1 /*
2 * Copyright (c) 2015 The TCPDUMP project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
15 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
16 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
17 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
18 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
20 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
21 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
22 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
24 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25 * POSSIBILITY OF SUCH DAMAGE.
26 *
27 * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com).
28 */
29
30 /* \summary: REdis Serialization Protocol (RESP) printer */
31
32 #ifdef HAVE_CONFIG_H
33 #include <config.h>
34 #endif
35
36 #include "netdissect-stdinc.h"
37 #include "netdissect.h"
38 #include <limits.h>
39
40 #include "extract.h"
41
42
43 /*
44 * For information regarding RESP, see: https://redis.io/topics/protocol
45 */
46
47 #define RESP_SIMPLE_STRING '+'
48 #define RESP_ERROR '-'
49 #define RESP_INTEGER ':'
50 #define RESP_BULK_STRING '$'
51 #define RESP_ARRAY '*'
52
53 #define resp_print_empty(ndo) ND_PRINT(" empty")
54 #define resp_print_null(ndo) ND_PRINT(" null")
55 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large")
56 #define resp_print_length_negative(ndo) ND_PRINT(" length negative and not -1")
57 #define resp_print_invalid(ndo) ND_PRINT(" invalid")
58
59 static int resp_parse(netdissect_options *, const u_char *, int);
60 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int);
61 static int resp_print_simple_string(netdissect_options *, const u_char *, int);
62 static int resp_print_integer(netdissect_options *, const u_char *, int);
63 static int resp_print_error(netdissect_options *, const u_char *, int);
64 static int resp_print_bulk_string(netdissect_options *, const u_char *, int);
65 static int resp_print_bulk_array(netdissect_options *, const u_char *, int);
66 static int resp_print_inline(netdissect_options *, const u_char *, int);
67 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **);
68
69 #define LCHECK2(_tot_len, _len) \
70 { \
71 if (_tot_len < _len) \
72 goto trunc; \
73 }
74
75 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1)
76
77 /*
78 * FIND_CRLF:
79 * Attempts to move our 'ptr' forward until a \r\n is found,
80 * while also making sure we don't exceed the buffer '_len'
81 * or go past the end of the captured data.
82 * If we exceed or go past the end of the captured data,
83 * jump to trunc.
84 */
85 #define FIND_CRLF(_ptr, _len) \
86 for (;;) { \
87 LCHECK2(_len, 2); \
88 ND_TCHECK_2(_ptr); \
89 if (GET_U_1(_ptr) == '\r' && \
90 GET_U_1(_ptr+1) == '\n') \
91 break; \
92 _ptr++; \
93 _len--; \
94 }
95
96 /*
97 * CONSUME_CRLF
98 * Consume a CRLF that we've just found.
99 */
100 #define CONSUME_CRLF(_ptr, _len) \
101 _ptr += 2; \
102 _len -= 2;
103
104 /*
105 * FIND_CR_OR_LF
106 * Attempts to move our '_ptr' forward until a \r or \n is found,
107 * while also making sure we don't exceed the buffer '_len'
108 * or go past the end of the captured data.
109 * If we exceed or go past the end of the captured data,
110 * jump to trunc.
111 */
112 #define FIND_CR_OR_LF(_ptr, _len) \
113 for (;;) { \
114 LCHECK(_len); \
115 if (GET_U_1(_ptr) == '\r' || \
116 GET_U_1(_ptr) == '\n') \
117 break; \
118 _ptr++; \
119 _len--; \
120 }
121
122 /*
123 * CONSUME_CR_OR_LF
124 * Consume all consecutive \r and \n bytes.
125 * If we exceed '_len' or go past the end of the captured data,
126 * jump to trunc.
