Add protocol definitions needed by ipfw-classifyd. Basically they are copied from the ipfw-classifyd pfPort which inherits them from l7-filter project on sf.net.

1 files changed, 20 insertions, 0 deletions

diff --git a/usr/local/share/protocols/tftp.pat b/usr/local/share/protocols/tftp.pat
new file mode 100644
index 0000000..e9f16f7
--- /dev/null
+++ b/usr/local/share/protocols/tftp.pat
@@ -0,0 +1,20 @@
+# TFTP - Trivial File Transfer Protocol - used for bootstrapping - RFC 1350
+# Pattern attributes: marginal veryfast fast
+# Protocol groups: document_retrieval ietf_internet_standard
+# Wiki: http://www.protocolinfo.org/wiki/TFTP
+#
+# usually runs on port 69
+# 
+# This pattern is unconfirmed. 
+
+tftp
+# The first packet from the initiating host should either be a Read Request 
+# or a Write Request.  In the other direction, it should be data packet with 
+# block number one or an ACK with block number zero.  We only attempt to match
+# the initiating host's packets, because the only identifying features of 
+# the responses to them are two byte sequences (which isn't specific enough).
+# (\x01|\x02) = Read Request or Write Request
+# [ -~]* = the file name
+# the rest = netascii|octet|mail (case insensitivity done by the kernel)
+
+^(\x01|\x02)[ -~]*(netascii|octet|mail)