Fixed TINC bug (cache usage)

Merged MS Lync with Skype (Microsoft renamed MS Lync in Skype for Business)
Renumbered Nintendo protocols in former MS Lync that was no longer used
Fix for #425

8 files changed, 109 insertions, 108 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 2c12fb69c..c01484b74 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -209,7 +209,8 @@
 #define NDPI_PROTOCOL_WHOIS_DAS 	 170
 #define NDPI_PROTOCOL_COLLECTD 	         171
 #define NDPI_PROTOCOL_SOCKS 	         172 /* Tomasz Bujlow <tomasz@skatnet.dk> */
-#define NDPI_PROTOCOL_MS_LYNC 	         173
+/* The Lync protocol is now skype for business and this the old id 173 can now be recycled */
+#define NDPI_PROTOCOL_NINTENDO		 173
 #define NDPI_PROTOCOL_RTMP 	         174 /* Tomasz Bujlow <tomasz@skatnet.dk> */
 #define NDPI_PROTOCOL_FTP_DATA 	         175 /* Tomasz Bujlow <tomasz@skatnet.dk> */
 #define NDPI_PROTOCOL_WIKIPEDIA 	 176 /* Tomasz Bujlow <tomasz@skatnet.dk> */
@@ -245,7 +246,6 @@
 #define NDPI_PROTOCOL_1KXUN 	         205
 #define NDPI_PROTOCOL_IQIYI 	         206
 #define NDPI_PROTOCOL_SMPP 	         207 /* Damir Franusic <df@release14.org> */
-
 #define NDPI_PROTOCOL_DNSCRYPT           208
 #define NDPI_PROTOCOL_TINC	         209 /* William Guglielmo <william@deselmo.com> */
 #define NDPI_PROTOCOL_DEEZER 	         210
@@ -269,12 +269,12 @@
 #define NDPI_PROTOCOL_PLAYSTORE          228 /* Google Play Store */
 #define NDPI_PROTOCOL_SOMEIP		 229
 #define NDPI_PROTOCOL_FIX		 230
-#define NDPI_PROTOCOL_NINTENDO		 231
+
 
 
 
 /* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL		        NDPI_PROTOCOL_NINTENDO
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL		        NDPI_PROTOCOL_FIX
 
 #define NDPI_MAX_SUPPORTED_PROTOCOLS                    (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
 #define NDPI_MAX_NUM_CUSTOM_PROTOCOLS                   (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index c10101d42..93b1b8651 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -335,11 +335,11 @@ struct bt_announce {              // 192 bytes
 
 #define TINC_CACHE_MAX_SIZE 10
 
-typedef struct {
+PACK_ON struct tinc_cache_entry {
   u_int32_t src_address;
   u_int32_t dst_address;
   u_int16_t dst_port;
-} tinc_cache_entry_t;
+} PACK_OFF;
 
 #endif
 
@@ -1071,10 +1071,9 @@ struct ndpi_flow_struct {
 #endif
 #ifdef NDPI_PROTOCOL_TINC
   u_int8_t tinc_state;
-  tinc_cache_entry_t tinc_cache_entry;
+  struct tinc_cache_entry tinc_cache_entry;
 #endif
 
-
   /* internal structures to save functions calls */
   struct ndpi_packet_struct packet;
   struct ndpi_flow_struct *flow;
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index d79eb3c20..8ed89e3ae 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1536,11 +1536,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "UBNTAC2", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),	      /* TCP */
 			    ndpi_build_default_ports(ports_b, 10001, 0, 0, 0, 0));    /* UDP */
-    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_MS_LYNC,
-			    no_master,
-			    no_master, "Lync", NDPI_PROTOCOL_CATEGORY_NETWORK,
-			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),	      /* TCP */
-			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));	      /* UDP */
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VIBER,
 			    no_master,
 			    no_master, "Viber", NDPI_PROTOCOL_CATEGORY_CHAT,
@@ -2717,6 +2712,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
 
