From bf738f0ddf31add1649b9fc843e4bcd99861f8f8 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 27 Sep 2026 01:26:06 +0000 Subject: [PATCH] eve: stamp the NFS records in the flow direction Txs flushed by the synthetic flow-timeout pseudo packets at flow end carry no wire direction, and the NFS eve log normalized them - and only them - to the flow direction, while a record completed on a real packet kept the packet direction. One flow then logged the same transaction under two directions, which no other app-layer does: SMB, HTTP and DNS all normalize every record. A gapped v3 READ file tx whose last reply never arrives shows it: logged on the response side, unreachable by request-side (dest port 2049) filters. Normalize on the flow direction for every NFS record and drop the FFR conditional. The v3 pins move with it, since the request and its reply now agree on the record. Ticket: #9265. --- doc/userguide/upgrade.rst | 5 +++++ src/output-json-nfs.c | 6 +++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst index 1673d0db8a..8690db1885 100644 --- a/doc/userguide/upgrade.rst +++ b/doc/userguide/upgrade.rst @@ -127,6 +127,11 @@ Logging Changes ``client_hello_done`` is now ``client_hello``). See :doc:`firewall/tls-state-migration` for the old-to-new mapping. +- NFS eve records are now logged in the flow direction, like SMB, HTTP and + DNS records: a record completed on a reply carries the client as + ``src_ip``/``src_port`` where 8.x logged the packet's addresses. Filters + that matched responses on ``src_port 2049`` need ``dest_port 2049`` now. + Removals ~~~~~~~~ diff --git a/src/output-json-nfs.c b/src/output-json-nfs.c index c95a16fa5a..9fd975a245 100644 --- a/src/output-json-nfs.c +++ b/src/output-json-nfs.c @@ -79,7 +79,11 @@ static int JsonNFSLogger(ThreadVars *tv, void *thread_data, if (SCNfsTxLoggingIsFiltered(state, nfstx)) return TM_ECODE_OK; - SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL, thread->ctx); + /* Log in the flow (request) direction, as SMB, HTTP and DNS do. A record + * is stamped once, when the tx ends, so with the packet direction the same + * flow would report its txs in both directions: toclient for the txs a real + * reply completed, toserver for the ones the flow-timeout flush ended. */ + SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "nfs", NULL, thread->ctx); if (unlikely(jb == NULL)) { return TM_ECODE_OK; }