1 /*
2  * Copyright (c) 2015 The TCPDUMP project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
15  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
16  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
17  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
18  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
20  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
21  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
22  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
24  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  *
27  * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com).
28  */
29 
30 /* \summary: REdis Serialization Protocol (RESP) printer */
31 
32 #ifdef HAVE_CONFIG_H
33 #include "config.h"
34 #endif
35 
36 #include <netdissect-stdinc.h>
37 #include "netdissect.h"
38 #include <limits.h>
39 #include <string.h>
40 #include <stdlib.h>
41 #include <errno.h>
42 
43 #include "extract.h"
44 
45 static const char tstr[] = " [|RESP]";
46 
47 /*
48  * For information regarding RESP, see: http://redis.io/topics/protocol
49  */
50 
51 #define RESP_SIMPLE_STRING    '+'
52 #define RESP_ERROR            '-'
53 #define RESP_INTEGER          ':'
54 #define RESP_BULK_STRING      '$'
55 #define RESP_ARRAY            '*'
56 
57 #define resp_print_empty(ndo)            ND_PRINT((ndo, " empty"))
58 #define resp_print_null(ndo)             ND_PRINT((ndo, " null"))
59 #define resp_print_length_too_large(ndo) ND_PRINT((ndo, " length too large"))
60 #define resp_print_length_negative(ndo)  ND_PRINT((ndo, " length negative and not -1"))
61 #define resp_print_invalid(ndo)          ND_PRINT((ndo, " invalid"))
62 
63 void       resp_print(netdissect_options *, const u_char *, u_int);
64 static int resp_parse(netdissect_options *, register const u_char *, int);
65 static int resp_print_string_error_integer(netdissect_options *, register const u_char *, int);
66 static int resp_print_simple_string(netdissect_options *, register const u_char *, int);
67 static int resp_print_integer(netdissect_options *, register const u_char *, int);
68 static int resp_print_error(netdissect_options *, register const u_char *, int);
69 static int resp_print_bulk_string(netdissect_options *, register const u_char *, int);
70 static int resp_print_bulk_array(netdissect_options *, register const u_char *, int);
71 static int resp_print_inline(netdissect_options *, register const u_char *, int);
72 static int resp_get_length(netdissect_options *, register const u_char *, int, const u_char **);
73 
74 #define LCHECK2(_tot_len, _len) \
75     {                           \
76         if (_tot_len < _len)    \
77             goto trunc;         \
78     }
79 
80 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1)
81 
82 /*
83  * FIND_CRLF:
84  * Attempts to move our 'ptr' forward until a \r\n is found,
85  * while also making sure we don't exceed the buffer '_len'
86  * or go past the end of the captured data.
87  * If we exceed or go past the end of the captured data,
88  * jump to trunc.
89  */
90 #define FIND_CRLF(_ptr, _len)                   \
91     for (;;) {                                  \
92         LCHECK2(_len, 2);                       \
93         ND_TCHECK2(*_ptr, 2);                   \
94         if (*_ptr == '\r' && *(_ptr+1) == '\n') \
95             break;                              \
96         _ptr++;                                 \
97         _len--;                                 \
98     }
99 
100 /*
101  * CONSUME_CRLF
102  * Consume a CRLF that we've just found.
103  */
104 #define CONSUME_CRLF(_ptr, _len) \
105     _ptr += 2;                   \
106     _len -= 2;
107 
108 /*
109  * FIND_CR_OR_LF
110  * Attempts to move our '_ptr' forward until a \r or \n is found,
111  * while also making sure we don't exceed the buffer '_len'
112  * or go past the end of the captured data.
113  * If we exceed or go past the end of the captured data,
114  * jump to trunc.
115  */
116 #define FIND_CR_OR_LF(_ptr, _len)           \
117     for (;;) {                              \
118         LCHECK(_len);                       \
119         ND_TCHECK(*_ptr);                   \
120         if (*_ptr == '\r' || *_ptr == '\n') \
121             break;                          \
122         _ptr++;                             \
123         _len--;                             \
124     }
125 
126 /*
127  * CONSUME_CR_OR_LF
128  * Consume all consecutive \r and \n bytes.
129  * If we exceed '_len' or go past the end of the captured data,
130  * jump to trunc.
