Wireshark-dev: [Wireshark-dev] [PATCH 02/16] NFS: Fix NFSv2/v3 SYMLINK and MKNOD filename snoop

From: Pali Rohár <pali@xxxxxxxxxx>
Date: Fri, 13 Sep 2024 23:08:37 +0200
---
 epan/dissectors/packet-nfs.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
index 59920f2c4bce..b10bf5d4f9b1 100644
--- a/epan/dissectors/packet-nfs.c
+++ b/epan/dissectors/packet-nfs.c
@@ -2742,11 +2742,11 @@ dissect_fhandle(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree,
 	/* are we snooping fh to filenames ?*/
 	if ((!pinfo->fd->visited) && nfs_file_name_snooping) {
 
-		/* NFS v2 LOOKUP, CREATE, MKDIR calls might give us a mapping*/
+		/* NFS v2 LOOKUP, CREATE, MKDIR, SYMLINK calls might give us a mapping*/
 		if ( (civ->prog == 100003)
 		  &&(civ->vers == 2)
 		  &&(!civ->request)
-		  &&((civ->proc == 4)||(civ->proc == 9)||(civ->proc == 14))
+		  &&((civ->proc == 4)||(civ->proc == 9)||(civ->proc == 13)||(civ->proc == 14))
 		) {
 			nfs_name_snoop_add_fh(civ->xid, tvb,
 				offset, 32);
@@ -3078,12 +3078,12 @@ dissect_diropargs(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tre
 
 	/* are we snooping fh to filenames ?*/
 	if ((!pinfo->fd->visited) && nfs_file_name_snooping) {
-		/* v2 LOOKUP, CREATE, MKDIR calls might give us a mapping*/
+		/* v2 LOOKUP, CREATE, MKDIR, SYMLINK calls might give us a mapping*/
 
 		if ( (civ->prog == 100003)
 		  &&(civ->vers == 2)
 		  &&(civ->request)
-		  &&((civ->proc == 4)||(civ->proc == 9)||(civ->proc == 14))
+		  &&((civ->proc == 4)||(civ->proc == 9)||(civ->proc == 13)||(civ->proc == 14))
 		) {
 			nfs_name_snoop_add_name(civ->xid, tvb,
 				offset+36, tvb_get_ntohl(tvb, offset+32),
@@ -3854,12 +3854,12 @@ dissect_nfs3_fh(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree,
 
 	/* are we snooping fh to filenames ?*/
 	if ((!pinfo->fd->visited) && nfs_file_name_snooping) {
-		/* NFS v3 LOOKUP, CREATE, MKDIR
+		/* NFS v3 LOOKUP, CREATE, MKDIR, SYMLINK, MKNOD
 			calls might give us a mapping*/
 		if ( ((civ->prog == 100003)
 		  &&((civ->vers == 3)
 		  &&(!civ->request)
-		  &&((civ->proc == 3)||(civ->proc == 8)||(civ->proc == 9))))
+		  &&((civ->proc == 3)||(civ->proc == 8)||(civ->proc == 9)||(civ->proc == 10)||(civ->proc == 11))))
 		|| civ->vers == 4
 		) {
 			fh_length = tvb_get_ntohl(tvb, offset);
@@ -4474,11 +4474,11 @@ dissect_diropargs3(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tr
 
 	/* are we snooping fh to filenames ?*/
 	if ((!pinfo->fd->visited) && nfs_file_name_snooping) {
-		/* v3 LOOKUP, CREATE, MKDIR calls might give us a mapping*/
+		/* v3 LOOKUP, CREATE, MKDIR, SYMLINK, MKNOD calls might give us a mapping*/
 		if ( (civ->prog == 100003)
 		  &&(civ->vers == 3)
 		  &&(civ->request)
-		  &&((civ->proc == 3)||(civ->proc == 8)||(civ->proc == 9))
+		  &&((civ->proc == 3)||(civ->proc == 8)||(civ->proc == 9)||(civ->proc == 10)||(civ->proc == 11))
 		) {
 			nfs_name_snoop_add_name(civ->xid, tvb,
 				name_offset, name_len,
-- 
2.20.1