Outbound Connections list in TLS section of report showing information for non-TLS connections

[duncangreene]

Describe the bug
The "Outbound Connections" list in the TLS section of the report is reporting connections that have no association with TLS. In the case of the below, one is infact related to IGMP, that operates at layer 3 and has no notion of ports, and the other is general mDNS.

I believe this section of the report is supposed to pertain to outbound connections picked up during the security.tls.v*_*_client tests(?), and according to the below, none were detected.

Expected behavior
Non-TLS related outbound connections would not be reported.

Error logs
outboundconnections.zip

Environment (please provide the following information about your setup):

• Version: 2.1

Additional context
Only modifications from official 2.1 release are as below.

• resources/test_packs/qualification.json (Set tests to excluded/recommended/informational as appropriate)
• resources/devices/device_profile.json (Add custom questions)

[duncangreene]

Also seen on these separate DUTs.

This one had exact same symptoms as above.
outboundconnections2.zip

This one did have some bona fida outbound TLS connections too, which appear to be picked up by the security.tls.v*_*_client tests.
outboundconnections3.zip

Note in the below the multicast addresses above, plus a host of port 123 (NTP) traffic, which is also non-TLS.

I wonder if the listing of "Unknown" under 'Port' warrants investigating/better handling if necessary too, as in the case of IGMP above, there is no notion of ports at all (i.e. it would be more appropriate to say "Not applicable", as opposed to "Unknown"), same goes for the ICMP packet below (presumably represented by the "Unknown" entry above).

[duncangreene]

Just spotted loads in this one too, also a couple of issues with the table formatting.

• Seems to be full width as opposed to auto width.
• Has rolled over onto separate page even though there appears to be plenty of space for the one extra entry that was rolled over.

formattingissues.zip

[jhughesoti]

This is intentional as all outbound connections are evaluated in the TLS module. This section of the report is designed to be comprehensive list of all detected outbound connections regardless of their validity or TLS nature. As you can see, some protocols are already filtered out from compliance testing but are still reported to show what the device is communicating with.

As far as unknown vs not applicable. In the example you provided it makes sense to use not applicable but from a wider context, unknown handles more use cases. While we can deal with some well known protocols, there is no way to guarantee we have every single protocol defined where a port should/shouldn't be available and it also would not account for malformed packets that should have a port but don't. Taking that into account, unknown covers more uses cases and effectively is the same information regardless of the semantic wording of that particular area of the report.

[jboddey]

It sounds like this is understood as intentional behavior - other than issues with table formatting?

[duncangreene]

@jboddey Agreed on the table formatting bug. I've a feeling in the past also that the formatting of the "Outbound Connections" heading made it seem like it was a sub-section of the TLS section of the report too, which added a bit of confusion when seeing those other non-TLS connections in there.

@jboddey @jhughesoti Given this section isn't just related to TLS and extended info for the security.tls.v*_*_client tests, it gives way to #1273 that I've noticed a number of times.

[jhughesoti]

@jboddey Reviewing #1273, it does not appear to be related specifically to outbound connections. I have updated that issue with some details.

[KrystsinaT]

The issue was reported 416692103