in src/analysis/nfs_parser.cpp [34:93]
bool NFSParser::parse_data(FilteredDataQueue::Ptr& ptr)
{
using namespace NST::protocols::rpc;
// TODO: refactor and generalize this code
if(ptr->dlen < sizeof(MessageHeader))
{
return false;
}
auto msg = reinterpret_cast<const MessageHeader*>(ptr->data);
switch(msg->type())
{
case MsgType::CALL:
{
if(ptr->dlen < sizeof(CallHeader))
{
return false;
}
auto call = static_cast<const CallHeader*>(msg);
if(RPCValidator::check(call) && (protocols::NFS4::Validator::check(call) ||
protocols::NFS3::Validator::check(call)))
{
Session* session = sessions.get_session(ptr->session, ptr->direction, MsgType::CALL);
if(session)
{
session->save_call_data(call->xid(), std::move(ptr));
}
return true;
}
}
break;
case MsgType::REPLY:
{
if(ptr->dlen < sizeof(ReplyHeader))
{
return false;
}
auto reply = static_cast<const ReplyHeader*>(msg);
if(!RPCValidator::check(reply))
{
return false;
}
Session* session = sessions.get_session(ptr->session, ptr->direction, MsgType::REPLY);
if(session)
{
FilteredDataQueue::Ptr&& call_data = session->get_call_data(reply->xid());
if(call_data)
{
analyze_nfs_procedure(std::move(call_data), std::move(ptr), session);
}
return true;
}
}
}
return false;
}