1 /* 2 * Copyright (c) 2015 The TCPDUMP project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 15 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 16 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 17 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 18 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 22 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 24 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 * 27 * Initial contribution by Andrew Darqui (andrew.darqui@gmail.com). 28 */ 29 30 #include <sys/cdefs.h> 31 #ifndef lint 32 __RCSID("$NetBSD: print-resp.c,v 1.5 2023/08/17 20:19:40 christos Exp $"); 33 #endif 34 35 /* \summary: REdis Serialization Protocol (RESP) printer */ 36 37 #ifdef HAVE_CONFIG_H 38 #include <config.h> 39 #endif 40 41 #include "netdissect-stdinc.h" 42 #include "netdissect.h" 43 #include <limits.h> 44 45 #include "extract.h" 46 47 48 /* 49 * For information regarding RESP, see: https://redis.io/topics/protocol 50 */ 51 52 #define RESP_SIMPLE_STRING '+' 53 #define RESP_ERROR '-' 54 #define RESP_INTEGER ':' 55 #define RESP_BULK_STRING '$' 56 #define RESP_ARRAY '*' 57 58 #define resp_print_empty(ndo) ND_PRINT(" empty") 59 #define resp_print_null(ndo) ND_PRINT(" null") 60 #define resp_print_length_too_large(ndo) ND_PRINT(" length too large") 61 #define resp_print_length_negative(ndo) ND_PRINT(" length negative and not -1") 62 #define resp_print_invalid(ndo) ND_PRINT(" invalid") 63 64 static int resp_parse(netdissect_options *, const u_char *, int); 65 static int resp_print_string_error_integer(netdissect_options *, const u_char *, int); 66 static int resp_print_simple_string(netdissect_options *, const u_char *, int); 67 static int resp_print_integer(netdissect_options *, const u_char *, int); 68 static int resp_print_error(netdissect_options *, const u_char *, int); 69 static int resp_print_bulk_string(netdissect_options *, const u_char *, int); 70 static int resp_print_bulk_array(netdissect_options *, const u_char *, int); 71 static int resp_print_inline(netdissect_options *, const u_char *, int); 72 static int resp_get_length(netdissect_options *, const u_char *, int, const u_char **); 73 74 #define LCHECK2(_tot_len, _len) \ 75 { \ 76 if (_tot_len < _len) \ 77 goto trunc; \ 78 } 79 80 #define LCHECK(_tot_len) LCHECK2(_tot_len, 1) 81 82 /* 83 * FIND_CRLF: 84 * Attempts to move our 'ptr' forward until a \r\n is found, 85 * while also making sure we don't exceed the buffer '_len' 86 * or go past the end of the captured data. 87 * If we exceed or go past the end of the captured data, 88 * jump to trunc. 89 */ 90 #define FIND_CRLF(_ptr, _len) \ 91 for (;;) { \ 92 LCHECK2(_len, 2); \ 93 ND_TCHECK_2(_ptr); \ 94 if (GET_U_1(_ptr) == '\r' && \ 95 GET_U_1(_ptr+1) == '\n') \ 96 break; \ 97 _ptr++; \ 98 _len--; \ 99 } 100 101 /* 102 * CONSUME_CRLF 103 * Consume a CRLF that we've just found. 104 */ 105 #define CONSUME_CRLF(_ptr, _len) \ 106 _ptr += 2; \ 107 _len -= 2; 108 109 /* 110 * FIND_CR_OR_LF 111 * Attempts to move our '_ptr' forward until a \r or \n is found, 112 * while also making sure we don't exceed the buffer '_len' 113 * or go past the end of the captured data. 114 * If we exceed or go past the end of the captured data, 115 * jump to trunc. 116 */ 117 #define FIND_CR_OR_LF(_ptr, _len) \ 118 for (;;) { \ 119 LCHECK(_len); \ 120 if (GET_U_1(_ptr) == '\r' || \ 121 GET_U_1(_ptr) == '\n') \ 122 break; \ 123 _ptr++; \ 124 _len--; \ 125 } 126 127 /* 128 * CONSUME_CR_OR_LF 129 * Consume all consecutive \r and \n bytes. 