/* packet-mongo.c

 * Routines for Mongo Wire Protocol dissection

 * Copyright 2010, Alexis La Goutte <alexis.lagoutte at gmail dot com>

 * BSON dissection added 2011, Thomas Buchanan <tom at thomasbuchanan dot com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

 * See Mongo Wire Protocol Specification

 * https://www.mongodb.com/docs/manual/reference/mongodb-wire-protocol/

 * See also BSON Specification

 * http://bsonspec.org/spec.html

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <epan/expert.h>

#include <epan/proto_data.h>

#include <epan/exceptions.h>

#include <wsutil/crc32.h> // CRC32C_PRELOAD

#include <epan/crc32-tvb.h> // crc32c_tvb_offset_calculate

#include "packet-tcp.h"

#ifdef HAVE_SNAPPY

#include <snappy-c.h>

#endif

void proto_register_mongo(void);

void proto_reg_handoff_mongo(void);

static dissector_handle_t mongo_handle;

static dissector_handle_t mongo_heur_handle;

/* Forward declaration */

static int

dissect_opcode_types(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *mongo_tree, unsigned opcode, unsigned *effective_opcode, uint8_t **command_name);

/* This is not IANA assigned nor registered */

#define TCP_PORT_MONGO 27017

/* All opcodes other than OP_COMPRESSED and OP_MSG were removed

 * in MongoDB 5.1 (December 2021)

 */

#define OP_REPLY           1

#define OP_MESSAGE      1000

#define OP_UPDATE       2001

#define OP_INSERT       2002

#define OP_RESERVED     2003

#define OP_QUERY        2004

#define OP_GET_MORE     2005

#define OP_DELETE       2006

#define OP_KILL_CURSORS 2007

#define OP_COMMAND      2010

#define OP_COMMANDREPLY 2011

#define OP_COMPRESSED   2012

#define OP_MSG          2013

/**************************************************************************/

/*                      OpCode                                            */

/**************************************************************************/

static const value_string opcode_vals[] = {

  { OP_REPLY,  "Reply" },

  { OP_MESSAGE, "Message" },

  { OP_UPDATE,  "Update document" },

  { OP_INSERT,  "Insert document" },

  { OP_RESERVED,"Reserved" },

  { OP_QUERY,  "Query" },

  { OP_GET_MORE,  "Get More" },

  { OP_DELETE,  "Delete document" },

  { OP_KILL_CURSORS,  "Kill Cursors" },

  { OP_COMMAND,  "Command Request" },

  { OP_COMMANDREPLY,  "Command Reply" },

  { OP_COMPRESSED,  "Compressed Data" },

  { OP_MSG,  "Extensible Message Format" },

  { 0,  NULL }

};

#define KIND_BODY               0

#define KIND_DOCUMENT_SEQUENCE  1

/**************************************************************************/

/*                      Section Kind                                      */

/**************************************************************************/

static const value_string section_kind_vals[] = {

  { KIND_BODY, "Body" },

  { KIND_DOCUMENT_SEQUENCE, "Document Sequence" },

  { 0,  NULL }

};

/**************************************************************************/

/*                      Compression Engines                               */

/**************************************************************************/

#define MONGO_COMPRESSOR_NOOP    0

#define MONGO_COMPRESSOR_SNAPPY  1

#define MONGO_COMPRESSOR_ZLIB    2

#define MONGO_COMPRESSOR_ZSTD    3

static const value_string compressor_vals[] = {

  { MONGO_COMPRESSOR_NOOP,   "Noop (Uncompressed)" },

  { MONGO_COMPRESSOR_SNAPPY, "Snappy" },

  { MONGO_COMPRESSOR_ZLIB,   "Zlib" },

  { MONGO_COMPRESSOR_ZSTD,   "Zstd" },

  { 0,  NULL }

};

