From 7aee856aa063f7861be7e7fe2970ba014391d9bf Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Wed, 9 Mar 2022 22:37:35 +0100
Subject: Extend tests coverage (#1476)

Now there is at least one flow under `tests/pcap` for 249 protocols out
of the 284 ones supported by nDPI.

The 35 protocols without any tests are:

* P2P/sharing protocols: DIRECT_DOWNLOAD_LINK, OPENFT, FASTTRACK,
EDONKEY, SOPCAST, THUNDER, APPLEJUICE, DIRECTCONNECT, STEALTHNET

* games: CSGO, HALFLIFE2, ARMAGETRON, CROSSFIRE, DOFUS, FIESTA,
FLORENSIA, GUILDWARS, MAPLESTORY, WORLD_OF_KUNG_FU

* voip/streaming: VHUA, ICECAST, SHOUTCAST, TVUPLAYER, TRUPHONE

* other: AYIYA, SOAP, TARGUS_GETDATA, RPC, ZMQ, REDIS, VMWARE, NOE,
LOTUS_NOTES, EGP, SAP

Most of these protocols (expecially the P2P and games ones) have been
inherited by OpenDPI and have not been updated since then: even if they
are still used, the detection rules might be outdated.

However code coverage (of `lib/protocols`) only increases from 65.6% to
68.9%.

Improve Citrix, Corba, Fix, Aimini, Megaco, PPStream, SNMP and Some/IP
dissection.
Treat IPP as a HTTP sub protocol.
Fix Cassandra false positives.

Remove `NDPI_PROTOCOL_QQLIVE` and `NDPI_PROTOCOL_REMOTE_SCAN`:
these protocol ids are defined but they are never used.

Remove Collectd support: its code has never been called. If someone is
really interested in this protocol, we can re-add it later, updating the
dissector.

Add decoding of PPI (Per-Packet Information) data link type.
---
 example/reader_util.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'example/reader_util.c')

diff --git a/example/reader_util.c b/example/reader_util.c
index 49ab00ea3..eff022fe2 100644
--- a/example/reader_util.c
+++ b/example/reader_util.c
@@ -1580,6 +1580,7 @@ int ndpi_is_datalink_supported(int datalink_type) {
   case DLT_LINUX_SLL:
   case DLT_IEEE802_11_RADIO:
   case DLT_RAW:
+  case DLT_PPI:
     return 1;
   default:
     return 0;
@@ -1624,8 +1625,8 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
   ndpi_packet_tunnel tunnel_type = ndpi_no_tunnel;
 
   /* lengths and offsets */
-  u_int32_t eth_offset = 0;
-  u_int16_t radio_len;
+  u_int32_t eth_offset = 0, dlt;
+  u_int16_t radio_len, header_length;
   u_int16_t fc;
   u_int16_t type = 0;
   int wifi_len = 0;
@@ -1787,6 +1788,15 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
     ip_offset = eth_offset;
     break;
 
+  case DLT_PPI:
+    header_length = le16toh(*(u_int16_t *)&packet[eth_offset + 2]);
+    dlt = le32toh(*(u_int32_t *)&packet[eth_offset + 4]);
+    if(dlt != DLT_EN10MB) /* Handle only standard ethernet, for the time being */
+      return(nproto);
+    datalink_type = DLT_EN10MB;
+    eth_offset += header_length;
+    goto datalink_check;
+
   default:
     /*
      * We shoudn't be here, because we already checked that this datalink is supported.
-- 
cgit v1.2.3