1 /* 2 * Copyright (c) 2015 The TCPDUMP project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 15 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 16 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 17 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 18 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 22 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 24 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 * 27 * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com). 28 */ 29 30 /* \summary: REdis Serialization Protocol (RESP) printer */ 31 32 #ifdef HAVE_CONFIG_H 33 #include <config.h> 34 #endif 35 36 #include "netdissect-stdinc.h" 37 #include "netdissect.h" 38 #include <limits.h> 39 40 #include "extract.h" 41 42 43 /* 44 * For information regarding RESP, see: https://redis.io/topics/protocol 45 */ 46 47 #define RESP_SIMPLE_STRING '+' 48 #define RESP_ERROR '-' 49 #define RESP_INTEGER ':' 50 #define RESP_BULK_STRING '$' 51 #define RESP_ARRAY '*' 52 53 #define resp_print_empty(ndo) ND_PRINT(" empty") 54 #define resp_print_null(ndo) ND_PRINT(" null") 55 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large") 56 #define resp_print_length_negative(ndo) ND_PRINT(" length negative and not -1") 57 #define resp_print_invalid(ndo) ND_PRINT(" invalid") 58 59 static int resp_parse(netdissect_options *, const u_char *, int); 60 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int); 61 static int resp_print_simple_string(netdissect_options *, const u_char *, int); 62 static int resp_print_integer(netdissect_options *, const u_char *, int); 63 static int resp_print_error(netdissect_options *, const u_char *, int); 64 static int resp_print_bulk_string(netdissect_options *, const u_char *, int); 65 static int resp_print_bulk_array(netdissect_options *, const u_char *, int); 66 static int resp_print_inline(netdissect_options *, const u_char *, int); 67 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **); 68 69 #define LCHECK2(_tot_len, _len) \ 70 { \ 71 if (_tot_len < _len) \ 72 goto trunc; \ 73 } 74 75 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1) 76 77 /* 78 * FIND_CRLF: 79 * Attempts to move our 'ptr' forward until a \r\n is found, 80 * while also making sure we don't exceed the buffer '_len' 81 * or go past the end of the captured data. 82 * If we exceed or go past the end of the captured data, 83 * jump to trunc. 84 */ 85 #define FIND_CRLF(_ptr, _len) \ 86 for (;;) { \ 87 LCHECK2(_len, 2); \ 88 ND_TCHECK_2(_ptr); \ 89 if (GET_U_1(_ptr) == '\r' && \ 90 GET_U_1(_ptr+1) == '\n') \ 91 break; \ 92 _ptr++; \ 93 _len--; \ 94 } 95 96 /* 97 * CONSUME_CRLF 98 * Consume a CRLF that we've just found. 99 */ 100 #define CONSUME_CRLF(_ptr, _len) \ 101 _ptr += 2; \ 102 _len -= 2; 103 104 /* 105 * FIND_CR_OR_LF 106 * Attempts to move our '_ptr' forward until a \r or \n is found, 107 * while also making sure we don't exceed the buffer '_len' 108 * or go past the end of the captured data. 109 * If we exceed or go past the end of the captured data, 110 * jump to trunc. 111 */ 112 #define FIND_CR_OR_LF(_ptr, _len) \ 113 for (;;) { \ 114 LCHECK(_len); \ 115 if (GET_U_1(_ptr) == '\r' || \ 116 GET_U_1(_ptr) == '\n') \ 117 break; \ 118 _ptr++; \ 119 _len--; \ 120 } 121 122 /* 123 * CONSUME_CR_OR_LF 124 * Consume all consecutive \r and \n bytes. 