From b36f0792abf0fb3b4868bd7efccd104a052a04c4 Mon Sep 17 00:00:00 2001
From: Nardi Ivan <nardi.ivan@gmail.com>
Date: Wed, 29 Mar 2023 21:50:43 +0200
Subject: [PATCH] Add another example of custom rules

Add an example where traffic matching the same IP, but different ports
is classified to different protocols.

Close #189
---
 example/protos.txt                            |   3 ++
 ...custom_rules_same-ip_multiple_ports.pcapng | Bin 0 -> 932 bytes
 ...om_rules_same-ip_multiple_ports.pcapng.out |  27 ++++++++++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 tests/pcap/custom_rules_same-ip_multiple_ports.pcapng
 create mode 100644 tests/result/custom_rules_same-ip_multiple_ports.pcapng.out

diff --git a/example/protos.txt b/example/protos.txt
index 2ed5e848c2a..17a68756de8 100644
--- a/example/protos.txt
+++ b/example/protos.txt
@@ -50,6 +50,9 @@ ip:213.75.170.11/32:443@CustomProtocol
 ip:8.248.73.247:443@AmazonPrime
 ip:54.80.47.130@AmazonPrime
 
+ip:3.3.3.3:443@CustomProtocolA
+ip:3.3.3.3:444@CustomProtocolB
+
 #
 # Risk Exceptions
 #
diff --git a/tests/pcap/custom_rules_same-ip_multiple_ports.pcapng b/tests/pcap/custom_rules_same-ip_multiple_ports.pcapng
new file mode 100644
index 0000000000000000000000000000000000000000..9f3f5b8cfd7c185ea1ccde75a7c49964a2972d0b
GIT binary patch
literal 932
zcmd<$<>k7;z`)>Zqb<b<r2j(!6N5Q}XI@Eajz*BCf^&XRsz!*frb4E<u8D=Afp4IK
zb3mwqgMyKsg@L<Am4ZfjW=V!ZaImY1o{=U4GlMvTPi9_eg@UP`p{bsMu9<;udTL&3
zQD!m&3qv%6OKEOFa$<pkMtEjXYH>zlQMRUnv7VWpxq^m!W{E->gk6xBoSm4Snxc?c
z43X6}tSe0_%_}K2GSD+H(KFC4hiOkqEh{cbOv*{s1p0u10puT$UtFMc9FW5Vv^g~|
z-;fh1!wD4U!Q)1tG*~Yikj?>dfS~wyfOx}3Z+0&r8-x`$Fg|EYGI@5LNm`wQ!Igo*
zW^=Ivg9F>Xr3Y3peq{!NdrFME155r*2I*eF^y|Zki$GVfux?>t;^11r-<kvxXJlq(
zhuDE`*R(aWUGUgd0=8=jadvg4<F`vM_2?cvc9nwdT1=c>6Wwv!RRRn{=`A|?xb4zC
z0kX>_5N6j)CB{A4hvNM}W@3injAQuin&f7mgU7CuV7mf{vun<ARJ&M#Tv*!R|G~<@
zy{5y0kwJ#RIUkrpQ;Uif3X1Z}GE;!bH>pw~1(M*I7&sU}YBfUln=?b%>sNPJumIWm
OAmf36705;gAUgm*k=_CT

literal 0
HcmV?d00001

diff --git a/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out
new file mode 100644
index 00000000000..8fe727c0408
--- /dev/null
+++ b/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out
@@ -0,0 +1,27 @@
+Guessed flow protos:	0
+
+DPI Packets (TCP):	2	(1.00 pkts/flow)
+Confidence Unknown          : 2 (flows)
+Num dissector calls: 0 (0.00 diss/flow)
+LRU cache ookla:      0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache zoom:       0/0/0 (insert/search/found)
+LRU cache stun:       0/0/0 (insert/search/found)
+LRU cache tls_cert:   0/0/0 (insert/search/found)
+LRU cache mining:     0/0/0 (insert/search/found)
+LRU cache msteams:    0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/0/0 (insert/search/found)
+Automa host:          0/0 (search/found)
+Automa domain:        0/0 (search/found)
+Automa tls cert:      0/0 (search/found)
+Automa risk mask:     0/0 (search/found)
+Automa common alpns:  0/0 (search/found)
+Patricia risk mask:   4/0 (search/found)
+Patricia risk:        0/0 (search/found)
+Patricia protocols:   2/2 (search/found)
+
+CustomProtocolA	3	222	1
+CustomProtocolB	2	148	1
+
+	1	TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.339/TLS.CustomProtocolA][IP: 339/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	2	TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 340/CustomProtocolB][IP: 340/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]