The Tcpdump Group git mirrors - tcpdump/blob - print-resp.c

   1 /*
   2  * Copyright (c) 2015 The TCPDUMP project
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  15  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  16  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  17  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  18  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  20  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  21  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  24  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  25  * POSSIBILITY OF SUCH DAMAGE.
  26  *
  27  * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com).
  28  */
  29
  30 /* \summary: REdis Serialization Protocol (RESP) printer */
  31
  32 #include <config.h>
  33
  34 #include "netdissect-stdinc.h"
  35 #include "netdissect.h"
  36 #include <limits.h>
  37
  38 #include "extract.h"
  39
  40
  41 /*
  42  * For information regarding RESP, see: https://redis.io/topics/protocol
  43  */
  44
  45 #define RESP_SIMPLE_STRING    '+'
  46 #define RESP_ERROR            '-'
  47 #define RESP_INTEGER          ':'
  48 #define RESP_BULK_STRING      '$'
  49 #define RESP_ARRAY            '*'
  50
  51 #define resp_print_empty(ndo)            ND_PRINT(" empty")
  52 #define resp_print_null(ndo)             ND_PRINT(" null")
  53 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large")
  54 #define resp_print_length_negative(ndo)  ND_PRINT(" length negative and not -1")
  55 #define resp_print_invalid(ndo)          ND_PRINT(" invalid")
  56
  57 static int resp_parse(netdissect_options *, const u_char *, int);
  58 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int);
  59 static int resp_print_simple_string(netdissect_options *, const u_char *, int);
  60 static int resp_print_integer(netdissect_options *, const u_char *, int);
  61 static int resp_print_error(netdissect_options *, const u_char *, int);
  62 static int resp_print_bulk_string(netdissect_options *, const u_char *, int);
  63 static int resp_print_bulk_array(netdissect_options *, const u_char *, int);
  64 static int resp_print_inline(netdissect_options *, const u_char *, int);
  65 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **);
  66
  67 #define LCHECK2(_tot_len, _len) \
  68     {                           \
  69         if (_tot_len < _len)    \
  70             goto trunc;         \
  71     }
  72
  73 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1)
  74
  75 /*
  76  * FIND_CRLF:
  77  * Attempts to move our 'ptr' forward until a \r\n is found,
  78  * while also making sure we don't exceed the buffer '_len'
  79  * or go past the end of the captured data.
  80  * If we exceed or go past the end of the captured data,
  81  * jump to trunc.
  82  */
  83 #define FIND_CRLF(_ptr, _len)                   \
  84     for (;;) {                                  \
  85         LCHECK2(_len, 2);                       \
  86         ND_TCHECK_2(_ptr);                      \
  87         if (GET_U_1(_ptr) == '\r' &&            \
  88             GET_U_1(_ptr+1) == '\n')            \
  89             break;                              \
  90         _ptr++;                                 \
  91         _len--;                                 \
  92     }
  93
  94 /*
  95  * CONSUME_CRLF
  96  * Consume a CRLF that we've just found.
  97  */
  98 #define CONSUME_CRLF(_ptr, _len) \
  99     _ptr += 2;                   \
 100     _len -= 2;
 101
 102 /*
 103  * FIND_CR_OR_LF
 104  * Attempts to move our '_ptr' forward until a \r or \n is found,
 105  * while also making sure we don't exceed the buffer '_len'
 106  * or go past the end of the captured data.
 107  * If we exceed or go past the end of the captured data,
 108  * jump to trunc.
 109  */
 110 #define FIND_CR_OR_LF(_ptr, _len)           \
 111     for (;;) {                              \
 112         LCHECK(_len);                       \
 113         if (GET_U_1(_ptr) == '\r' ||        \
 114             GET_U_1(_ptr) == '\n')          \
 115             break;                          \
 116         _ptr++;                             \
 117         _len--;                             \
 118     }
 119
 120 /*
 121  * CONSUME_CR_OR_LF
 122  * Consume all consecutive \r and \n bytes.
 123  * If we exceed '_len' or go past the end of the captured data,
 124  * jump to trunc.
