Tiny patch attached from my old tree. this fixes the bug that nfs name snooping did not work for nfs v2. (the patch contains some cosmetic moving aroung of a few blocks of code, the bugfix itself is only three lines in the diff, one line deleted and one line gets an indentation change. see if you can spot it.) mount v1 and v2 which are handled identically should also work.
as for link and symlink. i did not add them tonight. though it should be very very simple to add them using cutnpaste. please have a go at it if you want to. the only thing tricky could be where to place the if() blocks. one of the commands have one name and two handles and the other command have two names and one handle? so they cant be placed exactly where the current if() blocks are. also might be tricky to find the parent fh, but not very. ----- Original Message ----- From: "Dr. Uwe Girlich" Sent: Monday, January 14, 2002 8:56 PM Subject: Re: [Ethereal-dev] nfs : patch to snoop fhandle to filenames > Hello! > > On Sat, Jan 12, 2002 at 11:02:55AM +1100, Ronnie Sahlberg wrote: > > attached is a new patch for nfs name snooping, it fixes the bug where the '/' > > separating path components were sometimes missing. > > > the patch snoops certain nfs and mount packets to track the fhandle to > > filename mapping. > "certain" is the important word here. It works fairly good (SYMLINK is > missing) with NFSv3 but I could not get it to work with nfsv2.pcap.gz from the > web-site. Mount version 1 is missing (that is easy to add) but somehow all the > NFSv2 LOOKUP replies don't result in a file name (packets 23+24). But there > is already a LOOKUP check in the dissect_fhandle() code. Really strange! > > Bye, Uwe > > > _______________________________________________ > Ethereal-dev mailing list > [EMAIL PROTECTED] > http://www.ethereal.com/mailman/listinfo/ethereal-dev
nfs_names.patch
Description: Binary data
