/* packet-tftp.c

 * Routines for tftp packet dissection

 *

 * Richard Sharpe <rsharpe@ns.aus.com>

 * Craig Newell <CraigN@cheque.uq.edu.au>

 *      RFC2347 TFTP Option Extension

 * Joerg Mayer (see AUTHORS file)

 *      RFC2348 TFTP Blocksize Option

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * Copied from packet-bootp.c

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/* Documentation:

 * RFC 1350: THE TFTP PROTOCOL (REVISION 2)

 * RFC 2090: TFTP Multicast Option

 *           (not yet implemented)

 * RFC 2347: TFTP Option Extension

 * RFC 2348: TFTP Blocksize Option

 * RFC 2349: TFTP Timeout Interval and Transfer Size Options

 *           (not yet implemented)

 * RFC 7440: TFTP Windowsize Option

 *

 * "msftwindow" reverse-engineered from Windows Deployment Services traffic:

 *  - Requested by RRQ (or WRQ?) including "msftwindow" option, with value

 *    "31416" (round(M_PI * 10000)).

 *  - Granted by OACK including "msftwindow" option, with value "27182"

 *    (floor(e * 10000)).

 *  - Each subsequent ACK will include an extra byte carrying the next

 *    windowsize -- the number of DATA blocks expected before another ACK will

 *    be sent.

 */

#include "config.h"

#include <stdlib.h>

#include <epan/packet.h>

#include <epan/conversation.h>

#include <epan/expert.h>

#include <epan/prefs.h>

#include <epan/tap.h>

#include <epan/export_object.h>

#include <epan/proto_data.h>

#include <epan/reassemble.h>

#include "packet-tftp.h"

void proto_register_tftp(void);

/* Things we may want to remember for a whole conversation */

typedef struct _tftp_conv_info_t {

  uint16_t     blocksize;

  const char  *source_file, *destination_file;

  uint32_t     request_frame;

  bool         tsize_requested;

  bool         dynamic_windowing_active;

  uint16_t     windowsize;

  uint16_t     prev_opcode;

  /* Sequence analysis */

  uint32_t     next_block_num;

  bool         blocks_missing;

  unsigned     file_length;

  bool         last_package_available;

  /* When exporting file object, build data here */

  uint32_t     next_tap_block_num;

  uint8_t      *payload_data;

  /* Assembly of fragments */

  uint32_t     reassembly_id;

  uint32_t     last_reassembly_package;

  /* Is the TFTP payload a regular file, or a frame of a higher protocol */

  bool         is_simple_file;

} tftp_conv_info_t;

static int proto_tftp;

static int hf_tftp_opcode;

static int hf_tftp_source_file;

static int hf_tftp_destination_file;

static int hf_tftp_request_frame;

static int hf_tftp_transfer_type;

static int hf_tftp_blocknum;

static int hf_tftp_full_blocknum;

static int hf_tftp_nextwindowsize;

static int hf_tftp_error_code;

static int hf_tftp_error_string;

static int hf_tftp_option_name;

static int hf_tftp_option_value;

static int hf_tftp_data;

static int hf_tftp_fragments;

static int hf_tftp_fragment;

static int hf_tftp_fragment_overlap;

static int hf_tftp_fragment_overlap_conflicts;

static int hf_tftp_fragment_multiple_tails;

static int hf_tftp_fragment_too_long_fragment;

static int hf_tftp_fragment_error;

static int hf_tftp_fragment_count;

static int hf_tftp_reassembled_in;

static int hf_tftp_reassembled_length;

static int hf_tftp_reassembled_data;

static int ett_tftp;

static int ett_tftp_option;

static int ett_tftp_fragment;

static int ett_tftp_fragments;

static expert_field ei_tftp_error;

static expert_field ei_tftp_likely_tsize_probe;

static expert_field ei_tftp_blocksize_range;

static expert_field ei_tftp_blocknum_will_wrap;

static expert_field ei_tftp_windowsize_range;

static expert_field ei_tftp_msftwindow_unrecognized;

static expert_field ei_tftp_windowsize_change;

#define LIKELY_TSIZE_PROBE_KEY 0

#define FULL_BLOCKNUM_KEY 1

#define CONVERSATION_KEY 2

#define WINDOWSIZE_CHANGE_KEY 3

static dissector_handle_t tftp_handle;

static heur_dissector_list_t heur_subdissector_list;

static reassembly_table tftp_reassembly_table;

static const fragment_items tftp_frag_items = {

  &ett_tftp_fragment,

  &ett_tftp_fragments,

  &hf_tftp_fragments,

  &hf_tftp_fragment,

  &hf_tftp_fragment_overlap,

  &hf_tftp_fragment_overlap_conflicts,

  &hf_tftp_fragment_multiple_tails,

  &hf_tftp_fragment_too_long_fragment,

  &hf_tftp_fragment_error,

  &hf_tftp_fragment_count,

  &hf_tftp_reassembled_in,

  &hf_tftp_reassembled_length,

  &hf_tftp_reassembled_data,

  "TFTP fragments"