/* BSON Element types */

/* See http://bsonspec.org/#/specification for detail */

#define BSON_ELEMENT_TYPE_DOUBLE         1

#define BSON_ELEMENT_TYPE_STRING         2

#define BSON_ELEMENT_TYPE_DOC            3

#define BSON_ELEMENT_TYPE_ARRAY          4

#define BSON_ELEMENT_TYPE_BINARY         5

#define BSON_ELEMENT_TYPE_UNDEF          6  /* Deprecated */

#define BSON_ELEMENT_TYPE_OBJ_ID         7

#define BSON_ELEMENT_TYPE_BOOL           8

#define BSON_ELEMENT_TYPE_DATETIME       9

#define BSON_ELEMENT_TYPE_NULL          10

#define BSON_ELEMENT_TYPE_REGEX         11

#define BSON_ELEMENT_TYPE_DB_PTR        12  /* Deprecated */

#define BSON_ELEMENT_TYPE_JS_CODE       13

#define BSON_ELEMENT_TYPE_SYMBOL        14

#define BSON_ELEMENT_TYPE_JS_CODE_SCOPE 15

#define BSON_ELEMENT_TYPE_INT32         16  /* 0x10 */

#define BSON_ELEMENT_TYPE_TIMESTAMP     17  /* 0x11 */

#define BSON_ELEMENT_TYPE_INT64         18  /* 0x12 */

#define BSON_ELEMENT_TYPE_DECIMAL128    19  /* 0x13 */

#define BSON_ELEMENT_TYPE_MIN_KEY      255  /* 0xFF */

#define BSON_ELEMENT_TYPE_MAX_KEY      127  /* 0x7F */

static const value_string element_type_vals[] = {

  { BSON_ELEMENT_TYPE_DOUBLE,         "Double" },

  { BSON_ELEMENT_TYPE_STRING,         "String" },

  { BSON_ELEMENT_TYPE_DOC,            "Document" },

  { BSON_ELEMENT_TYPE_ARRAY,          "Array" },

  { BSON_ELEMENT_TYPE_BINARY,         "Binary" },

  { BSON_ELEMENT_TYPE_UNDEF,          "Undefined" },

  { BSON_ELEMENT_TYPE_OBJ_ID,         "Object ID" },

  { BSON_ELEMENT_TYPE_BOOL,           "Boolean" },

  { BSON_ELEMENT_TYPE_DATETIME,       "Datetime" },

  { BSON_ELEMENT_TYPE_NULL,           "NULL" },

  { BSON_ELEMENT_TYPE_REGEX,          "Regular Expression" },

  { BSON_ELEMENT_TYPE_DB_PTR,         "DBPointer" },

  { BSON_ELEMENT_TYPE_JS_CODE,        "JavaScript Code" },

  { BSON_ELEMENT_TYPE_SYMBOL,         "Symbol" },

  { BSON_ELEMENT_TYPE_JS_CODE_SCOPE,  "JavaScript Code w/Scope" },

  { BSON_ELEMENT_TYPE_INT32,          "Int32" },

  { BSON_ELEMENT_TYPE_TIMESTAMP,      "Timestamp" },

  { BSON_ELEMENT_TYPE_INT64,          "Int64" },

  { BSON_ELEMENT_TYPE_DECIMAL128,     "128-bit decimal floating point" },

  { BSON_ELEMENT_TYPE_MIN_KEY,        "Min Key" },

  { BSON_ELEMENT_TYPE_MAX_KEY,        "Max Key" },

  { 0, NULL }

};

/* BSON Element Binary subtypes */

#define BSON_ELEMENT_BINARY_TYPE_GENERIC  0

#define BSON_ELEMENT_BINARY_TYPE_FUNCTION 1

#define BSON_ELEMENT_BINARY_TYPE_BINARY   2 /* OLD */

#define BSON_ELEMENT_BINARY_TYPE_UUID     3

#define BSON_ELEMENT_BINARY_TYPE_MD5      4

#define BSON_ELEMENT_BINARY_TYPE_USER   128 /* 0x80 */

#if 0

static const value_string binary_type_vals[] = {

  { BSON_ELEMENT_BINARY_TYPE_GENERIC,  "Generic" },

  { BSON_ELEMENT_BINARY_TYPE_FUNCTION, "Function" },

  { BSON_ELEMENT_BINARY_TYPE_BINARY,   "Binary" },

  { BSON_ELEMENT_BINARY_TYPE_UUID,     "UUID" },

  { BSON_ELEMENT_BINARY_TYPE_MD5,      "MD5" },

  { BSON_ELEMENT_BINARY_TYPE_USER,     "User" },

  { 0, NULL }

};

#endif

static int proto_mongo;

static int hf_mongo_message_length;

static int hf_mongo_request_id;

static int hf_mongo_response_to;

static int hf_mongo_op_code;

static int hf_mongo_fullcollectionname;

static int hf_mongo_database_name;

static int hf_mongo_collection_name;

static int hf_mongo_reply_flags;

static int hf_mongo_reply_flags_cursornotfound;

static int hf_mongo_reply_flags_queryfailure;

static int hf_mongo_reply_flags_sharedconfigstale;

static int hf_mongo_reply_flags_awaitcapable;

static int hf_mongo_cursor_id;

static int hf_mongo_starting_from;

static int hf_mongo_number_returned;

static int hf_mongo_message;

static int hf_mongo_zero;

static int hf_mongo_update_flags;

static int hf_mongo_update_flags_upsert;

static int hf_mongo_update_flags_multiupdate;

static int hf_mongo_selector;

static int hf_mongo_update;

static int hf_mongo_insert_flags;

static int hf_mongo_insert_flags_continueonerror;

static int hf_mongo_query_flags;

static int hf_mongo_query_flags_tailablecursor;

static int hf_mongo_query_flags_slaveok;

static int hf_mongo_query_flags_oplogreplay;

static int hf_mongo_query_flags_nocursortimeout;

static int hf_mongo_query_flags_awaitdata;

static int hf_mongo_query_flags_exhaust;

static int hf_mongo_query_flags_partial;

static int hf_mongo_number_to_skip;

