The Tcpdump Group git mirrors - tcpdump/blob - print-resp.c

   1 /*
   2  * Copyright (c) 2015 The TCPDUMP project
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  15  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  16  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  17  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  18  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  20  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  21  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  24  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  25  * POSSIBILITY OF SUCH DAMAGE.
  26  *
  27  * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com).
  28  */
  29
  30 /* \summary: REdis Serialization Protocol (RESP) printer */
  31
  32 #ifdef HAVE_CONFIG_H
  33 #include <config.h>
  34 #endif
  35
  36 #include "netdissect-stdinc.h"
  37 #include "netdissect.h"
  38 #include <limits.h>
  39 #include <stdlib.h>
  40 #include <errno.h>
  41
  42 #include "extract.h"
  43
  44
  45 /*
  46  * For information regarding RESP, see: https://redis.io/topics/protocol
  47  */
  48
  49 #define RESP_SIMPLE_STRING    '+'
  50 #define RESP_ERROR            '-'
  51 #define RESP_INTEGER          ':'
  52 #define RESP_BULK_STRING      '$'
  53 #define RESP_ARRAY            '*'
  54
  55 #define resp_print_empty(ndo)            ND_PRINT(" empty")
  56 #define resp_print_null(ndo)             ND_PRINT(" null")
  57 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large")
  58 #define resp_print_length_negative(ndo)  ND_PRINT(" length negative and not -1")
  59 #define resp_print_invalid(ndo)          ND_PRINT(" invalid")
  60
  61 static int resp_parse(netdissect_options *, const u_char *, int);
  62 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int);
  63 static int resp_print_simple_string(netdissect_options *, const u_char *, int);
  64 static int resp_print_integer(netdissect_options *, const u_char *, int);
  65 static int resp_print_error(netdissect_options *, const u_char *, int);
  66 static int resp_print_bulk_string(netdissect_options *, const u_char *, int);
  67 static int resp_print_bulk_array(netdissect_options *, const u_char *, int);
  68 static int resp_print_inline(netdissect_options *, const u_char *, int);
  69 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **);
  70
  71 #define LCHECK2(_tot_len, _len) \
  72     {                           \
  73         if (_tot_len < _len)    \
  74             goto trunc;         \
  75     }
  76
  77 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1)
  78
  79 /*
  80  * FIND_CRLF:
  81  * Attempts to move our 'ptr' forward until a \r\n is found,
  82  * while also making sure we don't exceed the buffer '_len'
  83  * or go past the end of the captured data.
  84  * If we exceed or go past the end of the captured data,
  85  * jump to trunc.
  86  */
  87 #define FIND_CRLF(_ptr, _len)                   \
  88     for (;;) {                                  \
  89         LCHECK2(_len, 2);                       \
  90         ND_TCHECK_2(_ptr);                      \
  91         if (GET_U_1(_ptr) == '\r' &&            \
  92             GET_U_1(_ptr+1) == '\n')            \
  93             break;                              \
  94         _ptr++;                                 \
  95         _len--;                                 \
  96     }
  97
  98 /*
  99  * CONSUME_CRLF
 100  * Consume a CRLF that we've just found.
 101  */
 102 #define CONSUME_CRLF(_ptr, _len) \
 103     _ptr += 2;                   \
 104     _len -= 2;
 105
 106 /*
 107  * FIND_CR_OR_LF
 108  * Attempts to move our '_ptr' forward until a \r or \n is found,
 109  * while also making sure we don't exceed the buffer '_len'
 110  * or go past the end of the captured data.
 111  * If we exceed or go past the end of the captured data,
 112  * jump to trunc.
 113  */
 114 #define FIND_CR_OR_LF(_ptr, _len)           \
 115     for (;;) {                              \
 116         LCHECK(_len);                       \
 117         if (GET_U_1(_ptr) == '\r' ||        \
 118             GET_U_1(_ptr) == '\n')          \
 119             break;                          \
 120         _ptr++;                             \
 121         _len--;                             \
 122     }
 123
 124 /*
 125  * CONSUME_CR_OR_LF
 126  * Consume all consecutive \r and \n bytes.
 127  * If we exceed '_len' or go past the end of the captured data,
 128  * jump to trunc.