125 * If we exceed '_len' or go past the end of the captured data, 126 * jump to trunc. 127 */ 128 #define CONSUME_CR_OR_LF(_ptr, _len) \ 129 { \ 130 int _found_cr_or_lf = 0; \ 131 for (;;) { \ 132 /* \ 133 * Have we hit the end of data? \ 134 */ \ 135 if (_len == 0 || !ND_TTEST_1(_ptr)) {\ 136 /* \ 137 * Yes. Have we seen a \r \ 138 * or \n? \ 139 */ \ 140 if (_found_cr_or_lf) { \ 141 /* \ 142 * Yes. Just stop. \ 143 */ \ 144 break; \ 145 } \ 146 /* \ 147 * No. We ran out of packet. \ 148 */ \ 149 goto trunc; \ 150 } \ 151 if (GET_U_1(_ptr) != '\r' && \ 152 GET_U_1(_ptr) != '\n') \ 153 break; \ 154 _found_cr_or_lf = 1; \ 155 _ptr++; \ 156 _len--; \ 157 } \ 158 } 159 160 /* 161 * SKIP_OPCODE 162 * Skip over the opcode character. 163 * The opcode has already been fetched, so we know it's there, and don't 164 * need to do any checks. 165 */ 166 #define SKIP_OPCODE(_ptr, _tot_len) \ 167 _ptr++; \ 168 _tot_len--; 169 170 /* 171 * GET_LENGTH 172 * Get a bulk string or array length. 173 */ 174 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len) \ 175 { \ 176 const u_char *_endp; \ 177 _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \ 178 _tot_len -= (_endp - _ptr); \ 179 _ptr = _endp; \ 180 } 181 182 /* 183 * TEST_RET_LEN 184 * If ret_len is < 0, jump to the trunc tag which returns (-1) 185 * and 'bubbles up' to printing tstr. Otherwise, return ret_len. 186 */ 187 #define TEST_RET_LEN(rl) \ 188 if (rl < 0) { goto trunc; } else { return rl; } 189 190 /* 191 * TEST_RET_LEN_NORETURN 192 * If ret_len is < 0, jump to the trunc tag which returns (-1) 193 * and 'bubbles up' to printing tstr. Otherwise, continue onward. 194 */ 195 #define TEST_RET_LEN_NORETURN(rl) \ 196 if (rl < 0) { goto trunc; } 197 198 /* 199 * RESP_PRINT_SEGMENT 200 * Prints a segment in the form of: ' "<stuff>"\n" 201 * Assumes the data has already been verified as present. 202 */ 203 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len) \ 204 ND_PRINT(" \""); \ 205 if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \ 206 goto trunc; \ 207 fn_print_char(_ndo, '"'); 208 209 void 210 resp_print(netdissect_options *ndo, const u_char *bp, u_int length) 211 { 212 int ret_len = 0, length_cur = length; 213 214 ndo->ndo_protocol = "resp"; 215 if(!bp || length <= 0) 216 return; 217 218 ND_PRINT(": RESP"); 219 while (length_cur > 0) { 220 /* 221 * This block supports redis pipelining. 222 * For example, multiple operations can be pipelined within the same string: 223 * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n" 224 * or 225 * "PING\r\nPING\r\nPING\r\n" 226 * In order to handle this case, we must try and parse 'bp' until 227 * 'length' bytes have been processed or we reach a trunc condition. 228 */ 229 ret_len = resp_parse(ndo, bp, length_cur); 230 TEST_RET_LEN_NORETURN(ret_len); 231 bp += ret_len; 232 length_cur -= ret_len; 233 } 234 235 return; 236 237 trunc: 238 nd_print_trunc(ndo); 239 } 240 241 static int 242 resp_parse(netdissect_options *ndo, const u_char *bp, int length) 243 { 244 u_char op; 245 int ret_len; 246 247 LCHECK2(length, 1); 248 op = GET_U_1(bp); 249 250 /* bp now points to the op, so these routines must skip it */ 251 switch(op) { 252 case RESP_SIMPLE_STRING: ret_len = resp_print_simple_string(ndo, bp, length); break; 253 case RESP_INTEGER: ret_len = resp_print_integer(ndo, bp, length); break; 254 case RESP_ERROR: ret_len = resp_print_error(ndo, bp, length); break; 255 case RESP_BULK_STRING: ret_len = resp_print_bulk_string(ndo, bp, length); break; 256 case RESP_ARRAY: ret_len = resp_print_bulk_array(ndo, bp, length); break; 257 default: ret_len = resp_print_inline(ndo, bp, length); break; 258 } 259 260 /* 261 * This gives up with a "truncated" indicator for all errors, 262 * including invalid packet errors; that's what we want, as 263 * we have to give up on further parsing in that case. 264 */ 265 TEST_RET_LEN(ret_len); 266 267 trunc: 268 return (-1); 269 } 270 271 static int 272 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) { 273 return resp_print_string_error_integer(ndo, bp, length); 274 } 275 276 static int 277 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) { 278 return resp_print_string_error_integer(ndo, bp, length); 279 } 280 281 static int 282 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) { 283 return resp_print_string_error_integer(ndo, bp, length); 284 } 285 286 static int 287 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) { 288 int length_cur = length, len, ret_len; 289 const u_char *bp_ptr; 290 291 /* bp points to the op; skip it */ 292 SKIP_OPCODE(bp, length_cur); 293 bp_ptr = bp; 294 295 /* 296 * bp now prints past the (+-;) opcode, so it's pointing to the first 297 * character of the string (which could be numeric). 298 * +OK\r\n 299 * -ERR ...\r\n 300 * :02912309\r\n 301 * 302 * Find the \r\n with FIND_CRLF(). 303 */ 304 FIND_CRLF(bp_ptr, length_cur); 305 306 /* 307 * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text 308 * preceding the \r\n. That includes the opcode, so don't print 309 * that. 310 */ 311 len = ND_BYTES_BETWEEN(bp_ptr, bp); 312 RESP_PRINT_SEGMENT(ndo, bp, len); 313 ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/; 314 315 TEST_RET_LEN(ret_len); 316 317 trunc: 318 return (-1); 319 } 320 321 static int 322 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) { 323 int length_cur = length, string_len; 324 325 /* bp points to the op; skip it */ 326 SKIP_OPCODE(bp, length_cur); 327 328 /* <length>\r\n */ 329 GET_LENGTH(ndo, length_cur, bp, string_len); 330 331 if (string_len >= 0) { 332 /* Byte string of length string_len, starting at bp */ 333 if (string_len == 0) 334 resp_print_empty(ndo); 335 else { 336 LCHECK2(length_cur, string_len); 337 ND_TCHECK_LEN(bp, string_len); 338 RESP_PRINT_SEGMENT(ndo, bp, string_len); 339 bp += string_len; 340 length_cur -= string_len; 341 } 342 343 /* 344 * Find the \r\n at the end of the string and skip past it. 345 * XXX - report an error if the \r\n isn't immediately after 346 * the item? 347 */ 348 FIND_CRLF(bp, length_cur); 349 CONSUME_CRLF(bp, length_cur); 350 } else { 351 /* null, truncated, or invalid for some reason */ 352 switch(string_len) { 353 case (-1): resp_print_null(ndo); break; 354 case (-2): goto trunc; 355 case (-3): resp_print_length_too_large(ndo); break; 356 case (-4): resp_print_length_negative(ndo); break; 357 default: resp_print_invalid(ndo); break; 358 } 359 } 360 361 return (length - length_cur); 362 363 trunc: 364 return (-1); 365 } 366 367 static int 368 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) { 369 u_int length_cur = length; 370 int array_len, i, ret_len; 371 372 /* bp points to the op; skip it */ 373 SKIP_OPCODE(bp, length_cur); 374 375 /* <array_length>\r\n */ 376 