};

#define UDP_PORT_TFTP_RANGE    "69"

void proto_reg_handoff_tftp (void);

/* User definable values */

static range_t *global_tftp_port_range;

/* minimum length is an ACK message of 4 bytes */

#define MIN_HDR_LEN  4

#define TFTP_RRQ            1

#define TFTP_WRQ            2

#define TFTP_DATA           3

#define TFTP_ACK            4

#define TFTP_ERROR          5

#define TFTP_OACK           6

#define TFTP_INFO         255

#define TFTP_NO_OPCODE 0xFFFF

static const value_string tftp_opcode_vals[] = {

  { TFTP_RRQ,   "Read Request" },

  { TFTP_WRQ,   "Write Request" },

  { TFTP_DATA,  "Data Packet" },

  { TFTP_ACK,   "Acknowledgement" },

  { TFTP_ERROR, "Error Code" },

  { TFTP_OACK,  "Option Acknowledgement" },

  { TFTP_INFO,  "Information (MSDP)" },

  { 0,          NULL }

};

/* Error codes 0 through 7 are defined in RFC 1350. */

#define TFTP_ERR_NOT_DEF      0

#define TFTP_ERR_NOT_FOUND    1

#define TFTP_ERR_NOT_ALLOWED  2

#define TFTP_ERR_DISK_FULL    3

#define TFTP_ERR_BAD_OP       4

#define TFTP_ERR_BAD_ID       5

#define TFTP_ERR_EXISTS       6

#define TFTP_ERR_NO_USER      7

/* Error code 8 is defined in RFC 1782. */

#define TFTP_ERR_OPT_FAIL     8

static const value_string tftp_error_code_vals[] = {

  { TFTP_ERR_NOT_DEF,     "Not defined" },

  { TFTP_ERR_NOT_FOUND,   "File not found" },

  { TFTP_ERR_NOT_ALLOWED, "Access violation" },

  { TFTP_ERR_DISK_FULL,   "Disk full or allocation exceeded" },

  { TFTP_ERR_BAD_OP,      "Illegal TFTP Operation" },

  { TFTP_ERR_BAD_ID,      "Unknown transfer ID" }, /* Does not cause termination */

  { TFTP_ERR_EXISTS,      "File already exists" },

  { TFTP_ERR_NO_USER,     "No such user" },

  { TFTP_ERR_OPT_FAIL,    "Option negotiation failed" },

  { 0, NULL }

};

static int tftp_eo_tap;

/* Preference setting - defragment fragmented TFTP files */

static bool tftp_defragment;

/* Used for TFTP Export Object feature */

typedef struct _tftp_eo_t {

  char     *filename;

  uint32_t payload_len;

  uint8_t  *payload_data;

} tftp_eo_t;

/* Tap function */

static tap_packet_status

tftp_eo_packet(void *tapdata, packet_info *pinfo, epan_dissect_t *edt _U_, const void *data, tap_flags_t flags _U_)

{

  export_object_list_t *object_list = (export_object_list_t *)tapdata;

  const tftp_eo_t *eo_info = (const tftp_eo_t *)data;

  export_object_entry_t *entry;

  /* These values will be freed when the Export Object window is closed. */

  entry = g_new(export_object_entry_t, 1);

  /* Remember which frame had the last block of the file */

  entry->pkt_num = pinfo->num;

  /* Copy filename */

  entry->filename = g_path_get_basename(eo_info->filename);

  /* Free up unnecessary memory */

  g_free(eo_info->filename);

  /* Pass out the contiguous data and length already accumulated. */

  entry->payload_len = eo_info->payload_len;

  entry->payload_data = eo_info->payload_data;

  /* These 2 fields not used */

  entry->hostname = NULL;

  entry->content_type = NULL;

  /* Pass out entry to the GUI */

  object_list->add_entry(object_list->gui_data, entry);

  return TAP_PACKET_REDRAW; /* State changed - window should be redrawn */

}

static void

tftp_dissect_options(tvbuff_t *tvb, packet_info *pinfo, int offset,

                     proto_tree *tree, uint16_t opcode, tftp_conv_info_t *tftp_info)

{

  int         option_len, value_len;

  int         value_offset;

  const char *optionname;

  const char *optionvalue;

  proto_tree *opt_tree;

  while (tvb_offset_exists(tvb, offset)) {

    /* option_len and value_len include the trailing 0 byte */

    option_len = tvb_strsize(tvb, offset);

    value_offset = offset + option_len;

    value_len = tvb_strsize(tvb, value_offset);

    /* use xxx_len-1 to exclude the trailing 0 byte, it would be

       displayed as nonprinting character

       tvb_format_text(pinfo->pool, ) creates a temporary 0-terminated buffer */

    optionname = tvb_format_text(pinfo->pool, tvb, offset, option_len-1);

    optionvalue = tvb_format_text(pinfo->pool, tvb, value_offset, value_len-1);

    opt_tree = proto_tree_add_subtree_format(tree, tvb, offset, option_len+value_len,