 129  */
 130 #define CONSUME_CR_OR_LF(_ptr, _len)             \
 131     {                                            \
 132         int _found_cr_or_lf = 0;                 \
 133         for (;;) {                               \
 134             /*                                   \
 135              * Have we hit the end of data?      \
 136              */                                  \
 137             if (_len == 0 || !ND_TTEST_1(_ptr)) {\
 138                 /*                               \
 139                  * Yes.  Have we seen a \r       \
 140                  * or \n?                        \
 141                  */                              \
 142                 if (_found_cr_or_lf) {           \
 143                     /*                           \
 144                      * Yes.  Just stop.          \
 145                      */                          \
 146                     break;                       \
 147                 }                                \
 148                 /*                               \
 149                  * No.  We ran out of packet.    \
 150                  */                              \
 151                 goto trunc;                      \
 152             }                                    \
 153             if (GET_U_1(_ptr) != '\r' &&         \
 154                 GET_U_1(_ptr) != '\n')           \
 155                 break;                           \
 156             _found_cr_or_lf = 1;                 \
 157             _ptr++;                              \
 158             _len--;                              \
 159         }                                        \
 160     }
 161
 162 /*
 163  * SKIP_OPCODE
 164  * Skip over the opcode character.
 165  * The opcode has already been fetched, so we know it's there, and don't
 166  * need to do any checks.
 167  */
 168 #define SKIP_OPCODE(_ptr, _tot_len) \
 169     _ptr++;                         \
 170     _tot_len--;
 171
 172 /*
 173  * GET_LENGTH
 174  * Get a bulk string or array length.
 175  */
 176 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len)                \
 177     {                                                         \
 178         const u_char *_endp;                                  \
 179         _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \
 180         _tot_len -= (_endp - _ptr);                           \
 181         _ptr = _endp;                                         \
 182     }
 183
 184 /*
 185  * TEST_RET_LEN
 186  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 187  * and 'bubbles up' to printing tstr. Otherwise, return ret_len.
 188  */
 189 #define TEST_RET_LEN(rl) \
 190     if (rl < 0) { goto trunc; } else { return rl; }
 191
 192 /*
 193  * TEST_RET_LEN_NORETURN
 194  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 195  * and 'bubbles up' to printing tstr. Otherwise, continue onward.
 196  */
 197 #define TEST_RET_LEN_NORETURN(rl) \
 198     if (rl < 0) { goto trunc; }
 199
 200 /*
 201  * RESP_PRINT_SEGMENT
 202  * Prints a segment in the form of: ' "<stuff>"\n"
 203  * Assumes the data has already been verified as present.
 204  */
 205 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len)            \
 206     ND_PRINT(" \"");                                   \
 207     if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \
 208         goto trunc;                                    \
 209     fn_print_char(_ndo, '"');
 210
 211 void
 212 resp_print(netdissect_options *ndo, const u_char *bp, u_int length)
 213 {
 214     int ret_len = 0, length_cur = length;
 215
 216     ndo->ndo_protocol = "resp";
 217     if(!bp || length <= 0)
 218         return;
 219
 220     ND_PRINT(": RESP");
 221     while (length_cur > 0) {
 222         /*
 223          * This block supports redis pipelining.
 224          * For example, multiple operations can be pipelined within the same string:
 225          * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n"
 226          * or
 227          * "PING\r\nPING\r\nPING\r\n"
 228          * In order to handle this case, we must try and parse 'bp' until
 229          * 'length' bytes have been processed or we reach a trunc condition.
 230          */
 231         ret_len = resp_parse(ndo, bp, length_cur);
 232         TEST_RET_LEN_NORETURN(ret_len);
 233         bp += ret_len;
 234         length_cur -= ret_len;
 235     }
 236
 237     return;
 238
 239 trunc:
 240     nd_print_trunc(ndo);
 241 }
 242
 243 static int
 244 resp_parse(netdissect_options *ndo, const u_char *bp, int length)
 245 {
 246     u_char op;
 247     int ret_len;
 248
 249     LCHECK2(length, 1);
 250     op = GET_U_1(bp);
 251
 252     /* bp now points to the op, so these routines must skip it */
 253     switch(op) {
 254         case RESP_SIMPLE_STRING:  ret_len = resp_print_simple_string(ndo, bp, length);   break;
 255         case RESP_INTEGER:        ret_len = resp_print_integer(ndo, bp, length);         break;
 256         case RESP_ERROR:          ret_len = resp_print_error(ndo, bp, length);           break;
 257         case RESP_BULK_STRING:    ret_len = resp_print_bulk_string(ndo, bp, length);     break;
 258         case RESP_ARRAY:          ret_len = resp_print_bulk_array(ndo, bp, length);      break;
 259         default:                  ret_len = resp_print_inline(ndo, bp, length);          break;
 260     }
 261
 262     /*
 263      * This gives up with a "truncated" indicator for all errors,
 264      * including invalid packet errors; that's what we want, as
 265      * we have to give up on further parsing in that case.