static int hf_mongo_number_to_return;

static int hf_mongo_query;

static int hf_mongo_return_field_selector;

static int hf_mongo_document;

static int hf_mongo_document_length;

static int hf_mongo_document_empty;

static int hf_mongo_delete_flags;

static int hf_mongo_delete_flags_singleremove;

static int hf_mongo_number_of_cursor_ids;

static int hf_mongo_elements;

static int hf_mongo_element_name;

static int hf_mongo_element_type;

static int hf_mongo_element_length;

static int hf_mongo_element_value_boolean;

static int hf_mongo_element_value_int32;

static int hf_mongo_element_value_int64;

static int hf_mongo_element_value_decimal128;

static int hf_mongo_element_value_double;

static int hf_mongo_element_value_string;

static int hf_mongo_element_value_string_length;

static int hf_mongo_element_value_binary;

static int hf_mongo_element_value_binary_length;

static int hf_mongo_element_value_regex_pattern;

static int hf_mongo_element_value_regex_options;

static int hf_mongo_element_value_objectid;

static int hf_mongo_element_value_objectid_time;

static int hf_mongo_element_value_objectid_host;

static int hf_mongo_element_value_objectid_pid;

static int hf_mongo_element_value_objectid_machine_id;

static int hf_mongo_element_value_objectid_inc;

static int hf_mongo_element_value_db_ptr;

static int hf_mongo_element_value_js_code;

static int hf_mongo_element_value_js_scope;

static int hf_mongo_database;

static int hf_mongo_commandname;

static int hf_mongo_metadata;

static int hf_mongo_commandargs;

static int hf_mongo_commandreply;

static int hf_mongo_outputdocs;

static int hf_mongo_unknown;

static int hf_mongo_compression_info;

static int hf_mongo_original_op_code;

static int hf_mongo_uncompressed_size;

static int hf_mongo_compressor;

static int hf_mongo_compressed_data;

static int hf_mongo_unsupported_compressed;

static int hf_mongo_msg_flags;

static int hf_mongo_msg_flags_checksumpresent;

static int hf_mongo_msg_flags_moretocome;

static int hf_mongo_msg_flags_exhaustallowed;

static int hf_mongo_msg_sections_section;

static int hf_mongo_msg_sections_section_kind;

static int hf_mongo_msg_sections_section_body;

static int hf_mongo_msg_sections_section_doc_sequence;

static int hf_mongo_msg_sections_section_size;

static int hf_mongo_msg_sections_section_doc_sequence_id;

static int hf_mongo_msg_checksum;

static int hf_mongo_msg_checksum_status;

static int ett_mongo;

static int ett_mongo_doc;

static int ett_mongo_elements;

static int ett_mongo_element;

static int ett_mongo_objectid;

static int ett_mongo_machine_id;

static int ett_mongo_code;

static int ett_mongo_fcn;

static int ett_mongo_flags;

static int ett_mongo_compression_info;

static int ett_mongo_sections;

static int ett_mongo_section;

static int ett_mongo_msg_flags;

static int ett_mongo_doc_sequence;

static expert_field ei_mongo_document_recursion_exceeded;

static expert_field ei_mongo_document_length_bad;

static expert_field ei_mongo_section_size_bad;

static expert_field ei_mongo_unknown;

static expert_field ei_mongo_unsupported_compression;

static expert_field ei_mongo_msg_checksum;

static int

dissect_fullcollectionname(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

  uint32_t fcn_length, dbn_length;

  proto_item *ti;

  proto_tree *fcn_tree;

  fcn_length = tvb_strsize(tvb, offset);

  ti = proto_tree_add_item(tree, hf_mongo_fullcollectionname, tvb, offset, fcn_length, ENC_ASCII);

  /* If this doesn't find anything, we'll just throw an exception below */

  tvb_find_uint8_length(tvb, offset, fcn_length, '.', &dbn_length);

  dbn_length = dbn_length -offset;

  fcn_tree = proto_item_add_subtree(ti, ett_mongo_fcn);

  proto_tree_add_item(fcn_tree, hf_mongo_database_name, tvb, offset, dbn_length, ENC_ASCII);

  proto_tree_add_item(fcn_tree, hf_mongo_collection_name, tvb, offset + 1 + dbn_length, fcn_length - dbn_length - 2, ENC_ASCII);

  return fcn_length;

}

/* http://docs.mongodb.org/manual/reference/limits/ */

/* http://www.mongodb.org/display/DOCS/Documents */

#define BSON_MAX_NESTING 100

#define BSON_MAX_DOC_SIZE (16 * 1000 * 1000)

static int

// NOLINTNEXTLINE(misc-no-recursion)

dissect_bson_document(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree, int hf_mongo_doc)