 125  */
 126 #define CONSUME_CR_OR_LF(_ptr, _len)             \
 127     {                                            \
 128         int _found_cr_or_lf = 0;                 \
 129         for (;;) {                               \
 130             /*                                   \
 131              * Have we hit the end of data?      \
 132              */                                  \
 133             if (_len == 0 || !ND_TTEST_1(_ptr)) {\
 134                 /*                               \
 135                  * Yes.  Have we seen a \r       \
 136                  * or \n?                        \
 137                  */                              \
 138                 if (_found_cr_or_lf) {           \
 139                     /*                           \
 140                      * Yes.  Just stop.          \
 141                      */                          \
 142                     break;                       \
 143                 }                                \
 144                 /*                               \
 145                  * No.  We ran out of packet.    \
 146                  */                              \
 147                 goto trunc;                      \
 148             }                                    \
 149             if (GET_U_1(_ptr) != '\r' &&         \
 150                 GET_U_1(_ptr) != '\n')           \
 151                 break;                           \
 152             _found_cr_or_lf = 1;                 \
 153             _ptr++;                              \
 154             _len--;                              \
 155         }                                        \
 156     }
 157
 158 /*
 159  * SKIP_OPCODE
 160  * Skip over the opcode character.
 161  * The opcode has already been fetched, so we know it's there, and don't
 162  * need to do any checks.
 163  */
 164 #define SKIP_OPCODE(_ptr, _tot_len) \
 165     _ptr++;                         \
 166     _tot_len--;
 167
 168 /*
 169  * GET_LENGTH
 170  * Get a bulk string or array length.
 171  */
 172 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len)                \
 173     {                                                         \
 174         const u_char *_endp;                                  \
 175         _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \
 176         _tot_len -= (_endp - _ptr);                           \
 177         _ptr = _endp;                                         \
 178     }
 179
 180 /*
 181  * TEST_RET_LEN
 182  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 183  * and 'bubbles up' to printing tstr. Otherwise, return ret_len.
 184  *
 185  * Note that using this macro with a semicolon at the end emits a warning from
 186  * Sun C about an unreachable statement (the semicolon is the statement).
 187  */
 188 #define TEST_RET_LEN(rl) \
 189     if (rl < 0) { goto trunc; } else { return rl; }
 190
 191 /*
 192  * TEST_RET_LEN_NORETURN
 193  * If ret_len is < 0, jump to the trunc tag which returns (-1)
 194  * and 'bubbles up' to printing tstr. Otherwise, continue onward.
 195  */
 196 #define TEST_RET_LEN_NORETURN(rl) \
 197     if (rl < 0) { goto trunc; }
 198
 199 /*
 200  * RESP_PRINT_SEGMENT
 201  * Prints a segment in the form of: ' "<stuff>"\n"
 202  * Assumes the data has already been verified as present.
 203  */
 204 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len)            \
 205     ND_PRINT(" \"");                                   \
 206     if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \
 207         goto trunc;                                    \
 208     ND_PRINT("\"");
 209
 210 void
 211 resp_print(netdissect_options *ndo, const u_char *bp, u_int length)
 212 {
 213     int ret_len = 0;
 214
 215     ndo->ndo_protocol = "resp";
 216
 217     ND_PRINT(": RESP");
 218     while (length != 0) {
 219         /*
 220          * This block supports redis pipelining.
 221          * For example, multiple operations can be pipelined within the same string:
 222          * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n"
 223          * or
 224          * "PING\r\nPING\r\nPING\r\n"
 225          * In order to handle this case, we must try and parse 'bp' until
 226          * 'length' bytes have been processed or we reach a trunc condition.
 227          */
 228         ret_len = resp_parse(ndo, bp, length);
 229         TEST_RET_LEN_NORETURN(ret_len);
 230         bp += ret_len;
 231         length -= ret_len;
 232     }
 233
 234     return;
 235
 236 trunc:
 237     nd_print_trunc(ndo);
 238 }
 239
 240 static int
 241 resp_parse(netdissect_options *ndo, const u_char *bp, int length)
 242 {
 243     u_char op;
 244     int ret_len;
 245
 246     LCHECK2(length, 1);
 247     op = GET_U_1(bp);
 248
 249     /* bp now points to the op, so these routines must skip it */
 250     switch(op) {
 251         case RESP_SIMPLE_STRING:  ret_len = resp_print_simple_string(ndo, bp, length);   break;
 252         case RESP_INTEGER:        ret_len = resp_print_integer(ndo, bp, length);         break;
 253         case RESP_ERROR:          ret_len = resp_print_error(ndo, bp, length);           break;
 254         case RESP_BULK_STRING:    ret_len = resp_print_bulk_string(ndo, bp, length);     break;
 255         case RESP_ARRAY:          ret_len = resp_print_bulk_array(ndo, bp, length);      break;
 256         default:                  ret_len = resp_print_inline(ndo, bp, length);          break;
 257     }
 258
 259     /*
 260      * This gives up with a "truncated" indicator for all errors,
 261      * including invalid packet errors; that's what we want, as
 262      * we have to give up on further parsing in that case.
