FreeTDS Development Group

["Lowden, James K" <LowdenJK AT bernstein.com>]

> From: lists-tds AT mymailfilter.net [mailto:lists-tds AT mymailfilter.net]
> Sent: July 17, 2003 4:19 PM
> 
> The trace I included came directly from an application that 
> accesses an 
> MSSQL server via ADO.  It's a sniffer snapshot -- I want to know the 
> protocol, so I'm using a packet that's known to work.  In 
> other words, the 
> packet I'm trying to "decode" is/was constructed by a 
> Microsoft library.  

Excellent, Jeff.  I can tell you for certain that several people here will
be interested to learn what you discover.  I'm quite sure what you're
looking at is unknown to us.  Is this SQL Server 7 or 2000?  

Our Chief Reverse Engineer Emeritus, Brian Bruns (hmm, I wonder how he'll
like that title?) wrote  a TDS filter for Ethereal, but I expect that won't
decode your packet, either.  If we're fortunate, he might have some
insight/strategy to offer.  If we're extremely fortunate, someone with a
friend at Microsoft might have something to offer.  But that kind of direct
help doesn't arrive often.  

> I'm hoping to find some information similar to that already 
> documented (http://www.freetds.org/tds.html)

That file is maintained in CVS and can be found in the doc directory of the
source distribution.  (On my TODO is to update the website and move its
documents into CVS, too.)  We have a complete TDS 7.0 login packet now, but
nothing more on type 3 packets.  

> I want to better understand how the protocol is being used so 
> I can better understand how FreeTDS accomplishes the same thing...

You've got company. ;-)

> The more I look at it, the more it seems like the data I'm 
> questioning is "parameter" related.

Seems likely.  A completely wild guess would be offset, length, datatype,
and value information, to make marshalling easier.  IOW, maybe they prepend
the parameter data (and metadata) to the SQL text.  

> Maybe you can tell me how FreeTDS constructs the packet and that'll 
> correspond (except perhaps the "sp_execsql") accordingly.  

I can point you to our source code, if that helps.  See src/tds/query.c and
src/tds/write.c.  tds_write_packet() constructs the header (starting with
0x03).  query.c has our prepared statement functionality.  

> Thanks again James.

Glad to help if I can.  

If I could offer a baby-simple strategy, how about this?

create procedure foo @bar char(1) = 'B' output
        as      select @bar='A' 
                return 0

Then try these three calls:

        execute foo
        execute foo @a
        execute foo @a output

Maybe the differences in the mystery bytes will shed light on their purpose.
I at least would be interested in what turns up.  

--jkl
-----------------------------------------
The information contained in this transmission may contain privileged and 
confidential information and is intended only for the use of the person(s) 
named above. If you are not the intended recipient, or an employee or agent 
responsible for delivering this message to the intended recipient, any 
review, dissemination, distribution or duplication of this communication is 
strictly prohibited. If you are not the intended recipient, please contact 
the sender immediately by reply e-mail and destroy all copies of the original 
message. Please note that we do not accept account orders and/or instructions 
by e-mail, and therefore will not be responsible for carrying out such orders 
and/or instructions.