1 /* 2 * Copyright (c) 2015 The TCPDUMP project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 15 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 16 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 17 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 18 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 22 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 24 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 * 27 * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com). 28 */ 29 30 /* \summary: REdis Serialization Protocol (RESP) printer */ 31 32 #ifdef HAVE_CONFIG_H 33 #include <config.h> 34 #endif 35 36 #include "netdissect-stdinc.h" 37 #include "netdissect.h" 38 #include <limits.h> 39 40 #include "extract.h" 41 42 43 /* 44 * For information regarding RESP, see: https://redis.io/topics/protocol 45 */ 46 47 #define RESP_SIMPLE_STRING '+' 48 #define RESP_ERROR '-' 49 #define RESP_INTEGER ':' 50 #define RESP_BULK_STRING '$' 51 #define RESP_ARRAY '*' 52 53 #define resp_print_empty(ndo) ND_PRINT(" empty") 54 #define resp_print_null(ndo) ND_PRINT(" null") 55 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large") 56 #define resp_print_length_negative(ndo) ND_PRINT(" length negative and not -1") 57 #define resp_print_invalid(ndo) ND_PRINT(" invalid") 58 59 static int resp_parse(netdissect_options *, const u_char *, int); 60 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int); 61 static int resp_print_simple_string(netdissect_options *, const u_char *, int); 62 static int resp_print_integer(netdissect_options *, const u_char *, int); 63 static int resp_print_error(netdissect_options *, const u_char *, int); 64 static int resp_print_bulk_string(netdissect_options *, const u_char *, int); 65 static int resp_print_bulk_array(netdissect_options *, const u_char *, int); 66 static int resp_print_inline(netdissect_options *, const u_char *, int); 67 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **); 68 69 #define LCHECK2(_tot_len, _len) \ 70 { \ 71 if (_tot_len < _len) \ 72 goto trunc; \ 73 } 74 75 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1) 76 77 /* 78 * FIND_CRLF: 79 * Attempts to move our 'ptr' forward until a \r\n is found, 80 * while also making sure we don't exceed the buffer '_len' 81 * or go past the end of the captured data. 82 * If we exceed or go past the end of the captured data, 83 * jump to trunc. 84 */ 85 #define FIND_CRLF(_ptr, _len) \ 86 for (;;) { \ 87 LCHECK2(_len, 2); \ 88 ND_TCHECK_2(_ptr); \ 89 if (GET_U_1(_ptr) == '\r' && \ 90 GET_U_1(_ptr+1) == '\n') \ 91 break; \ 92 _ptr++; \ 93 _len--; \ 94 } 95 96 /* 97 * CONSUME_CRLF 98 * Consume a CRLF that we've just found. 99 */ 100 #define CONSUME_CRLF(_ptr, _len) \ 101 _ptr += 2; \ 102 _len -= 2; 103 104 /* 105 * FIND_CR_OR_LF 106 * Attempts to move our '_ptr' forward until a \r or \n is found, 107 * while also making sure we don't exceed the buffer '_len' 108 * or go past the end of the captured data. 109 * If we exceed or go past the end of the captured data, 110 * jump to trunc. 111 */ 112 #define FIND_CR_OR_LF(_ptr, _len) \ 113 for (;;) { \ 114 LCHECK(_len); \ 115 if (GET_U_1(_ptr) == '\r' || \ 116 GET_U_1(_ptr) == '\n') \ 117 break; \ 118 _ptr++; \ 119 _len--; \ 120 } 121 122 /* 123 * CONSUME_CR_OR_LF 124 * Consume all consecutive \r and \n bytes. 