 263      */
 264     TEST_RET_LEN(ret_len) // without a semicolon
 265
 266 trunc:
 267     return (-1);
 268 }
 269
 270 static int
 271 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) {
 272     return resp_print_string_error_integer(ndo, bp, length);
 273 }
 274
 275 static int
 276 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) {
 277     return resp_print_string_error_integer(ndo, bp, length);
 278 }
 279
 280 static int
 281 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) {
 282     return resp_print_string_error_integer(ndo, bp, length);
 283 }
 284
 285 static int
 286 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) {
 287     int length_cur = length, len, ret_len;
 288     const u_char *bp_ptr;
 289
 290     /* bp points to the op; skip it */
 291     SKIP_OPCODE(bp, length_cur);
 292     bp_ptr = bp;
 293
 294     /*
 295      * bp now prints past the (+-;) opcode, so it's pointing to the first
 296      * character of the string (which could be numeric).
 297      * +OK\r\n
 298      * -ERR ...\r\n
 299      * :02912309\r\n
 300      *
 301      * Find the \r\n with FIND_CRLF().
 302      */
 303     FIND_CRLF(bp_ptr, length_cur);
 304
 305     /*
 306      * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text
 307      * preceding the \r\n.  That includes the opcode, so don't print
 308      * that.
 309      */
 310     len = ND_BYTES_BETWEEN(bp, bp_ptr);
 311     RESP_PRINT_SEGMENT(ndo, bp, len);
 312     ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/;
 313
 314     TEST_RET_LEN(ret_len) // without a semicolon
 315
 316 trunc:
 317     return (-1);
 318 }
 319
 320 static int
 321 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) {
 322     int length_cur = length, string_len;
 323
 324     /* bp points to the op; skip it */
 325     SKIP_OPCODE(bp, length_cur);
 326
 327     /* <length>\r\n */
 328     GET_LENGTH(ndo, length_cur, bp, string_len);
 329
 330     if (string_len >= 0) {
 331         /* Byte string of length string_len, starting at bp */
 332         if (string_len == 0)
 333             resp_print_empty(ndo);
 334         else {
 335             LCHECK2(length_cur, string_len);
 336             ND_TCHECK_LEN(bp, string_len);
 337             RESP_PRINT_SEGMENT(ndo, bp, string_len);
 338             bp += string_len;
 339             length_cur -= string_len;
 340         }
 341
 342         /*
 343          * Find the \r\n at the end of the string and skip past it.
 344          * XXX - report an error if the \r\n isn't immediately after
 345          * the item?
 346          */
 347         FIND_CRLF(bp, length_cur);
 348         CONSUME_CRLF(bp, length_cur);
 349     } else {
 350         /* null, truncated, or invalid for some reason */
 351         switch(string_len) {
 352             case (-1):  resp_print_null(ndo);             break;
 353             case (-2):  goto trunc;
 354             case (-3):  resp_print_length_too_large(ndo); break;
 355             case (-4):  resp_print_length_negative(ndo);  break;
 356             default:    resp_print_invalid(ndo);          break;
 357         }
 358     }
 359
 360     return (length - length_cur);
 361
 362 trunc:
 363     return (-1);
 364 }
 365
 366 static int
 367 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) {
 368     u_int length_cur = length;
 369     int array_len, i, ret_len;
 370
 371     /* bp points to the op; skip it */
 372     SKIP_OPCODE(bp, length_cur);
 373
 374     /* <array_length>\r\n */
 375     GET_LENGTH(ndo, length_cur, bp, array_len);
 376
 377     if (array_len > 0) {
 378         /* non empty array */
 379         for (i = 0; i < array_len; i++) {
 380             ret_len = resp_parse(ndo, bp, length_cur);
 381
 382             TEST_RET_LEN_NORETURN(ret_len);
 383
 384             bp += ret_len;
 385             length_cur -= ret_len;
 386         }
 387     } else {
 388         /* empty, null, truncated, or invalid */
 389         switch(array_len) {
 390             case 0:     resp_print_empty(ndo);            break;
 391             case (-1):  resp_print_null(ndo);             break;
 392             case (-2):  goto trunc;
 393             case (-3):  resp_print_length_too_large(ndo); break;
 394             case (-4):  resp_print_length_negative(ndo);  break;
 395             default:    resp_print_invalid(ndo);          break;
 396         }
 397     }
 398
 399     return (length - length_cur);
 400
 401 trunc:
 402     return (-1);
 403 }
 404
 405 static int
 406 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) {
 407     int length_cur = length;
 408     int len;
 409     const u_char *bp_ptr;
 410
 411     /*
 412      * Inline commands are simply 'strings' followed by \r or \n or both.
