From 7aee856aa063f7861be7e7fe2970ba014391d9bf Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Wed, 9 Mar 2022 22:37:35 +0100
Subject: Extend tests coverage (#1476)

Now there is at least one flow under `tests/pcap` for 249 protocols out
of the 284 ones supported by nDPI.

The 35 protocols without any tests are:

* P2P/sharing protocols: DIRECT_DOWNLOAD_LINK, OPENFT, FASTTRACK,
EDONKEY, SOPCAST, THUNDER, APPLEJUICE, DIRECTCONNECT, STEALTHNET

* games: CSGO, HALFLIFE2, ARMAGETRON, CROSSFIRE, DOFUS, FIESTA,
FLORENSIA, GUILDWARS, MAPLESTORY, WORLD_OF_KUNG_FU

* voip/streaming: VHUA, ICECAST, SHOUTCAST, TVUPLAYER, TRUPHONE

* other: AYIYA, SOAP, TARGUS_GETDATA, RPC, ZMQ, REDIS, VMWARE, NOE,
LOTUS_NOTES, EGP, SAP

Most of these protocols (expecially the P2P and games ones) have been
inherited by OpenDPI and have not been updated since then: even if they
are still used, the detection rules might be outdated.

However code coverage (of `lib/protocols`) only increases from 65.6% to
68.9%.

Improve Citrix, Corba, Fix, Aimini, Megaco, PPStream, SNMP and Some/IP
dissection.
Treat IPP as a HTTP sub protocol.
Fix Cassandra false positives.

Remove `NDPI_PROTOCOL_QQLIVE` and `NDPI_PROTOCOL_REMOTE_SCAN`:
these protocol ids are defined but they are never used.

Remove Collectd support: its code has never been called. If someone is
really interested in this protocol, we can re-add it later, updating the
dissector.

Add decoding of PPI (Per-Packet Information) data link type.
---
 tests/result/smtps.pcapng.out | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 tests/result/smtps.pcapng.out

(limited to 'tests/result/smtps.pcapng.out')

diff --git a/tests/result/smtps.pcapng.out b/tests/result/smtps.pcapng.out
new file mode 100644
index 000000000..9bd70f9c5
--- /dev/null
+++ b/tests/result/smtps.pcapng.out
@@ -0,0 +1,13 @@
+Guessed flow protos:	0
+
+DPI Packets (TCP):	3	(3.00 pkts/flow)
+Confidence DPI              : 1 (flows)
+
+SMTPS	4	936	1
+
+JA3 Host Stats: 
+		 IP Address                  	 # JA3C     
+	1	 62.43.36.99              	 1      
+
+
+	1	TCP 62.43.36.99:37682 <-> 21.65.95.132:465 [proto: 29/SMTPS][Encrypted][Confidence: DPI][cat: Email/3][2 pkts/637 bytes <-> 2 pkts/299 bytes][Goodput ratio: 81/60][0.47 sec][Risk: ** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extension **][Risk Score: 60][TLSv1.2][JA3C: f17ca639ecdcaa65b4521c49e3515ef9][Firefox][PLAIN TEXT (4223.hostgator.com ESMTP Exim 4)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
-- 
cgit v1.2.3