[prev in list] [next in list] [prev in thread] [next in thread] 

List:       tcpdump-patches
Subject:    tcpdump och NFS
From:       Bjoern Groenvall <bg () sics ! se>
Date:       2001-05-20 10:17:38
[Download RAW message or body]


Hi,

The following patch is written to locate one or more NFS/RPC headers
in a TCP segment (the current code will only look for the first
header).

It also fixes a few bugs related to printing WCC data and adds code to
parse FSINFO and PATHCONF requests.

Cheers,
Björn

-- 
  _     _                                               ,_______________.  
Bjorn Gronvall (Björn Grönvall)                        /_______________/|     
Swedish Institute of Computer Science                  |               ||
PO Box 1263, S-164 29 Kista, Sweden                    | Schroedingers ||
Email: bg@sics.se, Phone +46 -8 633 15 25              |      Cat      |/
Cellular +46 -70 768 06 35, Fax +46 -8 751 72 30       `---------------' 

*** interface.h.ORIG	Wed Apr 11 15:38:37 2001
--- interface.h	Thu Apr 12 17:22:33 2001
***************
*** 218,223 ****
--- 218,224 ----
  extern void llap_print(const u_char *, u_int);
  extern void nfsreply_print(const u_char *, u_int, const u_char *);
  extern void nfsreq_print(const u_char *, u_int, const u_char *);
+ extern int  nfs_tcp_print(const u_char *, const u_char *);
  extern void ns_print(const u_char *, u_int);
  extern void ntp_print(const u_char *, u_int);
  extern void null_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
*** print-tcp.c.ORIG	Wed Apr 11 15:38:37 2001
--- print-tcp.c	Thu Apr 12 17:22:12 2001
***************
*** 272,294 ****
  
  	/*
  	 * If data present and NFS port used, assume NFS.
- 	 * Pass offset of data plus 4 bytes for RPC TCP msg length
- 	 * to NFS print routines.
  	 */
! 	if (!qflag) {
! 		if ((u_char *)tp + 4 + sizeof(struct rpc_msg) <= snapend &&
! 		    dport == NFS_PORT) {
! 			nfsreq_print((u_char *)tp + hlen + 4, length - hlen,
! 				     (u_char *)ip);
  			return;
! 		} else if ((u_char *)tp + 4 + sizeof(struct rpc_msg)
! 			   <= snapend &&
! 			   sport == NFS_PORT) {
! 			nfsreply_print((u_char *)tp + hlen + 4,length-hlen,
! 				       (u_char *)ip);
! 			return;
! 		}
! 	}
  #ifdef INET6
  	if (ip6) {
  		if (ip6->ip6_nxt == IPPROTO_TCP) {
--- 272,286 ----
  
  	/*
  	 * If data present and NFS port used, assume NFS.
  	 */
! 	if (!qflag
! 	    && (dport == NFS_PORT || sport == NFS_PORT)
! 	    && nfs_tcp_print(bp + hlen, bp2)) {
! 		if (!vflag)
  			return;
! 		else
! 			putchar(' ');
! 	} else
  #ifdef INET6
  	if (ip6) {
  		if (ip6->ip6_nxt == IPPROTO_TCP) {
*** print-nfs.c.ORIG	Wed Apr 11 15:38:37 2001
--- print-nfs.c	Thu Apr 12 17:22:54 2001
***************
*** 716,725 ****
--- 716,731 ----
  
  	case NFSPROC_FSINFO:
  		printf(" fsinfo");
+ 		if ((dp = parsereq(rp, length)) != NULL &&
+ 		    parsefh(dp, v3) != NULL)
+ 			return;
  		break;
  
  	case NFSPROC_PATHCONF:
  		printf(" pathconf");
+ 		if ((dp = parsereq(rp, length)) != NULL &&
+ 		    parsefh(dp, v3) != NULL)
+ 			return;
  		break;
  
  	case NFSPROC_COMMIT:
***************
*** 742,747 ****
--- 748,799 ----
  		fputs(" [|nfs]", stdout);
  }
  
+ #ifndef NFS_PROGRAM
+ #define NFS_PROGRAM ((unsigned long)(100003))
+ #endif
+ 
+ int
+ nfs_tcp_print(const u_char *bp, const u_char *bp2)
+ {
+ 	int did_print = 0;
+ 	u_int32_t len;
+ 	struct rpc_msg *rp;
+ 
+  more_rpc_msgs:
+ 	if (!TTEST2(*bp, 4))
+ 		return did_print;
+ 	memcpy(&len, bp, 4);
+ 	len = ntohl(len);
+ 	len &= 0x7fffffff;
+ 
+ 	rp = (struct rpc_msg *)(bp + 4);
+ 	if (TTEST(rp->rm_direction) && TTEST(rp->rm_call.cb_prog)) {
+ 		enum msg_type direction = ntohl(rp->rm_direction);
+ 		if (direction == CALL
+ 		    && ntohl(rp->rm_call.cb_rpcvers) == RPC_MSG_VERSION
+ 		    && ntohl(rp->rm_call.cb_prog) == NFS_PROGRAM) {
+ 			if (did_print)
+ 				putchar('\n');
+ 			else
+ 				did_print = 1;
+ 			nfsreq_print(bp + 4, len, bp2);
+ 			bp = bp + 4 + len;
+ 			goto more_rpc_msgs;
+ 		}
+ 		else if (direction == REPLY /* MSG_ACCEPTED=0, MSG_DENIED=1 */
+ 			 && (ntohl(rp->rm_reply.rp_stat) & 0xfffffffe) == 0) {
+ 			if (did_print)
+ 				putchar('\n');
+ 			else
+ 				did_print = 1;
+ 			nfsreply_print(bp + 4, len, bp2);
+ 			bp = bp + 4 + len;
+ 			goto more_rpc_msgs;
+ 		}
+ 	}
+ 	return did_print;
+ }
+ 
  /*
   * Print out an NFS file handle.
   * We assume packet was not truncated before the end of the
***************
*** 1242,1248 ****
  	if (!ntohl(dp[0]))
  		return (dp + 1);
  	dp++;
! 	TCHECK2(dp, 24);
  	if (verbose > 1) {
  		return parse_wcc_attr(dp);
  	} else {
--- 1294,1300 ----
  	if (!ntohl(dp[0]))
  		return (dp + 1);
  	dp++;
! 	TCHECK(dp[5]);
  	if (verbose > 1) {
  		return parse_wcc_attr(dp);
  	} else {
***************
*** 1549,1556 ****
  						tok2str(nfsv3_writemodes,
  							NULL, ntohl(dp[1])));
  				}
- 				return;
  			}
  		} else {
  			if (parseattrstat(dp, vflag, v3) != 0)
  				return;
--- 1601,1608 ----
  						tok2str(nfsv3_writemodes,
  							NULL, ntohl(dp[1])));
  				}
  			}
+ 			return;
  		} else {
  			if (parseattrstat(dp, vflag, v3) != 0)
  				return;

[prev in list] [next in list] [prev in thread] [next in thread]