epan/dissectors/packet-tds.c

   1 /* packet-tds.c
   2  * Routines for TDS NetLib dissection
   3  * Copyright 2000-2002, Brian Bruns <camber@ais.org>
   4  * Copyright 2002, Steve Langasek <vorlon@netexpress.net>
   5  *
   6  * $Id$
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  25  */
  26
  27 /*
  28  * The NETLIB protocol is a small blocking protocol designed to allow TDS
  29  * to be placed within different transports (TCP, DECNet, IPX/SPX).  A
  30  * NETLIB packet starts with an eight byte header containing:
  31  *
  32  *      a one-byte packet type field;
  33  *
  34  *      a one-byte status field;
  35  *
  36  *      a two-byte big-endian size field giving the size of the packet,
  37  *      including the header;
  38  *
  39  *      a two-byte big-endian channel number, used when multiple sessions
  40  *      are being multiplexed on a single connection;
  41  *
  42  *      a one-byte packet number, giving "the frame number of a multiplexed
  43  *      message, modulo 256";
  44  *
  45  *      a one-byte window, which is the number of frames to be sent
  46  *      before an acknowledgment message is received.
  47  *
  48  * followed by payload whose size is the value in the size field minus
  49  * 8.
  50  *
  51  * Microsoft Network Monitor 2.x dissects the 4 byte field (and indicates
  52  * that the one-byte last packet indicator also contains other bits).
  53  *
  54  * The TDS protocol consists of a number of protocol data units (PDUs) that
  55  * appear to be assembled from NETLIB packets, in the form of zero or more
  56  * NETLIB packets with the last packet indicator clear and a final NETLIB
  57  * packet with the last packet indicator set.  The type of the TDS PDU is
  58  * specified by the packet type field of the NETLIB header (presumably that
  59  * field has the same value for all NETLIB packets that make up a TDS PDU).
  60  *
  61  * The "server response" PDU consists of a sequence of multiple items, each
  62  * one beginning with a one byte type field at the start of the PDU.  Some
  63  * items are fixed length, some are variable length with a two byte size
  64  * field following the item type, and then there is TDS_ROW_TOKEN in which
  65  * size is determined by analyzing the result set returned from the server.
  66  * This in effect means that we are hopelessly lost if we haven't seen the
  67  * result set.  Also, TDS 4/5 is byte order negotiable, which is specified
  68  * in the login packet.  We can attempt to determine it later on, but not
  69  * with 100% accuracy.
  70  *
  71  * Some preliminary documentation on the packet format can be found at
  72  * http://www.freetds.org/tds.html
  73  *
  74  * Some more information can be found in
  75  * http://www.sybase.com/content/1013412/tds34.pdf
  76  * http://www.sybase.com/content/1040983/Sybase-tds38-102306.pdf
  77  * Microsoft's [MS-TDS] protocol specification
  78  *
  79  * This document is no longer available here:
  80  * http://download.nai.com/products/media/sniffer/support/sdos/sybase.pdf
  81  *
  82  * Much of this code was originally developed for the FreeTDS project.
  83  * http://www.freetds.org
  84  */
  85
  86 /*
  87  * Excerpts from Brian's posting to wireshark-dev:
  88  *
  89  * The TDS Protocol is actually a protocol within a protocol.  On the outside
  90  * there is netlib which is not so much a encapsulation as a blocking of the
  91  * data, typically to 512 or 4096 bytes.  Between this are the protocol data
  92  * units for TDS.  Netlib packets may be split over real packets, multiple
  93  * netlib packets may appear in single real packets.  TDS PDUs may be split
  94  * over netlib packets (and real packets) and most certainly can appear
  95  * multiple times within a netlib packet.
  96  *
  97  * Because of this, I abandoned my earlier attempt at making two dissectors,
  98  * one for netlib and one for TDS. Counterintuitively, a single dissector
  99  * turned out to be simpler than splitting it up.
 100  *
 101  * Here are some of the (hefty) limitations of the current code
 102  *
 103  * . We currently do not handle netlib headers that cross packet boundaries.
 104  *   This should be an easy fix.
 105  * . I probably could have used the packet reassembly stuff, but I started
 106  *   this at version 0.8.20, so c'est la vie. It wouldn't have covered the
 107  *   netlib stuff anyway, so no big loss.
 108  * . The older two layer version of the code dissected the PDU's, but the new
 109  *   version does not yet, it only labels the names. I need an elegant way to
 110  *   deal with dissecting data crossing (netlib and tcp) packet boundries.  I
 111  *   think I have one, but ran out of time to do it.
