The Tcpdump Group git mirrors - tcpdump/blob - print-resp.c

   1 /*
   2  * Copyright (c) 2015 The TCPDUMP project
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  15  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  16  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  17  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  18  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  20  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  21  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  24  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  25  * POSSIBILITY OF SUCH DAMAGE.
  26  *
  27  * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com).
  28  */
  29
  30 /* \summary: REdis Serialization Protocol (RESP) printer */
  31
  32 #ifdef HAVE_CONFIG_H
  33 #include <config.h>
  34 #endif
  35
  36 #include "netdissect-stdinc.h"
  37 #include "netdissect.h"
  38 #include <limits.h>
  39
  40 #include "extract.h"
  41
  42
  43 /*
  44  * For information regarding RESP, see: https://redis.io/topics/protocol
  45  */
  46
  47 #define RESP_SIMPLE_STRING    '+'
  48 #define RESP_ERROR            '-'
  49 #define RESP_INTEGER          ':'
  50 #define RESP_BULK_STRING      '$'
  51 #define RESP_ARRAY            '*'
  52
  53 #define resp_print_empty(ndo)            ND_PRINT(" empty")
  54 #define resp_print_null(ndo)             ND_PRINT(" null")
  55 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large")
  56 #define resp_print_length_negative(ndo)  ND_PRINT(" length negative and not -1")
  57 #define resp_print_invalid(ndo)          ND_PRINT(" invalid")
  58
  59 static int resp_parse(netdissect_options *, const u_char *, int);
  60 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int);
  61 static int resp_print_simple_string(netdissect_options *, const u_char *, int);
  62 static int resp_print_integer(netdissect_options *, const u_char *, int);
  63 static int resp_print_error(netdissect_options *, const u_char *, int);
  64 static int resp_print_bulk_string(netdissect_options *, const u_char *, int);
  65 static int resp_print_bulk_array(netdissect_options *, const u_char *, int);
  66 static int resp_print_inline(netdissect_options *, const u_char *, int);
  67 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **);
  68
  69 #define LCHECK2(_tot_len, _len) \
  70     {                           \
  71         if (_tot_len < _len)    \
  72             goto trunc;         \
  73     }
  74
  75 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1)
  76
  77 /*
  78  * FIND_CRLF:
  79  * Attempts to move our 'ptr' forward until a \r\n is found,
  80  * while also making sure we don't exceed the buffer '_len'
  81  * or go past the end of the captured data.
  82  * If we exceed or go past the end of the captured data,
  83  * jump to trunc.
  84  */
  85 #define FIND_CRLF(_ptr, _len)                   \
  86     for (;;) {                                  \
  87         LCHECK2(_len, 2);                       \
  88         ND_TCHECK_2(_ptr);                      \
  89         if (GET_U_1(_ptr) == '\r' &&            \
  90             GET_U_1(_ptr+1) == '\n')            \
  91             break;                              \
  92         _ptr++;                                 \
  93         _len--;                                 \
  94     }
  95
  96 /*
  97  * CONSUME_CRLF
  98  * Consume a CRLF that we've just found.
  99  */
 100 #define CONSUME_CRLF(_ptr, _len) \
 101     _ptr += 2;                   \
 102     _len -= 2;
 103
 104 /*
 105  * FIND_CR_OR_LF
 106  * Attempts to move our '_ptr' forward until a \r or \n is found,
 107  * while also making sure we don't exceed the buffer '_len'
 108  * or go past the end of the captured data.
 109  * If we exceed or go past the end of the captured data,
 110  * jump to trunc.
 111  */
 112 #define FIND_CR_OR_LF(_ptr, _len)           \
 113     for (;;) {                              \
 114         LCHECK(_len);                       \
 115         if (GET_U_1(_ptr) == '\r' ||        \
 116             GET_U_1(_ptr) == '\n')          \
 117             break;                          \
 118         _ptr++;                             \
 119         _len--;                             \
 120     }
 121
 122 /*
 123  * CONSUME_CR_OR_LF
 124  * Consume all consecutive \r and \n bytes.
 125  * If we exceed '_len' or go past the end of the captured data,
 126  * jump to trunc.
