[Thrift] Dissector fails to reassemble PDU on nested structures

Triton Circonflexe said:

Build Information:

Version 3.0.6 (Git commit 908c8e35)

Copyright 1998-2019 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.12.5, with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.60.6, with zlib 1.2.11, without SMI, without c-ares, with Lua 5.1.5, with GnuTLS 3.6.7, with Gcrypt 1.8.5, without Kerberos, without MaxMind DB resolver, without nghttp2, with LZ4, without Snappy, with libxml2 2.9.9, with QtMultimedia, without SBC, without SpanDSP, without bcg729.

Running on Linux 4.19.72-gentoo, with Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz (with SSE4.2), with 16011 MB of physical memory, with locale fr_FR.UTF-8, with libpcap version 1.9.1 (with TPACKET_V3), with GnuTLS 3.6.7, with Gcrypt 1.8.5, with zlib 1.2.11, binary plugins supported (14 loaded). Built using gcc 8.2.0.

Thrift PDU are not correctly reassembled when the packet break happens within nested structures.

Apart from basic types (integers, booleans, strings, enums), Thrift allows several kinds of structures (structs, maps, lists, sets) and the type of the elements/fields of these structures can be any type whether it is some basic type or other structures, resulting in nested structures.

Thrift dissector has some of the necessary bits to reassemble PDU across several packets but when the split happen in some nested structure, the dissection just stops with "Malformed Packet (Exception occurred)" and the end of the PDU in subsequent packets is just considered as non-specific TCP payload until the next Thrift header.

added libwireshark version3.2 labels

Triton Circonflexe said:

Already working on it, need to anonymize properly the example pcap or generate a new one before submitting it.

mentioned in merge request !3171 (closed)

mentioned in merge request !3598 (closed)

mentioned in merge request !3752 (merged)

closed with commit d4de5269

[Thrift] Dissector fails to reassemble PDU on nested structures

Child items ...

Activity