 112  * . It will only work on little endian platforms.  Or rather I should say,
 113  *   the client that was captured must be little endian.  TDS 7.0/8.0 is
 114  *   always LE; for TDS 4.2/5.0 look in the code for tvb_get_le*() functions,
 115  *   there are fields in the login packet which determine byte order.
 116  * . result sets that span netlib packets are not working
 117  * . TDS 7 and 4.2 result sets are not working yet
 118  *
 119  * All that said, the code does deal gracefully with different boudary
 120  * conditions and what remains are the easier bits, IMHO.
 121  *
 122  * XXX - "real packets" means "TCP segments", for TCP.
 123  *
 124  * XXX - is it *REALLY* true that you can have more than one TDS PDU (as
 125  * opposed to more than one server response item) per NETLIB packet?  Or is
 126  * all the data in a NETLIB packet put into a single TDS PDU?  If so, then
 127  * we can reassemble NETLIB packets using the standard TCP desegmentation
 128  * code, and can reassemble TDS PDUs using "fragment_add_seq_check()",
 129  * and more cleanly separate the NETLIB and TDS dissectors (although the
 130  * "is this NETLIB" heuristic would have to look at TDS information past
 131  * the NETLIB header, in order to make the heuristic strong enough not
 132  * to get too many false positives; note that the heuristic should reject
 133  * any putative NETLIB packet with a length field with a value < 8).
 134  *
 135  * That would substantially clean the dissector up, eliminating most of
 136  * the per-packet data (we might still need information to handle
 137  * TDS_ROW_TOKEN), getting rid of the stuff to handle data split across
 138  * TCP segment boundaries in favor of simple reassembly code, and
 139  * fixing some otherwise nasty-looking crashing bugs.
 140  *
 141  * NOTE: we assume that all the data in a NETLIB packet *can* be put into
 142  * a single TDS PTU, so that we have separate reassembly of NETLIB
 143  * packets and TDS PDUs; it seems to work, and it really did clean stuff
 144  * up and fix crashes.
 145  */
 146
 147 #include "config.h"
 148
 149 #include <string.h>
 150 #include <ctype.h>
 151
 152 #include "isprint.h"
 153
 154 #include <glib.h>
 155
 156 #include <epan/packet.h>
 157 #include <epan/exceptions.h>
 158 #include <epan/conversation.h>
 159 #include <epan/strutil.h>
 160 #include <epan/show_exception.h>
 161 #include <epan/reassemble.h>
 162 #include <epan/prefs.h>
 163 #include <epan/wmem/wmem.h>
 164 #include <epan/expert.h>
 165
 166 #define TDS_QUERY_PKT        1
 167 #define TDS_LOGIN_PKT        2
 168 #define TDS_RPC_PKT          3
 169 #define TDS_RESP_PKT         4
 170 #define TDS_RAW_PKT          5
 171 #define TDS_ATTENTION_PKT    6
 172 #define TDS_BULK_DATA_PKT    7
 173 #define TDS_OPEN_CHN_PKT     8
 174 #define TDS_CLOSE_CHN_PKT    9
 175 #define TDS_RES_ERROR_PKT   10
 176 #define TDS_LOG_CHN_ACK_PKT 11
 177 #define TDS_ECHO_PKT        12
 178 #define TDS_LOGOUT_CHN_PKT  13
 179 #define TDS_TRANS_MGR_PKT   14
 180 #define TDS_QUERY5_PKT      15  /* or "Normal tokenized request or response */
 181 #define TDS_LOGIN7_PKT      16  /* or "Urgent tokenized request or response */
 182 #define TDS_SSPI_PKT        17
 183 #define TDS_PRELOGIN_PKT    18
 184 #define TDS_INVALID_PKT     19
 185
 186 #define is_valid_tds_type(x) ((x) >= TDS_QUERY_PKT && (x) < TDS_INVALID_PKT)
 187
 188 /* The following constants are imported more or less directly from FreeTDS */
 189 /*      Updated from FreeTDS v0.63 tds.h                                   */
 190 /*         "$Id: tds.h,v 1.192 2004/10/28 12:42:12 freddy77]"              */