                                   ett_tftp_option, NULL, "Option: %s = %s", optionname, optionvalue);

    proto_tree_add_item(opt_tree, hf_tftp_option_name, tvb, offset,

                        option_len, ENC_ASCII);

    proto_tree_add_item(opt_tree, hf_tftp_option_value, tvb, value_offset,

                        value_len, ENC_ASCII);

    offset += option_len + value_len;

    col_append_fstr(pinfo->cinfo, COL_INFO, ", %s=%s",

                    optionname, optionvalue);

    /* Special code to handle individual options */

    if ((opcode == TFTP_RRQ || opcode == TFTP_WRQ)) {

      if (!g_ascii_strcasecmp((const char *)optionname, "msftwindow")) {

        if (g_strcmp0((const char *)optionvalue, "31416")) {

          expert_add_info(pinfo, opt_tree, &ei_tftp_msftwindow_unrecognized);

        }

      } else if (!g_ascii_strcasecmp((const char *)optionname, "windowsize")) {

        int windowsize = (int)strtol((const char *)optionvalue, NULL, 10);

        if (windowsize < 1 || windowsize > 65535) {

          expert_add_info(pinfo, opt_tree, &ei_tftp_windowsize_range);

        }

      } else if (!g_ascii_strcasecmp((const char *)optionname, "tsize") &&

               opcode == TFTP_RRQ) {

        tftp_info->tsize_requested = true;

      }

    } else if (opcode == TFTP_OACK) {

      if (!g_ascii_strcasecmp((const char *)optionname, "blksize")) {

        int blocksize = (int)strtol((const char *)optionvalue, NULL, 10);

        if (blocksize < 8 || blocksize > 65464) {

          expert_add_info(pinfo, opt_tree, &ei_tftp_blocksize_range);

        } else {

          tftp_info->blocksize = blocksize;

        }

      } else if (!g_ascii_strcasecmp((const char *)optionname, "windowsize")) {

        int windowsize = (int)strtol((const char *)optionvalue, NULL, 10);

        if (windowsize < 1 || windowsize > 65535) {

          expert_add_info(pinfo, opt_tree, &ei_tftp_windowsize_range);

        } else {

          tftp_info->windowsize = windowsize;

        }

      } else if (!g_ascii_strcasecmp((const char *)optionname, "msftwindow")) {

        if (!g_strcmp0((const char *)optionvalue, "27182")) {

          tftp_info->dynamic_windowing_active = true;

        } else {

          expert_add_info(pinfo, opt_tree, &ei_tftp_msftwindow_unrecognized);

        }

      }

    }

  }

}

static bool

error_is_likely_tsize_probe(uint16_t error, const tftp_conv_info_t *tftp_info)

{

  /*

   * The TFTP protocol does not define an explicit "close" for non-error

   * conditions, but it is traditionally implemented as an ERROR packet with

   * code zero (not defined) or 8 (option negotiation failed).  It is usually

   * produced when a client did not intend to proceed with a transfer, but was

   * just querying the transfer size ("tsize") through Option Negotiation.  The

   * ERROR packet would be observed directly after an OACK (when the server

   * supports Option Negotiation) or directly after DATA block #1 (when the

   * server does not support Option Negotiation).

   *

   * Inspect the state of the connection to see whether the ERROR packet would

   * most likely just be a request to close the connection after a transfer

   * size query.

   */

  if (error != TFTP_ERR_OPT_FAIL && error != TFTP_ERR_NOT_DEF) {

    return false;

  }

  if (tftp_info->source_file != NULL && tftp_info->tsize_requested) {

    /* There was an earlier RRQ requesting the transfer size. */

    if (tftp_info->prev_opcode == TFTP_OACK) {

      /* Response to RRQ when server supports Option Negotiation. */

      return true;

    }

    if (tftp_info->prev_opcode == TFTP_DATA && tftp_info->next_block_num == 2) {

      /* Response to RRQ when server doesn't support Option Negotiation. */

      return true;

    }

  }

  return false;

}

static uint32_t

determine_full_blocknum(uint16_t blocknum, const tftp_conv_info_t *tftp_info)

{

  /*

   * 'blocknum' might have wrapped around after extending beyond 16 bits.  Use

   * the rest of the conversation state to recover any missing bits.