   /* FIX */
   init_fix_dissector(ndpi_struct, &a, detection_bitmask);
+  
+  /* NINTENDO */
+  init_nintendo_dissector(ndpi_struct, &a, detection_bitmask);
 
   /*** Put false-positive sensitive protocols at the end ***/
 
@@ -2729,9 +2727,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* AMQP */
   init_amqp_dissector(ndpi_struct, &a, detection_bitmask);
 
-  /* NINTENDO */
-  init_nintendo_dissector(ndpi_struct, &a, detection_bitmask);
-
   /* ----------------------------------------------------------------- */
 
   ndpi_struct->callback_buffer_size = a;
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index 9bcaec941..80848f5ba 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -96,8 +96,8 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
 	    && (((payload[0] & 0xFF) == 0x80) || ((payload[0] & 0xFF) == 0xA0)) /* RTP magic byte[1] */	    
 	    && (payloadType = isValidMSRTPType(payload[1] & 0xFF))) {
     if(payloadType == 1 /* RTP */) {
-      NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "Found MS Lync\n");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MS_LYNC, NDPI_PROTOCOL_UNKNOWN);
+      NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "Found Skype for Business (former MS Lync)\n");
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
     } else /* RTCP */ {
       NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "Found MS RTCP\n");
       ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTCP, NDPI_PROTOCOL_UNKNOWN);
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 1a4c260c0..19de3c437 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -27,7 +27,7 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
   // const u_int8_t *packet_payload = packet->payload;
   u_int32_t payload_len = packet->payload_packet_len;
 
-  
+
   if(flow->host_server_name[0] != '\0')
     return;
 
@@ -52,7 +52,7 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
     }
     NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SKYPE);
     return;
-    
+
     // TCP check
   } else if(packet->tcp != NULL) {
     flow->l4.tcp.skype_packet_id++;
@@ -64,11 +64,15 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
 	      && flow->l4.tcp.seen_syn
 	      && flow->l4.tcp.seen_syn_ack
 	      && flow->l4.tcp.seen_ack) {
-      if((payload_len == 8) || (payload_len == 3)) {
-	//printf("[SKYPE] %u/%u\n", ntohs(packet->tcp->source), ntohs(packet->tcp->dest));
+
+      if((payload_len == 8) || (payload_len == 3) || (payload_len == 17)) {
+	// printf("[SKYPE] payload_len=%u\n", payload_len);
+	/* printf("[SKYPE] %u/%u\n", ntohs(packet->tcp->source), ntohs(packet->tcp->dest)); */
 
 	NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n");
 	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+      } else {
+	// printf("NO [SKYPE] payload_len=%u\n", payload_len);
       }
 
       /* printf("[SKYPE] [id: %u][len: %d]\n", flow->l4.tcp.skype_packet_id, payload_len);  */
@@ -91,7 +95,7 @@ void ndpi_search_skype(struct ndpi_detection_module_struct *ndpi_struct, struct
 }
 
 
-void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) 
+void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
 {
   ndpi_set_bitmask_protocol_detection("Skype", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_SKYPE,
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 37feb2871..d44d9c26e 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -18,7 +18,7 @@
  * GNU Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
  *
  */
 #include "ndpi_protocols.h"
@@ -49,12 +49,11 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 					   const u_int8_t * payload,
 					   const u_int16_t payload_length,
 					   u_int8_t *is_whatsapp,
-					   u_int8_t *is_lync) {
+					   u_int8_t *is_skype) {
   u_int16_t msg_type, msg_len;
   struct stun_packet_header *h = (struct stun_packet_header*)payload;
   u_int8_t can_this_be_whatsapp_voice = 1;
 