130 * If we exceed '_len' or go past the end of the captured data, 131 * jump to trunc. 132 */ 133 #define CONSUME_CR_OR_LF(_ptr, _len) \ 134 { \ 135 int _found_cr_or_lf = 0; \ 136 for (;;) { \ 137 /* \ 138 * Have we hit the end of data? \ 139 */ \ 140 if (_len == 0 || !ND_TTEST_1(_ptr)) {\ 141 /* \ 142 * Yes. Have we seen a \r \ 143 * or \n? \ 144 */ \ 145 if (_found_cr_or_lf) { \ 146 /* \ 147 * Yes. Just stop. \ 148 */ \ 149 break; \ 150 } \ 151 /* \ 152 * No. We ran out of packet. \ 153 */ \ 154 goto trunc; \ 155 } \ 156 if (GET_U_1(_ptr) != '\r' && \ 157 GET_U_1(_ptr) != '\n') \ 158 break; \ 159 _found_cr_or_lf = 1; \ 160 _ptr++; \ 161 _len--; \ 162 } \ 163 } 164 165 /* 166 * SKIP_OPCODE 167 * Skip over the opcode character. 168 * The opcode has already been fetched, so we know it's there, and don't 169 * need to do any checks. 170 */ 171 #define SKIP_OPCODE(_ptr, _tot_len) \ 172 _ptr++; \ 173 _tot_len--; 174 175 /* 176 * GET_LENGTH 177 * Get a bulk string or array length. 178 */ 179 #define GET_LENGTH(_ndo, _tot_len, _ptr, _len) \ 180 { \ 181 const u_char *_endp; \ 182 _len = resp_get_length(_ndo, _ptr, _tot_len, &_endp); \ 183 _tot_len -= (_endp - _ptr); \ 184 _ptr = _endp; \ 185 } 186 187 /* 188 * TEST_RET_LEN 189 * If ret_len is < 0, jump to the trunc tag which returns (-1) 190 * and 'bubbles up' to printing tstr. Otherwise, return ret_len. 191 */ 192 #define TEST_RET_LEN(rl) \ 193 if (rl < 0) { goto trunc; } else { return rl; } 194 195 /* 196 * TEST_RET_LEN_NORETURN 197 * If ret_len is < 0, jump to the trunc tag which returns (-1) 198 * and 'bubbles up' to printing tstr. Otherwise, continue onward. 199 */ 200 #define TEST_RET_LEN_NORETURN(rl) \ 201 if (rl < 0) { goto trunc; } 202 203 /* 204 * RESP_PRINT_SEGMENT 205 * Prints a segment in the form of: ' "<stuff>"\n" 206 * Assumes the data has already been verified as present. 207 */ 208 #define RESP_PRINT_SEGMENT(_ndo, _bp, _len) \ 209 ND_PRINT(" \""); \ 210 if (nd_printn(_ndo, _bp, _len, _ndo->ndo_snapend)) \ 211 goto trunc; \ 212 fn_print_char(_ndo, '"'); 213 214 void 215 resp_print(netdissect_options *ndo, const u_char *bp, u_int length) 216 { 217 int ret_len = 0; 218 219 ndo->ndo_protocol = "resp"; 220 221 ND_PRINT(": RESP"); 222 while (length > 0) { 223 /* 224 * This block supports redis pipelining. 225 * For example, multiple operations can be pipelined within the same string: 226 * "*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n*2\r\n\$4\r\nINCR\r\n\$1\r\nz\r\n" 227 * or 228 * "PING\r\nPING\r\nPING\r\n" 229 * In order to handle this case, we must try and parse 'bp' until 230 * 'length' bytes have been processed or we reach a trunc condition. 231 */ 232 ret_len = resp_parse(ndo, bp, length); 233 TEST_RET_LEN_NORETURN(ret_len); 234 bp += ret_len; 235 length -= ret_len; 236 } 237 238 return; 239 240 trunc: 241 nd_print_trunc(ndo); 242 } 243 244 static int 245 resp_parse(netdissect_options *ndo, const u_char *bp, int length) 246 { 247 u_char op; 248 int ret_len; 249 250 LCHECK2(length, 1); 251 op = GET_U_1(bp); 252 253 /* bp now points to the op, so these routines must skip it */ 254 switch(op) { 255 case RESP_SIMPLE_STRING: ret_len = resp_print_simple_string(ndo, bp, length); break; 256 case RESP_INTEGER: ret_len = resp_print_integer(ndo, bp, length); break; 257 case RESP_ERROR: ret_len = resp_print_error(ndo, bp, length); break; 