127 */
128 #define CONSUME_CR_OR_LF(_ptr, _len) \
129 { \
130 int _found_cr_or_lf = 0; \
131 for (;;) { \
132 /* \
133 * Have we hit the end of data? \
134 */ \
135 if (_len == 0 || !ND_TTEST_1(_ptr)) {\
136 /* \
137 * Yes. Have we seen a \r \
138 * or \n? \
139 */ \
140 if (_found_cr_or_lf) { \
141 /* \
142 * Yes. Just stop. \
143 */ \
144 break; \
145 } \
146 /* \
147 * No. We ran out of packet. \
148 */ \
149 goto trunc; \
150 } \
151 if (GET_U_1(_ptr) != '\r' && \
152 GET_U_1(_ptr) != '\n') \
153 break; \
154 _found_cr_or_lf = 1; \
155 _ptr++; \
156 _len--; \
157 } \
158 }
159
160 /*
161 * SKIP_OPCODE
162 * Skip over the opcode character.
163 * The opcode has already been fetched, so we know it's there, and don't
164 * need to do any checks.
165 */
166 #define SKIP_OPCODE(_ptr, _tot_len) \
167 _ptr++; \
168 _tot_len--;
169
170 /*
171 * GET_LENGTH
172 * Get a bulk string or array length.
173 */
174 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len) \
175 { \
176 const u_char *_endp; \
177 _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \
178 _tot_len -= (_endp - _ptr); \
179 _ptr = _endp; \
180 }
181
182 /*
183 * TEST_RET_LEN
184 * If ret_len is < 0, jump to the trunc tag which returns (-1)
185 * and 'bubbles up' to printing tstr. Otherwise, return ret_len.
186 */
187 #define TEST_RET_LEN(rl) \
188 if (rl < 0) { goto trunc; } else { return rl; }
189
190 /*
191 * TEST_RET_LEN_NORETURN
192 * If ret_len is < 0, jump to the trunc tag which returns (-1)
193 * and 'bubbles up' to printing tstr. Otherwise, continue onward.
194 */
195 #define TEST_RET_LEN_NORETURN(rl) \
196 if (rl < 0) { goto trunc; }
197
198 /*
199 * RESP_PRINT_SEGMENT
200 * Prints a segment in the form of: ' "<stuff>"\n"
201 * Assumes the data has already been verified as present.
202 */
203 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len) \
204 ND_PRINT(" \""); \
205 if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \
206 goto trunc; \
207 fn_print_char(_ndo, '"');
208
209 void
resp_print(netdissect_options * ndo,const u_char * bp,u_int length)210 resp_print(netdissect_options *ndo, const u_char *bp, u_int length)
211 {
212 int ret_len = 0;
213
214 ndo->ndo_protocol = "resp";
215
216 ND_PRINT(": RESP");
217 while (length > 0) {
218 /*
219 * This block supports redis pipelining.
220 * For example, multiple operations can be pipelined within the same string:
221 * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n"
222 * or
223 * "PING\r\nPING\r\nPING\r\n"
224 * In order to handle this case, we must try and parse 'bp' until
225 * 'length' bytes have been processed or we reach a trunc condition.
226 */
227 ret_len = resp_parse(ndo, bp, length);
228 TEST_RET_LEN_NORETURN(ret_len);
229 bp += ret_len;
230 length -= ret_len;
231 }
232
233 return;
234
235 trunc:
236 nd_print_trunc(ndo);
237 }
238
239 static int
resp_parse(netdissect_options * ndo,const u_char * bp,int length)240 resp_parse(netdissect_options *ndo, const u_char *bp, int length)
241 {
242 u_char op;
243 int ret_len;
244
245 LCHECK2(length, 1);
246 op = GET_U_1(bp);
247
248 /* bp now points to the op, so these routines must skip it */
249 switch(op) {
250 case RESP_SIMPLE_STRING: ret_len = resp_print_simple_string(ndo, bp, length); break;
251 case RESP_INTEGER: ret_len = resp_print_integer(ndo, bp, length); break;
252 case RESP_ERROR: ret_len = resp_print_error(ndo, bp, length); break;
253 case RESP_BULK_STRING: ret_len = resp_print_bulk_string(ndo, bp, length); break;
254 case RESP_ARRAY: ret_len = resp_print_bulk_array(ndo, bp, length); break;
255 default: ret_len = resp_print_inline(ndo, bp, length); break;
256 }
257
258 /*
259 * This gives up with a "truncated" indicator for all errors,
260 * including invalid packet errors; that's what we want, as
261 * we have to give up on further parsing in that case.