GET_LENGTH(ndo, length_cur, bp, array_len); 377 378 if (array_len > 0) { 379 /* non empty array */ 380 for (i = 0; i < array_len; i++) { 381 ret_len = resp_parse(ndo, bp, length_cur); 382 383 TEST_RET_LEN_NORETURN(ret_len); 384 385 bp += ret_len; 386 length_cur -= ret_len; 387 } 388 } else { 389 /* empty, null, truncated, or invalid */ 390 switch(array_len) { 391 case 0: resp_print_empty(ndo); break; 392 case (-1): resp_print_null(ndo); break; 393 case (-2): goto trunc; 394 case (-3): resp_print_length_too_large(ndo); break; 395 case (-4): resp_print_length_negative(ndo); break; 396 default: resp_print_invalid(ndo); break; 397 } 398 } 399 400 return (length - length_cur); 401 402 trunc: 403 return (-1); 404 } 405 406 static int 407 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) { 408 int length_cur = length; 409 int len; 410 const u_char *bp_ptr; 411 412 /* 413 * Inline commands are simply 'strings' followed by \r or \n or both. 414 * Redis will do its best to split/parse these strings. 415 * This feature of redis is implemented to support the ability of 416 * command parsing from telnet/nc sessions etc. 417 * 418 * <string><\r||\n||\r\n...> 419 */ 420 421 /* 422 * Skip forward past any leading \r, \n, or \r\n. 423 */ 424 CONSUME_CR_OR_LF(bp, length_cur); 425 bp_ptr = bp; 426 427 /* 428 * Scan forward looking for \r or \n. 429 */ 430 FIND_CR_OR_LF(bp_ptr, length_cur); 431 432 /* 433 * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the 434 * Length of the line text that precedes it. Print it. 435 */ 436 len = ND_BYTES_BETWEEN(bp_ptr, bp); 437 RESP_PRINT_SEGMENT(ndo, bp, len); 438 439 /* 440 * Skip forward past the \r, \n, or \r\n. 441 */ 442 CONSUME_CR_OR_LF(bp_ptr, length_cur); 443 444 /* 445 * Return the number of bytes we processed. 446 */ 447 return (length - length_cur); 448 449 trunc: 450 return (-1); 451 } 452 453 static int 454 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp) 455 { 456 int result; 457 u_char c; 458 int saw_digit; 459 int neg; 460 int too_large; 461 462 if (len == 0) 463 goto trunc; 464 too_large = 0; 465 neg = 0; 466 if (GET_U_1(bp) == '-') { 467 neg = 1; 468 bp++; 469 len--; 470 } 471 result = 0; 472 saw_digit = 0; 473 474 for (;;) { 475 if (len == 0) 476 goto trunc; 477 c = GET_U_1(bp); 478 if (!(c >= '0' && c <= '9')) { 479 if (!saw_digit) { 480 bp++; 481 goto invalid; 482 } 483 break; 484 } 485 c -= '0'; 486 if (result > (INT_MAX / 10)) { 487 /* This will overflow an int when we multiply it by 10. */ 488 too_large = 1; 489 } else { 490 result *= 10; 491 if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) { 492 /* This will overflow an int when we add c */ 493 too_large = 1; 494 } else 495 result += c; 496 } 497 bp++; 498 len--; 499 saw_digit = 1; 500 } 501 502 /* 503 * OK, we found a non-digit character. It should be a \r, followed 504 * by a \n. 505 */ 506 if (GET_U_1(bp) != '\r') { 507 bp++; 508 goto invalid; 509 } 510 bp++; 511 len--; 512 if (len == 0) 513 goto trunc; 514 if (GET_U_1(bp) != '\n') { 515 bp++; 516 goto invalid; 517 } 518 bp++; 519 len--; 520 *endp = bp; 521 if (neg) { 522 /* -1 means "null", anything else is invalid */ 523 if (too_large || result != 1) 524 return (-4); 525 result = -1; 526 } 527 return (too_large ? -3 : result); 528 529 trunc: 530 *endp = bp; 531 return (-2); 532 533 invalid: 534 *endp = bp; 535 return (-5); 536 } 537