From 7aee856aa063f7861be7e7fe2970ba014391d9bf Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Wed, 9 Mar 2022 22:37:35 +0100 Subject: Extend tests coverage (#1476) Now there is at least one flow under `tests/pcap` for 249 protocols out of the 284 ones supported by nDPI. The 35 protocols without any tests are: * P2P/sharing protocols: DIRECT_DOWNLOAD_LINK, OPENFT, FASTTRACK, EDONKEY, SOPCAST, THUNDER, APPLEJUICE, DIRECTCONNECT, STEALTHNET * games: CSGO, HALFLIFE2, ARMAGETRON, CROSSFIRE, DOFUS, FIESTA, FLORENSIA, GUILDWARS, MAPLESTORY, WORLD_OF_KUNG_FU * voip/streaming: VHUA, ICECAST, SHOUTCAST, TVUPLAYER, TRUPHONE * other: AYIYA, SOAP, TARGUS_GETDATA, RPC, ZMQ, REDIS, VMWARE, NOE, LOTUS_NOTES, EGP, SAP Most of these protocols (expecially the P2P and games ones) have been inherited by OpenDPI and have not been updated since then: even if they are still used, the detection rules might be outdated. However code coverage (of `lib/protocols`) only increases from 65.6% to 68.9%. Improve Citrix, Corba, Fix, Aimini, Megaco, PPStream, SNMP and Some/IP dissection. Treat IPP as a HTTP sub protocol. Fix Cassandra false positives. Remove `NDPI_PROTOCOL_QQLIVE` and `NDPI_PROTOCOL_REMOTE_SCAN`: these protocol ids are defined but they are never used. Remove Collectd support: its code has never been called. If someone is really interested in this protocol, we can re-add it later, updating the dissector. Add decoding of PPI (Per-Packet Information) data link type. --- src/lib/protocols/collectd.c | 54 -------------------------------------------- 1 file changed, 54 deletions(-) delete mode 100644 src/lib/protocols/collectd.c (limited to 'src/lib/protocols/collectd.c') diff --git a/src/lib/protocols/collectd.c b/src/lib/protocols/collectd.c deleted file mode 100644 index f9535ab91..000000000 --- a/src/lib/protocols/collectd.c +++ /dev/null @@ -1,54 +0,0 @@ -/* - * collectd.c - * - * Copyright (C) 2014-22 - ntop.org - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see . - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_COLLECTD - -#include "ndpi_api.h" - - -void ndpi_search_collectd(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - u_int len = 0; - - NDPI_LOG_DBG(ndpi_struct, "search collectd\n"); - - if (packet->udp == NULL) return; - - - while(len < packet->payload_packet_len) { - // u_int16_t elem_type = ntohs(*((u_int16_t*)&packet->payload[len])); - u_int16_t elem_len = ntohs(*((u_int16_t*)&packet->payload[len+2])); - - if (elem_len == 0) break; - - len += elem_len; - } - - if(len == packet->payload_packet_len) { - NDPI_LOG_INFO(ndpi_struct, "found COLLECTD\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_COLLECTD, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); - } else { - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - } -} -- cgit v1.2.3