--- -- Library methods for handling MongoDB, creating and parsing packets. -- -- @author Martin Holst Swende -- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html -- -- @args mongodb.db - the database to use for authentication -- Created 01/13/2010 - v0.1 - created by Martin Holst Swende -- Revised 01/03/2012 - v0.2 - added authentication support local nmap = require "nmap" local stdnse = require "stdnse" local string = require "string" local table = require "table" local math = require "math" local openssl = stdnse.silent_require "openssl" _ENV = stdnse.module("mongodb", stdnse.seeall) -- this is not yet widely implemented but at least used for authentication -- ideally, it would be used to set the database against which operations, -- that do not require a specific database, should run local arg_DB = stdnse.get_script_args("mongodb.db") -- Some lazy shortcuts local function dbg(str,...) stdnse.debug3("MngoDb:"..str, ...) end ---------------------------------------------------------------------- -- First of all comes a Bson parsing library. This can easily be moved out into a separate library should other -- services start to use Bson ---------------------------------------------------------------------- -- Library methods for handling the BSON format -- -- For more documentation about the BSON format, ---and more details about its implementations, check out the -- python BSON implementation which is available at -- http://github.com/mongodb/mongo-python-driver/blob/master/bson/ -- and licensed under the Apache License, Version 2.0 http://www.apache.org/licenses/LICENSE-2.0) -- -- @author Martin Holst Swende -- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html -- -- Version 0.1 -- Created 01/13/2010 - v0.1 - created by Martin Holst Swende --module("bson", package.seeall) local function dbg_err(str,...) stdnse.debug2("Bson-ERR:"..str, ...) end --Converts an element (key, value) into bson binary data --@param key the key name, must *NOT* contain . (period) or start with $ --@param value, the element value --@return status : true if ok, false if error --@return result : the packed binary data OR error message local function _element_to_bson(key, value) --Some constraints-checking if type(key) ~= 'string' then return false, "Documents must have only string keys, key was " .. type(key) end if key:sub(1,1) == "$" then return false, "key must not start with $: ".. key end if key:find("%.") then return false, ("key %s must not contain '.'"):format(tostring(key)) end if type(value) == 'string' then -- must null-terminate string first return true, string.pack(" 0x7fffffff or value < -0x80000000 then -- long return true, string.pack(" 4 * 1024 * 1024 then return false, "document too large - BSON documents are limited to 4 MB" end dbg("Packet length is %d",length) --Final pack return true, string.pack(" 0 do key, value, data, err = _element_to_dict(data) if not key then return result, ("Failed to parse element: %s"):format(err) end dbg("Parsed (%s='%s'), data left : %d", tostring(key),tostring(value), data:len()) --if type(value) ~= 'table' then value=tostring(value) end result[key] = value end return result end --Checks if enough data to parse the result is captured --@data binary bson data read from socket --@return true if the full bson table is contained in the data, false if data is incomplete --@return required size of packet, if known, otherwise nil function isPacketComplete(data) -- First, we check that the header is complete if data:len() < 4 then local err_msg = "Not enough data in buffer, at least 4 bytes header info expected" return false end local obj_size = string.unpack("stdnse.format_output function queryResultToTable( resultTable ) local result = {} for k,v in pairs( resultTable ) do if type(v) == 'table' then table.insert(result,k) table.insert(result,queryResultToTable(v)) else table.insert(result,(("%s = %s"):format(tostring(k), tostring(v)))) end end return result end local unittest = require "unittest" if not unittest.testing() then return _ENV end -- https://github.com/mongodb/mongo-python-driver/blob/master/test/bson_corpus/ local TESTS = { -- 0x01 = BSONNUM, float { desc = "BSONNUM: +1.0", bson = "10000000016400000000000000F03F00", obj = {d = {1.0}} }, { desc = "BSONNUM: -1.0", bson = "10000000016400000000000000F0BF00", obj = {d = {-1.0}} }, { desc = "BSONNUM: +1.0001220703125", bson = "10000000016400000000008000F03F00", obj = {d = {1.0001220703125}} }, { desc = "BSONNUM: -1.0001220703125", bson = "10000000016400000000008000F0BF00", obj = {d = {-1.0001220703125}} }, { desc = "BSONNUM: 1.2345678921232E+18", bson = "100000000164002a1bf5f41022b14300", obj = {d = {1.2345678921232e18}} }, { desc = "BSONNUM: -1.2345678921232E+18", bson = "100000000164002a1bf5f41022b1c300", obj = {d = {-1.2345678921232e18}} }, { desc = "BSONNUM: 0.0", bson = "10000000016400000000000000000000", obj = {d = {0.0}} }, { desc = "BSONNUM: -0.0", bson = "10000000016400000000000000008000", obj = {d = {-0.0}} }, -- Lua 5.3 safely round-trips all of these floats! { desc = "BSONNUM: NaN", bson = "10000000016400000000000000F87F00", test = function(o) return tostring(o.d) == "nan" end }, { desc = "BSONNUM: NaN with payload", bson = "10000000016400120000000000F87F00", test = function(o) return tostring(o.d) == "nan" end }, { desc = "BSONNUM: Inf", bson = "10000000016400000000000000F07F00", test = function(o) return