   */

  int16_t delta = (int16_t)(tftp_info->next_block_num - blocknum);

  if (delta > (int32_t)tftp_info->next_block_num) {

    /* Avoid wrapping back across 0. */

    return blocknum;

  }

  return tftp_info->next_block_num - delta;

}

static void dissect_tftp_message(tftp_conv_info_t *tftp_info,

                                 tvbuff_t *tvb, packet_info *pinfo,

                                 proto_tree *tree)

{

  proto_tree *tftp_tree;

  proto_item *root_ti;

  proto_item *ti;

  proto_item *blocknum_item;

  int         offset    = 0;

  uint16_t    opcode;

  const char  *filename = NULL;

  uint16_t    bytes;

  uint32_t    blocknum;

  unsigned    i1;

  uint16_t    error;

  bool        likely_tsize_probe;

  bool        is_last_package;

  bool        is_fragmented;

  tvbuff_t    *next_tvb;

  fragment_head *tftpfd_head = NULL;

  heur_dtbl_entry_t *hdtbl_entry;

  struct tftpinfo tftpinfo;

  uint32_t    payload_data_offset;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "TFTP");

  /* Protocol root */

  root_ti = proto_tree_add_item(tree, proto_tftp, tvb, offset, -1, ENC_NA);

  tftp_tree = proto_item_add_subtree(root_ti, ett_tftp);

  /* Opcode */

  opcode = tvb_get_ntohs(tvb, offset);

  proto_tree_add_uint(tftp_tree, hf_tftp_opcode, tvb, offset, 2, opcode);

  col_add_str(pinfo->cinfo, COL_INFO,

              val_to_str(pinfo->pool, opcode, tftp_opcode_vals, "Unknown (0x%04x)"));

  offset += 2;

  /* read and write requests contain file names

     for other messages, we add the filenames from the conversation */

  if (tftp_info->request_frame != 0 && opcode != TFTP_RRQ && opcode != TFTP_WRQ) {

    if (tftp_info->source_file) {

      filename = tftp_info->source_file;

    } else if (tftp_info->destination_file) {

      filename = tftp_info->destination_file;

    }

    ti = proto_tree_add_string(tftp_tree, hf_tftp_destination_file, tvb, 0, 0, filename);

    proto_item_set_generated(ti);

    ti = proto_tree_add_uint_format(tftp_tree, hf_tftp_request_frame,

                                    tvb, 0, 0, tftp_info->request_frame,

                                    "%s in frame %u",

                                    tftp_info->source_file ? "Read Request" : "Write Request",

                                    tftp_info->request_frame);

    proto_item_set_generated(ti);

  }

  switch (opcode) {

  case TFTP_RRQ:

    i1 = tvb_strsize(tvb, offset);

    proto_tree_add_item_ret_string(tftp_tree, hf_tftp_source_file,

                        tvb, offset, i1, ENC_ASCII|ENC_NA, wmem_file_scope(), (const uint8_t**)&tftp_info->source_file);

    /* we either have a source file name (for read requests) or a

       destination file name (for write requests)

       when we set one of the names, we clear the other */

    tftp_info->destination_file = NULL;

    tftp_info->request_frame = pinfo->num;

    col_append_fstr(pinfo->cinfo, COL_INFO, ", File: %s",

                    tvb_format_stringzpad(pinfo->pool, tvb, offset, i1));

    offset += i1;

    i1 = tvb_strsize(tvb, offset);

    proto_tree_add_item(tftp_tree, hf_tftp_transfer_type,

                        tvb, offset, i1, ENC_ASCII);

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Transfer type: %s",

                    tvb_format_stringzpad(pinfo->pool, tvb, offset, i1));

    offset += i1;

    tftp_dissect_options(tvb, pinfo,  offset, tftp_tree,

                         opcode, tftp_info);

    break;

  case TFTP_WRQ:

    i1 = tvb_strsize(tvb, offset);

    proto_tree_add_item_ret_string(tftp_tree, hf_tftp_destination_file,

                        tvb, offset, i1, ENC_ASCII|ENC_NA, wmem_file_scope(), (const uint8_t**)&tftp_info->destination_file);

    tftp_info->source_file = NULL; /* see above */

    tftp_info->request_frame = pinfo->num;

    col_append_fstr(pinfo->cinfo, COL_INFO, ", File: %s",

                    tvb_format_stringzpad(pinfo->pool, tvb, offset, i1));

    offset += i1;

    i1 = tvb_strsize(tvb, offset);

    proto_tree_add_item(tftp_tree, hf_tftp_transfer_type,

                        tvb, offset, i1, ENC_ASCII);

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Transfer type: %s",

                    tvb_format_stringzpad(pinfo->pool, tvb, offset, i1));

    offset += i1;

    tftp_dissect_options(tvb, pinfo, offset, tftp_tree,

                         opcode,  tftp_info);

    break;

  case TFTP_INFO:

    tftp_dissect_options(tvb, pinfo, offset, tftp_tree,

                         opcode,  tftp_info);

    break;

  case TFTP_DATA:

    proto_item_set_len(root_ti, 4);

    blocknum_item = proto_tree_add_item_ret_uint(tftp_tree, hf_tftp_blocknum, tvb, offset, 2,

