The Tcpdump Group git mirrors - tcpdump/blob - print-resp.c

   1 /*
   2  * Copyright (c) 2015 The TCPDUMP project
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  15  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  16  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  17  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  18  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  20  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  21  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  24  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  25  * POSSIBILITY OF SUCH DAMAGE.
  26  *
  27  * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com).
  28  */
  29
  30 /* \summary: REdis Serialization Protocol (RESP) printer */
  31
  32 #ifdef HAVE_CONFIG_H
  33 #include <config.h>
  34 #endif
  35
  36 #include "netdissect-stdinc.h"
  37 #include "netdissect.h"
  38 #include <limits.h>
  39 #include <string.h>
  40 #include <stdlib.h>
  41 #include <errno.h>
  42
  43 #include "extract.h"
  44
  45 static const char tstr[] = " [|RESP]";
  46
  47 /*
  48  * For information regarding RESP, see: http://redis.io/topics/protocol
  49  */
  50
  51 #define RESP_SIMPLE_STRING    '+'
  52 #define RESP_ERROR            '-'
  53 #define RESP_INTEGER          ':'
  54 #define RESP_BULK_STRING      '$'
  55 #define RESP_ARRAY            '*'
  56
  57 #define resp_print_empty(ndo)            ND_PRINT(" empty")
  58 #define resp_print_null(ndo)             ND_PRINT(" null")
  59 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large")
  60 #define resp_print_length_negative(ndo)  ND_PRINT(" length negative and not -1")
  61 #define resp_print_invalid(ndo)          ND_PRINT(" invalid")
  62
  63 void       resp_print(netdissect_options *, const u_char *, u_int);
  64 static int resp_parse(netdissect_options *, const u_char *, int);
  65 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int);
  66 static int resp_print_simple_string(netdissect_options *, const u_char *, int);
  67 static int resp_print_integer(netdissect_options *, const u_char *, int);
  68 static int resp_print_error(netdissect_options *, const u_char *, int);
  69 static int resp_print_bulk_string(netdissect_options *, const u_char *, int);
  70 static int resp_print_bulk_array(netdissect_options *, const u_char *, int);
  71 static int resp_print_inline(netdissect_options *, const u_char *, int);
  72 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **);
  73
  74 #define LCHECK2(_tot_len, _len) \
  75     {                           \
  76         if (_tot_len < _len)    \
  77             goto trunc;         \
  78     }
  79
  80 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1)
  81
  82 /*
  83  * FIND_CRLF:
  84  * Attempts to move our 'ptr' forward until a \r\n is found,
  85  * while also making sure we don't exceed the buffer '_len'
  86  * or go past the end of the captured data.
  87  * If we exceed or go past the end of the captured data,
  88  * jump to trunc.
  89  */
  90 #define FIND_CRLF(_ptr, _len)                   \
  91     for (;;) {                                  \
  92         LCHECK2(_len, 2);                       \
  93         ND_TCHECK_2(_ptr);                   \
  94         if (*_ptr == '\r' && *(_ptr+1) == '\n') \
  95             break;                              \
  96         _ptr++;                                 \
  97         _len--;                                 \
  98     }
  99
 100 /*
 101  * CONSUME_CRLF
 102  * Consume a CRLF that we've just found.
 103  */
 104 #define CONSUME_CRLF(_ptr, _len) \
 105     _ptr += 2;                   \
 106     _len -= 2;
 107
 108 /*
 109  * FIND_CR_OR_LF
 110  * Attempts to move our '_ptr' forward until a \r or \n is found,
 111  * while also making sure we don't exceed the buffer '_len'
 112  * or go past the end of the captured data.
 113  * If we exceed or go past the end of the captured data,
 114  * jump to trunc.
 115  */
 116 #define FIND_CR_OR_LF(_ptr, _len)           \
 117     for (;;) {                              \
 118         LCHECK(_len);                       \
 119         ND_TCHECK_1(_ptr);                  \
 120         if (*_ptr == '\r' || *_ptr == '\n') \
 121             break;                          \
 122         _ptr++;                             \
 123         _len--;                             \
 124     }
 125
 126 /*
 127  * CONSUME_CR_OR_LF
 128  * Consume all consecutive \r and \n bytes.
 129  * If we exceed '_len' or go past the end of the captured data,
 130  * jump to trunc.
