Extend tests coverage (#1476)

Now there is at least one flow under `tests/pcap` for 249 protocols out
of the 284 ones supported by nDPI.

The 35 protocols without any tests are:

* P2P/sharing protocols: DIRECT_DOWNLOAD_LINK, OPENFT, FASTTRACK,
EDONKEY, SOPCAST, THUNDER, APPLEJUICE, DIRECTCONNECT, STEALTHNET

* games: CSGO, HALFLIFE2, ARMAGETRON, CROSSFIRE, DOFUS, FIESTA,
FLORENSIA, GUILDWARS, MAPLESTORY, WORLD_OF_KUNG_FU

* voip/streaming: VHUA, ICECAST, SHOUTCAST, TVUPLAYER, TRUPHONE

* other: AYIYA, SOAP, TARGUS_GETDATA, RPC, ZMQ, REDIS, VMWARE, NOE,
LOTUS_NOTES, EGP, SAP

Most of these protocols (expecially the P2P and games ones) have been
inherited by OpenDPI and have not been updated since then: even if they
are still used, the detection rules might be outdated.

However code coverage (of `lib/protocols`) only increases from 65.6% to
68.9%.

Improve Citrix, Corba, Fix, Aimini, Megaco, PPStream, SNMP and Some/IP
dissection.
Treat IPP as a HTTP sub protocol.
Fix Cassandra false positives.

Remove `NDPI_PROTOCOL_QQLIVE` and `NDPI_PROTOCOL_REMOTE_SCAN`:
these protocol ids are defined but they are never used.

Remove Collectd support: its code has never been called. If someone is
really interested in this protocol, we can re-add it later, updating the
dissector.

Add decoding of PPI (Per-Packet Information) data link type.

1 files changed, 26 insertions, 14 deletions

diff --git a/src/lib/protocols/lisp.c b/src/lib/protocols/lisp.c
index 403355772..a1a2dafbb 100644
--- a/src/lib/protocols/lisp.c
+++ b/src/lib/protocols/lisp.c
@@ -24,8 +24,8 @@
 
 #include "ndpi_api.h"
 
-#define LISP_PORT  4341
-#define LISP_PORT1 4342
+#define LISP_PORT  4341 /* Only UDP */
+#define LISP_PORT1 4342 /* TCP and UDP */
 
 static void ndpi_int_lisp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
 					    struct ndpi_flow_struct *flow,
@@ -39,23 +39,35 @@ static void ndpi_check_lisp(struct ndpi_detection_module_struct *ndpi_struct, st
 {
 
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+  u_int16_t lisp_port1 = htons(LISP_PORT1);
+  u_int16_t lisp_port = htons(LISP_PORT);
 
   if(packet->udp != NULL) {
-
-    u_int16_t lisp_port = htons(LISP_PORT);
-    u_int16_t lisp_port1 = htons(LISP_PORT1);
-    
-    if(((packet->udp->source == lisp_port)
-       && (packet->udp->dest == lisp_port)) || 
-	((packet->udp->source == lisp_port1)
-       && (packet->udp->dest == lisp_port1)) ) {
-     
+    if((packet->udp->source == lisp_port && packet->udp->dest == lisp_port) ||
+       (packet->udp->source == lisp_port1 && packet->udp->dest == lisp_port1)) {
+      NDPI_LOG_INFO(ndpi_struct, "found lisp\n");
+      ndpi_int_lisp_add_connection(ndpi_struct, flow, 0);
+      return;
+    }
+  } else {
+    /* See draft-kouvelas-lisp-map-server-reliable-transport-07 */
+    if(packet->tcp->source == lisp_port1 ||
+       packet->tcp->dest == lisp_port1) {
+      if(packet->payload_packet_len >= 8) {
+        u_int16_t msg_len = ntohs(*(u_int16_t *)&packet->payload[2]);
+	if(msg_len >= packet->payload_packet_len &&
+	   /* End marker: we don't handle fragmented messages */
+	   packet->payload[packet->payload_packet_len - 1] == 0xE9 &&
+	   packet->payload[packet->payload_packet_len - 2] == 0xAD &&
+	   packet->payload[packet->payload_packet_len - 3] == 0xAC &&
+	   packet->payload[packet->payload_packet_len - 4] == 0x9F) {
 	  NDPI_LOG_INFO(ndpi_struct, "found lisp\n");
 	  ndpi_int_lisp_add_connection(ndpi_struct, flow, 0);
-	  return;
-
+          return;
+	}
       }
     }
+  }
 
   NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }
@@ -78,7 +90,7 @@ void init_lisp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
   ndpi_set_bitmask_protocol_detection("LISP", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_LISP,
 				      ndpi_search_lisp,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);
   *id += 1;