now i found that nfs kernel use 0x40000000 as callback program number.
the CREATE_SESSION and SETCLIENTID use 0x40000000 as callback program number,
and they didn't change it.
but i found that i use wireshark to decode nfsv4 callback procedures, it didn't
decode them if the wireshark or tcpdump didn't caught CREATE_SESSION and SETCLIENTID
packets before.
Signed-off-by: Fan Chaoting <[email protected]>
---
epan/dissectors/packet-nfs.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
index 63d1019..7b5ec88 100644
--- a/epan/dissectors/packet-nfs.c
+++ b/epan/dissectors/packet-nfs.c
@@ -7979,10 +7979,7 @@ dissect_nfs_cb_client4(tvbuff_t *tvb, int offset, proto_tree *tree)
{
proto_tree *cb_location = NULL;
proto_item *fitem = NULL;
- int cbprog;
- cbprog = tvb_get_ntohl(tvb, offset);
- reg_callback(cbprog);
offset = dissect_rpc_uint32(tvb, tree, hf_nfs_cb_program, offset);
fitem = proto_tree_add_text(tree, tvb, offset, 0, "cb_location");
@@ -8991,7 +8988,6 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
proto_tree *ftree = NULL;
proto_tree *newftree = NULL;
guint32 string_length;
- int cbprog;
const char *name = NULL, *source_name = NULL, *dest_name=NULL;
const char *opname=NULL;
guint32 last_fh_hash=0;
@@ -9012,6 +9008,10 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
"Operations (count: %u)", ops);
offset += 4;
+ /*Now the nfs use '0x40000000' as callback's program number.*/
+#define CB_PROG 0x40000000
+ reg_callback(CB_PROG);
+
#define MAX_NFSV4_OPS 128
if (ops > MAX_NFSV4_OPS) {
@@ -9469,8 +9469,6 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
offset = dissect_nfs_create_session_flags(tvb, offset, newftree, hf_nfs_create_session_flags_csa);
offset = dissect_rpc_chanattrs4(tvb, offset, newftree, "csa_fore_chan_attrs");
offset = dissect_rpc_chanattrs4(tvb, offset, newftree, "csa_back_chan_attrs");
- cbprog = tvb_get_ntohl(tvb, offset);
- reg_callback(cbprog);
offset = dissect_rpc_uint32(tvb, newftree, hf_nfs_cb_program, offset);
offset = dissect_rpc_secparms4(tvb, offset, newftree);
break;
--
1.7.10.1
On Fri, Jan 11, 2013 at 05:44:10PM +0800, fanchaoting wrote:
> now i found that nfs kernel use 0x40000000 as callback program number.
> the CREATE_SESSION and SETCLIENTID use 0x40000000 as callback program number,
> and they didn't change it.
>
> but i found that i use wireshark to decode nfsv4 callback procedures, it didn't
> decode them if the wireshark or tcpdump didn't caught CREATE_SESSION and SETCLIENTID
> packets before.
No, this change is incorrect.
It may be true that the current linux client always uses that program
number, but the protocol does allow the client to choose any program
number it wants, and I would not be surprised if other clients use
something different.
There might be some other heuristic we could use to find the callbacks
in the case we didn't capture CREATE_SESSION or SETCLIENTID--maybe it
would be OK to just guess that 4 is the right number in that case--but
we must not ignore the provided cb program in the case where we do see
it.
--b.
