Skip to Content.
Sympa Menu

freetds - Re: hints for writing a proxy?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: ark AT eltex.ru
  • To: freetds AT franklin.oit.unc.edu
  • Subject: Re: hints for writing a proxy?
  • Date: Wed, 24 Feb 1999 16:22:14 +0300


-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

Brian Bruns <camber AT umcc.ais.org> said :

> > I am currently writing a TDS proxy for firewall (ms-sql and sybase).
> > Some questions are:
> >
> Wow, I had been planning on writing just such a program! Well, glad to
> have someone else do it :)

I've seen one from TIS Gautlet, it does nothing except just letting packets
through in and out. Only basic header check is performed.

> > a) How can i _reliably_ detect login packet? Parsing based on message
> > id is not reliable: i've seen ms sql client that does set _all_ messages
> > id to 0x04 and it still works!
> >
> Hmmm...actually a 0x02 is what I show in the packect type field (not sure
> if my terminology is correct), but it is byte 0 of the packet (just before
> the last packet indicator). It seems to be very reliable from what I've
> seen. What values are you seeing for this byte?

0x04, as i said - that's what Arno's old mssql_client puts there.
The most amazing thing is that it works!

> > c) What else is worth filtering?
> >
> Have you considered a very basic encapsulation? Reading the first four
> bytes will give you the packet size, so everything inside the packet
> could be considered opaque. You could have the gateway listen on one port
> for each server you are tunneling to, relay that via HTTP (using POST
> let's say) to the reverse gateway on the other side on the firewall, which
> would untunnel and ship in to and fro from the SQL server. It really
> wouldn't need to be all that smart. Of course HTTP 1.1 with persistant
> connections would help greatly (otherwise tracking state is a PITA).

Hmm, i don't think HTTP is much useful here - i am writing it just to
speak generic TDS only..

> Actually you could even make an apache module to do the HTTP->TDS part,
> though that would probably be overkill.

Sounds interesting but i'm afraid i don't have enough time for it.. :(


_ _ _ _ _ _ _
{::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_
(##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_|
[||] [||] [||] Do i believe in Bible? Hell,man,i've seen one!

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNtP9BaH/mIJW9LeBAQGNkwP/XawLTdRP5F+ppGc/R5frA8pVO/962V7b
63caAKXdJHo+ZlZc545O4XgrWhrOw7SuamvbVmVMCcIWKRkZFMAbs60k7G0x141Q
QhWa/Jh3+fyo+/Nve/nXpy8tKUQvzoMCryQh5LhxjKEaPkxhTaukguYyQQ9tZm9z
gLz6Tp3qtCw=
=Dpqj
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page