maximum described in the specification.
4.14. Structure
Structures are declared as follows:
struct {
component-declaration-A;
component-declaration-B;
...
} identifier;
The components of the structure are encoded in the order of their
declaration in the structure. Each component’s size is a multiple of
four bytes, though the components may be different sizes.
+-------------+-------------+...
| component A | component B |... STRUCTURE
+-------------+-------------+...
4.15. Discriminated Union
A discriminated union is a type composed of a discriminant followed
by a type selected from a set of prearranged types according to the
value of the discriminant. The type of discriminant is either "int",
"unsigned int", or an enumerated type, such as "bool". The component
types are called "arms" of the union and are preceded by the value of
the discriminant that implies their encoding. Discriminated unions
are declared as follows:
union switch (discriminant-declaration) {
case discriminant-value-A:
arm-declaration-A;
case discriminant-value-B:
arm-declaration-B;
...
default: default-declaration;
} identifier;
Each "case" keyword is followed by a legal value of the discriminant.
The default arm is optional. If it is not specified, then a valid
encoding of the union cannot take on unspecified discriminant values.
The size of the implied arm is always a multiple of four bytes.
The discriminated union is encoded as its discriminant followed by
the encoding of the implied arm.
0 1 2 3
+---+---+---+---+---+---+---+---+
| discriminant | implied arm | DISCRIMINATED UNION
+---+---+---+---+---+---+---+---+
|<---4 bytes--->|
4.16. Void
An XDR void is a 0-byte quantity. Voids are useful for describing
operations that take no data as input or no data as output. They are
also useful in unions, where some arms may contain data and others do
not. The declaration is simply as follows:
void;
Voids are illustrated as follows:
++
|| VOID
++
--><-- 0 bytes
4.17. Constant
The data declaration for a constant follows this form:
const name-identifier = n;
"const" is used to define a symbolic name for a constant; it does not
declare any data. The symbolic constant may be used anywhere a
regular constant may be used. For example, the following defines a
symbolic constant DOZEN, equal to 12.
const DOZEN = 12;
4.18. Typedef
"typedef" does not declare any data either, but serves to define new
identifiers for declaring data. The syntax is:
typedef declaration;
The new type name is actually the variable name in the declaration
part of the typedef. For example, the following defines a new type
called "eggbox" using an existing type called "egg":
typedef egg eggbox[DOZEN];
Variables declared using the new type name have the same type as the
new type name would have in the typedef, if it were considered a
variable. For example, the following two declarations are equivalent
in declaring the variable "fresheggs":
eggbox fresheggs; egg fresheggs[DOZEN];
When a typedef involves a struct, enum, or union definition, there is
another (preferred) syntax that may be used to define the same type.
In general, a typedef of the following form:
typedef <<struct, union, or enum definition>> identifier;
may be converted to the alternative form by removing the "typedef"
part and placing the identifier after the "struct", "union", or
"enum" keyword, instead of at the end. For example, here are the two
ways to define the type "bool":
typedef enum { /* using typedef */
FALSE = 0,
TRUE = 1
} bool;
enum bool { /* preferred alternative */
FALSE = 0,
TRUE = 1
};
This syntax is preferred because one does not have to wait until the
end of a declaration to figure out the name of the new type.
4.19. Optional-Data
Optional-data is one kind of union that occurs so frequently that we
give it a special syntax of its own for declaring it. It is declared
as follows:
type-name *identifier;
This is equivalent to the following union:
union switch (bool opted) {
case TRUE:
type-name element;
case FALSE:
void;
} identifier;
It is also equivalent to the following variable-length array
declaration, since the boolean "opted" can be interpreted as the
length of the array:
type-name identifier<1>;
Optional-data is not so interesting in itself, but it is very useful
for describing recursive data-structures such as linked-lists and
trees. For example, the following defines a type "stringlist" that
encodes lists of zero or more arbitrary length strings:
struct stringentry {
string item<>;
stringentry *next;
};
typedef stringentry *stringlist;
It could have been equivalently declared as the following union:
union stringlist switch (bool opted) {
case TRUE:
struct {
string item<>;
stringlist next;
} element;
case FALSE:
void;
};
or as a variable-length array:
struct stringentry {
string item<>;
stringentry next<1>;
};
typedef stringentry stringlist<1>;
Both of these declarations obscure the intention of the stringlist
type, so the optional-data declaration is preferred over both of
them. The optional-data type also has a close correlation to how
recursive data structures are represented in high-level languages
such as Pascal or C by use of pointers. In fact, the syntax is the
same as that of the C language for pointers.