 191 /* Note: [###] below means 'not defined in FreeTDS tds.h'                  */
 192
 193 #define TDS5_PARAMFMT2_TOKEN       32  /* 0x20    TDS 5.0 only              */
 194 #define TDS_LANG_TOKEN             33  /* 0x21    TDS 5.0 only              */
 195 #define TDS5_ORDERBY2_TOKEN        34  /* 0x22    TDS 5.0 only              */
 196 #define TDS5_CURDECLARE2_TOKEN     35  /* 0x23    TDS 5.0 only        [###] */
 197 #define TDS5_ROWFMT2_TOKEN         97  /* 0x61    TDS 5.0 only              */
 198 #define TDS5_MSG_TOKEN            101  /* 0x65    TDS 5.0 only        [###] */
 199 #define TDS_LOGOUT_TOKEN          113  /* 0x71    TDS 5.0 only? ct_close()  */
 200 #define TDS_RET_STAT_TOKEN        121  /* 0x79                              */
 201 #define TDS_PROCID_TOKEN          124  /* 0x7C    TDS 4.2 only - TDS_PROCID */
 202 #define TDS_CURCLOSE_TOKEN        128  /* 0x80    TDS 5.0 only              */
 203 #define TDS7_RESULT_TOKEN         129  /* 0x81    TDS 7.0 only              */
 204 #define TDS_CURFETCH_TOKEN        130  /* 0x82    TDS 5.0 only              */
 205 #define TDS_CURINFO_TOKEN         131  /* 0x83    TDS 5.0 only              */
 206 #define TDS_CUROPEN_TOKEN         132  /* 0x84    TDS 5.0 only              */
 207 #define TDS_CURDECLARE_TOKEN      134  /* 0x86    TDS 5.0 only              */
 208 #define TDS7_COMPUTE_RESULT_TOKEN 136  /* 0x88    TDS 7.0 only              */
 209 #define TDS_COL_NAME_TOKEN        160  /* 0xA0    TDS 4.2 only              */
 210 #define TDS_COL_INFO_TOKEN        161  /* 0xA1    TDS 4.2 only - TDS_COLFMT */
 211 #define TDS5_DYNAMIC2_TOKEN       163  /* 0xA3    TDS 5.0 only              */
 212 #if 0 /* XX: Why commented out ? These are 'live' in FreeTDS tds.h */
 213 #define TDS_TABNAME               164  /* 0xA4                              */
 214 #define TDS_COL_INFO              165  /* 0xA5                              */
 215 #endif
 216 #define TDS_OPTIONCMD_TOKEN       166  /* 0xA6 */
 217 #define TDS_COMPUTE_NAMES_TOKEN   167  /* 0xA7 */
 218 #define TDS_COMPUTE_RESULT_TOKEN  168  /* 0xA8 */
 219 #define TDS_ORDER_BY_TOKEN        169  /* 0xA9    TDS_ORDER                 */
 220 #define TDS_ERR_TOKEN             170  /* 0xAA                              */
 221 #define TDS_MSG_TOKEN             171  /* 0xAB                              */
 222 #define TDS_PARAM_TOKEN           172  /* 0xAC    RETURNVALUE?              */
 223 #define TDS_LOGIN_ACK_TOKEN       173  /* 0xAD                              */
 224 #define TDS_CONTROL_TOKEN         174  /* 0xAE    TDS_CONTROL               */
 225 #define TDS_KEY_TOKEN             202  /* 0xCA                        [###] */
 226 #define TDS_ROW_TOKEN             209  /* 0xD1                              */
 227 #define TDS_CMP_ROW_TOKEN         211  /* 0xD3                              */
 228 #define TDS5_PARAMS_TOKEN         215  /* 0xD7    TDS 5.0 only              */
 229 #define TDS_CAP_TOKEN             226  /* 0xE2                              */
 230 #define TDS_ENV_CHG_TOKEN         227  /* 0xE3                              */
 231 #define TDS_EED_TOKEN             229  /* 0xE5                              */
 232 #define TDS_DBRPC_TOKEN           230  /* 0xE6                              */
 233 #define TDS5_DYNAMIC_TOKEN        231  /* 0xE7    TDS 5.0 only              */
 234 #define TDS5_PARAMFMT_TOKEN       236  /* 0xEC    TDS 5.0 only              */
 235 #define TDS_AUTH_TOKEN            237  /* 0xED                              */
 236 #define TDS_RESULT_TOKEN          238  /* 0xEE                              */