131  */
132 #define CONSUME_CR_OR_LF(_ptr, _len)             \
133     {                                            \
134         int _found_cr_or_lf = 0;                 \
135         for (;;) {                               \
136             /*                                   \
137              * Have we hit the end of data?      \
138              */                                  \
139             if (_len == 0 || !ND_TTEST(*_ptr)) { \
140                 /*                               \
141                  * Yes.  Have we seen a \r       \
142                  * or \n?                        \
143                  */                              \
144                 if (_found_cr_or_lf) {           \
145                     /*                           \
146                      * Yes.  Just stop.          \
147                      */                          \
148                     break;                       \
149                 }                                \
150                 /*                               \
151                  * No.  We ran out of packet.    \
152                  */                              \
153                 goto trunc;                      \
154             }                                    \
155             if (*_ptr != '\r' && *_ptr != '\n')  \
156                 break;                           \
157             _found_cr_or_lf = 1;                 \
158             _ptr++;                              \
159             _len--;                              \
160         }                                        \
161     }
162 
163 /*
164  * SKIP_OPCODE
165  * Skip over the opcode character.
166  * The opcode has already been fetched, so we know it's there, and don't
167  * need to do any checks.
168  */
169 #define SKIP_OPCODE(_ptr, _tot_len) \
170     _ptr++;                         \
171     _tot_len--;
172 
173 /*
174  * GET_LENGTH
175  * Get a bulk string or array length.
176  */
177 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len)                \
178     {                                                         \
179         const u_char *_endp;                                  \
180         _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \
181         _tot_len -= (_endp - _ptr);                           \
182         _ptr = _endp;                                         \
183     }
184 
185 /*
186  * TEST_RET_LEN
187  * If ret_len is < 0, jump to the trunc tag which returns (-1)
188  * and 'bubbles up' to printing tstr. Otherwise, return ret_len.
189  */
190 #define TEST_RET_LEN(rl) \
191     if (rl < 0) { goto trunc; } else { return rl; }
192 
193 /*
194  * TEST_RET_LEN_NORETURN
195  * If ret_len is < 0, jump to the trunc tag which returns (-1)
196  * and 'bubbles up' to printing tstr. Otherwise, continue onward.
197  */
198 #define TEST_RET_LEN_NORETURN(rl) \
199     if (rl < 0) { goto trunc; }
200 
201 /*
202  * RESP_PRINT_SEGMENT
203  * Prints a segment in the form of: ' "<stuff>"\n"
204  * Assumes the data has already been verified as present.
205  */
206 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len)            \
207     ND_PRINT((_ndo, " \""));                           \
208     if (fn_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \
209         goto trunc;                                    \
210     fn_print_char(_ndo, '"');
211 
212 void
resp_print(netdissect_options * ndo,const u_char * bp,u_int length)213 resp_print(netdissect_options *ndo, const u_char *bp, u_int length)
214 {
215     int ret_len = 0, length_cur = length;
216 
217     if(!bp || length <= 0)
218         return;
219 
220     ND_PRINT((ndo, ": RESP"));
221     while (length_cur > 0) {
222         /*
223          * This block supports redis pipelining.
224          * For example, multiple operations can be pipelined within the same string:
225          * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n"
226          * or
227          * "PING\r\nPING\r\nPING\r\n"
228          * In order to handle this case, we must try and parse 'bp' until
229          * 'length' bytes have been processed or we reach a trunc condition.
230          */
231         ret_len = resp_parse(ndo, bp, length_cur);
232         TEST_RET_LEN_NORETURN(ret_len);
233         bp += ret_len;
234         length_cur -= ret_len;
235     }
236 
237     return;
238 
239 trunc:
240     ND_PRINT((ndo, "%s", tstr));
241 }
242 
243 static int
resp_parse(netdissect_options * ndo,register const u_char * bp,int length)244 resp_parse(netdissect_options *ndo, register const u_char *bp, int length)
245 {
246     u_char op;
247     int ret_len;
248 
249     LCHECK2(length, 1);
250     ND_TCHECK(*bp);
251     op = *bp;
252 
253     /* bp now points to the op, so these routines must skip it */
254     switch(op) {
255         case RESP_SIMPLE_STRING:  ret_len = resp_print_simple_string(ndo, bp, length);   break;
256         case RESP_INTEGER:        ret_len = resp_print_integer(ndo, bp, length);         break;
257         case RESP_ERROR:          ret_len = resp_print_error(ndo, bp, length);           break;
258         case RESP_BULK_STRING:    ret_len = resp_print_bulk_string(ndo, bp, length);     break;
259         case RESP_ARRAY:          ret_len = resp_print_bulk_array(ndo, bp, length);      break;
260         default:                  ret_len = resp_print_inline(ndo, bp, length);          break;
261     }
262 
263     /*
264      * This gives up with a "truncated" indicator for all errors,
265      * including invalid packet errors; that's what we want, as
266      * we have to give up on further parsing in that case.
267      */
268     TEST_RET_LEN(ret_len);
269 
270 trunc:
271     return (-1);
272 }
273 
274 static int
resp_print_simple_string(netdissect_options * ndo,register const u_char * bp,int length)275 resp_print_simple_string(netdissect_options *ndo, register const u_char *bp, int length) {
276     return resp_print_string_error_integer(ndo, bp, length);
277 }
278 
279 static int
resp_print_integer(netdissect_options * ndo,register const u_char * bp,int length)280 resp_print_integer(netdissect_options *ndo, register const u_char *bp, int length) {
281     return resp_print_string_error_integer(ndo, bp, length);
282 }
283 
284 static int
resp_print_error(netdissect_options * ndo,register const u_char * bp,int length)285 resp_print_error(netdissect_options *ndo, register const u_char *bp, int length) {
286     return resp_print_string_error_integer(ndo, bp, length);
287 }
288 
289 static int
resp_print_string_error_integer(netdissect_options * ndo,register const u_char * bp,int length)290 resp_print_string_error_integer(netdissect_options *ndo, register const u_char *bp, int length) {
291     int length_cur = length, len, ret_len;
292     const u_char *bp_ptr;
293 
294     /* bp points to the op; skip it */
295     SKIP_OPCODE(bp, length_cur);
296     bp_ptr = bp;
297 
298     /*
299      * bp now prints past the (+-;) opcode, so it's pointing to the first
300      * character of the string (which could be numeric).
301      * +OK\r\n
302      * -ERR ...\r\n
303      * :02912309\r\n
304      *
305      * Find the \r\n with FIND_CRLF().
306      */
307     FIND_CRLF(bp_ptr, length_cur);
308 
309     /*
310      * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text
311      * preceding the \r\n.  That includes the opcode, so don't print
312      * that.
313      */
314     len = (bp_ptr - bp);
315     RESP_PRINT_SEGMENT(ndo, bp, len);
316     ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/;
317 
318     TEST_RET_LEN(ret_len);
319 
320 trunc:
321     return (-1);
322 }
323 
324 static int
resp_print_bulk_string(netdissect_options * ndo,register const u_char * bp,int length)325 resp_print_bulk_string(netdissect_options *ndo, register const u_char *bp, int length) {
326     int length_cur = length, string_len;
327 
328     /* bp points to the op; skip it */
329     SKIP_OPCODE(bp, length_cur);
330 
331     /* <length>\r\n */
332     GET_LENGTH(ndo, length_cur, bp, string_len);
333 
334     if (string_len >= 0) {
335         /* Byte string of length string_len, starting at bp */
336         if (string_len == 0)
337             resp_print_empty(ndo);
338         else {
339             LCHECK2(length_cur, string_len);
340             ND_TCHECK2(*bp, string_len);
341             RESP_PRINT_SEGMENT(ndo, bp, string_len);
342             bp += string_len;
343             length_cur -= string_len;
344         }
345 
346         /*
347          * Find the \r\n at the end of the string and skip past it.
348          * XXX - report an error if the \r\n isn't immediately after
349          * the item?
350          */
351         FIND_CRLF(bp, length_cur);
352         CONSUME_CRLF(bp, length_cur);
353     } else {
354         /* null, truncated, or invalid for some reason */
355         switch(string_len) {
356             case (-1):  resp_print_null(ndo);             break;
357             case (-2):  goto trunc;
358             case (-3):  resp_print_length_too_large(ndo); break;
359             case (-4):  resp_print_length_negative(ndo);  break;
360             default:    resp_print_invalid(ndo);          break;
361         }
362     }
363 
364     return (length - length_cur);
365 
366 trunc:
367     return (-1);
368 }
369 
370 static int
resp_print_bulk_array(netdissect_options * ndo,register const u_char * bp,int length)371 resp_print_bulk_array(netdissect_options *ndo, register const u_char *bp, int length) {
372     u_int length_cur = length;
373     int array_len, i, ret_len;
374 
375     /* bp points to the op; skip it */
376     SKIP_OPCODE(bp, length_cur);
377 
378     /* <array_length>\r\n */
379     GET_LENGTH(ndo, length_cur, bp, array_len);
380 
381     if (array_len > 0) {
382         /* non empty array */
383         for (i = 0; i < array_len; i++) {
384             ret_len = resp_parse(ndo, bp, length_cur);
385 
386             TEST_RET_LEN_NORETURN(ret_len);
387 
388             bp += ret_len;
389             length_cur -= ret_len;
390         }
391     } else {
392         /* empty, null, truncated, or invalid */
393         switch(array_len) {
394             case 0:     resp_print_empty(ndo);            break;
395             case (-1):  resp_print_null(ndo);             break;
396             case (-2):  goto trunc;
397             case (-3):  resp_print_length_too_large(ndo); break;
398             case (-4):  resp_print_length_negative(ndo);  break;
399             default:    resp_print_invalid(ndo);          break;
400         }
401     }
402 
403     return (length - length_cur);
404 
405 trunc:
406     return (-1);
407 }
408 
409 static int
resp_print_inline(netdissect_options * ndo,register const u_char * bp,int length)410 resp_print_inline(netdissect_options *ndo, register const u_char *bp, int length) {
411     int length_cur = length;
412     int len;
413     const u_char *bp_ptr;
414 
415     /*
416      * Inline commands are simply 'strings' followed by \r or \n or both.
417      * Redis will do its best to split/parse these strings.
418      * This feature of redis is implemented to support the ability of
419      * command parsing from telnet/nc sessions etc.
420      *
421      * <string><\r||\n||\r\n...>
422      */
423 
424     /*
425      * Skip forward past any leading \r, \n, or \r\n.
426      */
427     CONSUME_CR_OR_LF(bp, length_cur);
428     bp_ptr = bp;
429 
430     /*
431      * Scan forward looking for \r or \n.
432      */
433     FIND_CR_OR_LF(bp_ptr, length_cur);
434 
435     /*
436      * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the
437      * Length of the line text that preceeds it.  Print it.
438      */
439     len = (bp_ptr - bp);
440     RESP_PRINT_SEGMENT(ndo, bp, len);
441 
442     /*
443      * Skip forward past the \r, \n, or \r\n.
444      */
445     CONSUME_CR_OR_LF(bp_ptr, length_cur);
446 
447     /*
448      * Return the number of bytes we processed.
449      */
450     return (length - length_cur);
451 
452 trunc:
453     return (-1);
454 }
455 
456 static int
resp_get_length(netdissect_options * ndo,register const u_char * bp,int len,const u_char ** endp)457 resp_get_length(netdissect_options *ndo, register const u_char *bp, int len, const u_char **endp)
458 {
459     int result;
460     u_char c;
461     int saw_digit;
462     int neg;
463     int too_large;
464 
465     if (len == 0)
466         goto trunc;
467     ND_TCHECK(*bp);
468     too_large = 0;
469     neg = 0;
470     if (*bp == '-') {
471         neg = 1;
472         bp++;
473         len--;
474     }
475     result = 0;
476     saw_digit = 0;
477 
478     for (;;) {
479         if (len == 0)
480             goto trunc;
481         ND_TCHECK(*bp);
482         c = *bp;
483         if (!(c >= '0' && c <= '9')) {
484             if (!saw_digit) {
485                 bp++;
486                 goto invalid;
487             }
488             break;
489         }
490         c -= '0';
491         if (result > (INT_MAX / 10)) {
492             /* This will overflow an int when we multiply it by 10. */
493             too_large = 1;
494         } else {
495             result *= 10;
496             if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) {
497                 /* This will overflow an int when we add c */
498                 too_large = 1;
499             } else
500                 result += c;
501         }
502         bp++;
503         len--;
504         saw_digit = 1;
505     }
506 
507     /*
508      * OK, we found a non-digit character.  It should be a \r, followed
509      * by a \n.
510      */
511     if (*bp != '\r') {
512         bp++;
513         goto invalid;
514     }
515     bp++;
516     len--;
517     if (len == 0)
518         goto trunc;
519     ND_TCHECK(*bp);
520     if (*bp != '\n') {
521         bp++;
522         goto invalid;
523     }
524     bp++;
525     len--;
526     *endp = bp;
527     if (neg) {
528         /* -1 means "null", anything else is invalid */
529         if (too_large || result != 1)
530             return (-4);
531         result = -1;
532     }
533     return (too_large ? -3 : result);
534 
535 trunc:
536     *endp = bp;
537     return (-2);
538 
539 invalid:
540     *endp = bp;
541     return (-5);
542 }
543