{

  int32_t document_length;

  unsigned final_offset;

  proto_item *ti, *elements, *element, *objectid, *js_code, *js_scope, *machine_id;

  proto_tree *doc_tree, *elements_tree, *element_sub_tree, *objectid_sub_tree, *js_code_sub_tree, *js_scope_sub_tree, *machine_id_sub_tree;

  document_length = tvb_get_letohl(tvb, offset);

  ti = proto_tree_add_item(tree, hf_mongo_doc, tvb, offset, document_length, ENC_NA);

  doc_tree = proto_item_add_subtree(ti, ett_mongo_doc);

  proto_tree_add_item(doc_tree, hf_mongo_document_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  if (document_length < 5) {

      expert_add_info_format(pinfo, ti, &ei_mongo_document_length_bad, "BSON document length too short: %u", document_length);

      return MAX(4, document_length); /* see the comment above */

  }

  if (document_length > BSON_MAX_DOC_SIZE) {

      expert_add_info_format(pinfo, ti, &ei_mongo_document_length_bad, "BSON document length too long: %u", document_length);

      return document_length;

  }

  if (document_length == 5) {

    /* document with length 5 is an empty document */

    /* don't display the element subtree */

    proto_tree_add_item(doc_tree, hf_mongo_document_empty, tvb, offset, document_length, ENC_NA);

    return document_length;

  }

  unsigned nest_level = p_get_proto_depth(pinfo, proto_mongo);

  if (++nest_level > BSON_MAX_NESTING) {

      expert_add_info_format(pinfo, ti, &ei_mongo_document_recursion_exceeded, "BSON document recursion exceeds %u", BSON_MAX_NESTING);

      /* return the number of bytes we consumed, these are at least the 4 bytes for the length field */

      return MAX(4, document_length);

  }

  p_set_proto_depth(pinfo, proto_mongo, nest_level);

  final_offset = offset + document_length;

  offset += 4;

  elements = proto_tree_add_item(doc_tree, hf_mongo_elements, tvb, offset, document_length-5, ENC_NA);

  elements_tree = proto_item_add_subtree(elements, ett_mongo_elements);

  do {

    /* Read document elements */

    uint8_t e_type;  /* Element type */

    unsigned str_len;   /* String length */

    unsigned e_len;     /* Element length */

    unsigned doc_len;   /* Document length */

    e_type = tvb_get_uint8(tvb, offset);

    element = proto_tree_add_item_ret_length(elements_tree, hf_mongo_element_name, tvb, offset+1, -1, ENC_UTF_8, &str_len);

    element_sub_tree = proto_item_add_subtree(element, ett_mongo_element);

    proto_tree_add_item(element_sub_tree, hf_mongo_element_type, tvb, offset, 1, ENC_LITTLE_ENDIAN);

    offset += str_len+1;

    switch(e_type) {

      case BSON_ELEMENT_TYPE_DOUBLE:

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_double, tvb, offset, 8, ENC_LITTLE_ENDIAN);

        offset += 8;

        break;

      case BSON_ELEMENT_TYPE_STRING:

      case BSON_ELEMENT_TYPE_JS_CODE:

      case BSON_ELEMENT_TYPE_SYMBOL:

        str_len = tvb_get_letohl(tvb, offset);

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string, tvb, offset+4, str_len, ENC_UTF_8);

        offset += str_len+4;

        break;

      case BSON_ELEMENT_TYPE_DOC:

      case BSON_ELEMENT_TYPE_ARRAY:

        offset += dissect_bson_document(tvb, pinfo, offset, element_sub_tree, hf_mongo_document);

        break;

      case BSON_ELEMENT_TYPE_BINARY:

        e_len = tvb_get_letohl(tvb, offset);

        /* TODO - Add functions to decode various binary subtypes */

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_binary_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_binary, tvb, offset+5, e_len, ENC_NA);

        offset += e_len+5;

        break;

      case BSON_ELEMENT_TYPE_UNDEF:

      case BSON_ELEMENT_TYPE_NULL:

      case BSON_ELEMENT_TYPE_MIN_KEY:

      case BSON_ELEMENT_TYPE_MAX_KEY:

        /* Nothing to do, as there is no element content */

        break;

      case BSON_ELEMENT_TYPE_OBJ_ID:

        objectid = proto_tree_add_item(element_sub_tree, hf_mongo_element_value_objectid, tvb, offset, 12, ENC_NA);

        objectid_sub_tree = proto_item_add_subtree(objectid, ett_mongo_objectid);

        /* Unlike most BSON elements, parts of ObjectID are stored Big Endian, so they can be compared bit by bit */

        proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_time, tvb, offset, 4, ENC_BIG_ENDIAN);

        /* The machine ID was traditionally split up in Host Hash/PID */

        machine_id = proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_machine_id, tvb, offset+4, 5, ENC_NA);

        machine_id_sub_tree = proto_item_add_subtree(machine_id, ett_mongo_machine_id);

        proto_tree_add_item(machine_id_sub_tree, hf_mongo_element_value_objectid_host, tvb, offset+4, 3, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(machine_id_sub_tree, hf_mongo_element_value_objectid_pid, tvb, offset+7, 2, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(objectid_sub_tree, hf_mongo_element_value_objectid_inc, tvb, offset+9, 3, ENC_BIG_ENDIAN);

        offset += 12;

        break;

      case BSON_ELEMENT_TYPE_BOOL:

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_boolean, tvb, offset, 1, ENC_NA);

        offset += 1;

        break;

      case BSON_ELEMENT_TYPE_REGEX:

        /* regex pattern */

        proto_tree_add_item_ret_length(element_sub_tree, hf_mongo_element_value_regex_pattern, tvb, offset, -1, ENC_UTF_8, &str_len);

        offset += str_len;

        /* regex options */

        proto_tree_add_item_ret_length(element_sub_tree, hf_mongo_element_value_regex_options, tvb, offset, -1, ENC_UTF_8, &str_len);

        offset += str_len;

        break;

      case BSON_ELEMENT_TYPE_DB_PTR:

        str_len = tvb_get_letohl(tvb, offset);

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_string, tvb, offset+4, str_len, ENC_UTF_8);

        offset += str_len;

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_db_ptr, tvb, offset, 12, ENC_NA);

        offset += 12;

        break;

      case BSON_ELEMENT_TYPE_JS_CODE_SCOPE:

        /* code_w_s ::= int32 string document */

        proto_tree_add_item(element_sub_tree, hf_mongo_element_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        e_len = tvb_get_letohl(tvb, offset);

        offset += 4;

        str_len = tvb_get_letohl(tvb, offset);

        js_code = proto_tree_add_item(element_sub_tree, hf_mongo_element_value_js_code, tvb, offset, str_len+4, ENC_NA);

        js_code_sub_tree = proto_item_add_subtree(js_code, ett_mongo_code);

        proto_tree_add_item(js_code_sub_tree, hf_mongo_element_value_string_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(js_code_sub_tree, hf_mongo_element_value_string, tvb, offset+4, str_len, ENC_UTF_8);

        offset += str_len+4;

        doc_len = e_len - (str_len + 8);

        js_scope = proto_tree_add_item(element_sub_tree, hf_mongo_element_value_js_scope, tvb, offset, doc_len, ENC_NA);

        js_scope_sub_tree = proto_item_add_subtree(js_scope, ett_mongo_code);

        offset += dissect_bson_document(tvb, pinfo, offset, js_scope_sub_tree, hf_mongo_document);

        break;

      case BSON_ELEMENT_TYPE_INT32:

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_int32, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        offset += 4;

        break;

      case BSON_ELEMENT_TYPE_DATETIME:

      case BSON_ELEMENT_TYPE_TIMESTAMP:

        /* TODO Implement routine to convert datetime & timestamp values to UTC date/time */

        /* for now, simply display the integer value */

      case BSON_ELEMENT_TYPE_INT64:

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_int64, tvb, offset, 8, ENC_LITTLE_ENDIAN);

        offset += 8;

        break;

      case BSON_ELEMENT_TYPE_DECIMAL128:

        /* TODO Implement routine to convert to decimal128 for now, simply display bytes */

        /* https://github.com/mongodb/specifications/blob/master/source/bson-decimal128/decimal128.rst */

        proto_tree_add_item(element_sub_tree, hf_mongo_element_value_decimal128, tvb, offset, 16, ENC_NA);

        offset += 16;

        break;

      default:

        break;

    }  /* end switch() */

  } while (offset < final_offset-1);

  // Restore depth.

  nest_level--;

  p_set_proto_depth(pinfo, proto_mongo, nest_level);

  return document_length;

}

/* get_first_bson_field returns the first field of the BSON document. Returned string is NULL terminated. Returns NULL on error. */

static uint8_t* get_first_bson_field(tvbuff_t *tvb, packet_info *pinfo, unsigned offset)

{

  int32_t document_length = tvb_get_letohl(tvb, offset);

  if (document_length < 5) {

    return NULL;

  }

  if (document_length > BSON_MAX_DOC_SIZE) {

    return NULL;

  }

  if (document_length == 5) {

    /* Empty document. */

    return NULL;

  }

  offset += 4;

  /* Read first document element. Ignore first byte (type) */

  return tvb_get_stringz_enc(pinfo->pool, tvb, offset+1, NULL /* out length */, ENC_ASCII);

}

static int

dissect_mongo_reply(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree)

{

  proto_item *ti;

  proto_tree *flags_tree;

  uint32_t i, number_returned;

  ti = proto_tree_add_item(tree, hf_mongo_reply_flags, tvb, offset, 4, ENC_NA);

  flags_tree = proto_item_add_subtree(ti, ett_mongo_flags);

  proto_tree_add_item(flags_tree, hf_mongo_reply_flags_cursornotfound, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_reply_flags_queryfailure, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_reply_flags_sharedconfigstale, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_reply_flags_awaitcapable, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  proto_tree_add_item(tree, hf_mongo_cursor_id, tvb, offset, 8, ENC_LITTLE_ENDIAN);

  offset += 8;

  proto_tree_add_item(tree, hf_mongo_starting_from, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  proto_tree_add_item_ret_uint(tree, hf_mongo_number_returned, tvb, offset, 4, ENC_LITTLE_ENDIAN, &number_returned);

  offset += 4;

  for (i=0; i < number_returned; i++)

