)
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }