FreeTDS Development Group

[ark AT eltex.ru]

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

Brian Bruns <camber AT umcc.ais.org> said :

> > I am currently writing a TDS proxy for firewall (ms-sql and sybase). 
> > Some questions are:
> >
> Wow, I had been planning on writing just such a program! Well, glad to
> have someone else do it :) 

I've seen one from TIS Gautlet, it does nothing except just letting packets
through in and out. Only basic header check is performed.
   
> > a) How can i _reliably_ detect login packet? Parsing based on message
> > id is not reliable: i've seen ms sql client that does set _all_ messages
> > id to 0x04 and it still works!
> > 
> Hmmm...actually a 0x02 is what I show in the packect type field (not sure
> if my terminology is correct), but it is byte 0 of the packet (just before
> the last packet indicator). It seems to be very reliable from what I've
> seen. What values are you seeing for this byte?

0x04, as i said - that's what Arno's old mssql_client puts there.
The most amazing thing is that it works!
    
> > c) What else is worth filtering?
> > 
> Have you considered a very basic encapsulation? Reading the first four
> bytes will give you the packet size, so everything inside the packet
> could be considered opaque. You could have the gateway listen on one port
> for each server you are tunneling to, relay that via HTTP (using POST
> let's say) to the reverse gateway on the other side on the firewall, which
> would untunnel and ship in to and fro from the SQL server. It really
> wouldn't need to be all that smart. Of course HTTP 1.1 with persistant
> connections would help greatly (otherwise tracking state is a PITA).

Hmm, i don't think HTTP is much useful here - i am writing it just to
speak generic TDS only..

> Actually you could even make an apache module to do the HTTP->TDS part,
> though that would probably be overkill.

Sounds interesting but i'm afraid i don't have enough time for it.. :(


                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNtP9BaH/mIJW9LeBAQGNkwP/XawLTdRP5F+ppGc/R5frA8pVO/962V7b
63caAKXdJHo+ZlZc545O4XgrWhrOw7SuamvbVmVMCcIWKRkZFMAbs60k7G0x141Q
QhWa/Jh3+fyo+/Nve/nXpy8tKUQvzoMCryQh5LhxjKEaPkxhTaukguYyQQ9tZm9z
gLz6Tp3qtCw=
=Dpqj
-----END PGP SIGNATURE-----