  {

    offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_document);

  }

  return offset;

}

static int

dissect_mongo_msg(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

  proto_tree_add_item(tree, hf_mongo_message, tvb, offset, -1, ENC_ASCII);

  offset += tvb_strsize(tvb, offset);

  return offset;

}

static int

dissect_mongo_update(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree)

{

  proto_item *ti;

  proto_tree *flags_tree;

  proto_tree_add_item(tree, hf_mongo_zero, tvb, offset, 4, ENC_NA);

  offset += 4;

  offset += dissect_fullcollectionname(tvb, offset, tree);

  ti = proto_tree_add_item(tree, hf_mongo_update_flags, tvb, offset, 4, ENC_NA);

  flags_tree = proto_item_add_subtree(ti, ett_mongo_flags);

  proto_tree_add_item(flags_tree, hf_mongo_update_flags_upsert, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_update_flags_multiupdate, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_selector);

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_update);

  return offset;

}

static int

dissect_mongo_insert(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree)

{

  proto_item *ti;

  proto_tree *flags_tree;

  ti = proto_tree_add_item(tree, hf_mongo_insert_flags, tvb, offset, 4, ENC_NA);

  flags_tree = proto_item_add_subtree(ti, ett_mongo_flags);

  proto_tree_add_item(flags_tree, hf_mongo_insert_flags_continueonerror, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  offset += dissect_fullcollectionname(tvb, offset, tree);

  while(offset < tvb_reported_length(tvb)) {

    offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_document);

  }

  return offset;

}

static int

dissect_mongo_query(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree, uint8_t **command_name)

{

  proto_item *ti;

  proto_tree *flags_tree;

  int fullcollectionname_len;

  bool is_command = false;

  ti = proto_tree_add_item(tree, hf_mongo_query_flags, tvb, offset, 4, ENC_NA);

  flags_tree = proto_item_add_subtree(ti, ett_mongo_flags);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_tailablecursor, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_slaveok, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_oplogreplay, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_nocursortimeout, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_awaitdata, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_exhaust, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(flags_tree, hf_mongo_query_flags_partial, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  fullcollectionname_len = dissect_fullcollectionname(tvb, offset, tree);

  if (tvb_strneql (tvb, offset, "admin.$cmd", strlen("admin.$cmd") + 1) == 0) {

    is_command = true;

  }

  offset += fullcollectionname_len;

  proto_tree_add_item(tree, hf_mongo_number_to_skip, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  proto_tree_add_item(tree, hf_mongo_number_to_return, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset +=4;

  if (is_command && command_name && *command_name == NULL) {

    *command_name = get_first_bson_field (tvb, pinfo, offset);

  }

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_query);

  while(offset < tvb_reported_length(tvb)) {

    offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_return_field_selector);

  }

  return offset;

}

static int

dissect_mongo_getmore(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

  proto_tree_add_item(tree, hf_mongo_zero, tvb, offset, 4, ENC_NA);

  offset += 4;

  offset += dissect_fullcollectionname(tvb, offset, tree);

  proto_tree_add_item(tree, hf_mongo_number_to_return, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  proto_tree_add_item(tree, hf_mongo_cursor_id, tvb, offset, 8, ENC_LITTLE_ENDIAN);

  offset += 8;

  return offset;

}

static int

dissect_mongo_delete(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree)

{

  proto_item *ti;

  proto_tree *flags_tree;

  proto_tree_add_item(tree, hf_mongo_zero, tvb, offset, 4, ENC_NA);

  offset += 4;

  offset += dissect_fullcollectionname(tvb, offset, tree);

  ti = proto_tree_add_item(tree, hf_mongo_delete_flags, tvb, offset, 4, ENC_NA);

  flags_tree = proto_item_add_subtree(ti, ett_mongo_flags);

  proto_tree_add_item(flags_tree, hf_mongo_delete_flags_singleremove, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_selector);

  return offset;

}

static int

dissect_mongo_kill_cursors(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

  proto_tree_add_item(tree, hf_mongo_zero, tvb, offset, 4, ENC_NA);

  offset += 4;

  proto_tree_add_item(tree, hf_mongo_number_of_cursor_ids, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  offset += 4;

  while(offset < tvb_reported_length(tvb)) {

    proto_tree_add_item(tree, hf_mongo_cursor_id, tvb, offset, 8, ENC_LITTLE_ENDIAN);

    offset +=8;

  }

  return offset;

}

static int

dissect_mongo_op_command(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree)