 127  */
 128 #define CONSUME_CR_OR_LF(_ptr, _len)             \
 129     {                                            \
 130         int _found_cr_or_lf = 0;                 \
 131         for (;;) {                               \
 132             /*                                   \
 133              * Have we hit the end of data?      \
 134              */                                  \
 135             if (_len == 0 || !ND_TTEST_1(_ptr)) {\
 136                 /*                               \
 137                  * Yes.  Have we seen a \r       \
 138                  * or \n?                        \
 139                  */                              \
 140                 if (_found_cr_or_lf) {           \
 141                     /*                           \
 142                      * Yes.  Just stop.          \
 143                      */                          \
 144                     break;                       \
 145                 }                                \
 146                 /*                               \
 147                  * No.  We ran out of packet.    \
 148                  */                              \
 149                 goto trunc;                      \
 150             }                                    \
 151             if (GET_U_1(_ptr) != '\r' &&         \
 152                 GET_U_1(_ptr) != '\n')           \
 153                 break;                           \
 154             _found_cr_or_lf = 1;                 \
 155             _ptr++;                              \
 156             _len--;                              \
 157         }                                        \
 158     }
 159
 160 /*
 161  * SKIP_OPCODE
 162  * Skip over the opcode character.
 163  * The opcode has already been fetched, so we know it's there, and don't
 164  * need to do any checks.
 165  */
 166 #define SKIP_OPCODE(_ptr, _tot_len) \
 167     _ptr++;                         \
 168     _tot_len--;
 169
 170 /*
 171  * GET_LENGTH
 172  * Get a bulk string or array length.
 173  */
 174 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len)                \
 175     {                                                         \
 176         const u_char *_endp;                                  \
 177         _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \
 178         _tot_len -= (_endp - _ptr);                           \
 179         _ptr = _endp;                                         \
 180     }
 181
 182 /*
 183  * TEST_RET_LEN
 184  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 185  * and 'bubbles up' to printing tstr. Otherwise, return ret_len.
 186  */
 187 #define TEST_RET_LEN(rl) \
 188     if (rl < 0) { goto trunc; } else { return rl; }
 189
 190 /*
 191  * TEST_RET_LEN_NORETURN
 192  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 193  * and 'bubbles up' to printing tstr. Otherwise, continue onward.
 194  */
 195 #define TEST_RET_LEN_NORETURN(rl) \
 196     if (rl < 0) { goto trunc; }
 197
 198 /*
 199  * RESP_PRINT_SEGMENT
 200  * Prints a segment in the form of: ' "<stuff>"\n"
 201  * Assumes the data has already been verified as present.
 202  */
 203 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len)            \
 204     ND_PRINT(" \"");                                   \
 205     if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \
 206         goto trunc;                                    \
 207     fn_print_char(_ndo, '"');
 208
 209 void
 210 resp_print(netdissect_options *ndo, const u_char *bp, u_int length)
 211 {
 212     int ret_len = 0, length_cur = length;
 213
 214     ndo->ndo_protocol = "resp";
 215     if(!bp || length == 0)
 216         return;
 217
 218     ND_PRINT(": RESP");
 219     while (length_cur > 0) {
 220         /*
 221          * This block supports redis pipelining.
 222          * For example, multiple operations can be pipelined within the same string:
 223          * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n"
 224          * or
 225          * "PING\r\nPING\r\nPING\r\n"
 226          * In order to handle this case, we must try and parse 'bp' until
 227          * 'length' bytes have been processed or we reach a trunc condition.
 228          */
 229         ret_len = resp_parse(ndo, bp, length_cur);
 230         TEST_RET_LEN_NORETURN(ret_len);
 231         bp += ret_len;
 232         length_cur -= ret_len;
 233     }
 234
 235     return;
 236
 237 trunc:
 238     nd_print_trunc(ndo);
 239 }
 240
 241 static int
 242 resp_parse(netdissect_options *ndo, const u_char *bp, int length)
 243 {
 244     u_char op;
 245     int ret_len;
 246
 247     LCHECK2(length, 1);
 248     op = GET_U_1(bp);
 249
 250     /* bp now points to the op, so these routines must skip it */
 251     switch(op) {
 252         case RESP_SIMPLE_STRING:  ret_len = resp_print_simple_string(ndo, bp, length);   break;
 253         case RESP_INTEGER:        ret_len = resp_print_integer(ndo, bp, length);         break;
 254         case RESP_ERROR:          ret_len = resp_print_error(ndo, bp, length);           break;
 255         case RESP_BULK_STRING:    ret_len = resp_print_bulk_string(ndo, bp, length);     break;
 256         case RESP_ARRAY:          ret_len = resp_print_bulk_array(ndo, bp, length);      break;
 257         default:                  ret_len = resp_print_inline(ndo, bp, length);          break;
 258     }
 259
 260     /*
 261      * This gives up with a "truncated" indicator for all errors,
 262      * including invalid packet errors; that's what we want, as
 263      * we have to give up on further parsing in that case.