tostring(o.d) == "inf" end }, { desc = "BSONNUM: -Inf", bson = "10000000016400000000000000F0FF00", test = function(o) return tostring(o.d) == "-inf" end }, { desc = "bad BSONNUM: double truncated", invalid = true, bson = "0B0000000164000000F03F00" }, -- 0x02 = BSONSTR, string { desc = "BSONSTR: Empty string", bson = "0D000000026100010000000000", obj = {a = ""} }, { desc = "BSONSTR: Single character", bson = "0E00000002610002000000620000", obj = {a = "b"} }, { desc = "BSONSTR: Multi-character", bson = "190000000261000D0000006162616261626162616261620000", obj = {a = "abababababab"} }, { desc = "BSONSTR: Embedded nulls", bson = "190000000261000D0000006162006261620062616261620000", obj = {a = "ab\x00bab\x00babab"} }, { desc = "BSONSTR: bad string length: 0 (but no 0x00 either)", invalid = true, bson = "0C0000000261000000000000" }, { desc = "BSONSTR: bad string length: -1", invalid = true, bson = "0C000000026100FFFFFFFF00" }, { desc = "BSONSTR: bad string length: eats terminator", invalid = true, bson = "10000000026100050000006200620000" }, { desc = "BSONSTR: bad string length: longer than rest of document", invalid = true, bson = "120000000200FFFFFF00666F6F6261720000" }, { desc = "BSONSTR: string is not null-terminated", invalid = true, bson = "1000000002610004000000616263FF00" }, { desc = "BSONSTR: empty string, but extra null", invalid = true, bson = "0E00000002610001000000000000" }, { desc = "Empty array", bson = "0D000000046100050000000000", -- Should probably use json.make_array and json.typeof for this. FAIL = "Can't distinguish array vs object table", obj = {a = {}} }, { desc = "single element array", bson = "140000000461000C0000001030000A0000000000", FAIL = "Can't distinguish array vs object table", obj = {a = {10}} }, { desc = "single element with empty index", bson = "130000000461000B00000010000A0000000000", fixed = "140000000461000C0000001030000A0000000000", FAIL = "Can't distinguish array vs object table", obj = {a = {10}} }, { desc = "bad array: too long", invalid = true, bson = "140000000461000D0000001030000A0000000000", }, { desc = "bad array: too short", invalid = true, bson = "140000000461000B0000001030000A0000000000" }, { desc = "bad array: bad string length", invalid = true, bson = "1A00000004666F6F00100000000230000500000062617A000000" }, { desc = "BSONBIN: subtype 0x00 (Zero-length)", bson = "0D000000057800000000000000", FAIL = "No encoder for BSONBIN type", obj = {x = "Binary subtype 0: "} }, { desc = "BSONBIN: subtype 0x00", bson = "0F0000000578000200000000FFFF00", FAIL = "No encoder for BSONBIN type", obj = {x = "Binary subtype 0: ffff"} }, { desc = "BSONBIN: subtype 0x01", bson = "0F0000000578000200000001FFFF00", FAIL = "No encoder for BSONBIN type", obj = {x = "Binary subtype 1: ffff"} }, { desc = "BSONBIN: subtype 0x03", bson = "1D000000057800100000000373FFD26444B34C6990E8E7D1DFC035D400", FAIL = "No encoder for BSONBIN type", obj = {x = "Binary subtype 3: 73ffd26444b34c6990e8e7d1dfc035d4"} }, { desc = "BSONBIN: Length longer than document", invalid = true, bson = "1D000000057800FF0000000573FFD26444B34C6990E8E7D1DFC035D400" }, { desc = "BSONBIN: Negative length", invalid = true, bson = "0D000000057800FFFFFFFF0000" }, { desc = "BSONBIN: subtype 0x02 length too long ", invalid = true, bson = "13000000057800060000000203000000FFFF00" }, { desc = "BSONBIN: subtype 0x02 length too short", invalid = true, bson = "13000000057800060000000201000000FFFF00" }, { desc = "BSONBIN: subtype 0x02 length negative one", invalid = true, bson = "130000000578000600000002FFFFFFFFFFFF00" }, { desc = "Int32 MinValue", bson = "0C0000001069000000008000", obj = {i = -2147483648} }, { desc = "Int32: MaxValue", bson = "0C000000106900FFFFFF7F00", obj = {i = 2147483647} }, { desc = "Int32: -1", bson = "0C000000106900FFFFFFFF00", obj = {i = -1} }, { desc = "Int32: 0", bson = "0C0000001069000000000000", obj = {i = 0} }, { desc = "Int32: 1", bson = "0C0000001069000100000000", obj = {i = 1} }, { desc = "Int32: Bad int32 field length", invalid = true, bson = "090000001061000500" } } test_suite = unittest.TestSuite:new() local equal = unittest.equal local is_nil = unittest.is_nil local is_true = unittest.is_true local type_is = unittest.type_is for _, test in ipairs(TESTS) do dbg("Loading test %s...", test.desc) local fmt = function(description) return ("%s: %s"):format(test.desc, description) end local binary = stdnse.fromhex(test.bson) local obj, rem, err = fromBson(binary) if test.invalid then dbg("Expect error, type is %s: %s", type(err), err) test_suite:add_test(type_is("string", err), fmt("Error reported for invalid BSON")) else test_suite:add_test(type_is("table", obj), fmt("BSON parsed to table")) test_suite:add_test(is_nil(err), fmt("No error reported for valid BSON")) local status, bsonout = toBson(obj) test_suite:add_test(is_true(status), fmt("toBson succeeds")) test_suite:add_test(equal(type(bsonout), "string"), fmt("toBson returns string")) -- round-trip test. Some "bad" encodings are ok but will generate different bson local rttest = equal(stdnse.tohex(bsonout), test.fixed and test.fixed or stdnse.tohex(binary)) -- Our library is incomplete in some ways as noted in FAIL if test.FAIL then rttest = unittest.expected_failure(rttest) end test_suite:add_test(rttest, fmt("Round-trip encoding matches")) if test.test then test_suite:add_test(is_true(test.test(obj)), fmt("Extra test")) end end end return _ENV;