FreeTDS Development Group

[Brian Bruns <camber AT umcc.ais.org>]

On Tue, 23 Feb 1999 ark AT eltex.ru wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> nuqneH,
> 
> I am currently writing a TDS proxy for firewall (ms-sql and sybase). 
> Some questions are:
>
Wow, I had been planning on writing just such a program! Well, glad to
have someone else do it :) 
  
> a) How can i _reliably_ detect login packet? Parsing based on message
> id is not reliable: i've seen ms sql client that does set _all_ messages
> id to 0x04 and it still works!
> 
Hmmm...actually a 0x02 is what I show in the packect type field (not sure
if my terminology is correct), but it is byte 0 of the packet (just before
the last packet indicator). It seems to be very reliable from what I've
seen. What values are you seeing for this byte?
  
> b) What is OOB data format? is it the same packet-based one? What for 
> OOB messages are used?
>
I'm taking a bit of a guess here, since I haven't seen these at the
protocol level yet. But OOB attentions are also referred to at 'expedited
messages', my assumption is that this means messages can appear between
rows for instance where this wouldn't normally be possible. I'm sure
someone will correct me if I'm wrong on this.
 
> c) What else is worth filtering?
> 
Have you considered a very basic encapsulation? Reading the first four
bytes will give you the packet size, so everything inside the packet
could be considered opaque. You could have the gateway listen on one port
for each server you are tunneling to, relay that via HTTP (using POST
let's say) to the reverse gateway on the other side on the firewall, which
would untunnel and ship in to and fro from the SQL server. It really
wouldn't need to be all that smart. Of course HTTP 1.1 with persistant
connections would help greatly (otherwise tracking state is a PITA).

Actually you could even make an apache module to do the HTTP->TDS part,
though that would probably be overkill.