-
   if(payload_length < sizeof(struct stun_packet_header)) {
     if(flow->num_stun_udp_pkts > 0) {
       *is_whatsapp = 1;
@@ -80,15 +79,21 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 
     /*
       This can either be the standard RTCP or Ms Lync RTCP that
-      later will becomg Ms Lync RTP. In this case we need to
+      later will become Ms Lync RTP. In this case we need to
       be careful before deciding about the protocol before dissecting the packet
+      
+      MS Lync = Skype
+      https://en.wikipedia.org/wiki/Skype_for_Business
     */
 
     while(offset < payload_length) {
-
       u_int16_t attribute = ntohs(*((u_int16_t*)&payload[offset]));
       u_int16_t len = ntohs(*((u_int16_t*)&payload[offset+2]));
+      u_int16_t x = (len + 4) % 4;
 
+      if(x != 0)
+	len += 4-x;
+      
       switch(attribute) {
       case 0x0008: /* Message Integrity */
       case 0x0020: /* XOR-MAPPED-ADDRESSES */
@@ -101,7 +106,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	   && (payload[offset+5] == 0x00)
 	   && (payload[offset+6] == 0x00)
 	   && (payload[offset+7] == 0x00)) {
-	  *is_lync = 1;
+	  /* Either skype for business or "normal" skype with multiparty call */
+	  *is_skype = 1;
 	  return(NDPI_IS_STUN);
 	}
 	break;
@@ -111,8 +117,9 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	   && (payload[offset+4] == 0x00)
 	   && (payload[offset+5] == 0x00)
 	   && (payload[offset+6] == 0x00)
-	   && (payload[offset+7] == 0x02)) {
-	  *is_lync = 1;
+	   && ((payload[offset+7] == 0x02) || (payload[offset+7] == 0x03))
+	   ) {
+	  *is_skype = 1;
 	  return(NDPI_IS_STUN);
 	}
 	break;
@@ -122,6 +129,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	can_this_be_whatsapp_voice = 0;
 	break;
       }
+     
       offset += len + 4;
     }
     goto udp_stun_found;
@@ -244,7 +252,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
-  u_int8_t is_whatsapp = 0, is_lync = 0;
+  u_int8_t is_whatsapp = 0, is_skype = 0;
 
   NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "search stun.\n");
 
@@ -257,10 +265,10 @@ void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct n
        * improved by checking only the STUN packet of given length */
 
       if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload + 2,
-			     packet->payload_packet_len - 2, &is_whatsapp, &is_lync) == NDPI_IS_STUN) {
-	if(is_lync) {
-	  NDPI_LOG(NDPI_PROTOCOL_MS_LYNC, ndpi_struct, NDPI_LOG_DEBUG, "Found MS Lync\n");
-	  ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_MS_LYNC, flow);
+			     packet->payload_packet_len - 2, &is_whatsapp, &is_skype) == NDPI_IS_STUN) {
+	if(is_skype) {
+	  NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found Skype\n");
+	  ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_SKYPE, flow);
 	} else {
 	  NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found UDP stun.\n");
 	  ndpi_int_stun_add_connection(ndpi_struct,
@@ -272,10 +280,10 @@ void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct n
   }
 
   if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload,
-			 packet->payload_packet_len, &is_whatsapp, &is_lync) == NDPI_IS_STUN) {
-    if(is_lync) {
-      NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "Found MS Lync\n");
-      ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_MS_LYNC, flow);
+			 packet->payload_packet_len, &is_whatsapp, &is_skype) == NDPI_IS_STUN) {
+    if(is_skype) {
+      NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "Found Skype\n");
+      ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_SKYPE, flow);
     } else {
       NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found UDP stun.\n");
       ndpi_int_stun_add_connection(ndpi_struct,
diff --git a/src/lib/protocols/tinc.c b/src/lib/protocols/tinc.c
index a69d18759..cdd330bca 100644
--- a/src/lib/protocols/tinc.c
+++ b/src/lib/protocols/tinc.c
@@ -32,25 +32,25 @@ static void ndpi_check_tinc(struct ndpi_detection_module_struct *ndpi_struct, st
   
   if(packet->udp != NULL) {
     if(ndpi_struct->tinc_cache != NULL) {
-      tinc_cache_entry_t tinc_cache_entry1 = {
+      struct tinc_cache_entry tinc_cache_entry1 = {
         .src_address = packet->iph->saddr,
         .dst_address = packet->iph->daddr,
         .dst_port = packet->udp->dest
       };
 
