Skip to Content.
Sympa Menu

freetds - [freetds] possible corruption of TDS 5.0 login packet

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "James K. Lowden" <jklowden AT freetds.org>
  • To: TDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: [freetds] possible corruption of TDS 5.0 login packet
  • Date: Wed, 26 Nov 2008 15:56:31 -0500

There might be a problem with the TDS 5.0 login packet. Careful
examination of memory and the bytestream shows some strangeness that the
server doesn't seem to mind, but that I can't explain from the
documentation or the code.

What follows is some TDSDUMP output (using new logging just added in CVS)
and a set of concerns.

1. The data passed to tds_put_login_string() frequently include data
beyond end-of-data. The passed length is correct, but the bytes between
EOD and the end of the buffer are not zero. Because the function relies
on the strlen of the passed string, it works OK, but it's odd.

2. The servername field is being overwritten by "SYBASE" even when it
should not be.

== LOG ==
log.c:190:Starting log file for FreeTDS 0.83.dev.20080708
on 2008-11-26 20:14:49 with debug flags 0x4fff.
iconv.c:337:tds_iconv_open(0x807e000, 646)
iconv.c:78:Using trivial iconv
iconv.c:197:local name for ISO-8859-1 is ISO-8859-1
iconv.c:197:local name for UTF-8 is UTF-8
iconv.c:197:local name for UCS-2LE is UCS-2LE
iconv.c:197:local name for UCS-2BE is (null)
iconv.c:365:setting up conversions for client charset "646"
iconv.c:367:preparing iconv for "646" <-> "UCS-2LE" conversion
iconv.c:404:preparing iconv for "ISO-8859-1" <-> "ISO-8859-1" conversion
iconv.c:407:tds_iconv_open: done
net.c:204:Connecting to 10.80.57.62 port 11025 (TDS version 5.0)
net.c:258:tds_open_socket: connect(2) returned "Operation now in progress"
net.c:296:tds_open_socket() succeeded
util.c:162:Changed query state from DEAD to IDLE
login.c:481:login string
0000 6e 74 63 35 30 30 33 2e-61 63 6d 6c 2e 63 6f 6d |clientN. abcd.com|
0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 |........ ......|

# This ^^^ is the way I'd expect a login field to be sent.

login.c:481:login string
0000 41 47 45 4e 54 39 39 00-00 00 00 00 00 00 00 00 |usrname. ........|
0010 53 48 49 4c 54 4f 4e 00-00 00 00 00 00 00 |passwrd. ......|

# The user_name field has the password at offset 16.
# tds_put_login_string() uses strlen(3) to determine the EOD (here, 7).

# The pattern continues for the next several fields.

login.c:481:login string
0000 53 48 49 4c 54 4f 4e 00-00 00 00 00 00 00 00 00 |passwrd. ........|
0010 54 44 53 2d 4c 69 62 72-61 72 79 00 00 00 |TDS-Libr ary...|

login.c:481:login string
0000 33 37 38 37 36 00 55 6e-6b 6e 6f 77 6e 20 70 72 |37876.Un known pr|
0010 6f 74 6f 63 6f 6c 20 76-65 72 73 69 6f 6e |otocol v ersion|

login.c:481:login string
0000 54 53 51 4c 00 00 00 00-00 00 00 00 00 00 00 00 |TSQL.... ........|
0010 41 47 45 4e 54 39 39 00-00 00 00 00 00 00 |usrname. ......|

login.c:481:login string
0000 53 59 42 41 53 45 00 00-00 00 00 00 00 00 00 00 |SYBASE.. ........|
0010 36 34 36 00 38 38 35 39-2d 31 00 00 00 00 |646.8859 -1....|

login.c:481:login string
0000 54 44 53 2d 4c 69 62 72-61 72 |TDS-Libr ar|

login.c:481:login string
0000 75 73 5f 65 6e 67 6c 69-73 68 00 00 00 00 00 00 |us_engli sh......|
0010 73 74 70 63 73 00 00 00-00 00 00 00 00 00 |svrnm... ......|

# Note that "svrnm" is the true servername, but it is not the value that
# ends up in the login packet, see below.

net.c:768:Sending packet
0000 02 00 02 00 00 00 00 00-6e 74 63 35 30 30 33 2e |........ clientN.|
0010 61 63 6d 6c 2e 63 6f 6d-00 00 00 00 00 00 00 00 |abcd.com ........|
0020 00 00 00 00 00 00 10 41-47 45 4e 54 39 39 00 00 |.......u srname..|
0030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0040 00 00 00 00 00 07 53 48-49 4c 54 4f 4e 00 00 00 |......pa sswrd...|
0050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0060 00 00 00 00 07 33 37 38-37 36 00 00 00 00 00 00 |.....378 76......|
0070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0080 00 00 00 05 03 01 06 0a-09 01 00 00 00 00 00 00 |........ ........|
0090 00 00 00 00 54 53 51 4c-00 00 00 00 00 00 00 00 |....TSQL ........|
00a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
00b0 00 00 04 53 59 42 41 53-45 00 00 00 00 00 00 00 |...SYBAS E.......|
^^^^^^^
# Item 2: This is not the servername looked up in freetds.conf

00c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
00d0 00 06 00 07 53 48 49 4c-54 4f 4e 00 00 00 00 00 |....pass wrd.....|
00e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
00f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
01b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
01c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
01d0 00 09 05 00 00 00 54 44-53 2d 4c 69 62 72 61 72 |......TD S-Librar|
01e0 0a 05 00 00 00 00 0d 11-75 73 5f 65 6e 67 6c 69 |........ us_engli|
01f0 73 68 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |sh...... ........|

login.c:481:login string
0000 69 73 6f 36 34 36 00 69-73 6f 5f 31 00 6b 6f 69 |iso646.i so_1.koi|
0010 38 00 6d 61 63 00 6d 61-63 5f 63 79 72 00 |8.mac.ma c_cyr.|

login.c:481:login string
0000 35 31 32 00 0a 50 - |512..P|

net.c:768:Sending packet
0000 02 01 00 61 00 00 00 00-00 00 00 00 00 00 0a 00 |...a.... ........|
0010 00 00 00 00 00 00 00 00-00 00 00 00 00 69 73 6f |........ .....iso|
0020 36 34 36 00 00 00 00 00-00 00 00 00 00 00 00 00 |646..... ........|
0030 00 00 00 00 00 00 00 00-00 00 00 06 01 35 31 32 |........ .....512|
0040 00 00 00 03 00 00 00 00-e2 16 00 01 09 00 08 0e |........ ........|
0050 6d 7f ff ff ff fe 02 09-00 00 00 00 02 68 00 00 |m....... .....h..|
0060 00 - |.|

== EOL ==




Archive powered by MHonArc 2.6.24.

Top of Page