125 * If we exceed '_len' or go past the end of the captured data, 126 * jump to trunc. 127 */ 128 #define CONSUME_CR_OR_LF(_ptr, _len) \ 129 { \ 130 int _found_cr_or_lf = 0; \ 131 for (;;) { \ 132 /* \ 133 * Have we hit the end of data? \ 134 */ \ 135 if (_len == 0 || !ND_TTEST_1(_ptr)) {\ 136 /* \ 137 * Yes. Have we seen a \r \ 138 * or \n? \ 139 */ \ 140 if (_found_cr_or_lf) { \ 141 /* \ 142 * Yes. Just stop. \ 143 */ \ 144 break; \ 145 } \ 146 /* \ 147 * No. We ran out of packet. \ 148 */ \ 149 goto trunc; \ 150 } \ 151 if (GET_U_1(_ptr) != '\r' && \ 152 GET_U_1(_ptr) != '\n') \ 153 break; \ 154 _found_cr_or_lf = 1; \ 155 _ptr++; \ 156 _len--; \ 157 } \ 158 } 159 160 /* 161 * SKIP_OPCODE 162 * Skip over the opcode character. 163 * The opcode has already been fetched, so we know it's there, and don't 164 * need to do any checks. 165 */ 166 #define SKIP_OPCODE(_ptr, _tot_len) \ 167 _ptr++; \ 168 _tot_len--; 169 170 /* 171 * GET_LENGTH 172 * Get a bulk string or array length. 173 */ 174 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len) \ 175 { \ 176 const u_char *_endp; \ 177 _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \ 178 _tot_len -= (_endp - _ptr); \ 179 _ptr = _endp; \ 180 } 181 182 /* 183 * TEST_RET_LEN 184 * If ret_len is < 0, jump to the trunc tag which returns (-1) 185 * and 'bubbles up' to printing tstr. Otherwise, return ret_len. 186 */ 187 #define TEST_RET_LEN(rl) \ 188 if (rl < 0) { goto trunc; } else { return rl; } 189 190 /* 191 * TEST_RET_LEN_NORETURN 192 * If ret_len is < 0, jump to the trunc tag which returns (-1) 193 * and 'bubbles up' to printing tstr. Otherwise, continue onward. 194 */ 195 #define TEST_RET_LEN_NORETURN(rl) \ 196 if (rl < 0) { goto trunc; } 197 198 /* 199 * RESP_PRINT_SEGMENT 200 * Prints a segment in the form of: ' "<stuff>"\n" 201 * Assumes the data has already been verified as present. 202 */ 203 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len) \ 204 ND_PRINT(" \""); \ 205 if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \ 206 goto trunc; \ 207 fn_print_char(_ndo, '"'); 208 209 void 210 resp_print(netdissect_options *ndo, const u_char *bp, u_int length) 211 { 212 int ret_len = 0; 213 214 ndo->ndo_protocol = "resp"; 215 216 ND_PRINT(": RESP"); 217 while (length > 0) { 218 /* 219 * This block supports redis pipelining. 220 * For example, multiple operations can be pipelined within the same string: 221 * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n" 222 * or 223 * "PING\r\nPING\r\nPING\r\n" 224 * In order to handle this case, we must try and parse 'bp' until 225 * 'length' bytes have been processed or we reach a trunc condition. 226 */ 227 ret_len = resp_parse(ndo, bp, length); 228 TEST_RET_LEN_NORETURN(ret_len); 229 bp += ret_len; 230 length -= ret_len; 231 } 232 233 return; 234 235 trunc: 236 nd_print_trunc(ndo); 237 } 238 239 static int 240 resp_parse(netdissect_options *ndo, const u_char *bp, int length) 241 { 242 u_char op; 243 int ret_len; 244 245 LCHECK2(length, 1); 246 op = GET_U_1(bp); 247 248 /* bp now points to the op, so these routines must skip it */ 249 switch(op) { 250 case RESP_SIMPLE_STRING: ret_len = resp_print_simple_string(ndo, bp, length); break; 251 case RESP_INTEGER: ret_len = resp_print_integer(ndo, bp, length); break; 252 case RESP_ERROR: ret_len = resp_print_error(ndo, bp, length); break; 253 case RESP_BULK_STRING: ret_len = resp_print_bulk_string(ndo, bp, length); break; 254 case RESP_ARRAY: ret_len = resp_print_bulk_array(ndo, bp, length); break; 255 default: ret_len = resp_print_inline(ndo, bp, length); break; 256 } 257 258 /* 259 * This gives up with a "truncated" indicator for all errors, 260 * including invalid packet errors; that's what we want, as 261 * we have to give up on further parsing in that case. 262 */ 263 TEST_RET_LEN(ret_len); 264 265 trunc: 266 return (-1); 267 } 268 269 static int 270 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) { 271 return resp_print_string_error_integer(ndo, bp, length); 272 } 273 274 static int 275 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) { 276 return resp_print_string_error_integer(ndo, bp, length); 277 } 278 279 static int 280 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) { 281 return resp_print_string_error_integer(ndo, bp, length); 282 } 283 284 static int 285 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) { 286 int length_cur = length, len, ret_len; 287 const u_char *bp_ptr; 288 289 /* bp points to the op; skip it */ 290 SKIP_OPCODE(bp, length_cur); 291 bp_ptr = bp; 292 293 /* 294 * bp now prints past the (+-;) opcode, so it's pointing to the first 295 * character of the string (which could be numeric). 296 * +OK\r\n 297 * -ERR ...\r\n 298 * :02912309\r\n 299 * 300 * Find the \r\n with FIND_CRLF(). 301 */ 302 FIND_CRLF(bp_ptr, length_cur); 303 304 /* 305 * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text 306 * preceding the \r\n. That includes the opcode, so don't print 307 * that. 308 */ 309 len = ND_BYTES_BETWEEN(bp_ptr, bp); 310 RESP_PRINT_SEGMENT(ndo, bp, len); 311 ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/; 312 313 TEST_RET_LEN(ret_len); 314 315 trunc: 316 return (-1); 317 } 318 319 static int 320 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) { 321 int length_cur = length, string_len; 322 323 /* bp points to the op; skip it */ 324 SKIP_OPCODE(bp, length_cur); 325 326 /* <length>\r\n */ 327 GET_LENGTH(ndo, length_cur, bp, string_len); 328 329 if (string_len >= 0) { 330 /* Byte string of length string_len, starting at bp */ 331 if (string_len == 0) 332 resp_print_empty(ndo); 333 else { 334 LCHECK2(length_cur, string_len); 335 ND_TCHECK_LEN(bp, string_len); 336 RESP_PRINT_SEGMENT(ndo, bp, string_len); 337 bp += string_len; 338 length_cur -= string_len; 339 } 340 341 /* 342 * Find the \r\n at the end of the string and skip past it. 343 * XXX - report an error if the \r\n isn't immediately after 344 * the item? 345 */ 346 FIND_CRLF(bp, length_cur); 347 CONSUME_CRLF(bp, length_cur); 348 } else { 349 /* null, truncated, or invalid for some reason */ 350 switch(string_len) { 351 case (-1): resp_print_null(ndo); break; 352 case (-2): goto trunc; 353 case (-3): resp_print_length_too_large(ndo); break; 354 case (-4): resp_print_length_negative(ndo); break; 355 default: resp_print_invalid(ndo); break; 356 } 357 } 358 359 return (length - length_cur); 360 361 trunc: 362 return (-1); 363 } 364 365 static int 366 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) { 367 u_int length_cur = length; 368 int array_len, i, ret_len; 369 370 /* bp points to the op; skip it */ 371 SKIP_OPCODE(bp, length_cur); 372 373 /* <array_length>\r\n */ 374 GET_LENGTH(ndo, length_cur, bp, array_len); 375 376 if (array_len > 0) { 377 /* non empty array */ 378 for (i = 0; i < array_len; i++) { 379 ret_len = resp_parse(ndo, bp, length_cur); 380 381 TEST_RET_LEN_NORETURN(ret_len); 382 383 bp += ret_len; 384 length_cur -= ret_len; 385 } 386 } else { 387 /* empty, null, truncated, or invalid */ 388 switch(array_len) { 389 case 0: resp_print_empty(ndo); break; 390 case (-1): resp_print_null(ndo); break; 391 case (-2): goto trunc; 392 case (-3): resp_print_length_too_large(ndo); break; 393 case (-4): resp_print_length_negative(ndo); break; 394 default: resp_print_invalid(ndo); break; 395 } 396 } 397 398 return (length - length_cur); 399 400 trunc: 401 return (-1); 402 } 403 404 static int 405 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) { 406 int length_cur = length; 407 int len; 408 const u_char *bp_ptr; 409 410 /* 411 * Inline commands are simply 'strings' followed by \r or \n or both. 412 * Redis will do its best to split/parse these strings. 413 * This feature of redis is implemented to support the ability of 414 * command parsing from telnet/nc sessions etc. 415 * 416 * <string><\r||\n||\r\n...> 417 */ 418 419 /* 420 * Skip forward past any leading \r, \n, or \r\n. 421 */ 422 CONSUME_CR_OR_LF(bp, length_cur); 423 bp_ptr = bp; 424 425 /* 426 * Scan forward looking for \r or \n. 427 */ 428 FIND_CR_OR_LF(bp_ptr, length_cur); 429 430 /* 431 * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the 432 * Length of the line text that precedes it. Print it. 433 */ 434 len = ND_BYTES_BETWEEN(bp_ptr, bp); 435 RESP_PRINT_SEGMENT(ndo, bp, len); 436 437 /* 438 * Skip forward past the \r, \n, or \r\n. 439 */ 440 CONSUME_CR_OR_LF(bp_ptr, length_cur); 441 442 /* 443 * Return the number of bytes we processed. 444 */ 445 return (length - length_cur); 446 447 trunc: 448 return (-1); 449 } 450 451 static int 452 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp) 453 { 454 int result; 455 u_char c; 456 int saw_digit; 457 int neg; 458 int too_large; 459 460 if (len == 0) 461 goto trunc; 462 too_large = 0; 463 neg = 0; 464 if (GET_U_1(bp) == '-') { 465 neg = 1; 466 bp++; 467 len--; 468 } 469 result = 0; 470 saw_digit = 0; 471 472 for (;;) { 473 if (len == 0) 474 goto trunc; 475 c = GET_U_1(bp); 476 if (!(c >= '0' && c <= '9')) { 477 if (!saw_digit) { 478 bp++; 479 goto invalid; 480 } 481 break; 482 } 483 c -= '0'; 484 if (result > (INT_MAX / 10)) { 485 /* This will overflow an int when we multiply it by 10. */ 486 too_large = 1; 487 } else { 488 result *= 10; 489 if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) { 490 /* This will overflow an int when we add c */ 491 too_large = 1; 492 } else 493 result += c; 494 } 495 bp++; 496 len--; 497 saw_digit = 1; 498 } 499 500 /* 501 * OK, we found a non-digit character. It should be a \r, followed 502 * by a \n. 503 */ 504 if (GET_U_1(bp) != '\r') { 505 bp++; 506 goto invalid; 507 } 508 bp++; 509 len--; 510 if (len == 0) 511 goto trunc; 512 if (GET_U_1(bp) != '\n') { 513 bp++; 514 goto invalid; 515 } 516 bp++; 517 len--; 518 *endp = bp; 519 if (neg) { 520 /* -1 means "null", anything else is invalid */ 521 if (too_large || result != 1) 522 return (-4); 523 result = -1; 524 } 525 return (too_large ? -3 : result); 526 527 trunc: 528 *endp = bp; 529 return (-2); 530 531 invalid: 532 *endp = bp; 533 return (-5); 534 } 535