-      tinc_cache_entry_t tinc_cache_entry2 = {
+      struct tinc_cache_entry tinc_cache_entry2 = {
         .src_address = packet->iph->daddr,
         .dst_address = packet->iph->saddr,
         .dst_port = packet->udp->source
       };
 
-      if( cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry1, sizeof(tinc_cache_entry1)) == CACHE_NO_ERROR ||
-          cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry2, sizeof(tinc_cache_entry2)) == CACHE_NO_ERROR)
-      {
+      if(cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry1, sizeof(tinc_cache_entry1)) == CACHE_NO_ERROR ||
+	 cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry2, sizeof(tinc_cache_entry2)) == CACHE_NO_ERROR) {
+
         cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry1, sizeof(tinc_cache_entry1));
         cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry2, sizeof(tinc_cache_entry2));
 
-        // cache_free(ndpi_struct->tinc_cache);
+	/* cache_free(ndpi_struct->tinc_cache); */
 
         NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "Found tinc udp connection\n");
         ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TINC, NDPI_PROTOCOL_UNKNOWN);
@@ -59,9 +59,7 @@ static void ndpi_check_tinc(struct ndpi_detection_module_struct *ndpi_struct, st
 
     return;
 
-  } 
-  else if(packet->tcp != NULL) {
-
+  } else if(packet->tcp != NULL) {
     if(payload_len == 0) {
       if(packet->tcp->syn == 1 && packet->tcp->ack == 0) {
         flow->tinc_cache_entry.src_address = packet->iph->saddr;
@@ -72,58 +70,56 @@ static void ndpi_check_tinc(struct ndpi_detection_module_struct *ndpi_struct, st
     }
 
     switch(flow->tinc_state) {
-      case 0:
-      case 1:
-        if(payload_len > 6 && memcmp(packet_payload, "0 ", 2) == 0 && packet_payload[2] != ' ') {
-          u_int16_t i = 3;
-          while(i < payload_len && packet_payload[i++] != ' ');
-          if(i+3 == payload_len && memcmp((packet_payload+i), "17\n", 3) == 0) {
-            flow->tinc_state++;
-            return;
-          }
-        }
-        break;
-
-      case 2:
-      case 3:
-        if(payload_len > 11 && memcmp(packet_payload, "1 ", 2) == 0 && packet_payload[2] != ' ') {
-          u_int16_t i = 3;
-          u_int8_t numbers_left = 4;
-          while(numbers_left) {
-            while(packet_payload[i] >= '0' && packet_payload[i] <= '9') {
-              i++;
-            }
-
-            if(packet_payload[i++] == ' ') {
-              numbers_left--;
-            }
-            else break;
-          }
+    case 0:
+    case 1:
+      if(payload_len > 6 && memcmp(packet_payload, "0 ", 2) == 0 && packet_payload[2] != ' ') {
+	u_int16_t i = 3;
+	while(i < payload_len && packet_payload[i++] != ' ');
+	if(i+3 == payload_len && memcmp((packet_payload+i), "17\n", 3) == 0) {
+	  flow->tinc_state++;
+	  return;
+	}
+      }
+      break;
+
+    case 2:
+    case 3:
+      if(payload_len > 11 && memcmp(packet_payload, "1 ", 2) == 0 && packet_payload[2] != ' ') {
+	u_int16_t i = 3;
+	u_int8_t numbers_left = 4;
+	while(numbers_left) {
+	  while(packet_payload[i] >= '0' && packet_payload[i] <= '9') {
+	    i++;
+	  }
+
+	  if(packet_payload[i++] == ' ') {
+	    numbers_left--;
+	  }
+	  else break;
+	}
           
-          if(numbers_left) break;
+	if(numbers_left) break;
           