>
> Signed-off-by: Fan Chaoting <[email protected]>
>
> ---
> epan/dissectors/packet-nfs.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)
>
> diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
> index 63d1019..7b5ec88 100644
> --- a/epan/dissectors/packet-nfs.c
> +++ b/epan/dissectors/packet-nfs.c
> @@ -7979,10 +7979,7 @@ dissect_nfs_cb_client4(tvbuff_t *tvb, int offset, proto_tree *tree)
> {
> proto_tree *cb_location = NULL;
> proto_item *fitem = NULL;
> - int cbprog;
>
> - cbprog = tvb_get_ntohl(tvb, offset);
> - reg_callback(cbprog);
> offset = dissect_rpc_uint32(tvb, tree, hf_nfs_cb_program, offset);
> fitem = proto_tree_add_text(tree, tvb, offset, 0, "cb_location");
>
> @@ -8991,7 +8988,6 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
> proto_tree *ftree = NULL;
> proto_tree *newftree = NULL;
> guint32 string_length;
> - int cbprog;
> const char *name = NULL, *source_name = NULL, *dest_name=NULL;
> const char *opname=NULL;
> guint32 last_fh_hash=0;
> @@ -9012,6 +9008,10 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
> "Operations (count: %u)", ops);
> offset += 4;
>
> + /*Now the nfs use '0x40000000' as callback's program number.*/
> +#define CB_PROG 0x40000000
> + reg_callback(CB_PROG);
> +
> #define MAX_NFSV4_OPS 128
>
> if (ops > MAX_NFSV4_OPS) {
> @@ -9469,8 +9469,6 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
> offset = dissect_nfs_create_session_flags(tvb, offset, newftree, hf_nfs_create_session_flags_csa);
> offset = dissect_rpc_chanattrs4(tvb, offset, newftree, "csa_fore_chan_attrs");
> offset = dissect_rpc_chanattrs4(tvb, offset, newftree, "csa_back_chan_attrs");
> - cbprog = tvb_get_ntohl(tvb, offset);
> - reg_callback(cbprog);
> offset = dissect_rpc_uint32(tvb, newftree, hf_nfs_cb_program, offset);
> offset = dissect_rpc_secparms4(tvb, offset, newftree);
> break;
> --
> 1.7.10.1
J. Bruce Fields 写道:
> On Fri, Jan 11, 2013 at 05:44:10PM +0800, fanchaoting wrote:
>> now i found that nfs kernel use 0x40000000 as callback program number.
>> the CREATE_SESSION and SETCLIENTID use 0x40000000 as callback program number,
>> and they didn't change it.
>>
>> but i found that i use wireshark to decode nfsv4 callback procedures, it didn't
>> decode them if the wireshark or tcpdump didn't caught CREATE_SESSION and SETCLIENTID
>> packets before.
>
> No, this change is incorrect.
>
> It may be true that the current linux client always uses that program
> number, but the protocol does allow the client to choose any program
> number it wants, and I would not be surprised if other clients use
> something different.
>
> There might be some other heuristic we could use to find the callbacks
> in the case we didn't capture CREATE_SESSION or SETCLIENTID--maybe it
> would be OK to just guess that 4 is the right number in that case--but
> we must not ignore the provided cb program in the case where we do see
> it.
>
thanks , but i think maybe it have some other ways to slove this problem.
> --b.
>
>> Signed-off-by: Fan Chaoting <[email protected]>
>>
>> ---
>> epan/dissectors/packet-nfs.c | 10 ++++------
>> 1 file changed, 4 insertions(+), 6 deletions(-)
>>
>> diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
>> index 63d1019..7b5ec88 100644
>> --- a/epan/dissectors/packet-nfs.c
>> +++ b/epan/dissectors/packet-nfs.c
>> @@ -7979,10 +7979,7 @@ dissect_nfs_cb_client4(tvbuff_t *tvb, int offset, proto_tree *tree)
>> {
>> proto_tree *cb_location = NULL;
>> proto_item *fitem = NULL;
>> - int cbprog;
>>
>> - cbprog = tvb_get_ntohl(tvb, offset);
>> - reg_callback(cbprog);
>> offset = dissect_rpc_uint32(tvb, tree, hf_nfs_cb_program, offset);
>> fitem = proto_tree_add_text(tree, tvb, offset, 0, "cb_location");
>>
>> @@ -8991,7 +8988,6 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
>> proto_tree *ftree = NULL;
>> proto_tree *newftree = NULL;
>> guint32 string_length;
>> - int cbprog;
>> const char *name = NULL, *source_name = NULL, *dest_name=NULL;
>> const char *opname=NULL;
>> guint32 last_fh_hash=0;
>> @@ -9012,6 +9008,10 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
>> "Operations (count: %u)", ops);
>> offset += 4;
>>
>> + /*Now the nfs use '0x40000000' as callback's program number.*/
>> +#define CB_PROG 0x40000000
>> + reg_callback(CB_PROG);
>> +
>> #define MAX_NFSV4_OPS 128
>>
>> if (ops > MAX_NFSV4_OPS) {
>> @@ -9469,8 +9469,6 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
>> offset = dissect_nfs_create_session_flags(tvb, offset, newftree, hf_nfs_create_session_flags_csa);
>> offset = dissect_rpc_chanattrs4(tvb, offset, newftree, "csa_fore_chan_attrs");
>> offset = dissect_rpc_chanattrs4(tvb, offset, newftree, "csa_back_chan_attrs");
>> - cbprog = tvb_get_ntohl(tvb, offset);
>> - reg_callback(cbprog);
>> offset = dissect_rpc_uint32(tvb, newftree, hf_nfs_cb_program, offset);
>> offset = dissect_rpc_secparms4(tvb, offset, newftree);
>> break;
>> --
>> 1.7.10.1
>
>
>
>