                                                 ENC_BIG_ENDIAN, &blocknum);

    offset += 2;

    if (!PINFO_FD_VISITED(pinfo)) {

      blocknum = determine_full_blocknum(blocknum, tftp_info);

      p_add_proto_data(wmem_file_scope(), pinfo, proto_tftp, FULL_BLOCKNUM_KEY,

                       GUINT_TO_POINTER(blocknum));

    } else {

      blocknum = GPOINTER_TO_UINT(p_get_proto_data(wmem_file_scope(), pinfo,

                                                   proto_tftp, FULL_BLOCKNUM_KEY));

    }

    ti = proto_tree_add_uint(tftp_tree, hf_tftp_full_blocknum, tvb, 0, 0,

                             blocknum);

    proto_item_set_generated(ti);

    bytes = tvb_reported_length_remaining(tvb, offset);

    is_last_package = (bytes < tftp_info->blocksize);

    /* Sequence analysis on blocknums (first pass only) */

    if (!PINFO_FD_VISITED(pinfo)) {

      tftp_info->last_package_available |= is_last_package;

      if (blocknum > tftp_info->next_block_num) {

        /* There is a gap.  Don't try to recover from this. */

        tftp_info->next_block_num = blocknum + 1;

        tftp_info->blocks_missing = true;

        /* TODO: add info to a result table for showing expert info in later passes */

      }

      else if (blocknum == tftp_info->next_block_num) {

        /* OK, inc what we expect next */

        tftp_info->next_block_num++;

        tftp_info->file_length += bytes;

      }

    }

    /* Show number of bytes in this block, and whether it is the end of the file */

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Block: %u%s",

                    blocknum,

                    is_last_package ?" (last)":"" );

    is_fragmented = !(is_last_package && blocknum == 1);

    if (is_fragmented) {

      /* If tftp_defragment is on, this is a fragment,

       * then just add the fragment to the hashtable.

       */

      if (tftp_defragment && (pinfo->num <= tftp_info->last_reassembly_package)) {

        tftpfd_head = fragment_add_seq_check(&tftp_reassembly_table, tvb, offset, pinfo,

                                             tftp_info->reassembly_id, /* id */

                                             NULL,                     /* data */

                                             blocknum - 1,

                                             bytes, !is_last_package);

        next_tvb = process_reassembled_data(tvb, offset, pinfo,

                                            "Reassembled TFTP", tftpfd_head,

                                            &tftp_frag_items, NULL, tftp_tree);

      } else {

        next_tvb = NULL;

      }

    } else {

      next_tvb = tvb_new_subset_remaining(tvb, offset);

    }

    if (next_tvb == NULL) {

      /* Reassembly continues */

      call_data_dissector(tvb_new_subset_remaining(tvb, offset), pinfo, tree);

    } else {

      /* Reassembly completed successfully */

      tftp_info->last_reassembly_package = pinfo->num;

      if (tvb_reported_length(next_tvb) > 0) {

        tftpinfo.filename = filename;

        /* Is the payload recognised by another dissector? */

        if (!dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo,

                                     tree, &hdtbl_entry, &tftpinfo)) {

          call_data_dissector(next_tvb, pinfo, tree);

        } else {

          tftp_info->is_simple_file = false;

        }

      }

    }

    if (blocknum == 0xFFFF && bytes == tftp_info->blocksize) {

       /* There will be a block 0x10000. */

       expert_add_info(pinfo, blocknum_item, &ei_tftp_blocknum_will_wrap);

    }

    /* If Export Object tap is listening, need to accumulate blocks info list

       to send to tap. But we have a number of conditions for this.

       */

    if (have_tap_listener(tftp_eo_tap) &&

        tftp_info->is_simple_file            /* This is a simple file */

        && filename != NULL                  /* There is a file name */

        && !tftp_info->blocks_missing        /* No missing blocks */

        && (tftp_info->last_package_available || !PINFO_FD_VISITED(pinfo))

          /* If this is the first pass (i.e., this is tshark one-pass

           * mode and we're tapping), then we can't know if the last

           * block is present in the file yet. */

    ) {

      if (PINFO_FD_VISITED(pinfo)) {

        if (blocknum == 1 && !tftp_info->payload_data) {

          tftp_info->payload_data = (uint8_t *)g_try_malloc((size_t)tftp_info->file_length);

        }

      } else {

        /* We allocate this in file scope so that it doesn't leak if it

         * turns out we don't have all the blocks so we never send this

         * to the tap.

