nfs: add support for v4.2 operations and error codes (#7397)

* nfs: add support for v4.2 operations and error codes

NFSv4.2 (rfc7862) is a published standard since Nov. 2016 and
supported by various nfs servers and clients.

This change is adding operation and status codes defined by
v4.2 spec.

* packetbeat: add basic test for NFSv4.2 operations

This is a basic test to verify NFsv4.2 support. Due to lack of server
and client that supports full set of v4.2 operations, only one
operation is added.

* packetbeat: add test case for NFSv4.2 CLONE operation

Signed-off-by: Tigran Mkrtchyan <[email protected]>

packetbeat/protos/nfs/nfs4.go

@@ -76,6 +76,19 @@ const (
 	opWantDelegation     = 56
 	opDestroyClientid    = 57
 	opReclaimComplete    = 58
+	opAllocate           = 59
+	opCopy               = 60
+	opCopyNotify         = 61
+	opDeallocate         = 62
+	opIoAdvise           = 63
+	opLayoutError        = 64
+	opLayoutStats        = 65
+	opOffloadCancel      = 66
+	opOffloadStatus      = 67
+	opReadPlus           = 68
+	opSeek               = 69
+	opWriteSame          = 70
+	opClone              = 71
 	opIllegal            = 10044
 )
 
@@ -136,6 +149,19 @@ var nfsOpnum4 = map[int]string{
 	56:    "WANT_DELEGATION",
 	57:    "DESTROY_CLIENTID",
 	58:    "RECLAIM_COMPLETE",
+	59:    "ALLOCATE",
+	60:    "COPY",
+	61:    "COPY_NOTIFY",
+	62:    "DEALLOCATE",
+	63:    "IO_ADVISE",
+	64:    "LAYOUTERROR",
+	65:    "LAYOUTSTATS",
+	66:    "OFFLOAD_CANCEL",
+	67:    "OFFLOAD_STATUS",
+	68:    "READ_PLUS",
+	69:    "SEEK",
+	70:    "WRITE_SAME",
+	71:    "CLONE",
 	10044: "ILLEGAL",
 }
 
@@ -261,7 +287,20 @@ func (nfs *nfs) findV4MainOpcode(xdr *xdr) string {
 			opSetSsv,
 			opTestStateid,
 			opWantDelegation,
-			opWrite:
+			opWrite,
+			opAllocate,
+			opCopy,
+			opCopyNotify,
+			opDeallocate,
+			opIoAdvise,
+			opLayoutError,
+			opLayoutStats,
+			opOffloadCancel,
+			opOffloadStatus,
+			opReadPlus,
+			opSeek,
+			opWriteSame,
+			opClone:
 
 			found = true
 		default:

packetbeat/protos/nfs/nfs_status.go

@@ -126,4 +126,12 @@ var nfsStatus = map[int]string{
 	10084: "NFSERR_DIRDELEG_UNAVAIL",
 	10085: "NFSERR_REJECT_DELEG",
 	10086: "NFSERR_RETURNCONFLICT",
+	10087: "NFS4ERR_DELEG_REVOKED",
+	10088: "NFS4ERR_PARTNER_NOTSUPP",
+	10089: "NFS4ERR_PARTNER_NO_AUTH",
+	10090: "NFS4ERR_UNION_NOTSUPP",
+	10091: "NFS4ERR_OFFLOAD_DENIED",
+	10092: "NFS4ERR_WRONG_LFS",
+	10093: "NFS4ERR_BADLABEL",
+	10094: "NFS4ERR_OFFLOAD_NO_REQS",
 }

packetbeat/tests/system/test_0061_nfs.py

@@ -73,3 +73,36 @@ def test_first_class_op(self):
         o = objs[0]
 
         assert o["nfs.opcode"] == "CLOSE"
+
+    def test_first_class_op_v42(self):
+        """
+        Should correctly detect first-class nfs v4.2 opration in a middle of
+        compound call
+        """
+        self.render_config_template(
+            nfs_ports=[2049],
+        )
+        self.run_packetbeat(pcap="nfsv42_layoutstats.pcap")
+
+        objs = self.read_output()
+        assert len(objs) == 1
+        o = objs[0]
+
+        assert o["nfs.opcode"] == "LAYOUTSTATS"
+
+    def test_clone_notsupp_v42(self):
+        """
+        Should correctly detect first-class nfs v4.2 opration in a middle of
+        compound call and corresponding error code
+        """
+        self.render_config_template(
+            nfs_ports=[2049],
+        )
+        self.run_packetbeat(pcap="nfsv42_clone.pcap")
+
+        objs = self.read_output()
+        assert len(objs) == 1
+        o = objs[0]
+
+        assert o["nfs.opcode"] == "CLONE"
+        assert o["nfs.status"] == "NFSERR_NOTSUPP"