 131  */
 132 #define CONSUME_CR_OR_LF(_ptr, _len)             \
 133     {                                            \
 134         int _found_cr_or_lf = 0;                 \
 135         for (;;) {                               \
 136             /*                                   \
 137              * Have we hit the end of data?      \
 138              */                                  \
 139             if (_len == 0 || !ND_TTEST_1(_ptr)) {\
 140                 /*                               \
 141                  * Yes.  Have we seen a \r       \
 142                  * or \n?                        \
 143                  */                              \
 144                 if (_found_cr_or_lf) {           \
 145                     /*                           \
 146                      * Yes.  Just stop.          \
 147                      */                          \
 148                     break;                       \
 149                 }                                \
 150                 /*                               \
 151                  * No.  We ran out of packet.    \
 152                  */                              \
 153                 goto trunc;                      \
 154             }                                    \
 155             if (*_ptr != '\r' && *_ptr != '\n')  \
 156                 break;                           \
 157             _found_cr_or_lf = 1;                 \
 158             _ptr++;                              \
 159             _len--;                              \
 160         }                                        \
 161     }
 162
 163 /*
 164  * SKIP_OPCODE
 165  * Skip over the opcode character.
 166  * The opcode has already been fetched, so we know it's there, and don't
 167  * need to do any checks.
 168  */
 169 #define SKIP_OPCODE(_ptr, _tot_len) \
 170     _ptr++;                         \
 171     _tot_len--;
 172
 173 /*
 174  * GET_LENGTH
 175  * Get a bulk string or array length.
 176  */
 177 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len)                \
 178     {                                                         \
 179         const u_char *_endp;                                  \
 180         _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \
 181         _tot_len -= (_endp - _ptr);                           \
 182         _ptr = _endp;                                         \
 183     }
 184
 185 /*
 186  * TEST_RET_LEN
 187  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 188  * and 'bubbles up' to printing tstr. Otherwise, return ret_len.
 189  */
 190 #define TEST_RET_LEN(rl) \
 191     if (rl < 0) { goto trunc; } else { return rl; }
 192
 193 /*
 194  * TEST_RET_LEN_NORETURN
 195  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 196  * and 'bubbles up' to printing tstr. Otherwise, continue onward.
 197  */
 198 #define TEST_RET_LEN_NORETURN(rl) \
 199     if (rl < 0) { goto trunc; }
 200
 201 /*
 202  * RESP_PRINT_SEGMENT
 203  * Prints a segment in the form of: ' "<stuff>"\n"
 204  * Assumes the data has already been verified as present.
 205  */
 206 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len)            \
 207     ND_PRINT(" \"");                                   \
 208     if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \
 209         goto trunc;                                    \
 210     fn_print_char(_ndo, '"');
 211
 212 void
 213 resp_print(netdissect_options *ndo, const u_char *bp, u_int length)
 214 {
 215     int ret_len = 0, length_cur = length;
 216
 217     ndo->ndo_protocol = "resp";
 218     if(!bp || length <= 0)
 219         return;
 220
 221     ND_PRINT(": RESP");
 222     while (length_cur > 0) {
 223         /*
 224          * This block supports redis pipelining.
 225          * For example, multiple operations can be pipelined within the same string:
 226          * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n"
 227          * or
 228          * "PING\r\nPING\r\nPING\r\n"
 229          * In order to handle this case, we must try and parse 'bp' until
 230          * 'length' bytes have been processed or we reach a trunc condition.
 231          */
 232         ret_len = resp_parse(ndo, bp, length_cur);
 233         TEST_RET_LEN_NORETURN(ret_len);
 234         bp += ret_len;
 235         length_cur -= ret_len;
 236     }
 237
 238     return;
 239
 240 trunc:
 241     ND_PRINT("%s", tstr);
 242 }
 243
 244 static int
 245 resp_parse(netdissect_options *ndo, const u_char *bp, int length)
 246 {
 247     u_char op;
 248     int ret_len;
 249
 250     LCHECK2(length, 1);
 251     ND_TCHECK_1(bp);
 252     op = EXTRACT_U_1(bp);
 253
 254     /* bp now points to the op, so these routines must skip it */
 255     switch(op) {
 256         case RESP_SIMPLE_STRING:  ret_len = resp_print_simple_string(ndo, bp, length);   break;
 257         case RESP_INTEGER:        ret_len = resp_print_integer(ndo, bp, length);         break;
 258         case RESP_ERROR:          ret_len = resp_print_error(ndo, bp, length);           break;
 259         case RESP_BULK_STRING:    ret_len = resp_print_bulk_string(ndo, bp, length);     break;
 260         case RESP_ARRAY:          ret_len = resp_print_bulk_array(ndo, bp, length);      break;
 261         default:                  ret_len = resp_print_inline(ndo, bp, length);          break;
 262     }
 263
 264     /*
 265      * This gives up with a "truncated" indicator for all errors,
 266      * including invalid packet errors; that's what we want, as
 267      * we have to give up on further parsing in that case.
