freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
Re: [freetds] possible corruption of TDS 5.0 login packet
- From: "Frediano Ziglio" <freddy77 AT gmail.com>
- To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
- Subject: Re: [freetds] possible corruption of TDS 5.0 login packet
- Date: Thu, 27 Nov 2008 11:10:49 +0100
2008/11/26 James K. Lowden <jklowden AT freetds.org>
>
> There might be a problem with the TDS 5.0 login packet. Careful
> examination of memory and the bytestream shows some strangeness that the
> server doesn't seem to mind, but that I can't explain from the
> documentation or the code.
>
> What follows is some TDSDUMP output (using new logging just added in CVS)
> and a set of concerns.
>
> 1. The data passed to tds_put_login_string() frequently include data
> beyond end-of-data. The passed length is correct, but the bytes between
> EOD and the end of the buffer are not zero. Because the function relies
> on the strlen of the passed string, it works OK, but it's odd.
>
no, tds_put_login_string call tds_put_buf which read third-arg bytes
and fill up with zeroes to fourth-arg perhaps you are confused by
tds_put_n.
> 2. The servername field is being overwritten by "SYBASE" even when it
> should not be.
>
Strange...
> == LOG ==
> log.c:190:Starting log file for FreeTDS 0.83.dev.20080708
> on 2008-11-26 20:14:49 with debug flags 0x4fff.
> iconv.c:337:tds_iconv_open(0x807e000, 646)
> iconv.c:78:Using trivial iconv
> iconv.c:197:local name for ISO-8859-1 is ISO-8859-1
> iconv.c:197:local name for UTF-8 is UTF-8
> iconv.c:197:local name for UCS-2LE is UCS-2LE
> iconv.c:197:local name for UCS-2BE is (null)
> iconv.c:365:setting up conversions for client charset "646"
> iconv.c:367:preparing iconv for "646" <-> "UCS-2LE" conversion
> iconv.c:404:preparing iconv for "ISO-8859-1" <-> "ISO-8859-1" conversion
> iconv.c:407:tds_iconv_open: done
> net.c:204:Connecting to 10.80.57.62 port 11025 (TDS version 5.0)
> net.c:258:tds_open_socket: connect(2) returned "Operation now in progress"
> net.c:296:tds_open_socket() succeeded
> util.c:162:Changed query state from DEAD to IDLE
> login.c:481:login string
> 0000 6e 74 63 35 30 30 33 2e-61 63 6d 6c 2e 63 6f 6d |clientN. abcd.com|
> 0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 |........ ......|
>
?? where this line came?
Did you add a tdsdump_log line ?? I think so.
> # This ^^^ is the way I'd expect a login field to be sent.
>
> login.c:481:login string
> 0000 41 47 45 4e 54 39 39 00-00 00 00 00 00 00 00 00 |usrname. ........|
> 0010 53 48 49 4c 54 4f 4e 00-00 00 00 00 00 00 |passwrd. ......|
>
> # The user_name field has the password at offset 16.
> # tds_put_login_string() uses strlen(3) to determine the EOD (here, 7).
>
> # The pattern continues for the next several fields.
>
> login.c:481:login string
> 0000 53 48 49 4c 54 4f 4e 00-00 00 00 00 00 00 00 00 |passwrd. ........|
> 0010 54 44 53 2d 4c 69 62 72-61 72 79 00 00 00 |TDS-Libr ary...|
>
> login.c:481:login string
> 0000 33 37 38 37 36 00 55 6e-6b 6e 6f 77 6e 20 70 72 |37876.Un known pr|
> 0010 6f 74 6f 63 6f 6c 20 76-65 72 73 69 6f 6e |otocol v ersion|
>
> login.c:481:login string
> 0000 54 53 51 4c 00 00 00 00-00 00 00 00 00 00 00 00 |TSQL.... ........|
> 0010 41 47 45 4e 54 39 39 00-00 00 00 00 00 00 |usrname. ......|
>
> login.c:481:login string
> 0000 53 59 42 41 53 45 00 00-00 00 00 00 00 00 00 00 |SYBASE.. ........|
> 0010 36 34 36 00 38 38 35 39-2d 31 00 00 00 00 |646.8859 -1....|
>
> login.c:481:login string
> 0000 54 44 53 2d 4c 69 62 72-61 72 |TDS-Libr ar|
>
> login.c:481:login string
> 0000 75 73 5f 65 6e 67 6c 69-73 68 00 00 00 00 00 00 |us_engli sh......|
> 0010 73 74 70 63 73 00 00 00-00 00 00 00 00 00 |svrnm... ......|
>
> # Note that "svrnm" is the true servername, but it is not the value that
> # ends up in the login packet, see below.