 237 #define TDS_DONE_TOKEN            253  /* 0xFD    TDS_DONE                  */
 238 #define TDS_DONEPROC_TOKEN        254  /* 0xFE    TDS_DONEPROC              */
 239 #define TDS_DONEINPROC_TOKEN      255  /* 0xFF    TDS_DONEINPROC            */
 240
 241 /* Microsoft internal stored procedure id's */
 242
 243 #define TDS_SP_CURSOR           1
 244 #define TDS_SP_CURSOROPEN       2
 245 #define TDS_SP_CURSORPREPARE    3
 246 #define TDS_SP_CURSOREXECUTE    4
 247 #define TDS_SP_CURSORPREPEXEC   5
 248 #define TDS_SP_CURSORUNPREPARE  6
 249 #define TDS_SP_CURSORFETCH      7
 250 #define TDS_SP_CURSOROPTION     8
 251 #define TDS_SP_CURSORCLOSE      9
 252 #define TDS_SP_EXECUTESQL      10
 253 #define TDS_SP_PREPARE         11
 254 #define TDS_SP_EXECUTE         12
 255 #define TDS_SP_PREPEXEC        13
 256 #define TDS_SP_PREPEXECRPC     14
 257 #define TDS_SP_UNPREPARE       15
 258
 259
 260 #define TDS_RPC_OPT_WITH_RECOMP    0x01
 261 #define TDS_RPC_OPT_NO_METADATA    0x02
 262 #define TDS_RPC_OPT_REUSE_METADATA 0x04
 263
 264 #define TDS_RPC_PARAMETER_STATUS_BY_REF  0x01
 265 #define TDS_RPC_PARAMETER_STATUS_DEFAULT 0x02
 266
 267 /* Sybase Data Types */
 268
 269 #define SYBCHAR        47  /* 0x2F */
 270 #define SYBVARCHAR     39  /* 0x27 */
 271 #define SYBINTN        38  /* 0x26 */
 272 #define SYBINT1        48  /* 0x30 */
 273 #define SYBINT2        52  /* 0x34 */
 274 #define SYBINT4        56  /* 0x38 */
 275 #define SYBINT8       127  /* 0x7F */
 276 #define SYBFLT8        62  /* 0x3E */
 277 #define SYBDATETIME    61  /* 0x3D */
 278 #define SYBBIT         50  /* 0x32 */
 279 #define SYBTEXT        35  /* 0x23 */
 280 #define SYBNTEXT       99  /* 0x63 */
 281 #define SYBIMAGE       34  /* 0x22 */
 282 #define SYBMONEY4     122  /* 0x7A */
 283 #define SYBMONEY       60  /* 0x3C */
 284 #define SYBDATETIME4   58  /* 0x3A */
 285 #define SYBREAL        59  /* 0x3B */
 286 #define SYBBINARY      45  /* 0x2D */
 287 #define SYBVOID        31  /* 0x1F */
 288 #define SYBVARBINARY   37  /* 0x25 */
 289 #define SYBNVARCHAR   103  /* 0x67 */
 290 #define SYBBITN       104  /* 0x68 */
 291 #define SYBNUMERIC    108  /* 0x6C */
 292 #define SYBDECIMAL    106  /* 0x6A */
 293 #define SYBFLTN       109  /* 0x6D */
 294 #define SYBMONEYN     110  /* 0x6E */
 295 #define SYBDATETIMN   111  /* 0x6F */
 296 #define XSYBCHAR      175  /* 0xA7 */
 297 #define XSYBVARCHAR   167  /* 0xAF */
 298 #define XSYBNVARCHAR  231  /* 0xE7 */
 299 #define XSYBNCHAR     239  /* 0xEF */
 300 #define XSYBVARBINARY 165  /* 0xA5 */
 301 #define XSYBBINARY    173  /* 0xAD */
 302 #define SYBLONGBINARY 225  /* 0xE1 */
 303 #define SYBSINT1       64  /* 0x40 */
 304 #define SYBUINT2       65  /* 0x41 */
 305 #define SYBUINT4       66  /* 0x42 */
 306 #define SYBUINT8       67  /* 0x43 */
 307 #define SYBUNIQUE      36  /* 0x24 */
 308 #define SYBVARIANT     98  /* 0x62 */
 309
 310 #define is_fixed_coltype(x) (x==SYBINT1    ||           \
 311                              x==SYBINT2      ||         \
 312                              x==SYBINT4      ||         \
 313                              x==SYBINT8      ||         \
 314                              x==SYBREAL       ||        \
 315                              x==SYBFLT8      ||         \
 316                              x==SYBDATETIME  ||         \
 317                              x==SYBDATETIME4 ||         \
 318                              x==SYBBIT       ||         \
 319                              x==SYBMONEY     ||         \
 320                              x==SYBMONEY4    ||         \
