Re: possible corruption of TDS 5.0 login packet
"Frediano Ziglio" <[email protected]>
| Newsgroups | gmane.comp.db.tds.freetds |
|---|---|
| Message-ID | <[email protected]> |
2008/11/26 James K. Lowden <[email protected]> > > There might be a problem with the TDS 5.0 login packet. Careful > examination of memory and the bytestream shows some strangeness that the > server doesn't seem to mind, but that I can't explain from the > documentation or the code. > > What follows is some TDSDUMP output (using new logging just added in CVS) > and a set of concerns. > > 1. The data passed to tds_put_login_string() frequently include data > beyond end-of-data. The passed length is correct, but the bytes between > EOD and the end of the buffer are not zero. Because the function relies > on the strlen of the passed string, it works OK, but it's odd. > no, tds_put_login_string call tds_put_buf which read third-arg bytes and fill up with zeroes to fourth-arg perhaps you are confused by tds_put_n. > 2. The servername field is being overwritten by "SYBASE" even when it > should not be. > Strange... > == LOG == > log.c:190:Starting log file for FreeTDS 0.83.dev.20080708 > on 2008-11-26 20:14:49 with debug flags 0x4fff. > iconv.c:337:tds_iconv_open(0x807e000, 646) > iconv.c:78:Using trivial iconv > iconv.c:197:local name for ISO-8859-1 is ISO-8859-1 > iconv.c:197:local name for UTF-8 is UTF-8 > iconv.c:197:local name for UCS-2LE is UCS-2LE > iconv.c:197:local name for UCS-2BE is (null) > iconv.c:365:setting up conversions for client charset "646" > iconv.c:367:preparing iconv for "646" <-> "UCS-2LE" conversion > iconv.c:404:preparing iconv for "ISO-8859-1" <-> "ISO-8859-1" conversion > iconv.c:407:tds_iconv_open: done > net.c:204:Connecting to 10.80.57.62 port 11025 (TDS version 5.0) > net.c:258:tds_open_socket: connect(2) returned "Operation now in progress" > net.c:296:tds_open_socket() succeeded > util.c:162:Changed query state from DEAD to IDLE > login.c:481:login string > 0000 6e 74 63 35 30 30 33 2e-61 63 6d 6c 2e 63 6f 6d |clientN. abcd.com| > 0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 |........ ......| > ?? where this line came? Did you add a tdsdump_log line ?? I think so. > # This ^^^ is the way I'd expect a login field to be sent. > > login.c:481:login string > 0000 41 47 45 4e 54 39 39 00-00 00 00 00 00 00 00 00 |usrname. ........| > 0010 53 48 49 4c 54 4f 4e 00-00 00 00 00 00 00 |passwrd. ......| > > # The user_name field has the password at offset 16. > # tds_put_login_string() uses strlen(3) to determine the EOD (here, 7). > > # The pattern continues for the next several fields. > > login.c:481:login string > 0000 53 48 49 4c 54 4f 4e 00-00 00 00 00 00 00 00 00 |passwrd. ........| > 0010 54 44 53 2d 4c 69 62 72-61 72 79 00 00 00 |TDS-Libr ary...| > > login.c:481:login string > 0000 33 37 38 37 36 00 55 6e-6b 6e 6f 77 6e 20 70 72 |37876.Un known pr| > 0010 6f 74 6f 63 6f 6c 20 76-65 72 73 69 6f 6e |otocol v ersion| > > login.c:481:login string > 0000 54 53 51 4c 00 00 00 00-00 00 00 00 00 00 00 00 |TSQL.... ........| > 0010 41 47 45 4e 54 39 39 00-00 00 00 00 00 00 |usrname. ......| > > login.c:481:login string > 0000 53 59 42 41 53 45 00 00-00 00 00 00 00 00 00 00 |SYBASE.. ........| > 0010 36 34 36 00 38 38 35 39-2d 31 00 00 00 00 |646.8859 -1....| > > login.c:481:login string > 0000 54 44 53 2d 4c 69 62 72-61 72 |TDS-Libr ar| > > login.c:481:login string > 0000 75 73 5f 65 6e 67 6c 69-73 68 00 00 00 00 00 00 |us_engli sh......| > 0010 73 74 70 63 73 00 00 00-00 00 00 00 00 00 |svrnm... ......| > > # Note that "svrnm" is the true servername, but it is not the value that > # ends up in the login packet, see below. > > net.c:768:Sending packet > 0000 02 00 02 00 00 00 00 00-6e 74 63 35 30 30 33 2e |........ clientN.| > 0010 61 63 6d 6c 2e 63 6f 6d-00 00 00 00 00 00 00 00 |abcd.com ........| > 0020 00 00 00 00 00 00 10 41-47 45 4e 54 39 39 00 00 |.......u srname..| > 0030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0040 00 00 00 00 00 07 53 48-49 4c 54 4f 4e 00 00 00 |......pa sswrd...| > 0050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0060 00 00 00 00 07 33 37 38-37 36 00 00 00 00 00 00 |.....378 76......| > 0070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0080 00 00 00 05 03 01 06 0a-09 01 00 00 00 00 00 00 |........ ........| > 0090 00 00 00 00 54 53 51 4c-00 00 00 00 00 00 00 00 |....TSQL ........| > 00a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 00b0 00 00 04 53 59 42 41 53-45 00 00 00 00 00 00 00 |...SYBAS E.......| > ^^^^^^^ > # Item 2: This is not the servername looked up in freetds.conf > Mmm... should be connection->server_name... if you didn't use ASA_DATABASE environment. > 00c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 00d0 00 06 00 07 53 48 49 4c-54 4f 4e 00 00 00 00 00 |....pass wrd.....| > 00e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 00f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 01b0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 01c0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |........ ........| > 01d0 00 09 05 00 00 00 54 44-53 2d 4c 69 62 72 61 72 |......TD S-Librar| > 01e0 0a 05 00 00 00 00 0d 11-75 73 5f 65 6e 67 6c 69 |........ us_engli| > 01f0 73 68 00 00 00 00 00 00-00 00 00 00 00 00 00 00 |sh...... ........| > > login.c:481:login string > 0000 69 73 6f 36 34 36 00 69-73 6f 5f 31 00 6b 6f 69 |iso646.i so_1.koi| > 0010 38 00 6d 61 63 00 6d 61-63 5f 63 79 72 00 |8.mac.ma c_cyr.| > > login.c:481:login string > 0000 35 31 32 00 0a 50 - |512..P| > > net.c:768:Sending packet > 0000 02 01 00 61 00 00 00 00-00 00 00 00 00 00 0a 00 |...a.... ........| > 0010 00 00 00 00 00 00 00 00-00 00 00 00 00 69 73 6f |........ .....iso| > 0020 36 34 36 00 00 00 00 00-00 00 00 00 00 00 00 00 |646..... ........| > 0030 00 00 00 00 00 00 00 00-00 00 00 06 01 35 31 32 |........ .....512| > 0040 00 00 00 03 00 00 00 00-e2 16 00 01 09 00 08 0e |........ ........| > 0050 6d 7f ff ff ff fe 02 09-00 00 00 00 02 68 00 00 |m....... .....h..| > 0060 00 - |.| > > == EOL == freddy77