Actions
Bug #9371
open
VJ
VJ
nfs: several records incorrectly parsed
Bug #9371:
nfs: several records incorrectly parsed
Affected Versions:
Effort:
Difficulty:
Label:
Description
Two NFS decoding defects affect released versions (verified present in main and main-8.0.x):
- READDIRPLUS replies: entries are parsed with `many0(complete(...))`, so they
decode only when the whole reply is available in one buffer. When the reply is
split across TCP segments the entry list is dropped, and the dirlist chain
(cookie / eof) is not followed, so names and file info for the directory
contents are lost.
- Malformed data: the event is set on the parser state instead of on the
transaction the record creates, so it is reported on every transaction of the
flow rather than the one at fault - or on none, when the record fails before a
transaction exists.
Actions