         */

        tftp_info->payload_data = (uint8_t *)wmem_realloc(wmem_file_scope(), tftp_info->payload_data, (size_t)tftp_info->file_length);

      }

      if (tftp_info->payload_data == NULL ||

          (blocknum != tftp_info->next_tap_block_num)) {

        /* Ignore. Not enough memory or just clicking previous frame */

        break;

      }

      payload_data_offset =

          (tftp_info->next_tap_block_num - 1) * tftp_info->blocksize;

      /* Copy data to its place in the payload_data */

      tvb_memcpy(tvb, tftp_info->payload_data + payload_data_offset, offset,

                 bytes);

      tftp_info->next_tap_block_num++;

      /* Tap export object only when reach end of file */

      if (is_last_package) {

        tftp_eo_t        *eo_info;

        /* Create the eo_info to pass to the listener */

        eo_info = wmem_new(pinfo->pool, tftp_eo_t);

        /* Set filename */

        eo_info->filename = g_strdup(filename);

        /* Set payload */

        eo_info->payload_len = tftp_info->file_length;

        eo_info->payload_data = tftp_info->payload_data;

        /* Send to tap */

        tap_queue_packet(tftp_eo_tap, pinfo, eo_info);

        /* Have sent, so forget payload_data, and only pay attention if we

           get back to the first block again. */

        tftp_info->next_tap_block_num = 1;

        tftp_info->payload_data = NULL;

      }

    }

    break;

  case TFTP_ACK:

    proto_tree_add_item_ret_uint(tftp_tree, hf_tftp_blocknum, tvb, offset, 2,

                                 ENC_BIG_ENDIAN, &blocknum);

    if (!PINFO_FD_VISITED(pinfo)) {

      blocknum = determine_full_blocknum(blocknum, tftp_info);

      p_add_proto_data(wmem_file_scope(), pinfo, proto_tftp, FULL_BLOCKNUM_KEY,

                       GUINT_TO_POINTER(blocknum));

    } else {

      blocknum = GPOINTER_TO_UINT(p_get_proto_data(wmem_file_scope(), pinfo,

                                                   proto_tftp, FULL_BLOCKNUM_KEY));

    }

    ti = proto_tree_add_uint(tftp_tree, hf_tftp_full_blocknum, tvb, 0, 0,

                             blocknum);

    proto_item_set_generated(ti);

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Block: %u",

                    blocknum);

    offset += 2;

    if (tftp_info->dynamic_windowing_active && tvb_bytes_exist(tvb, offset, 1)) {

      bool windowsize_changed;

      uint8_t windowsize = tvb_get_uint8(tvb, offset);

      ti = proto_tree_add_uint(tftp_tree, hf_tftp_nextwindowsize, tvb,

                               offset, 1, windowsize);

      if (!PINFO_FD_VISITED(pinfo)) {

        /*

         * Note changes in window size, but ignore the final ACK which includes

         * an unnecessary (and seemingly bogus) window size.

         */

        windowsize_changed = windowsize != tftp_info->windowsize &&

                             !tftp_info->last_package_available;

        if (windowsize_changed) {

          p_add_proto_data(wmem_file_scope(), pinfo, proto_tftp,

                           WINDOWSIZE_CHANGE_KEY, GUINT_TO_POINTER(1));

          tftp_info->windowsize = windowsize;

        }

      } else {

        windowsize_changed = p_get_proto_data(wmem_file_scope(), pinfo, proto_tftp, WINDOWSIZE_CHANGE_KEY) != NULL;

      }

      if (windowsize_changed) {

        expert_add_info(pinfo, ti, &ei_tftp_windowsize_change);

      }

    }

    break;

  case TFTP_ERROR:

    error = tvb_get_ntohs(tvb, offset);

    proto_tree_add_uint(tftp_tree, hf_tftp_error_code, tvb, offset, 2,

                        error);

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Code: %s",

                    val_to_str(pinfo->pool, error, tftp_error_code_vals, "Unknown (%u)"));

    offset += 2;

    i1 = tvb_strsize(tvb, offset);

    proto_tree_add_item(tftp_tree, hf_tftp_error_string, tvb, offset,

                        i1, ENC_ASCII);

    col_append_fstr(pinfo->cinfo, COL_INFO, ", Message: %s",

                    tvb_format_stringzpad(pinfo->pool, tvb, offset, i1));

    /*

     * If the packet looks like an intentional "close" after a transfer-size

     * probe, don't report it as an error.

     */

    if (!PINFO_FD_VISITED(pinfo)) {

      likely_tsize_probe = error_is_likely_tsize_probe(error, tftp_info);

      if (likely_tsize_probe) {

        p_add_proto_data(wmem_file_scope(), pinfo, proto_tftp, LIKELY_TSIZE_PROBE_KEY, GUINT_TO_POINTER(1));

      }

    } else {

      likely_tsize_probe = GPOINTER_TO_UINT(p_get_proto_data(wmem_file_scope(), pinfo, proto_tftp,

                                                             LIKELY_TSIZE_PROBE_KEY)) != 0;

    }

    expert_add_info(pinfo, tftp_tree, likely_tsize_probe ? &ei_tftp_likely_tsize_probe : &ei_tftp_error);

    break;

  case TFTP_OACK:

    tftp_dissect_options(tvb, pinfo, offset, tftp_tree,

                         opcode, tftp_info);

    break;

  default:

    proto_tree_add_item(tftp_tree, hf_tftp_data, tvb, offset, -1, ENC_NA);

    break;