262 */
263 TEST_RET_LEN(ret_len);
264
265 trunc:
266 return (-1);
267 }
268
269 static int
resp_print_simple_string(netdissect_options * ndo,const u_char * bp,int length)270 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) {
271 return resp_print_string_error_integer(ndo, bp, length);
272 }
273
274 static int
resp_print_integer(netdissect_options * ndo,const u_char * bp,int length)275 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) {
276 return resp_print_string_error_integer(ndo, bp, length);
277 }
278
279 static int
resp_print_error(netdissect_options * ndo,const u_char * bp,int length)280 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) {
281 return resp_print_string_error_integer(ndo, bp, length);
282 }
283
284 static int
resp_print_string_error_integer(netdissect_options * ndo,const u_char * bp,int length)285 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) {
286 int length_cur = length, len, ret_len;
287 const u_char *bp_ptr;
288
289 /* bp points to the op; skip it */
290 SKIP_OPCODE(bp, length_cur);
291 bp_ptr = bp;
292
293 /*
294 * bp now prints past the (+-;) opcode, so it's pointing to the first
295 * character of the string (which could be numeric).
296 * +OK\r\n
297 * -ERR ...\r\n
298 * :02912309\r\n
299 *
300 * Find the \r\n with FIND_CRLF().
301 */
302 FIND_CRLF(bp_ptr, length_cur);
303
304 /*
305 * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text
306 * preceding the \r\n. That includes the opcode, so don't print
307 * that.
308 */
309 len = ND_BYTES_BETWEEN(bp_ptr, bp);
310 RESP_PRINT_SEGMENT(ndo, bp, len);
311 ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/;
312
313 TEST_RET_LEN(ret_len);
314
315 trunc:
316 return (-1);
317 }
318
319 static int
resp_print_bulk_string(netdissect_options * ndo,const u_char * bp,int length)320 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) {
321 int length_cur = length, string_len;
322
323 /* bp points to the op; skip it */
324 SKIP_OPCODE(bp, length_cur);
325
326 /* <length>\r\n */
327 GET_LENGTH(ndo, length_cur, bp, string_len);
328
329 if (string_len >= 0) {
330 /* Byte string of length string_len, starting at bp */
331 if (string_len == 0)
332 resp_print_empty(ndo);
333 else {
334 LCHECK2(length_cur, string_len);
335 ND_TCHECK_LEN(bp, string_len);
336 RESP_PRINT_SEGMENT(ndo, bp, string_len);
337 bp += string_len;
338 length_cur -= string_len;
339 }
340
341 /*
342 * Find the \r\n at the end of the string and skip past it.
343 * XXX - report an error if the \r\n isn't immediately after
344 * the item?
345 */
346 FIND_CRLF(bp, length_cur);
347 CONSUME_CRLF(bp, length_cur);
348 } else {
349 /* null, truncated, or invalid for some reason */
350 switch(string_len) {
351 case (-1): resp_print_null(ndo); break;
352 case (-2): goto trunc;
353 case (-3): resp_print_length_too_large(ndo); break;
354 case (-4): resp_print_length_negative(ndo); break;
355 default: resp_print_invalid(ndo); break;
356 }
357 }
358
359 return (length - length_cur);
360
361 trunc:
362 return (-1);
363 }
364
365 static int
resp_print_bulk_array(netdissect_options * ndo,const u_char * bp,int length)366 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) {
367 u_int length_cur = length;
368 int array_len, i, ret_len;
369
370 /* bp points to the op; skip it */
371 SKIP_OPCODE(bp, length_cur);
372
373 /* <array_length>\r\n */
374 GET_LENGTH(ndo, length_cur, bp, array_len);
375
376 if (array_len > 0) {
377 /* non empty array */
378 for (i = 0; i < array_len; i++) {
379 ret_len = resp_parse(ndo, bp, length_cur);
380
381 TEST_RET_LEN_NORETURN(ret_len);
382
383 bp += ret_len;
384 length_cur -= ret_len;
385 }
386 } else {
387 /* empty, null, truncated, or invalid */
388 switch(array_len) {
389 case 0: resp_print_empty(ndo); break;
390 case (-1): resp_print_null(ndo); break;
391 case (-2): goto trunc;
392 case (-3): resp_print_length_too_large(ndo); break;
393 case (-4): resp_print_length_negative(ndo); break;
394 default: resp_print_invalid(ndo); break;
395 }
396 }
397
398 return (length - length_cur);
399
400 trunc:
401 return (-1);
402 }
403
404 static int
resp_print_inline(netdissect_options * ndo,const u_char * bp,int length)405 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) {
406 int length_cur = length;
407 int len;
408 const u_char *bp_ptr;
409
410 /*
411 * Inline commands are simply 'strings' followed by \r or \n or both.
