From a5f0cb7e6c4cfb45666876b79f23f2ec7a56a870 Mon Sep 17 00:00:00 2001 From: Thomas Winter Date: Tue, 29 Aug 2023 13:14:27 +1200 Subject: tftp: check incrementation for DATA and ACK packets The 2 bytes following the opcode for DATA and ACK packets are the block number and this should be incrementing every packet. We should check to see that this is occurring otherwise false matches can occur, eg L2TPv3 over UDP matches the DATA opcode but the next two bytes are always zero. Remove the DATA max block size assumption since this can be false if the blksize option is used to increase it. Fixes #2070 --- src/include/ndpi_typedefs.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/include/ndpi_typedefs.h') diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index d440a9e74..4d4d22161 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -921,6 +921,10 @@ struct ndpi_flow_udp_struct { /* NDPI_PROTOCOL_LINE_CALL */ u_int8_t line_pkts[2]; u_int8_t line_base_cnt[2]; + + /* NDPI_PROTOCOL_TFTP */ + u_int16_t tftp_data_num; + u_int16_t tftp_ack_num; }; /* ************************************************** */ -- cgit v1.2.3