  }

  tftp_info->prev_opcode = opcode;

}

static tftp_conv_info_t *

tftp_info_for_conversation(conversation_t *conversation)

{

  tftp_conv_info_t *tftp_info;

  tftp_info = (tftp_conv_info_t *)conversation_get_proto_data(conversation, proto_tftp);

  if (!tftp_info) {

    tftp_info = wmem_new(wmem_file_scope(), tftp_conv_info_t);

    tftp_info->blocksize = 512; /* TFTP default block size */

    tftp_info->source_file = NULL;

    tftp_info->destination_file = NULL;

    tftp_info->request_frame = 0;

    tftp_info->tsize_requested = false;

    tftp_info->dynamic_windowing_active = false;

    tftp_info->windowsize = 0;

    tftp_info->prev_opcode = TFTP_NO_OPCODE;

    tftp_info->next_block_num = 1;

    tftp_info->blocks_missing = false;

    tftp_info->file_length = 0;

    tftp_info->last_package_available = false;

    tftp_info->next_tap_block_num = 1;

    tftp_info->payload_data = NULL;

    tftp_info->reassembly_id = conversation->conv_index;

    tftp_info->last_reassembly_package = UINT32_MAX;

    tftp_info->is_simple_file = true;

    conversation_add_proto_data(conversation, proto_tftp, tftp_info);

  }

  return tftp_info;

}

static bool

is_valid_request_body(tvbuff_t *tvb, packet_info *pinfo)

{

  int offset = 2;

  unsigned zeros_counter = 0;

  for (int i = offset; i < (int)tvb_captured_length(tvb); ++i) {

    char c = (char)tvb_get_uint8(tvb, i);

    if (c == '\0') {

      zeros_counter++;

    } else if (!g_ascii_isprint(c)) {

      return false;

    }

  }

  if (zeros_counter % 2 != 0 || zeros_counter == 0)

    return false;

  offset += tvb_strsize(tvb, offset);

  unsigned len = tvb_strsize(tvb, offset);

  const char* mode = tvb_format_stringzpad(pinfo->pool, tvb, offset, len);

  const char* modes[] = {"netascii", "octet", "mail"};

  for(unsigned i = 0; i < array_length(modes); ++i) {

    if (g_ascii_strcasecmp(mode, modes[i]) == 0) return true;

  }

  return false;

}

static bool

is_valid_request(tvbuff_t *tvb, packet_info *pinfo)

{

  if (tvb_captured_length(tvb) < MIN_HDR_LEN)

    return false;

  uint16_t opcode = tvb_get_ntohs(tvb, 0);

  if ((opcode != TFTP_RRQ) && (opcode != TFTP_WRQ))

    return false;

  return is_valid_request_body(tvb, pinfo);

}

static conversation_t* create_tftp_conversation(packet_info *pinfo)

{

  conversation_t* conversation = NULL;

  if (!PINFO_FD_VISITED(pinfo)) {

    /* New read or write request on first pass, so create conversation with client port only */

    /* XXX - We might want to create one conversation for the addresses and

     * port, and have a wmem_tree_t of tftp_conv_info_t, which is the

     * information for a single transfer.

     */

    conversation = conversation_new_strat(pinfo, CONVERSATION_UDP, NO_PORT2);

    conversation_set_dissector(conversation, tftp_handle);

    /* Store conversation in this frame */

    p_add_proto_data(wmem_file_scope(), pinfo, proto_tftp, CONVERSATION_KEY,

                     (void *)conversation);

  } else {

    /* Read or write request, but not first pass, so look up existing conversation */

    conversation = (conversation_t *)p_get_proto_data(wmem_file_scope(), pinfo,

                                                      proto_tftp, CONVERSATION_KEY);

  }

  return conversation;

}

static bool

dissect_tftp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

  if (is_valid_request_body(tvb, pinfo)) {

    conversation_t* conversation = create_tftp_conversation(pinfo);

    dissect_tftp_message(tftp_info_for_conversation(conversation), tvb, pinfo, tree);

    return true;

  }

  return false;

}

static bool

dissect_embeddedtftp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)

{

  /* Used to dissect TFTP packets where one can not assume

     that the TFTP is the only protocol used by that port, and

     that TFTP may not be carried by UDP */

  conversation_t   *conversation;

  uint16_t          opcode;

  /*

   * We need to verify it could be a TFTP message before creating a conversation

   */

  if (tvb_captured_length(tvb) < MIN_HDR_LEN)

    return false;

  opcode = tvb_get_ntohs(tvb, 0);

  switch (opcode) {

    case TFTP_RRQ:

    case TFTP_WRQ:

      /* These 2 opcodes have a NULL-terminated source file name after opcode. Verify */

      if (!is_valid_request_body(tvb, pinfo))

        return false;