 321                              x==SYBUNIQUE)
 322
 323 /* FIXEDLENTYPE */
 324 #define TDS_DATA_TYPE_NULL            0x1F  /* Null (no data associated with this type) */
 325 #define TDS_DATA_TYPE_INT1            0x30  /* TinyInt (1 byte data representation) */
 326 #define TDS_DATA_TYPE_BIT             0x32  /* Bit (1 byte data representation) */
 327 #define TDS_DATA_TYPE_INT2            0x34  /* SmallInt (2 byte data representation) */
 328 #define TDS_DATA_TYPE_INT4            0x38  /* Int (4 byte data representation) */
 329 #define TDS_DATA_TYPE_DATETIM4        0x3A  /* SmallDateTime (4 byte data representation) */
 330 #define TDS_DATA_TYPE_FLT4            0x3B  /* Real (4 byte data representation) */
 331 #define TDS_DATA_TYPE_MONEY           0x3C  /* Money (8 byte data representation) */
 332 #define TDS_DATA_TYPE_DATETIME        0x3D  /* DateTime (8 byte data representation) */
 333 #define TDS_DATA_TYPE_FLT8            0x3E  /* Float (8 byte data representation) */
 334 #define TDS_DATA_TYPE_MONEY4          0x7A  /* SmallMoney (4 byte data representation) */
 335 #define TDS_DATA_TYPE_INT8            0x7F  /* BigInt (8 byte data representation) */
 336 /* BYTELEN_TYPE */
 337 #define TDS_DATA_TYPE_GUID            0x24  /* UniqueIdentifier */
 338 #define TDS_DATA_TYPE_INTN            0x26
 339 #define TDS_DATA_TYPE_DECIMAL         0x37  /* Decimal (legacy support) */
 340 #define TDS_DATA_TYPE_NUMERIC         0x3F  /* Numeric (legacy support) */
 341 #define TDS_DATA_TYPE_BITN            0x68
 342 #define TDS_DATA_TYPE_DECIMALN        0x6A  /* Decimal */
 343 #define TDS_DATA_TYPE_NUMERICN        0x6C  /* Numeric */
 344 #define TDS_DATA_TYPE_FLTN            0x6D
 345 #define TDS_DATA_TYPE_MONEYN          0x6E
 346 #define TDS_DATA_TYPE_DATETIMN        0x6F
 347 #define TDS_DATA_TYPE_DATEN           0x28  /* (introduced in TDS 7.3) */
 348 #define TDS_DATA_TYPE_TIMEN           0x29  /* (introduced in TDS 7.3) */
 349 #define TDS_DATA_TYPE_DATETIME2N      0x2A  /* (introduced in TDS 7.3) */
 350 #define TDS_DATA_TYPE_DATETIMEOFFSETN 0x2B  /* (introduced in TDS 7.3) */
 351 #define TDS_DATA_TYPE_CHAR            0x2F  /* Char (legacy support) */
 352 #define TDS_DATA_TYPE_VARCHAR         0x27  /* VarChar (legacy support) */
 353 #define TDS_DATA_TYPE_BINARY          0x2D  /* Binary (legacy support) */
 354 #define TDS_DATA_TYPE_VARBINARY       0x25  /* VarBinary (legacy support) */
 355 /* USHORTLEN_TYPE */
 356 #define TDS_DATA_TYPE_BIGVARBIN       0xA5  /* VarBinary */
 357 #define TDS_DATA_TYPE_BIGVARCHR       0xA7  /* VarChar */
 358 #define TDS_DATA_TYPE_BIGBINARY       0xAD  /* Binary */
 359 #define TDS_DATA_TYPE_BIGCHAR         0xAF  /* Char */
 360 #define TDS_DATA_TYPE_NVARCHAR        0xE7  /* NVarChar */
 361 #define TDS_DATA_TYPE_NCHAR           0xEF  /* NChar */
 362 /* LONGLEN_TYPE */
 363 #define TDS_DATA_TYPE_XML             0xF1  /* XML (introduced in TDS 7.2) */
 364 #define TDS_DATA_TYPE_UDT             0xF0  /* CLR-UDT (introduced in TDS 7.2) */
 365 #define TDS_DATA_TYPE_TEXT            0x23  /* Text */
 366 #define TDS_DATA_TYPE_IMAGE           0x22  /* Image */
 367 #define TDS_DATA_TYPE_NTEXT           0x63  /* NText */
 368 #define TDS_DATA_TYPE_SSVARIANT       0x62  /* Sql_Variant (introduced in TDS 7.2) */
 369
 370 static const value_string tds_data_type_names[] = {
 371     /* FIXEDLENTYPE */
 372     {TDS_DATA_TYPE_NULL,            "NULLTYPE - Null (no data associated with this type)"},
 373     {TDS_DATA_TYPE_INT1,            "INT1TYPE - TinyInt (1 byte data representation)"},
 374     {TDS_DATA_TYPE_BIT,             "BITTYPE - Bit (1 byte data representation)"},
