From a156d69ea4ff47160d49b29eae1f32339f197b40 Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Fri, 6 Dec 2024 20:19:28 +0100
Subject: STUN: fix monitoring (#2639)

---
 src/lib/protocols/stun.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'src/lib/protocols/stun.c')

diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 0ead2a0ea..138308082 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -667,6 +667,7 @@ static int keep_extra_dissection(struct ndpi_detection_module_struct *ndpi_struc
    * for the other protocols, we stop after we have all metadata (if enabled)
    * for some specific protocol, we might know that some attributes
    are never used
+   * if monitoring is enabled, keep looking for (S)RTP anyway
 
    **After** extra dissection is ended, we might move to monitoring. Note that:
    * classification doesn't change while in monitoring!
@@ -699,6 +700,11 @@ static int keep_extra_dissection(struct ndpi_detection_module_struct *ndpi_struc
   if(!is_subclassification_real(flow))
     return 1;
 
+  if(is_monitoring_enabled(ndpi_struct, NDPI_PROTOCOL_STUN) &&
+     (flow->detected_protocol_stack[1] != NDPI_PROTOCOL_SRTP &&
+      flow->detected_protocol_stack[1] != NDPI_PROTOCOL_DTLS))
+    return 1;
+
   if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_TELEGRAM_VOIP &&
      ndpi_struct->cfg.stun_peer_address_enabled)
     return 1;
-- 
cgit v1.2.3