TFTP with blksize option being recognized as NOE

[thomasjwinter]

Describe the bug

TFTP transaction with blksize options is being detected as the NOE protocol.

This is happening because the Optional Acknowledgement tftp packet with the blksize option happens to match the check in the noe disector. I don't know if this is actually intentional as I've never heard of the noe protocol before.

noe.c:

    } else if((packet->payload_packet_len >= 25) &&
	      (packet->payload[0] == 0x00 &&
	       packet->payload[1] == 0x06 &&
	       packet->payload[2] == 0x62 &&
	       packet->payload[3] == 0x6c)) {
      ndpi_int_noe_add_connection(ndpi_struct, flow);
      return;
    }

tftp packet 2:

0x00 0x06 0x62 0x6c
2 byte opcode 0x00 0x06 is Optional Acknowledgement
0x62 0x6c is ascii for 'bl' part of the blksize option string following the opcode

I have submitted a pull request #2074 to improve tftp detection with options but this issue still remains.

Expected behavior

TFTP transaction with blksize options should be detected as TFTP.

Obtained behavior

TFTP transaction with blksize options is being detected as the NOE protocol.

nDPI Environment (please complete the following information):

• OS name: Ubuntu
• OS version: 20.04
• Architecture: x86
• nDPI version or commit hash: 4.6

How to reproduce the reported bug

Reproducible using ndpiReader?

• The reported bug is reproducible using ndpiReader.

If applicable, the used ndpiReader options:

./ndpiReader -i tftp_as_noe.pcap 

Detected protocols:
        TFTP                 packets: 1             bytes: 87            flows: 1            
        NOE                  packets: 139           bytes: 106418        flows: 1        

If your bug is reproducible using a pcap, please attach a pcap file (or a valid link to download it)

Example: tftp_as_noe.pcap

Steps to reproduce the behavior:

1. Run '...'
2. Set '....'
3. Do '....'
4. See error

Additional context

Add any other context about the problem here.

[thomasjwinter]

tftp_as_noe.tar.gz