 375     {TDS_DATA_TYPE_INT2,            "INT2TYPE - SmallInt (2 byte data representation)"},
 376     {TDS_DATA_TYPE_INT4,            "INT4TYPE - Int (4 byte data representation)"},
 377     {TDS_DATA_TYPE_DATETIM4,        "DATETIM4TYPE - SmallDateTime (4 byte data representation)"},
 378     {TDS_DATA_TYPE_FLT4,            "FLT4TYPE - Real (4 byte data representation)"},
 379     {TDS_DATA_TYPE_MONEY,           "MONEYTYPE - Money (8 byte data representation)"},
 380     {TDS_DATA_TYPE_DATETIME,        "DATETIMETYPE - DateTime (8 byte data representation)"},
 381     {TDS_DATA_TYPE_FLT8,            "FLT8TYPE - Float (8 byte data representation)"},
 382     {TDS_DATA_TYPE_MONEY4,          "MONEY4TYPE - SmallMoney (4 byte data representation)"},
 383     {TDS_DATA_TYPE_INT8,            "INT8TYPE - BigInt (8 byte data representation)"},
 384     /* BYTELEN_TYPE */
 385     {TDS_DATA_TYPE_GUID,            "GUIDTYPE - UniqueIdentifier"},
 386     {TDS_DATA_TYPE_INTN,            "INTNTYPE"},
 387     {TDS_DATA_TYPE_DECIMAL,         "DECIMALTYPE - Decimal (legacy support)"},
 388     {TDS_DATA_TYPE_NUMERIC,         "NUMERICTYPE - Numeric (legacy support)"},
 389     {TDS_DATA_TYPE_BITN,            "BITNTYPE"},
 390     {TDS_DATA_TYPE_DECIMALN,        "DECIMALNTYPE - Decimal"},
 391     {TDS_DATA_TYPE_NUMERICN,        "NUMERICNTYPE - Numeric"},
 392     {TDS_DATA_TYPE_FLTN,            "FLTNTYPE"},
 393     {TDS_DATA_TYPE_MONEYN,          "MONEYNTYPE"},
 394     {TDS_DATA_TYPE_DATETIMN,        "DATETIMNTYPE"},
 395     {TDS_DATA_TYPE_DATEN,           "DATENTYPE - (introduced in TDS 7.3)"},
 396     {TDS_DATA_TYPE_TIMEN,           "TIMENTYPE - (introduced in TDS 7.3)"},
 397     {TDS_DATA_TYPE_DATETIME2N,      "DATETIME2NTYPE - (introduced in TDS 7.3)"},
 398     {TDS_DATA_TYPE_DATETIMEOFFSETN, "DATETIMEOFFSETNTYPE - (introduced in TDS 7.3)"},
 399     {TDS_DATA_TYPE_CHAR,            "CHARTYPE - Char (legacy support)"},
 400     {TDS_DATA_TYPE_VARCHAR,         "VARCHARTYPE - VarChar (legacy support)"},
 401     {TDS_DATA_TYPE_BINARY,          "BINARYTYPE - Binary (legacy support)"},
 402     {TDS_DATA_TYPE_VARBINARY,       "VARBINARYTYPE - VarBinary (legacy support)"},
 403     /* USHORTLEN_TYPE */
 404     {TDS_DATA_TYPE_BIGVARBIN,       "BIGVARBINTYPE - VarBinary"},
 405     {TDS_DATA_TYPE_BIGVARCHR,       "BIGVARCHRTYPE - VarChar"},
 406     {TDS_DATA_TYPE_BIGBINARY,       "BIGBINARYTYPE - Binary"},
 407     {TDS_DATA_TYPE_BIGCHAR,         "BIGCHARTYPE - Char"},
 408     {TDS_DATA_TYPE_NVARCHAR,        "NVARCHARTYPE - NVarChar"},
 409     {TDS_DATA_TYPE_NCHAR,           "NCHARTYPE - NChar"},
 410     /* LONGLEN_TYPE */
 411     {TDS_DATA_TYPE_XML,             "XMLTYPE - XML (introduced in TDS 7.2)"},
 412     {TDS_DATA_TYPE_UDT,             "UDTTYPE - CLR-UDT (introduced in TDS 7.2)"},
 413     {TDS_DATA_TYPE_TEXT,            "TEXTTYPE - Text"},
 414     {TDS_DATA_TYPE_IMAGE,           "IMAGETYPE - Image"},
 415     {TDS_DATA_TYPE_NTEXT,           "NTEXTTYPE - NText"},
 416     {TDS_DATA_TYPE_SSVARIANT,       "SSVARIANTTYPE - Sql_Variant (introduced in TDS 7.2)"},
 417     {0, NULL }
 418 };
 419
 420 /* Initialize the protocol and registered fields */
 421 static int proto_tds = -1;
 422 static int hf_tds_type = -1;
 423 static int hf_tds_status = -1;
 424 static int hf_tds_status_eom = -1;
 425 static int hf_tds_status_ignore = -1;
 426 static int hf_tds_status_event_notif = -1;
 427 static int hf_tds_status_reset_conn = -1;
 428 static int hf_tds_status_reset_conn_skip_tran = -1;
 429 static int hf_tds_length = -1;