258 case RESP_BULK_STRING: ret_len = resp_print_bulk_string(ndo, bp, length); break; 259 case RESP_ARRAY: ret_len = resp_print_bulk_array(ndo, bp, length); break; 260 default: ret_len = resp_print_inline(ndo, bp, length); break; 261 } 262 263 /* 264 * This gives up with a "truncated" indicator for all errors, 265 * including invalid packet errors; that's what we want, as 266 * we have to give up on further parsing in that case. 267 */ 268 TEST_RET_LEN(ret_len); 269 270 trunc: 271 return (-1); 272 } 273 274 static int 275 resp_print_simple_string(netdissect_options *ndo, const u_char *bp, int length) { 276 return resp_print_string_error_integer(ndo, bp, length); 277 } 278 279 static int 280 resp_print_integer(netdissect_options *ndo, const u_char *bp, int length) { 281 return resp_print_string_error_integer(ndo, bp, length); 282 } 283 284 static int 285 resp_print_error(netdissect_options *ndo, const u_char *bp, int length) { 286 return resp_print_string_error_integer(ndo, bp, length); 287 } 288 289 static int 290 resp_print_string_error_integer(netdissect_options *ndo, const u_char *bp, int length) { 291 int length_cur = length, len, ret_len; 292 const u_char *bp_ptr; 293 294 /* bp points to the op; skip it */ 295 SKIP_OPCODE(bp, length_cur); 296 bp_ptr = bp; 297 298 /* 299 * bp now prints past the (+-;) opcode, so it's pointing to the first 300 * character of the string (which could be numeric). 301 * +OK\r\n 302 * -ERR ...\r\n 303 * :02912309\r\n 304 * 305 * Find the \r\n with FIND_CRLF(). 306 */ 307 FIND_CRLF(bp_ptr, length_cur); 308 309 /* 310 * bp_ptr points to the \r\n, so bp_ptr - bp is the length of text 311 * preceding the \r\n. That includes the opcode, so don't print 312 * that. 313 */ 314 len = ND_BYTES_BETWEEN(bp_ptr, bp); 315 RESP_PRINT_SEGMENT(ndo, bp, len); 316 ret_len = 1 /*<opcode>*/ + len /*<string>*/ + 2 /*<CRLF>*/; 317 318 TEST_RET_LEN(ret_len); 319 320 trunc: 321 return (-1); 322 } 323 324 static int 325 resp_print_bulk_string(netdissect_options *ndo, const u_char *bp, int length) { 326 int length_cur = length, string_len; 327 328 /* bp points to the op; skip it */ 329 SKIP_OPCODE(bp, length_cur); 330 331 /* <length>\r\n */ 332 GET_LENGTH(ndo, length_cur, bp, string_len); 333 334 if (string_len >= 0) { 335 /* Byte string of length string_len, starting at bp */ 336 if (string_len == 0) 337 resp_print_empty(ndo); 338 else { 339 LCHECK2(length_cur, string_len); 340 ND_TCHECK_LEN(bp, string_len); 341 RESP_PRINT_SEGMENT(ndo, bp, string_len); 342 bp += string_len; 343 length_cur -= string_len; 344 } 345 346 /* 347 * Find the \r\n at the end of the string and skip past it. 348 * XXX - report an error if the \r\n isn't immediately after 349 * the item? 350 */ 351 FIND_CRLF(bp, length_cur); 352 CONSUME_CRLF(bp, length_cur); 353 } else { 354 /* null, truncated, or invalid for some reason */ 355 switch(string_len) { 356 case (-1): resp_print_null(ndo); break; 357 case (-2): goto trunc; 358 case (-3): resp_print_length_too_large(ndo); break; 359 case (-4): resp_print_length_negative(ndo); break; 360 default: resp_print_invalid(ndo); break; 361 } 362 } 363 364 return (length - length_cur); 365 366 trunc: 367 return (-1); 368 } 369 370 static int 371 resp_print_bulk_array(netdissect_options *ndo, const u_char *bp, int length) { 372 u_int length_cur = length; 373 int array_len, i, ret_len; 374 375 /* bp points to the op; skip it */ 376 SKIP_OPCODE(bp, length_cur); 377 378 /* <array_length>\r\n */ 379 GET_LENGTH(ndo, length_cur, bp, array_len); 380 381 if (array_len > 0) { 382 /* non empty array */ 383 for (i = 0; i < array_len; i++) { 384 ret_len = resp_parse(ndo, bp, length_cur); 385 386 TEST_RET_LEN_NORETURN(ret_len); 387 388 bp += ret_len; 389 length_cur -= ret_len; 390 } 391 } else { 392 /* empty, null, truncated, or invalid */ 393 switch(array_len) { 394 case 0: resp_print_empty(ndo); break; 395 case (-1): resp_print_null(ndo); break; 396 case (-2): goto trunc; 397 case (-3): resp_print_length_too_large(ndo); break; 398 case (-4): resp_print_length_negative(ndo); break; 399 default: resp_print_invalid(ndo); break; 400 } 401 } 402 403 return (length - length_cur); 404 405 trunc: 406 return (-1); 407 } 408 409 static int 410 resp_print_inline(netdissect_options *ndo, const u_char *bp, int length) { 411 int length_cur = length; 412 int len; 413 const u_char *bp_ptr; 414 415 /* 416 * Inline commands are simply 'strings' followed by \r or \n or both. 417 * Redis will do its best to split/parse these strings. 418 * This feature of redis is implemented to support the ability of 419 * command parsing from telnet/nc sessions etc. 420 * 421 * <string><\r||\n||\r\n...> 422 */ 423 424 /* 425 * Skip forward past any leading \r, \n, or \r\n. 426 */ 427 CONSUME_CR_OR_LF(bp, length_cur); 428 bp_ptr = bp; 429 430 /* 431 * Scan forward looking for \r or \n. 432 */ 433 FIND_CR_OR_LF(bp_ptr, length_cur); 434 435 /* 436 * Found it; bp_ptr points to the \r or \n, so bp_ptr - bp is the 437 * Length of the line text that precedes it. Print it. 438 */ 439 len = ND_BYTES_BETWEEN(bp_ptr, bp); 440 RESP_PRINT_SEGMENT(ndo, bp, len); 441 442 /* 443 * Skip forward past the \r, \n, or \r\n. 444 */ 445 CONSUME_CR_OR_LF(bp_ptr, length_cur); 446 447 /* 448 * Return the number of bytes we processed. 449 */ 450 return (length - length_cur); 451 452 trunc: 453 return (-1); 454 } 455 456 static int 457 resp_get_length(netdissect_options *ndo, const u_char *bp, int len, const u_char **endp) 458 { 459 int result; 460 u_char c; 461 int saw_digit; 462 int neg; 463 int too_large; 464 465 if (len == 0) 466 goto trunc; 467 too_large = 0; 468 neg = 0; 469 if (GET_U_1(bp) == '-') { 470 neg = 1; 471 bp++; 472 len--; 473 } 474 result = 0; 475 saw_digit = 0; 476 477 for (;;) { 478 if (len == 0) 479 goto trunc; 480 c = GET_U_1(bp); 481 if (!(c >= '0' && c <= '9')) { 482 if (!saw_digit) { 483 bp++; 484 goto invalid; 485 } 486 break; 487 } 488 c -= '0'; 489 if (result > (INT_MAX / 10)) { 490 /* This will overflow an int when we multiply it by 10. */ 491 too_large = 1; 492 } else { 493 result *= 10; 494 if (result == ((INT_MAX / 10) * 10) && c > (INT_MAX % 10)) { 495 /* This will overflow an int when we add c */ 496 too_large = 1; 497 } else 498 result += c; 499 } 500 bp++; 501 len--; 502 saw_digit = 1; 503 } 504 505 /* 506 * OK, we found a non-digit character. It should be a \r, followed 507 * by a \n. 508 */ 509 if (GET_U_1(bp) != '\r') { 510 bp++; 511 goto invalid; 512 } 513 bp++; 514 len--; 515 if (len == 0) 516 goto trunc; 517 if (GET_U_1(bp) != '\n') { 518 bp++; 519 goto invalid; 520 } 521 bp++; 522 len--; 523 *endp = bp; 524 if (neg) { 525 /* -1 means "null", anything else is invalid */ 526 if (too_large || result != 1) 527 return (-4); 528 result = -1; 529 } 530 return (too_large ? -3 : result); 531 532 trunc: 533 *endp = bp; 534 return (-2); 535 536 invalid: 537 *endp = bp; 538 return (-5); 539 } 540