 266      */
 267     TEST_RET_LEN(ret_len);
 268
 269 trunc:
 270     return (-1);
 271 }
 272
 273 static int
 274 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) {
 275     return resp_print_string_error_integer(ndo, bp, length);
 276 }
 277
 278 static int
 279 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) {
 280     return resp_print_string_error_integer(ndo, bp, length);
 281 }
 282
 283 static int
 284 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) {
 285     return resp_print_string_error_integer(ndo, bp, length);
 286 }
 287
 288 static int
 289 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) {
 290     int length_cur = length, len, ret_len;
 291     const u_char *bp_ptr;
 292
 293     /* bp points to the op; skip it */
 294     SKIP_OPCODE(bp, length_cur);
 295     bp_ptr = bp;
 296
 297     /*
 298      * bp now prints past the (+-;) opcode, so it's pointing to the first
 299      * character of the string (which could be numeric).
 300      * +OK\r\n
 301      * -ERR ...\r\n
 302      * :02912309\r\n
 303      *
 304      * Find the \r\n with FIND_CRLF().
 305      */
 306     FIND_CRLF(bp_ptr, length_cur);
 307
 308     /*
 309      * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text
 310      * preceding the \r\n.  That includes the opcode, so don't print
 311      * that.
 312      */
 313     len = ND_BYTES_BETWEEN(bp_ptr, bp);
 314     RESP_PRINT_SEGMENT(ndo, bp, len);
 315     ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/;
 316
 317     TEST_RET_LEN(ret_len);
 318
 319 trunc:
 320     return (-1);
 321 }
 322
 323 static int
 324 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) {
 325     int length_cur = length, string_len;
 326
 327     /* bp points to the op; skip it */
 328     SKIP_OPCODE(bp, length_cur);
 329
 330     /* <length>\r\n */
 331     GET_LENGTH(ndo, length_cur, bp, string_len);
 332
 333     if (string_len >= 0) {
 334         /* Byte string of length string_len, starting at bp */
 335         if (string_len == 0)
 336             resp_print_empty(ndo);
 337         else {
 338             LCHECK2(length_cur, string_len);
 339             ND_TCHECK_LEN(bp, string_len);
 340             RESP_PRINT_SEGMENT(ndo, bp, string_len);
 341             bp += string_len;
 342             length_cur -= string_len;
 343         }
 344
 345         /*
 346          * Find the \r\n at the end of the string and skip past it.
 347          * XXX - report an error if the \r\n isn't immediately after
 348          * the item?
 349          */
 350         FIND_CRLF(bp, length_cur);
 351         CONSUME_CRLF(bp, length_cur);
 352     } else {
 353         /* null, truncated, or invalid for some reason */
 354         switch(string_len) {
 355             case (-1):  resp_print_null(ndo);             break;
 356             case (-2):  goto trunc;
 357             case (-3):  resp_print_length_too_large(ndo); break;
 358             case (-4):  resp_print_length_negative(ndo);  break;
 359             default:    resp_print_invalid(ndo);          break;
 360         }
 361     }
 362
 363     return (length - length_cur);
 364
 365 trunc:
 366     return (-1);
 367 }
 368
 369 static int
 370 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) {
 371     u_int length_cur = length;
 372     int array_len, i, ret_len;
 373
 374     /* bp points to the op; skip it */
 375     SKIP_OPCODE(bp, length_cur);
 376
 377     /* <array_length>\r\n */
 378     GET_LENGTH(ndo, length_cur, bp, array_len);
 379
 380     if (array_len > 0) {
 381         /* non empty array */
 382         for (i = 0; i < array_len; i++) {
 383             ret_len = resp_parse(ndo, bp, length_cur);
 384
 385             TEST_RET_LEN_NORETURN(ret_len);
 386
 387             bp += ret_len;
 388             length_cur -= ret_len;
 389         }
 390     } else {
 391         /* empty, null, truncated, or invalid */
 392         switch(array_len) {
 393             case 0:     resp_print_empty(ndo);            break;
 394             case (-1):  resp_print_null(ndo);             break;
 395             case (-2):  goto trunc;
 396             case (-3):  resp_print_length_too_large(ndo); break;
 397             case (-4):  resp_print_length_negative(ndo);  break;
 398             default:    resp_print_invalid(ndo);          break;
 399         }
 400     }
 401
 402     return (length - length_cur);
 403
 404 trunc:
 405     return (-1);
 406 }
 407
 408 static int
 409 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) {
 410     int length_cur = length;
 411     int len;
 412     const u_char *bp_ptr;
 413
 414     /*
 415      * Inline commands are simply 'strings' followed by \r or \n or both.