 430 static int hf_tds_channel = -1;
 431 static int hf_tds_packet_number = -1;
 432 static int hf_tds_window = -1;
 433 static int hf_tds_reassembled_in = -1;
 434 static int hf_tds_reassembled_length = -1;
 435 static int hf_tds_fragments = -1;
 436 static int hf_tds_fragment = -1;
 437 static int hf_tds_fragment_overlap = -1;
 438 static int hf_tds_fragment_overlap_conflict = -1;
 439 static int hf_tds_fragment_multiple_tails = -1;
 440 static int hf_tds_fragment_too_long_fragment = -1;
 441 static int hf_tds_fragment_error = -1;
 442 static int hf_tds_fragment_count = -1;
 443 static int hf_tds_collate_codepage = -1;
 444 static int hf_tds_collate_flags = -1;
 445 static int hf_tds_collate_charset_id = -1;
 446
 447 static int hf_tds7_login_total_size = -1;
 448 static int hf_tds7_version = -1;
 449 static int hf_tds7_packet_size = -1;
 450 static int hf_tds7_client_version = -1;
 451 static int hf_tds7_client_pid = -1;
 452 static int hf_tds7_connection_id = -1;
 453 static int hf_tds7_option_flags1 = -1;
 454 static int hf_tds7_option_flags2 = -1;
 455 static int hf_tds7_sql_type_flags = -1;
 456 static int hf_tds7_reserved_flags = -1;
 457 static int hf_tds7_time_zone = -1;
 458 static int hf_tds7_collation = -1;
 459 static int hf_tds7_loginack_version = -1;
 460
 461 static int hf_tds_all_headers = -1;
 462 static int hf_tds_all_headers_total_length = -1;
 463 static int hf_tds_all_headers_header_length = -1;
 464 static int hf_tds_all_headers_header_type = -1;
 465 static int hf_tds_all_headers_trans_descr = -1;
 466 static int hf_tds_all_headers_request_cnt = -1;
 467
 468 static int hf_tds_type_info = -1;
 469 static int hf_tds_type_info_type = -1;
 470 static int hf_tds_type_info_varlen = -1;
 471 static int hf_tds_type_info_precision = -1;
 472 static int hf_tds_type_info_scale = -1;
 473 static int hf_tds_type_info_collation = -1;
 474 static int hf_tds_type_info_collation_lcid = -1;
 475 static int hf_tds_type_info_collation_ign_case = -1;
 476 static int hf_tds_type_info_collation_ign_accent = -1;
 477 static int hf_tds_type_info_collation_ign_kana = -1;
 478 static int hf_tds_type_info_collation_ign_width = -1;
 479 static int hf_tds_type_info_collation_binary = -1;
 480 static int hf_tds_type_info_collation_version = -1;
 481 static int hf_tds_type_info_collation_sortid = -1;
 482 static int hf_tds_type_varbyte_length = -1;
 483 static int hf_tds_type_varbyte_data_null = -1;
 484 static int hf_tds_type_varbyte_data_boolean = -1;
 485 static int hf_tds_type_varbyte_data_int1 = -1;
 486 static int hf_tds_type_varbyte_data_int2 = -1;
 487 static int hf_tds_type_varbyte_data_int4 = -1;
 488 static int hf_tds_type_varbyte_data_int8 = -1;
 489 static int hf_tds_type_varbyte_data_float = -1;
 490 static int hf_tds_type_varbyte_data_double = -1;
 491 static int hf_tds_type_varbyte_data_bytes = -1;
 492 static int hf_tds_type_varbyte_data_guid = -1;
 493 static int hf_tds_type_varbyte_data_string = -1;
 494 static int hf_tds_type_varbyte_plp_len = -1;
 495 static int hf_tds_type_varbyte_plp_chunk_len = -1;
 496
 497 static int hf_tds_rpc = -1;
 498 static int hf_tds_rpc_name_length8 = -1;
 499 static int hf_tds_rpc_name_length = -1;
 500 static int hf_tds_rpc_name = -1;
 501 static int hf_tds_rpc_proc_id = -1;
 502 static int hf_tds_rpc_options = -1;
 503 static int hf_tds_rpc_options_with_recomp = -1;
 504 static int hf_tds_rpc_options_no_metadata = -1;
 505 static int hf_tds_rpc_options_reuse_metadata = -1;
 506 static int hf_tds_rpc_separator = -1;
 507 static int hf_tds_rpc_parameter = -1;
 508 static int hf_tds_rpc_parameter_name_length = -1;