4.20. Areas for Future Enhancement
The XDR standard lacks representations for bit fields and bitmaps,
since the standard is based on bytes. Also missing are packed (or
binary-coded) decimals.
The intent of the XDR standard was not to describe every kind of data
that people have ever sent or will ever want to send from machine to
machine. Rather, it only describes the most commonly used data-types
of high-level languages such as Pascal or C so that applications
written in these languages will be able to communicate easily over
some medium.
One could imagine extensions to XDR that would let it describe almost
any existing protocol, such as TCP. The minimum necessary for this
is support for different block sizes and byte-orders. The XDR
discussed here could then be considered the 4-byte big-endian member
of a larger XDR family.
5. Discussion
(1) Why use a language for describing data? What’s wrong with
diagrams?
There are many advantages in using a data-description language such
as XDR versus using diagrams. Languages are more formal than
diagrams and lead to less ambiguous descriptions of data. Languages
are also easier to understand and allow one to think of other issues
instead of the low-level details of bit encoding. Also, there is a
close analogy between the types of XDR and a high-level language such
as C or Pascal. This makes the implementation of XDR encoding and
decoding modules an easier task. Finally, the language specification
itself is an ASCII string that can be passed from machine to machine
to perform on-the-fly data interpretation.
(2) Why is there only one byte-order for an XDR unit?
Supporting two byte-orderings requires a higher-level protocol for
determining in which byte-order the data is encoded. Since XDR is
not a protocol, this can’t be done. The advantage of this, though,
is that data in XDR format can be written to a magnetic tape, for
example, and any machine will be able to interpret it, since no
higher-level protocol is necessary for determining the byte-order.
(3) Why is the XDR byte-order big-endian instead of little-endian?
Isn’t this unfair to little-endian machines such as the VAX(r),
which has to convert from one form to the other?
Yes, it is unfair, but having only one byte-order means you have to
be unfair to somebody. Many architectures, such as the Motorola
68000* and IBM 370*, support the big-endian byte-order.
(4) Why is the XDR unit four bytes wide?
There is a tradeoff in choosing the XDR unit size. Choosing a small
size, such as two, makes the encoded data small, but causes alignment
problems for machines that aren’t aligned on these boundaries. A
large size, such as eight, means the data will be aligned on
virtually every machine, but causes the encoded data to grow too big.
We chose four as a compromise. Four is big enough to support most
architectures efficiently, except for rare machines such as the
eight-byte-aligned Cray*. Four is also small enough to keep the
encoded data restricted to a reasonable size.
(5) Why must variable-length data be padded with zeros?
It is desirable that the same data encode into the same thing on all
machines, so that encoded data can be meaningfully compared or
checksummed. Forcing the padded bytes to be zero ensures this.
(6) Why is there no explicit data-typing?
Data-typing has a relatively high cost for what small advantages it
may have. One cost is the expansion of data due to the inserted type
fields. Another is the added cost of interpreting these type fields
and acting accordingly. And most protocols already know what type
they expect, so data-typing supplies only redundant information.
However, one can still get the benefits of data-typing using XDR.
One way is to encode two things: first, a string that is the XDR data
description of the encoded data, and then the encoded data itself.
Another way is to assign a value to all the types in XDR, and then
define a universal type that takes this value as its discriminant and
for each value, describes the corresponding data type.
6. The XDR Language Specification
6.1. Notational Conventions
This specification uses an extended Back-Naur Form notation for
describing the XDR language. Here is a brief description of the
notation:
(1) The characters ’|’, ’(’, ’)’, ’[’, ’]’, ’"’, and ’*’ are special.
(2) Terminal symbols are strings of any characters surrounded by
double quotes. (3) Non-terminal symbols are strings of non-special
characters. (4) Alternative items are separated by a vertical bar
("|"). (5) Optional items are enclosed in brackets. (6) Items are
grouped together by enclosing them in parentheses. (7) A ’*’
following an item means 0 or more occurrences of that item.
For example, consider the following pattern:
"a " "very" (", " "very")* [" cold " "and "] " rainy "
("day" | "night")
An infinite number of strings match this pattern. A few of them are:
"a very rainy day"
"a very, very rainy day"
"a very cold and rainy day"
"a very, very, very cold and rainy night"
6.2. Lexical Notes
(1) Comments begin with ’/*’ and terminate with ’*/’. (2) White
space serves to separate items and is otherwise ignored. (3) An
identifier is a letter followed by an optional sequence of letters,
digits, or underbar (’_’). The case of identifiers is not ignored.
(4) A decimal constant expresses a number in base 10 and is a
sequence of one or more decimal digits, where the first digit is not
a zero, and is optionally preceded by a minus-sign (’-’). (5) A
hexadecimal constant expresses a number in base 16, and must be
preceded by ’0x’, followed by one or hexadecimal digits (’A’, ’B’,
’C’, ’D’, E’, ’F’, ’a’, ’b’, ’c’, ’d’, ’e’, ’f’, ’0’, ’1’, ’2’, ’3’,
’4’, ’5’, ’6’, ’7’, ’8’, ’9’). (6) An octal constant expresses a
number in base 8, always leads with digit 0, and is a sequence of one
or more octal digits (’0’, ’1’, ’2’, ’3’, ’4’, ’5’, ’6’, ’7’).
6.3. Syntax Information
declaration:
type-specifier identifier
| type-specifier identifier "[" value "]"
| type-specifier identifier "<" [ value ] ">"
| "opaque" identifier "[" value "]"
| "opaque" identifier "<" [ value ] ">"
| "string" identifier "<" [ value ] ">"
| type-specifier "*" identifier
| "void"
value:
constant
| identifier
constant:
decimal-constant | hexadecimal-constant | octal-constant
type-specifier:
[ "unsigned" ] "int"
| [ "unsigned" ] "hyper"
| "float"
| "double"
| "quadruple"
| "bool"
| enum-type-spec
| struct-type-spec
| union-type-spec
| identifier
enum-type-spec:
"enum" enum-body
enum-body:
"{"
( identifier "=" value )
( "," identifier "=" value )*
"}"
struct-type-spec:
"struct" struct-body
struct-body:
"{"
( declaration ";" )
( declaration ";" )*
"}"
union-type-spec:
"union" union-body
union-body:
"switch" "(" declaration ")" "{"
case-spec
case-spec *
[ "default" ":" declaration ";" ]
"}"
case-spec:
( "case" value ":")
( "case" value ":") *
declaration ";"
constant-def:
"const" identifier "=" constant ";"
type-def:
"typedef" declaration ";"
| "enum" identifier enum-body ";"
| "struct" identifier struct-body ";"
| "union" identifier union-body ";"
definition:
type-def
| constant-def
specification:
definition *
6.4. Syntax Notes
(1) The following are keywords and cannot be used as identifiers:
"bool", "case", "const", "default", "double", "quadruple", "enum",
"float", "hyper", "int", "opaque", "string", "struct", "switch",
"typedef", "union", "unsigned", and "void".
(2) Only unsigned constants may be used as size specifications for
arrays. If an identifier is used, it must have been declared
previously as an unsigned constant in a "const" definition.
(3) Constant and type identifiers within the scope of a specification
are in the same name space and must be declared uniquely within this
scope.
(4) Similarly, variable names must be unique within the scope of
struct and union declarations. Nested struct and union declarations
create new scopes.
(5) The discriminant of a union must be of a type that evaluates to
an integer. That is, "int", "unsigned int", "bool", an enumerated
type, or any typedefed type that evaluates to one of these is legal.
