Improved TFTP. Dissect Read/Write Request filenames. (#1617)

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

2 files changed, 19 insertions, 2 deletions

diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 74e937138..19fc04759 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1287,6 +1287,10 @@ struct ndpi_flow_struct {
     } ssh;
 
     struct {
+      char filename[128];
+    } tftp;
+
+    struct {
       u_int8_t username_detected:1, username_found:1,
 	password_detected:1, password_found:1,
 	_pad:4;
diff --git a/src/lib/protocols/tftp.c b/src/lib/protocols/tftp.c
index 07f2ca07f..f5aa32e62 100644
--- a/src/lib/protocols/tftp.c
+++ b/src/lib/protocols/tftp.c
@@ -67,9 +67,11 @@ void ndpi_search_tftp(struct ndpi_detection_module_struct
         {
           char const * const possible_modes[] = { "netascii", "octet", "mail" };
           uint8_t mode_found = 0, mode_idx;
-          for(mode_idx = 0; mode_idx < sizeof(possible_modes) / sizeof(possible_modes[0]); ++mode_idx)
+          size_t mode_len;
+
+          for(mode_idx = 0; mode_idx < NDPI_ARRAY_LENGTH(possible_modes); ++mode_idx)
           {
-            size_t const mode_len = strlen(possible_modes[mode_idx]);
+            mode_len = strlen(possible_modes[mode_idx]);
 
             if (packet->payload_packet_len < mode_len + 1 /* mode is a nul terminated string */)
             {
@@ -89,6 +91,17 @@ void ndpi_search_tftp(struct ndpi_detection_module_struct
             return;
           }
 
+          /* Dissect RRQ/WWQ filename. */
+          size_t filename_len = packet->payload_packet_len - 2 /* Opcode */ - mode_len - 1 /* NUL */;
+
+          if (filename_len == 0 || packet->payload[2] == '\0' || ndpi_is_printable_buffer(&packet->payload[2], filename_len - 1) == 0)
+          {
+            ndpi_set_risk(ndpi_struct, flow, NDPI_MALFORMED_PACKET, "Invalid TFTP RR/WR header: Source/Destination file missing");
+          } else {
+            memcpy(flow->protos.tftp.filename, &packet->payload[2], ndpi_min(filename_len, sizeof(flow->protos.tftp.filename) - 1));
+            flow->protos.tftp.filename[filename_len] = '\0';
+          }
+
           /* We have seen enough and do not need any more TFTP packets. */
           NDPI_LOG_INFO(ndpi_struct, "found tftp (RRQ/WWQ)\n");
           ndpi_int_tftp_add_connection(ndpi_struct, flow);