Wireshark-dev: [Wireshark-dev] [PATCH 10/16] NFS: Do not show NFS4 Close deprecation warning fo

From: Pali Rohár <pali@xxxxxxxxxx>
Date: Fri, 13 Sep 2024 23:08:45 +0200
Show NFS4 deprecation warning from Close about State ID only when the
server returns value different from what it should return according to
protocol specifications.
---
 epan/dissectors/packet-nfs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
index ec5b451cd76e..1d6d49b9b6fe 100644
--- a/epan/dissectors/packet-nfs.c
+++ b/epan/dissectors/packet-nfs.c
@@ -11029,7 +11029,12 @@ dissect_nfs4_response_op(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tr
 
 		case NFS4_OP_CLOSE:
 			ti = proto_tree_add_item(newftree, hf_nfs4_stateid, tvb, offset, 16, ENC_NA);
-			expert_add_info(pinfo, ti, &ei_nfs4_stateid_deprecated);
+			/*
+			 * RFC8881 18.2.4. CLOSE IMPLEMENTATION: The server SHOULD return the invalid special stateid
+			 * (the "other" value is zero and the "seqid" field is NFS4_UINT32_MAX).
+			 */
+			if (memcmp(tvb_get_ptr(tvb, offset, 16), "\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16) != 0)
+				expert_add_info(pinfo, ti, &ei_nfs4_stateid_deprecated);
 			offset += 16;
 			break;
 
-- 
2.20.1