{

  int32_t db_length, cmd_length;

  db_length = tvb_strsize(tvb, offset);

  proto_tree_add_item(tree, hf_mongo_database, tvb, offset, db_length, ENC_ASCII);

  offset += db_length;

  cmd_length = tvb_strsize(tvb, offset);

  proto_tree_add_item(tree, hf_mongo_commandname, tvb, offset, cmd_length, ENC_ASCII);

  offset += cmd_length;

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_metadata);

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_commandargs);

  return offset;

}

static int

dissect_mongo_op_commandreply(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree)

{

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_metadata);

  offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_commandreply);

  if (tvb_reported_length_remaining(tvb, offset) > 0){

    offset += dissect_bson_document(tvb, pinfo, offset, tree, hf_mongo_outputdocs);

  }

  return offset;

}

static int

// NOLINTNEXTLINE(misc-no-recursion)

dissect_mongo_op_compressed(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree, unsigned *effective_opcode, uint8_t **command_name)

{

  unsigned opcode = 0;

  uint8_t compressor;

  proto_item *ti;

  proto_tree *compression_info_tree;

  ti = proto_tree_add_item(tree, hf_mongo_compression_info, tvb, offset, 9, ENC_NA);

  compression_info_tree = proto_item_add_subtree(ti, ett_mongo_compression_info);

  proto_tree_add_item(compression_info_tree, hf_mongo_original_op_code, tvb, offset, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(compression_info_tree, hf_mongo_uncompressed_size, tvb, offset + 4, 4, ENC_LITTLE_ENDIAN);

  proto_tree_add_item(compression_info_tree, hf_mongo_compressor, tvb, offset + 8, 1, ENC_NA);

  proto_tree_add_item(compression_info_tree, hf_mongo_compressed_data, tvb, offset + 9, -1, ENC_NA);

  opcode = tvb_get_letohl(tvb, offset);

  *effective_opcode = opcode;

  compressor = tvb_get_uint8(tvb, offset + 8);

  offset += 9;

  switch(compressor) {

  case MONGO_COMPRESSOR_NOOP:

    offset = dissect_opcode_types(tvb, pinfo, offset, tree, opcode, effective_opcode, command_name);

    break;

#ifdef HAVE_SNAPPY

  case MONGO_COMPRESSOR_SNAPPY: {

    tvbuff_t* uncompressed_tvb = tvb_child_uncompress_snappy(tvb, tvb, offset, tvb_captured_length_remaining(tvb, offset));

    if (uncompressed_tvb) {

        add_new_data_source(pinfo, uncompressed_tvb, "Decompressed Data");

        dissect_opcode_types(uncompressed_tvb, pinfo, 0, tree, opcode, effective_opcode, command_name);

    } else {

      expert_add_info_format(pinfo, ti, &ei_mongo_unsupported_compression, "Error uncompressing snappy data");

    }

    offset = tvb_reported_length(tvb);

  } break;

#endif

#ifdef HAVE_ZSTD

  case MONGO_COMPRESSOR_ZSTD:

  {

    tvbuff_t *uncompressed_tvb = tvb_child_uncompress_zstd (tvb, tvb, offset, tvb_captured_length_remaining (tvb, offset));

    if (!uncompressed_tvb) {

      expert_add_info_format(pinfo, ti, &ei_mongo_unsupported_compression, "Error uncompressing zstd data");

    } else {

      add_new_data_source(pinfo, uncompressed_tvb, "Decompressed Data");

      dissect_opcode_types(uncompressed_tvb, pinfo, 0, tree, opcode, effective_opcode, command_name);

    }

    offset = tvb_reported_length(tvb);

  }

  break;

#endif

  case MONGO_COMPRESSOR_ZLIB: {

    tvbuff_t* compressed_tvb = tvb_child_uncompress_zlib(tvb, tvb, offset, tvb_captured_length_remaining(tvb, offset));

    if (compressed_tvb) {

      add_new_data_source(pinfo, compressed_tvb, "Decompressed Data");

      dissect_opcode_types(compressed_tvb, pinfo, 0, tree, opcode, effective_opcode, command_name);

    } else {

      proto_tree_add_item(compression_info_tree, hf_mongo_unsupported_compressed, tvb, offset, -1, ENC_NA);

      expert_add_info_format(pinfo, ti, &ei_mongo_unsupported_compression, "Error uncompressing zlib data");

    }

    offset = tvb_reported_length(tvb);

  } break;

  default:

    proto_tree_add_item(compression_info_tree, hf_mongo_unsupported_compressed, tvb, offset, -1, ENC_NA);

    expert_add_info_format(pinfo, ti, &ei_mongo_unsupported_compression, "Unsupported compression format: %d", compressor);

    offset = tvb_reported_length(tvb);

    break;

  }

  return offset;

}

static int

dissect_op_msg_section(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree, uint8_t **command_name)