 264      */
 265     TEST_RET_LEN(ret_len);
 266
 267 trunc:
 268     return (-1);
 269 }
 270
 271 static int
 272 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) {
 273     return resp_print_string_error_integer(ndo, bp, length);
 274 }
 275
 276 static int
 277 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) {
 278     return resp_print_string_error_integer(ndo, bp, length);
 279 }
 280
 281 static int
 282 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) {
 283     return resp_print_string_error_integer(ndo, bp, length);
 284 }
 285
 286 static int
 287 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) {
 288     int length_cur = length, len, ret_len;
 289     const u_char *bp_ptr;
 290
 291     /* bp points to the op; skip it */
 292     SKIP_OPCODE(bp, length_cur);
 293     bp_ptr = bp;
 294
 295     /*
 296      * bp now prints past the (+-;) opcode, so it's pointing to the first
 297      * character of the string (which could be numeric).
 298      * +OK\r\n
 299      * -ERR ...\r\n
 300      * :02912309\r\n
 301      *
 302      * Find the \r\n with FIND_CRLF().
 303      */
 304     FIND_CRLF(bp_ptr, length_cur);
 305
 306     /*
 307      * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text
 308      * preceding the \r\n.  That includes the opcode, so don't print
 309      * that.
 310      */
 311     len = ND_BYTES_BETWEEN(bp_ptr, bp);
 312     RESP_PRINT_SEGMENT(ndo, bp, len);
 313     ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/;
 314
 315     TEST_RET_LEN(ret_len);
 316
 317 trunc:
 318     return (-1);
 319 }
 320
 321 static int
 322 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) {
 323     int length_cur = length, string_len;
 324
 325     /* bp points to the op; skip it */
 326     SKIP_OPCODE(bp, length_cur);
 327
 328     /* <length>\r\n */
 329     GET_LENGTH(ndo, length_cur, bp, string_len);
 330
 331     if (string_len >= 0) {
 332         /* Byte string of length string_len, starting at bp */
 333         if (string_len == 0)
 334             resp_print_empty(ndo);
 335         else {
 336             LCHECK2(length_cur, string_len);
 337             ND_TCHECK_LEN(bp, string_len);
 338             RESP_PRINT_SEGMENT(ndo, bp, string_len);
 339             bp += string_len;
 340             length_cur -= string_len;
 341         }
 342
 343         /*
 344          * Find the \r\n at the end of the string and skip past it.
 345          * XXX - report an error if the \r\n isn't immediately after
 346          * the item?
 347          */
 348         FIND_CRLF(bp, length_cur);
 349         CONSUME_CRLF(bp, length_cur);
 350     } else {
 351         /* null, truncated, or invalid for some reason */
 352         switch(string_len) {
 353             case (-1):  resp_print_null(ndo);             break;
 354             case (-2):  goto trunc;
 355             case (-3):  resp_print_length_too_large(ndo); break;
 356             case (-4):  resp_print_length_negative(ndo);  break;
 357             default:    resp_print_invalid(ndo);          break;
 358         }
 359     }
 360
 361     return (length - length_cur);
 362
 363 trunc:
 364     return (-1);
 365 }
 366
 367 static int
 368 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) {
 369     u_int length_cur = length;
 370     int array_len, i, ret_len;
 371
 372     /* bp points to the op; skip it */
 373     SKIP_OPCODE(bp, length_cur);
 374
 375     /* <array_length>\r\n */
 376     GET_LENGTH(ndo, length_cur, bp, array_len);
 377
 378     if (array_len > 0) {
 379         /* non empty array */
 380         for (i = 0; i < array_len; i++) {
 381             ret_len = resp_parse(ndo, bp, length_cur);
 382
 383             TEST_RET_LEN_NORETURN(ret_len);
 384
 385             bp += ret_len;
 386             length_cur -= ret_len;
 387         }
 388     } else {
 389         /* empty, null, truncated, or invalid */
 390         switch(array_len) {
 391             case 0:     resp_print_empty(ndo);            break;
 392             case (-1):  resp_print_null(ndo);             break;
 393             case (-2):  goto trunc;
 394             case (-3):  resp_print_length_too_large(ndo); break;
 395             case (-4):  resp_print_length_negative(ndo);  break;
 396             default:    resp_print_invalid(ndo);          break;
 397         }
 398     }
 399
 400     return (length - length_cur);
 401
 402 trunc:
 403     return (-1);
 404 }
 405
 406 static int
 407 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) {
 408     int length_cur = length;
 409     int len;
 410     const u_char *bp_ptr;
 411
 412     /*
 413      * Inline commands are simply 'strings' followed by \r or \n or both.
