Extend tests coverage (#1476)

Now there is at least one flow under `tests/pcap` for 249 protocols out
of the 284 ones supported by nDPI.

The 35 protocols without any tests are:

* P2P/sharing protocols: DIRECT_DOWNLOAD_LINK, OPENFT, FASTTRACK,
EDONKEY, SOPCAST, THUNDER, APPLEJUICE, DIRECTCONNECT, STEALTHNET

* games: CSGO, HALFLIFE2, ARMAGETRON, CROSSFIRE, DOFUS, FIESTA,
FLORENSIA, GUILDWARS, MAPLESTORY, WORLD_OF_KUNG_FU

* voip/streaming: VHUA, ICECAST, SHOUTCAST, TVUPLAYER, TRUPHONE

* other: AYIYA, SOAP, TARGUS_GETDATA, RPC, ZMQ, REDIS, VMWARE, NOE,
LOTUS_NOTES, EGP, SAP

Most of these protocols (expecially the P2P and games ones) have been
inherited by OpenDPI and have not been updated since then: even if they
are still used, the detection rules might be outdated.

However code coverage (of `lib/protocols`) only increases from 65.6% to
68.9%.

Improve Citrix, Corba, Fix, Aimini, Megaco, PPStream, SNMP and Some/IP
dissection.
Treat IPP as a HTTP sub protocol.
Fix Cassandra false positives.

Remove `NDPI_PROTOCOL_QQLIVE` and `NDPI_PROTOCOL_REMOTE_SCAN`:
these protocol ids are defined but they are never used.

Remove Collectd support: its code has never been called. If someone is
really interested in this protocol, we can re-add it later, updating the
dissector.

Add decoding of PPI (Per-Packet Information) data link type.

1 files changed, 18 insertions, 32 deletions

diff --git a/src/lib/protocols/citrix.c b/src/lib/protocols/citrix.c
index 6a9aa25b9..740dfca8b 100644
--- a/src/lib/protocols/citrix.c
+++ b/src/lib/protocols/citrix.c
@@ -35,40 +35,26 @@ static void ndpi_check_citrix(struct ndpi_detection_module_struct *ndpi_struct,
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
   u_int32_t payload_len = packet->payload_packet_len;
 
-  if(packet->tcp != NULL) {
-    flow->l4.tcp.citrix_packet_id++;
-    
-    if((flow->l4.tcp.citrix_packet_id == 3)
-       /* We have seen the 3-way handshake */
-       && flow->l4.tcp.seen_syn
-       && flow->l4.tcp.seen_syn_ack
-       && flow->l4.tcp.seen_ack) {
-      if(payload_len == 6) {
-	char citrix_header[] = { 0x07, 0x07, 0x49, 0x43, 0x41, 0x00 };
-	
-	if(memcmp(packet->payload, citrix_header, sizeof(citrix_header)) == 0) {
-	  NDPI_LOG_INFO(ndpi_struct, "found citrix\n");
-	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CITRIX, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-	}
-	return;
-      } else if(payload_len > 22) {
-	char citrix_header[] = { 0x1a, 0x43, 0x47, 0x50, 0x2f, 0x30, 0x31 };
-	
-	if((memcmp(packet->payload, citrix_header, sizeof(citrix_header)) == 0)
-	   || (ndpi_strnstr((const char *)packet->payload, "Citrix.TcpProxyService", payload_len) != NULL)) {
-	  NDPI_LOG_INFO(ndpi_struct, "found citrix\n");
-	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CITRIX, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-	}
-	return;	
-      }
-      
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    } else if(flow->l4.tcp.citrix_packet_id > 3) {
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+  if(payload_len == 6) {
+    char citrix_header[] = { 0x7F, 0x7F, 0x49, 0x43, 0x41, 0x00 };
+
+    if(memcmp(packet->payload, citrix_header, sizeof(citrix_header)) == 0) {
+      NDPI_LOG_INFO(ndpi_struct, "found citrix\n");
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CITRIX, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+      return;
+    }
+  } else if(payload_len > 22) {
+    char citrix_header[] = { 0x1a, 0x43, 0x47, 0x50, 0x2f, 0x30, 0x31 };
+
+    if((memcmp(packet->payload, citrix_header, sizeof(citrix_header)) == 0)
+       || (ndpi_strnstr((const char *)packet->payload, "Citrix.TcpProxyService", payload_len) != NULL)) {
+      NDPI_LOG_INFO(ndpi_struct, "found citrix\n");
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CITRIX, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+      return;
     }
-    
-    return;
   }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }
 
 void ndpi_search_citrix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)