 268      */
 269     TEST_RET_LEN(ret_len);
 270
 271 trunc:
 272     return (-1);
 273 }
 274
 275 static int
 276 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) {
 277     return resp_print_string_error_integer(ndo, bp, length);
 278 }
 279
 280 static int
 281 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) {
 282     return resp_print_string_error_integer(ndo, bp, length);
 283 }
 284
 285 static int
 286 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) {
 287     return resp_print_string_error_integer(ndo, bp, length);
 288 }
 289
 290 static int
 291 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) {
 292     int length_cur = length, len, ret_len;
 293     const u_char *bp_ptr;
 294
 295     /* bp points to the op; skip it */
 296     SKIP_OPCODE(bp, length_cur);
 297     bp_ptr = bp;
 298
 299     /*
 300      * bp now prints past the (+-;) opcode, so it's pointing to the first
 301      * character of the string (which could be numeric).
 302      * +OK\r\n
 303      * -ERR ...\r\n
 304      * :02912309\r\n
 305      *
 306      * Find the \r\n with FIND_CRLF().
 307      */
 308     FIND_CRLF(bp_ptr, length_cur);
 309
 310     /*
 311      * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text
 312      * preceding the \r\n.  That includes the opcode, so don't print
 313      * that.
 314      */
 315     len = (bp_ptr - bp);
 316     RESP_PRINT_SEGMENT(ndo, bp, len);
 317     ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/;
 318
 319     TEST_RET_LEN(ret_len);
 320
 321 trunc:
 322     return (-1);
 323 }
 324
 325 static int
 326 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) {
 327     int length_cur = length, string_len;
 328
 329     /* bp points to the op; skip it */
 330     SKIP_OPCODE(bp, length_cur);
 331
 332     /* <length>\r\n */
 333     GET_LENGTH(ndo, length_cur, bp, string_len);
 334
 335     if (string_len >= 0) {
 336         /* Byte string of length string_len, starting at bp */
 337         if (string_len == 0)
 338             resp_print_empty(ndo);
 339         else {
 340             LCHECK2(length_cur, string_len);
 341             ND_TCHECK_LEN(bp, string_len);
 342             RESP_PRINT_SEGMENT(ndo, bp, string_len);
 343             bp += string_len;
 344             length_cur -= string_len;
 345         }
 346
 347         /*
 348          * Find the \r\n at the end of the string and skip past it.
 349          * XXX - report an error if the \r\n isn't immediately after
 350          * the item?
 351          */
 352         FIND_CRLF(bp, length_cur);
 353         CONSUME_CRLF(bp, length_cur);
 354     } else {
 355         /* null, truncated, or invalid for some reason */
 356         switch(string_len) {
 357             case (-1):  resp_print_null(ndo);             break;
 358             case (-2):  goto trunc;
 359             case (-3):  resp_print_length_too_large(ndo); break;
 360             case (-4):  resp_print_length_negative(ndo);  break;
 361             default:    resp_print_invalid(ndo);          break;
 362         }
 363     }
 364
 365     return (length - length_cur);
 366
 367 trunc:
 368     return (-1);
 369 }
 370
 371 static int
 372 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) {
 373     u_int length_cur = length;
 374     int array_len, i, ret_len;
 375
 376     /* bp points to the op; skip it */
 377     SKIP_OPCODE(bp, length_cur);
 378
 379     /* <array_length>\r\n */
 380     GET_LENGTH(ndo, length_cur, bp, array_len);
 381
 382     if (array_len > 0) {
 383         /* non empty array */
 384         for (i = 0; i < array_len; i++) {
 385             ret_len = resp_parse(ndo, bp, length_cur);
 386
 387             TEST_RET_LEN_NORETURN(ret_len);
 388
 389             bp += ret_len;
 390             length_cur -= ret_len;
 391         }
 392     } else {
 393         /* empty, null, truncated, or invalid */
 394         switch(array_len) {
 395             case 0:     resp_print_empty(ndo);            break;
 396             case (-1):  resp_print_null(ndo);             break;
 397             case (-2):  goto trunc;
 398             case (-3):  resp_print_length_too_large(ndo); break;
 399             case (-4):  resp_print_length_negative(ndo);  break;
 400             default:    resp_print_invalid(ndo);          break;
 401         }
 402     }
 403
 404     return (length - length_cur);
 405
 406 trunc:
 407     return (-1);
 408 }
 409
 410 static int
 411 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) {
 412     int length_cur = length;
 413     int len;
 414     const u_char *bp_ptr;
 415
 416     /*
 417      * Inline commands are simply 'strings' followed by \r or \n or both.