>
> net.c:768:Sending packet
> 0000 02 00 02 00 00 00 00 00-6e 74 63 35 30 30 33 2e |........ clientN.|
> 0010 61 63 6d 6c 2e 63 6f 6d-00 00 00 00 00 00 00 00 |abcd.com ........|
> 0020 00 00 00 00 00 00 10 41-47 45 4e 54 39 39 00 00 |.......u srname..|
> 0030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0040 00 00 00 00 00 07 53 48-49 4c 54 4f 4e 00 00 00 |......pa sswrd...|
> 0050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0060 00 00 00 00 07 33 37 38-37 36 00 00 00 00 00 00 |.....378 76......|
> 0070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0080 00 00 00 05 03 01 06 0a-09 01 00 00 00 00 00 00 |........ ........|
> 0090 00 00 00 00 54 53 51 4c-00 00 00 00 00 00 00 00 |....TSQL ........|
> 00a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 00b0 00 00 04 53 59 42 41 53-45 00 00 00 00 00 00 00 |...SYBAS E.......|
> ^^^^^^^
> # Item 2: This is not the servername looked up in freetds.conf
>
Mmm... should be connection->server_name... if you didn't use
ASA_DATABASE environment.
> 00c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 00d0 00 06 00 07 53 48 49 4c-54 4f 4e 00 00 00 00 00 |....pass wrd.....|
> 00e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 00f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 01b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 01c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........|
> 01d0 00 09 05 00 00 00 54 44-53 2d 4c 69 62 72 61 72 |......TD S-Librar|
> 01e0 0a 05 00 00 00 00 0d 11-75 73 5f 65 6e 67 6c 69 |........ us_engli|
> 01f0 73 68 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |sh...... ........|
>
> login.c:481:login string
> 0000 69 73 6f 36 34 36 00 69-73 6f 5f 31 00 6b 6f 69 |iso646.i so_1.koi|
> 0010 38 00 6d 61 63 00 6d 61-63 5f 63 79 72 00 |8.mac.ma c_cyr.|
>
> login.c:481:login string
> 0000 35 31 32 00 0a 50 - |512..P|
>
> net.c:768:Sending packet
> 0000 02 01 00 61 00 00 00 00-00 00 00 00 00 00 0a 00 |...a.... ........|
> 0010 00 00 00 00 00 00 00 00-00 00 00 00 00 69 73 6f |........ .....iso|
> 0020 36 34 36 00 00 00 00 00-00 00 00 00 00 00 00 00 |646..... ........|
> 0030 00 00 00 00 00 00 00 00-00 00 00 06 01 35 31 32 |........ .....512|
> 0040 00 00 00 03 00 00 00 00-e2 16 00 01 09 00 08 0e |........ ........|
> 0050 6d 7f ff ff ff fe 02 09-00 00 00 00 02 68 00 00 |m....... .....h..|
> 0060 00 - |.|
>
> == EOL ==
freddy77
-
[freetds] possible corruption of TDS 5.0 login packet,
James K. Lowden, 11/26/2008
-
Re: [freetds] possible corruption of TDS 5.0 login packet,
Frediano Ziglio, 11/27/2008
- Re: [freetds] possible corruption of TDS 5.0 login packet, James K. Lowden, 11/29/2008
-
Re: [freetds] possible corruption of TDS 5.0 login packet,
Frediano Ziglio, 11/27/2008
Archive powered by MHonArc 2.6.24.