Extend tests coverage (#1476)

Now there is at least one flow under `tests/pcap` for 249 protocols out
of the 284 ones supported by nDPI.

The 35 protocols without any tests are:

* P2P/sharing protocols: DIRECT_DOWNLOAD_LINK, OPENFT, FASTTRACK,
EDONKEY, SOPCAST, THUNDER, APPLEJUICE, DIRECTCONNECT, STEALTHNET

* games: CSGO, HALFLIFE2, ARMAGETRON, CROSSFIRE, DOFUS, FIESTA,
FLORENSIA, GUILDWARS, MAPLESTORY, WORLD_OF_KUNG_FU

* voip/streaming: VHUA, ICECAST, SHOUTCAST, TVUPLAYER, TRUPHONE

* other: AYIYA, SOAP, TARGUS_GETDATA, RPC, ZMQ, REDIS, VMWARE, NOE,
LOTUS_NOTES, EGP, SAP

Most of these protocols (expecially the P2P and games ones) have been
inherited by OpenDPI and have not been updated since then: even if they
are still used, the detection rules might be outdated.

However code coverage (of `lib/protocols`) only increases from 65.6% to
68.9%.

Improve Citrix, Corba, Fix, Aimini, Megaco, PPStream, SNMP and Some/IP
dissection.
Treat IPP as a HTTP sub protocol.
Fix Cassandra false positives.

Remove `NDPI_PROTOCOL_QQLIVE` and `NDPI_PROTOCOL_REMOTE_SCAN`:
these protocol ids are defined but they are never used.

Remove Collectd support: its code has never been called. If someone is
really interested in this protocol, we can re-add it later, updating the
dissector.

Add decoding of PPI (Per-Packet Information) data link type.

1 files changed, 2 insertions, 23 deletions

diff --git a/src/lib/protocols/someip.c b/src/lib/protocols/someip.c
index 50a823ec0..c99e8d27c 100644
--- a/src/lib/protocols/someip.c
+++ b/src/lib/protocols/someip.c
@@ -71,12 +71,6 @@ enum MAGIC_COOKIE_CONSTANTS{
   MC_INTERFACE_VERSION = 0x01
 };
 
-enum DEFAULT_PROTOCOL_PORTS{
-  PORT_DEFAULT_CLIENT = 30491,
-  PORT_DEFAULT_SERVER = 30501,
-  PORT_DEFAULT_SD = 30490
-};
-
 /**
  * Entry point when protocol is identified.
  */
@@ -151,6 +145,7 @@ void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct,
   u_int8_t interface_version = (packet->payload[13]);
 
   u_int8_t message_type = (u_int8_t) (packet->payload[14]);
+  message_type &= (~0x20); /* Clear TP  bit */
   NDPI_LOG_DBG2(ndpi_struct,"====>>>> SOME/IP message type: [%d]\n",message_type);
 
   if ((message_type != SOMEIP_REQUEST) && (message_type != SOMEIP_REQUEST_NO_RETURN) && (message_type != SOMEIP_NOTIFICATION) && (message_type != SOMEIP_REQUEST_ACK) && 
@@ -201,23 +196,7 @@ void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct,
     NDPI_LOG_DBG2(ndpi_struct, "SOME/IP-SD currently not supported [%d]\n", message_type);
   }
 
-  //Filtering by port. 
-  //This check is NOT a 100% thing - these ports are mentioned in the documentation but the documentation also states they haven't been approved by IANA yet, and that the user is free to use different ports.
-  //This is is PURELY for demo purposes and the rest of the check must be filled in later on!
-  if (flow->l4_proto == IPPROTO_UDP){
-    if ((packet->udp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SERVER)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SD))) {
-      ndpi_int_someip_add_connection(ndpi_struct, flow);
-      return;
-    }
-  }
-  if (flow->l4_proto == IPPROTO_TCP){
-    if ((packet->tcp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->tcp->dest == ntohs(PORT_DEFAULT_SERVER))) {
-      ndpi_int_someip_add_connection(ndpi_struct, flow);
-      return;
-    }
-  }
-
-  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+  ndpi_int_someip_add_connection(ndpi_struct, flow);
 }
 /**
  * Entry point for the ndpi library