Also, the case values must be one of the legal values of the
discriminant. Finally, a case value may not be specified more than
once within the scope of a union declaration.
7. An Example of an XDR Data Description
Here is a short XDR data description of a thing called a "file",
which might be used to transfer files from one machine to another.
const MAXUSERNAME = 32; /* max length of a user name */
const MAXFILELEN = 65535; /* max length of a file */
const MAXNAMELEN = 255; /* max length of a file name */
/*
* Types of files:
*/
enum filekind {
TEXT = 0, /* ascii data */
DATA = 1, /* raw data */
EXEC = 2 /* executable */
};
/*
* File information, per kind of file:
*/
union filetype switch (filekind kind) {
case TEXT:
void; /* no extra information */
case DATA:
string creator<MAXNAMELEN>; /* data creator */
case EXEC:
string interpretor<MAXNAMELEN>; /* program interpretor */
};
/*
* A complete file:
*/
struct file {
string filename<MAXNAMELEN>; /* name of file */
filetype type; /* info about file */
string owner<MAXUSERNAME>; /* owner of file */
opaque data<MAXFILELEN>; /* file data */
};
Suppose now that there is a user named "john" who wants to store his
lisp program "sillyprog" that contains just the data "(quit)". His
file would be encoded as follows:
OFFSET HEX BYTES ASCII COMMENTS
------ --------- ----- --------
0 00 00 00 09 .... -- length of filename = 9
4 73 69 6c 6c sill -- filename characters
8 79 70 72 6f ypro -- ... and more characters ...
12 67 00 00 00 g... -- ... and 3 zero-bytes of fill
16 00 00 00 02 .... -- filekind is EXEC = 2
20 00 00 00 04 .... -- length of interpretor = 4
24 6c 69 73 70 lisp -- interpretor characters
28 00 00 00 04 .... -- length of owner = 4
32 6a 6f 68 6e john -- owner characters
36 00 00 00 06 .... -- length of file data = 6
40 28 71 75 69 (qui -- file data bytes ...
44 74 29 00 00 t).. -- ... and 2 zero-bytes of fill
8. Security Considerations
XDR is a data description language, not a protocol, and hence it does
not inherently give rise to any particular security considerations.
Protocols that carry XDR-formatted data, such as NFSv4, are
responsible for providing any necessary security services to secure
the data they transport.
Care must be take to properly encode and decode data to avoid
attacks. Known and avoidable risks include:
* Buffer overflow attacks. Where feasible, protocols should be
defined with explicit limits (via the "<" [ value ] ">" notation
instead of "<" ">") on elements with variable-length data types.
Regardless of the feasibility of an explicit limit on the
variable length of an element of a given protocol, decoders need
to ensure the incoming size does not exceed the length of any
provisioned receiver buffers.
* Nul octets embedded in an encoded value of type string. If the
decoder’s native string format uses nul-terminated strings, then
the apparent size of the decoded object will be less than the
amount of memory allocated for the string. Some memory
deallocation interfaces take a size argument. The caller of the
deallocation interface would likely determine the size of the
string by counting to the location of the nul octet and adding
one. This discrepancy can cause memory leakage (because less
memory is actually returned to the free pool than allocated),
leading to system failure and a denial of service attack.
* Decoding of characters in strings that are legal ASCII
characters but nonetheless are illegal for the intended
application. For example, some operating systems treat the ’/’
character as a component separator in path names. For a
protocol that encodes a string in the argument to a file
creation operation, the decoder needs to ensure that ’/’ is not
inside the component name. Otherwise, a file with an illegal
’/’ in its name will be created, making it difficult to remove,
and is therefore a denial of service attack.
* Denial of service caused by recursive decoder or encoder
subroutines. A recursive decoder or encoder might process data
that has a structured type with a member of type optional data
that directly or indirectly refers to the structured type (i.e.,
a linked list). For example,
struct m {
int x;
struct m *next;
};
An encoder or decoder subroutine might be written to recursively
call itself each time another element of type "struct m" is
found. An attacker could construct a long linked list of
"struct m" elements in the request or response, which then
causes a stack overflow on the decoder or encoder. Decoders and