-          while((packet_payload[i] >= '0' && packet_payload[i] <= '9') ||
-                (packet_payload[i] >= 'A' && packet_payload[i] <= 'Z')) {
-            i++;
-          }
+	while((packet_payload[i] >= '0' && packet_payload[i] <= '9') ||
+	      (packet_payload[i] >= 'A' && packet_payload[i] <= 'Z')) {
+	  i++;
+	}
           
-          if(packet_payload[i] == '\n') {
-            if(++flow->tinc_state > 3) {
-              if(ndpi_struct->tinc_cache == NULL) {
-                ndpi_struct->tinc_cache = cache_new(TINC_CACHE_MAX_SIZE);
-              }
-
-              cache_add(ndpi_struct->tinc_cache, &(flow->tinc_cache_entry), sizeof(flow->tinc_cache_entry));
-
-              NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "Found tinc tcp connection\n");
-              ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TINC, NDPI_PROTOCOL_UNKNOWN);
-            }
-            return;
-          }
-        }
-        break;
+	if(packet_payload[i] == '\n') {
+	  if(++flow->tinc_state > 3) {
+	    if(ndpi_struct->tinc_cache == NULL)
+	      ndpi_struct->tinc_cache = cache_new(TINC_CACHE_MAX_SIZE);              
+
+	    cache_add(ndpi_struct->tinc_cache, &(flow->tinc_cache_entry), sizeof(flow->tinc_cache_entry));
+	    NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "Found tinc tcp connection\n");
+	    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TINC, NDPI_PROTOCOL_UNKNOWN);
+	  }
+	  return;
+	}
+      }
+      break;
       
-      default: break;
+    default: break;
     }
   }
 
@@ -136,8 +132,8 @@ void ndpi_search_tinc(struct ndpi_detection_module_struct* ndpi_struct, struct n
 
   NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "tinc detection...\n");
 
-  if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_TINC) {
-    if (packet->tcp_retransmission == 0) {
+  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_TINC) {
+    if(packet->tcp_retransmission == 0) {
       ndpi_check_tinc(ndpi_struct, flow);
     }
   }
@@ -146,11 +142,11 @@ void ndpi_search_tinc(struct ndpi_detection_module_struct* ndpi_struct, struct n
 void init_tinc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
 {
   ndpi_set_bitmask_protocol_detection("TINC", ndpi_struct, detection_bitmask, *id,
-              NDPI_PROTOCOL_TINC,
-              ndpi_search_tinc,
-              NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP,
-              SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-              ADD_TO_DETECTION_BITMASK);
+				      NDPI_PROTOCOL_TINC,
+				      ndpi_search_tinc,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
 
   *id += 1;
 }
diff --git a/src/lib/third_party/src/libcache.c b/src/lib/third_party/src/libcache.c
index 0a2ce6f6a..af53c9813 100644
--- a/src/lib/third_party/src/libcache.c
+++ b/src/lib/third_party/src/libcache.c
@@ -130,9 +130,10 @@ cache_result cache_add(cache_t cache, void *item, uint32_t item_size) {
 
   if((cache->map)[hash]) {
     cache_entry_map hash_entry_map = cache->map[hash];
+
     while(hash_entry_map) {
       if(item_size == hash_entry_map->entry->item_size &&
-          !memcmp(hash_entry_map->entry->item, item, item_size)) {
+	 !memcmp(hash_entry_map->entry->item, item, item_size)) {
         break;
       }
       
@@ -141,7 +142,6 @@ cache_result cache_add(cache_t cache, void *item, uint32_t item_size) {
 
     if(hash_entry_map) {
       cache_touch_entry(cache, hash_entry_map->entry);
-
       return CACHE_NO_ERROR;
     }
   }
@@ -256,8 +256,7 @@ cache_result cache_remove(cache_t cache, void *item, uint32_t item_size) {
       hash_entry_map = hash_entry_map->next;
     }
 
-    if(hash_entry_map) {
-      
+    if(hash_entry_map) {      
       if(hash_entry_map_prev) {
         hash_entry_map_prev->next = hash_entry_map->next;
       } else {