fix elastic#14872: fix incorrectly handle with two-words redis command (

elastic#14873)

Updated redis protocol decoder to support two-word commands.

Fixes elastic#14872

CHANGELOG.next.asciidoc

@@ -37,6 +37,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Packetbeat*
 
+- Redis: fix incorrectly handle with two-words redis command. {issue}14872[14872] {pull}14873[14873] 
 
 *Winlogbeat*
 

packetbeat/protos/redis/redis_parse.go

@@ -18,6 +18,7 @@
 package redis
 
 import (
+ "bytes"
  "time"
 
  "github.com/elastic/beats/v7/libbeat/common"
@@ -423,11 +424,22 @@ func (p *parser) parseArray(depth int, buf *streambuf.Buffer) (common.NetString,
  }
 
  // handle top-level request command
- if depth == 0 && isRedisCommand(content[0]) {
+ var oneWordCommand, twoWordsCommand bool
+ oneWordCommand = isRedisCommand(content[0])
+ twoWordsCommand = count > 1 && isRedisCommand(bytes.Join(content[0:2], []byte(" ")))
+
+ if depth == 0 && (oneWordCommand || twoWordsCommand) {
  p.message.isRequest = true
- p.message.method = content[0]
- if len(content) > 1 {
- p.message.path = content[1]
+ if oneWordCommand {
+ p.message.method = content[0]
+ if len(content) > 1 {
+ p.message.path = content[1]
+ }
+ } else if twoWordsCommand {
+ p.message.method = bytes.Join(content[0:2], []byte(" "))
+ if len(content) > 2 {
+ p.message.path = content[2]
+ }
  }
 
  var value common.NetString

packetbeat/protos/redis/redis_test.go

@@ -67,9 +67,31 @@ func TestRedisParser_ArrayRequest(t *testing.T) {
  assert.True(t, complete)
  assert.True(t, msg.isRequest)
  assert.Equal(t, "SET key1 Hello", string(msg.message))
+ assert.Equal(t, "SET", string(msg.method))
+ assert.Equal(t, "key1", string(msg.path))
  assert.Equal(t, len(arrayRequest), msg.size)
 }
 
+var arrayRequest2 = []byte("*3\r\n" +
+ "$6\r\n" +
+ "CONFIG\r\n" +
+ "$3\r\n" +
+ "GET\r\n" +
+ "$1\r\n" +
+ "*\r\n")
+
+func TestRedisParser_ArrayRequest2(t *testing.T) {
+ msg, ok, complete := parse(arrayRequest2)
+
+ assert.True(t, ok)
+ assert.True(t, complete)
+ assert.True(t, msg.isRequest)
+ assert.Equal(t, "CONFIG GET *", string(msg.message))
+ assert.Equal(t, "CONFIG GET", string(msg.method))
+ assert.Equal(t, "*", string(msg.path))
+ assert.Equal(t, len(arrayRequest2), msg.size)
+}
+
 var arrayResponse = []byte("*4\r\n" +
  "$3\r\n" +
  "foo\r\n" +