 416      * Redis will do its best to split/parse these strings.
 417      * This feature of redis is implemented to support the ability of
 418      * command parsing from telnet/nc sessions etc.
 419      *
 420      * <string><\r||\n||\r\n...>
 421      */
 422
 423     /*
 424      * Skip forward past any leading \r, \n, or \r\n.
 425      */
 426     CONSUME_CR_OR_LF(bp, length_cur);
 427     bp_ptr = bp;
 428
 429     /*
 430      * Scan forward looking for \r or \n.
 431      */
 432     FIND_CR_OR_LF(bp_ptr, length_cur);
 433
 434     /*
 435      * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the
 436      * Length of the line text that precedes it.  Print it.
 437      */
 438     len = ND_BYTES_BETWEEN(bp_ptr, bp);
 439     RESP_PRINT_SEGMENT(ndo, bp, len);
 440
 441     /*
 442      * Skip forward past the \r, \n, or \r\n.
 443      */
 444     CONSUME_CR_OR_LF(bp_ptr, length_cur);
 445
 446     /*
 447      * Return the number of bytes we processed.
 448      */
 449     return (length - length_cur);
 450
 451 trunc:
 452     return (-1);
 453 }
 454
 455 static int
 456 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp)
 457 {
 458     int result;
 459     u_char c;
 460     int saw_digit;
 461     int neg;
 462     int too_large;
 463
 464     if (len == 0)
 465         goto trunc;
 466     too_large = 0;
 467     neg = 0;
 468     if (GET_U_1(bp) == '-') {
 469         neg = 1;
 470         bp++;
 471         len--;
 472     }
 473     result = 0;
 474     saw_digit = 0;
 475
 476     for (;;) {
 477         if (len == 0)
 478             goto trunc;
 479         c = GET_U_1(bp);
 480         if (!(c >= '0' && c <= '9')) {
 481             if (!saw_digit) {
 482                 bp++;
 483                 goto invalid;
 484             }
 485             break;
 486         }
 487         c -= '0';
 488         if (result > (INT_MAX / 10)) {
 489             /* This will overflow an int when we multiply it by 10. */
 490             too_large = 1;
 491         } else {
 492             result *= 10;
 493             if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) {
 494                 /* This will overflow an int when we add c */
 495                 too_large = 1;
 496             } else
 497                 result += c;
 498         }
 499         bp++;
 500         len--;
 501         saw_digit = 1;
 502     }
 503
 504     /*
 505      * OK, we found a non-digit character.  It should be a \r, followed
 506      * by a \n.
 507      */
 508     if (GET_U_1(bp) != '\r') {
 509         bp++;
 510         goto invalid;
 511     }
 512     bp++;
 513     len--;
 514     if (len == 0)
 515         goto trunc;
 516     if (GET_U_1(bp) != '\n') {
 517         bp++;
 518         goto invalid;
 519     }
 520     bp++;
 521     len--;
 522     *endp = bp;
 523     if (neg) {
 524         /* -1 means "null", anything else is invalid */
 525         if (too_large || result != 1)
 526             return (-4);
 527         result = -1;
 528     }
 529     return (too_large ? -3 : result);
 530
 531 trunc:
 532     *endp = bp;
 533     return (-2);
 534
 535 invalid:
 536     *endp = bp;
 537     return (-5);
 538 }