 413      * Redis will do its best to split/parse these strings.
 414      * This feature of redis is implemented to support the ability of
 415      * command parsing from telnet/nc sessions etc.
 416      *
 417      * <string><\r||\n||\r\n...>
 418      */
 419
 420     /*
 421      * Skip forward past any leading \r, \n, or \r\n.
 422      */
 423     CONSUME_CR_OR_LF(bp, length_cur);
 424     bp_ptr = bp;
 425
 426     /*
 427      * Scan forward looking for \r or \n.
 428      */
 429     FIND_CR_OR_LF(bp_ptr, length_cur);
 430
 431     /*
 432      * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the
 433      * Length of the line text that precedes it.  Print it.
 434      */
 435     len = ND_BYTES_BETWEEN(bp, bp_ptr);
 436     RESP_PRINT_SEGMENT(ndo, bp, len);
 437
 438     /*
 439      * Skip forward past the \r, \n, or \r\n.
 440      */
 441     CONSUME_CR_OR_LF(bp_ptr, length_cur);
 442
 443     /*
 444      * Return the number of bytes we processed.
 445      */
 446     return (length - length_cur);
 447
 448 trunc:
 449     return (-1);
 450 }
 451
 452 static int
 453 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp)
 454 {
 455     int result;
 456     u_char c;
 457     int saw_digit;
 458     int neg;
 459     int too_large;
 460
 461     if (len == 0)
 462         goto trunc;
 463     too_large = 0;
 464     neg = 0;
 465     if (GET_U_1(bp) == '-') {
 466         neg = 1;
 467         bp++;
 468         len--;
 469     }
 470     result = 0;
 471     saw_digit = 0;
 472
 473     for (;;) {
 474         if (len == 0)
 475             goto trunc;
 476         c = GET_U_1(bp);
 477         if (!(c >= '0' && c <= '9')) {
 478             if (!saw_digit) {
 479                 bp++;
 480                 goto invalid;
 481             }
 482             break;
 483         }
 484         c -= '0';
 485         if (result > (INT_MAX / 10)) {
 486             /* This will overflow an int when we multiply it by 10. */
 487             too_large = 1;
 488         } else {
 489             result *= 10;
 490             if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) {
 491                 /* This will overflow an int when we add c */
 492                 too_large = 1;
 493             } else
 494                 result += c;
 495         }
 496         bp++;
 497         len--;
 498         saw_digit = 1;
 499     }
 500
 501     /*
 502      * OK, we found a non-digit character.  It should be a \r, followed
 503      * by a \n.
 504      */
 505     if (GET_U_1(bp) != '\r') {
 506         bp++;
 507         goto invalid;
 508     }
 509     bp++;
 510     len--;
 511     if (len == 0)
 512         goto trunc;
 513     if (GET_U_1(bp) != '\n') {
 514         bp++;
 515         goto invalid;
 516     }
 517     bp++;
 518     len--;
 519     *endp = bp;
 520     if (neg) {
 521         /* -1 means "null", anything else is invalid */
 522         if (too_large || result != 1)
 523             return (-4);
 524         result = -1;
 525     }
 526     return (too_large ? -3 : result);
 527
 528 trunc:
 529     *endp = bp;
 530     return (-2);
 531
 532 invalid:
 533     *endp = bp;
 534     return (-5);
 535 }