{

  proto_item *ti;

  proto_tree *section_tree;

  uint8_t e_type;

  int section_len = -1;   /* Section length */

  e_type = tvb_get_uint8(tvb, offset);

  ti = proto_tree_add_item(tree, hf_mongo_msg_sections_section, tvb, offset, 1, ENC_NA);

  section_tree = proto_item_add_subtree(ti, ett_mongo_section);

  proto_tree_add_item(section_tree, hf_mongo_msg_sections_section_kind, tvb, offset, 1, ENC_LITTLE_ENDIAN);

  offset += 1;

  section_len = tvb_get_letohil(tvb, offset);

  /* The section length must be strictly smaller than the total message size,

   * both signed int32s. This prevents signed integer overflow. */

  if (section_len < 0 || section_len >= (INT32_MAX-1)) {

    proto_tree_add_expert_format(section_tree, pinfo, &ei_mongo_section_size_bad, tvb, offset, 4, "Bogus Mongo message section size: %i", section_len);

    THROW(ReportedBoundsError);

  }

  proto_item_set_len(ti, 1 + section_len);

  switch (e_type) {

    case KIND_BODY:

      section_len = dissect_bson_document(tvb, pinfo, offset, section_tree, hf_mongo_msg_sections_section_body);

      /* If section_len is bogus (e.g., negative), dissect_bson_document sets

       * an expert info and can return a different value than read above.

       */

      if (command_name && *command_name == NULL) {

        *command_name = get_first_bson_field (tvb, pinfo, offset);

      }

      break;

    case KIND_DOCUMENT_SEQUENCE: {

      int32_t dsi_length;

      int32_t to_read = section_len;

      proto_item *documents;

      proto_tree *documents_tree;

      proto_tree_add_item(section_tree, hf_mongo_msg_sections_section_size, tvb, offset, 4, ENC_LITTLE_ENDIAN);

      /* This is redundant with the lengths in the documents, we don't use this

       * size at all. We could still report an expert info if it's bogus.

       */

      offset += 4;

      to_read -= 4;

      dsi_length = tvb_strsize(tvb, offset);

      proto_tree_add_item(section_tree, hf_mongo_msg_sections_section_doc_sequence_id, tvb, offset, dsi_length, ENC_ASCII);

      offset += dsi_length;

      to_read -= dsi_length;

      documents = proto_tree_add_item(section_tree, hf_mongo_msg_sections_section_doc_sequence, tvb, offset, to_read, ENC_NA);

      documents_tree = proto_item_add_subtree(documents, ett_mongo_doc_sequence);

      while (to_read > 0){

        int32_t doc_size = dissect_bson_document(tvb, pinfo, offset, documents_tree, hf_mongo_document);

        to_read -= doc_size;

        offset += doc_size;

      }

    } break;

    default:

      expert_add_info_format(pinfo, tree, &ei_mongo_unknown, "Unknown section type: %u", e_type);

  }

  return 1 + section_len;

}

static int

dissect_mongo_op_msg(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *tree, uint8_t **command_name)

{

  static int * const mongo_msg_flags[] = {

    &hf_mongo_msg_flags_checksumpresent,

    &hf_mongo_msg_flags_moretocome,

    &hf_mongo_msg_flags_exhaustallowed,

    NULL

  };

  uint64_t op_msg_flags;

  bool checksum_present = false;

  proto_tree_add_bitmask_ret_uint64 (tree, tvb, offset, hf_mongo_msg_flags, ett_mongo_msg_flags, mongo_msg_flags, ENC_LITTLE_ENDIAN, &op_msg_flags);

  if (op_msg_flags & 0x00000001) {

    checksum_present = true;

  }

  offset += 4;

  while (tvb_reported_length_remaining(tvb, offset) > (checksum_present ? 4U : 0U)){

    offset += dissect_op_msg_section(tvb, pinfo, offset, tree, command_name);

  }

  if (checksum_present) {

    uint32_t calculated_checksum = ~crc32c_tvb_offset_calculate (tvb, 0, tvb_reported_length (tvb) - 4, CRC32C_PRELOAD);

    proto_tree_add_checksum(tree, tvb, offset, hf_mongo_msg_checksum, hf_mongo_msg_checksum_status, &ei_mongo_msg_checksum, pinfo, calculated_checksum, ENC_BIG_ENDIAN, PROTO_CHECKSUM_VERIFY);

    offset += 4;

  }

  return offset;

}

static int

// NOLINTNEXTLINE(misc-no-recursion)

dissect_opcode_types(tvbuff_t *tvb, packet_info *pinfo, unsigned offset, proto_tree *mongo_tree, unsigned opcode, unsigned *effective_opcode, uint8_t **command_name)

{

    *effective_opcode = opcode;

    unsigned recursion_depth = p_get_proto_depth(pinfo, proto_mongo);

    DISSECTOR_ASSERT(recursion_depth <= BSON_MAX_NESTING);

    p_set_proto_depth(pinfo, proto_mongo, recursion_depth + 1);

    switch(opcode){

    case OP_REPLY:

      offset = dissect_mongo_reply(tvb, pinfo, offset, mongo_tree);

      break;

    case OP_MESSAGE:

      offset = dissect_mongo_msg(tvb, offset, mongo_tree);

      break;