     /* Intentionally dropping through here... */

    case TFTP_DATA:

    case TFTP_ACK:

    case TFTP_OACK:

    case TFTP_INFO:

      break;

    case TFTP_ERROR:

      /* for an error, we can verify the error code is legit */

      switch (tvb_get_ntohs(tvb, 2)) {

        case TFTP_ERR_NOT_DEF:

        case TFTP_ERR_NOT_FOUND:

        case TFTP_ERR_NOT_ALLOWED:

        case TFTP_ERR_DISK_FULL:

        case TFTP_ERR_BAD_OP:

        case TFTP_ERR_BAD_ID:

        case TFTP_ERR_EXISTS:

        case TFTP_ERR_NO_USER:

        case TFTP_ERR_OPT_FAIL:

          break;

        default:

          return false;

      }

      break;

    default:

      return false;

  }

  conversation = find_or_create_conversation(pinfo);

  dissect_tftp_message(tftp_info_for_conversation(conversation), tvb, pinfo, tree);

  return true;

}

static int

dissect_tftp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  conversation_t   *conversation = NULL;

  /*

   * The first TFTP packet (which is always a read or write request)

   * goes to the TFTP port; the second one comes from some *other* port,

   * but goes back to the same IP address and port as the ones from which

   * the first packet came; all subsequent packets go between those two

   * IP addresses and ports.

   *

   * If this packet looks like the first of a transfer, we create

   * a conversation, with its address 1/port 1 pair being

   * the source address/port of this packet, its address 2 being

   * the destination address of this packet, and its port 2 being

   * wildcarded, and give it the TFTP dissector as a dissector.

   *

   * By checking if it looks like a request, we handle the case where

   * the same port is reused for another file transfer later in the

   * capture, and also handle the (rare but apparently existing) case

   * where the *other* port is still the TFTP port.

   */

  if (is_valid_request(tvb, pinfo))

  {

    conversation = create_tftp_conversation(pinfo);

  }

  if (conversation == NULL)

  {

    /* Not the initial read or write request */

    /* Look for wildcarded conversation based upon client port, checking

     * both directions (we don't know which side *is* the client port.) */

    if ((conversation = find_conversation_strat(pinfo, CONVERSATION_UDP,

                                     NO_PORT_B, true)) && conversation_get_dissector(conversation, pinfo->num) == tftp_handle) {

#if 0

      /* XXX: While setting the wildcarded port makes sense, if we do that,

       * it's more complicated to find the correct conversation if ports are

       * reused. (find_conversation with full information prefers any exact

       * match, even with an earlier setup frame, to any wildcarded match.)

       * We would want to find the most recent conversations with one wildcard

       * and with both ports, and take the latest of those.

       */

      /* Set other side of conversation (server port) */

      if (pinfo->destport == conversation_key_port1(conversation->key_ptr))

        conversation_set_port2(conversation, pinfo->srcport);

#endif

    } else if ((conversation = find_conversation_strat(pinfo, CONVERSATION_UDP,

                                     NO_PORT_B, false)) && conversation_get_dissector(conversation, pinfo->num) == tftp_handle) {

    } else {

      /* How did we get here? We must have matched one of the TFTP ports

       * and missed the WRQ/RRQ. While it is contrary to the spirit of

       * RFC 1350 for the server not to change ports, there appear to be

       * such servers out there (issue #18122), and since the default port

       * is IANA assigned it doesn't do harm to process it. Note that in

       * that case the conversation won't have the tftp dissector set. */

      conversation = find_conversation_pinfo_strat(pinfo, 0);

      if (conversation == NULL) {

        return 0;

      }

    }

  }

  if (pinfo->num > conversation->last_frame) {

    conversation->last_frame = pinfo->num;

  }

  dissect_tftp_message(tftp_info_for_conversation(conversation), tvb, pinfo, tree);

  return tvb_captured_length(tvb);

}

static void

apply_tftp_prefs(void) {

  global_tftp_port_range = prefs_get_range_value("tftp", "udp.port");

}

void

proto_register_tftp(void)

{

  static hf_register_info hf[] = {

    { &hf_tftp_opcode,

      { "Opcode",             "tftp.opcode",

        FT_UINT16, BASE_DEC, VALS(tftp_opcode_vals), 0x0,

        "TFTP message type", HFILL }},

    { &hf_tftp_source_file,

      { "Source File",        "tftp.source_file",

        FT_STRINGZ, BASE_NONE, NULL, 0x0,

        "TFTP source file name", HFILL }},

    { &hf_tftp_destination_file,

      { "Destination File",   "tftp.destination_file",

        FT_STRINGZ, BASE_NONE, NULL, 0x0,

        "TFTP destination file name", HFILL }},

    { &hf_tftp_request_frame,

      { "Request frame",        "tftp.request_frame",

        FT_FRAMENUM, BASE_NONE, NULL, 0x00,

        "TFTP request is in frame", HFILL }},

    { &hf_tftp_transfer_type,