Project

General

Profile

Actions

Bug #9371

open
VJ VJ

nfs: several records incorrectly parsed

Bug #9371: nfs: several records incorrectly parsed

Added by Victor Julien 4 days ago. Updated 4 days ago.

Status:
In Progress
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Two NFS decoding defects affect released versions (verified present in main and main-8.0.x):

- READDIRPLUS replies: entries are parsed with `many0(complete(...))`, so they
decode only when the whole reply is available in one buffer. When the reply is
split across TCP segments the entry list is dropped, and the dirlist chain
(cookie / eof) is not followed, so names and file info for the directory
contents are lost.
- Malformed data: the event is set on the parser state instead of on the
transaction the record creates, so it is reported on every transaction of the
flow rather than the one at fault - or on none, when the record fails before a
transaction exists.

Actions

Also available in: PDF Atom