412 * Redis will do its best to split/parse these strings.
413 * This feature of redis is implemented to support the ability of
414 * command parsing from telnet/nc sessions etc.
415 *
416 * <string><\r||\n||\r\n...>
417 */
418
419 /*
420 * Skip forward past any leading \r, \n, or \r\n.
421 */
422 CONSUME_CR_OR_LF(bp, length_cur);
423 bp_ptr = bp;
424
425 /*
426 * Scan forward looking for \r or \n.
427 */
428 FIND_CR_OR_LF(bp_ptr, length_cur);
429
430 /*
431 * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the
432 * Length of the line text that precedes it. Print it.
433 */
434 len = ND_BYTES_BETWEEN(bp_ptr, bp);
435 RESP_PRINT_SEGMENT(ndo, bp, len);
436
437 /*
438 * Skip forward past the \r, \n, or \r\n.
439 */
440 CONSUME_CR_OR_LF(bp_ptr, length_cur);
441
442 /*
443 * Return the number of bytes we processed.
444 */
445 return (length - length_cur);
446
447 trunc:
448 return (-1);
449 }
450
451 static int
resp_get_length(netdissect_options * ndo,const u_char * bp,int len,const u_char ** endp)452 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp)
453 {
454 int result;
455 u_char c;
456 int saw_digit;
457 int neg;
458 int too_large;
459
460 if (len == 0)
461 goto trunc;
462 too_large = 0;
463 neg = 0;
464 if (GET_U_1(bp) == '-') {
465 neg = 1;
466 bp++;
467 len--;
468 }
469 result = 0;
470 saw_digit = 0;
471
472 for (;;) {
473 if (len == 0)
474 goto trunc;
475 c = GET_U_1(bp);
476 if (!(c >= '0' && c <= '9')) {
477 if (!saw_digit) {
478 bp++;
479 goto invalid;
480 }
481 break;
482 }
483 c -= '0';
484 if (result > (INT_MAX / 10)) {
485 /* This will overflow an int when we multiply it by 10. */
486 too_large = 1;
487 } else {
488 result *= 10;
489 if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) {
490 /* This will overflow an int when we add c */
491 too_large = 1;
492 } else
493 result += c;
494 }
495 bp++;
496 len--;
497 saw_digit = 1;
498 }
499
500 /*
501 * OK, we found a non-digit character. It should be a \r, followed
502 * by a \n.
503 */
504 if (GET_U_1(bp) != '\r') {
505 bp++;
506 goto invalid;
507 }
508 bp++;
509 len--;
510 if (len == 0)
511 goto trunc;
512 if (GET_U_1(bp) != '\n') {
513 bp++;
514 goto invalid;
515 }
516 bp++;
517 len--;
518 *endp = bp;
519 if (neg) {
520 /* -1 means "null", anything else is invalid */
521 if (too_large || result != 1)
522 return (-4);
523 result = -1;
524 }
525 return (too_large ? -3 : result);
526
527 trunc:
528 *endp = bp;
529 return (-2);
530
531 invalid:
532 *endp = bp;
533 return (-5);
534 }
535