 414      * Redis will do its best to split/parse these strings.
 415      * This feature of redis is implemented to support the ability of
 416      * command parsing from telnet/nc sessions etc.
 417      *
 418      * <string><\r||\n||\r\n...>
 419      */
 420
 421     /*
 422      * Skip forward past any leading \r, \n, or \r\n.
 423      */
 424     CONSUME_CR_OR_LF(bp, length_cur);
 425     bp_ptr = bp;
 426
 427     /*
 428      * Scan forward looking for \r or \n.
 429      */
 430     FIND_CR_OR_LF(bp_ptr, length_cur);
 431
 432     /*
 433      * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the
 434      * Length of the line text that precedes it.  Print it.
 435      */
 436     len = ND_BYTES_BETWEEN(bp_ptr, bp);
 437     RESP_PRINT_SEGMENT(ndo, bp, len);
 438
 439     /*
 440      * Skip forward past the \r, \n, or \r\n.
 441      */
 442     CONSUME_CR_OR_LF(bp_ptr, length_cur);
 443
 444     /*
 445      * Return the number of bytes we processed.
 446      */
 447     return (length - length_cur);
 448
 449 trunc:
 450     return (-1);
 451 }
 452
 453 static int
 454 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp)
 455 {
 456     int result;
 457     u_char c;
 458     int saw_digit;
 459     int neg;
 460     int too_large;
 461
 462     if (len == 0)
 463         goto trunc;
 464     too_large = 0;
 465     neg = 0;
 466     if (GET_U_1(bp) == '-') {
 467         neg = 1;
 468         bp++;
 469         len--;
 470     }
 471     result = 0;
 472     saw_digit = 0;
 473
 474     for (;;) {
 475         if (len == 0)
 476             goto trunc;
 477         c = GET_U_1(bp);
 478         if (!(c >= '0' && c <= '9')) {
 479             if (!saw_digit) {
 480                 bp++;
 481                 goto invalid;
 482             }
 483             break;
 484         }
 485         c -= '0';
 486         if (result > (INT_MAX / 10)) {
 487             /* This will overflow an int when we multiply it by 10. */
 488             too_large = 1;
 489         } else {
 490             result *= 10;
 491             if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) {
 492                 /* This will overflow an int when we add c */
 493                 too_large = 1;
 494             } else
 495                 result += c;
 496         }
 497         bp++;
 498         len--;
 499         saw_digit = 1;
 500     }
 501
 502     /*
 503      * OK, we found a non-digit character.  It should be a \r, followed
 504      * by a \n.
 505      */
 506     if (GET_U_1(bp) != '\r') {
 507         bp++;
 508         goto invalid;
 509     }
 510     bp++;
 511     len--;
 512     if (len == 0)
 513         goto trunc;
 514     if (GET_U_1(bp) != '\n') {
 515         bp++;
 516         goto invalid;
 517     }
 518     bp++;
 519     len--;
 520     *endp = bp;
 521     if (neg) {
 522         /* -1 means "null", anything else is invalid */
 523         if (too_large || result != 1)
 524             return (-4);
 525         result = -1;
 526     }
 527     return (too_large ? -3 : result);
 528
 529 trunc:
 530     *endp = bp;
 531     return (-2);
 532
 533 invalid:
 534     *endp = bp;
 535     return (-5);
 536 }