 418      * Redis will do its best to split/parse these strings.
 419      * This feature of redis is implemented to support the ability of
 420      * command parsing from telnet/nc sessions etc.
 421      *
 422      * <string><\r||\n||\r\n...>
 423      */
 424
 425     /*
 426      * Skip forward past any leading \r, \n, or \r\n.
 427      */
 428     CONSUME_CR_OR_LF(bp, length_cur);
 429     bp_ptr = bp;
 430
 431     /*
 432      * Scan forward looking for \r or \n.
 433      */
 434     FIND_CR_OR_LF(bp_ptr, length_cur);
 435
 436     /*
 437      * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the
 438      * Length of the line text that preceeds it.  Print it.
 439      */
 440     len = (bp_ptr - bp);
 441     RESP_PRINT_SEGMENT(ndo, bp, len);
 442
 443     /*
 444      * Skip forward past the \r, \n, or \r\n.
 445      */
 446     CONSUME_CR_OR_LF(bp_ptr, length_cur);
 447
 448     /*
 449      * Return the number of bytes we processed.
 450      */
 451     return (length - length_cur);
 452
 453 trunc:
 454     return (-1);
 455 }
 456
 457 static int
 458 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp)
 459 {
 460     int result;
 461     u_char c;
 462     int saw_digit;
 463     int neg;
 464     int too_large;
 465
 466     if (len == 0)
 467         goto trunc;
 468     ND_TCHECK_1(bp);
 469     too_large = 0;
 470     neg = 0;
 471     if (EXTRACT_U_1(bp) == '-') {
 472         neg = 1;
 473         bp++;
 474         len--;
 475     }
 476     result = 0;
 477     saw_digit = 0;
 478
 479     for (;;) {
 480         if (len == 0)
 481             goto trunc;
 482         ND_TCHECK_1(bp);
 483         c = EXTRACT_U_1(bp);
 484         if (!(c >= '0' && c <= '9')) {
 485             if (!saw_digit) {
 486                 bp++;
 487                 goto invalid;
 488             }
 489             break;
 490         }
 491         c -= '0';
 492         if (result > (INT_MAX / 10)) {
 493             /* This will overflow an int when we multiply it by 10. */
 494             too_large = 1;
 495         } else {
 496             result *= 10;
 497             if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) {
 498                 /* This will overflow an int when we add c */
 499                 too_large = 1;
 500             } else
 501                 result += c;
 502         }
 503         bp++;
 504         len--;
 505         saw_digit = 1;
 506     }
 507
 508     /*
 509      * OK, we found a non-digit character.  It should be a \r, followed
 510      * by a \n.
 511      */
 512     if (EXTRACT_U_1(bp) != '\r') {
 513         bp++;
 514         goto invalid;
 515     }
 516     bp++;
 517     len--;
 518     if (len == 0)
 519         goto trunc;
 520     ND_TCHECK_1(bp);
 521     if (EXTRACT_U_1(bp) != '\n') {
 522         bp++;
 523         goto invalid;
 524     }
 525     bp++;
 526     len--;
 527     *endp = bp;
 528     if (neg) {
 529         /* -1 means "null", anything else is invalid */
 530         if (too_large || result != 1)
 531             return (-4);
 532         result = -1;
 533     }
 534     return (too_large ? -3 : result);
 535
 536 trunc:
 537     *endp = bp;
 538     return (-2);
 539
 540 invalid:
 541     *endp = bp;
 542     return (-5);
 543 }