 509 static int hf_tds_rpc_parameter_name = -1;
 510 static int hf_tds_rpc_parameter_status = -1;
 511 static int hf_tds_rpc_parameter_status_by_ref = -1;
 512 static int hf_tds_rpc_parameter_status_default = -1;
 513 static int hf_tds_rpc_parameter_value = -1;
 514
 515 /* Initialize the subtree pointers */
 516 static gint ett_tds = -1;
 517 static gint ett_tds_status = -1;
 518 static gint ett_tds_fragments = -1;
 519 static gint ett_tds_fragment = -1;
 520 static gint ett_tds_token = -1;
 521 static gint ett_tds_all_headers = -1;
 522 static gint ett_tds_all_headers_header = -1;
 523 static gint ett_tds_type_info = -1;
 524 static gint ett_tds_type_info_collation = -1;
 525 static gint ett_tds_type_varbyte = -1;
 526 static gint ett_tds_message = -1;
 527 static gint ett_tds_rpc_options = -1;
 528 static gint ett_tds_rpc_parameter = -1;
 529 static gint ett_tds_rpc_parameter_status = -1;
 530 static gint ett_tds7_query = -1;
 531 static gint ett_tds7_login = -1;
 532 static gint ett_tds7_hdr = -1;
 533
 534 static expert_field ei_tds_type_info_type_undecoded = EI_INIT;
 535 static expert_field ei_tds_invalid_length = EI_INIT;
 536 static expert_field ei_tds_token_length_invalid = EI_INIT;
 537 static expert_field ei_tds_type_info_type = EI_INIT;
 538 static expert_field ei_tds_all_headers_header_type = EI_INIT;
 539
 540 /* Desegmentation of Netlib buffers crossing TCP segment boundaries. */
 541 static gboolean tds_desegment = TRUE;
 542
 543 static const fragment_items tds_frag_items = {
 544     &ett_tds_fragment,
 545     &ett_tds_fragments,
 546     &hf_tds_fragments,
 547     &hf_tds_fragment,
 548     &hf_tds_fragment_overlap,
 549     &hf_tds_fragment_overlap_conflict,
 550     &hf_tds_fragment_multiple_tails,
 551     &hf_tds_fragment_too_long_fragment,
 552     &hf_tds_fragment_error,
 553     &hf_tds_fragment_count,
 554     &hf_tds_reassembled_in,
 555     &hf_tds_reassembled_length,
 556     /* Reassembled data field */
 557     NULL,
 558     "fragments"
 559 };
 560
 561 /* Tables for reassembly of fragments. */
 562 static reassembly_table tds_reassembly_table;
 563
 564 /* defragmentation of multi-buffer TDS PDUs */
 565 static gboolean tds_defragment = TRUE;
 566
 567 static dissector_handle_t tds_tcp_handle;
 568
 569 static dissector_handle_t ntlmssp_handle;
 570 static dissector_handle_t gssapi_handle;
 571 static dissector_handle_t data_handle;
 572
 573 typedef struct {
 574     gint tds7_version;
 575 } tds_conv_info_t;
 576
 577 /* TDS protocol type preference */
 578 /*   XXX: This preference is used as a 'hint' for cases where interpretation is ambiguous */
 579 /*        Currently the hint is global                                                    */
 580 /*   TODO: Consider storing protocol type with each conversation                          */
 581 /*        (when type is determined and using the preference as a default) ??              */
 582
 583 #define TDS_PROTOCOL_NOT_SPECIFIED   0
 584 #define TDS_PROTOCOL_4      0x40
 585 #define TDS_PROTOCOL_5      0x50
 586 #define TDS_PROTOCOL_7_0    0x70
 587 #define TDS_PROTOCOL_7_1    0x71
 588 #define TDS_PROTOCOL_7_2    0x72
 589 #define TDS_PROTOCOL_7_3    0x73
 590
 591 static gint tds_protocol_type = TDS_PROTOCOL_NOT_SPECIFIED;
 592
 593 static const enum_val_t tds_protocol_type_options[] = {
 594     {"not_specified", "Not Specified", TDS_PROTOCOL_NOT_SPECIFIED},
 595     {"tds4", "TDS 4", TDS_PROTOCOL_4},  /* TDS 4.2 and TDS 4.6 */
 596     {"tds5", "TDS 5", TDS_PROTOCOL_5},
 597     {"tds70", "TDS 7.0", TDS_PROTOCOL_7_0},
 598     {"tds71", "TDS 7.1", TDS_PROTOCOL_7_1},
 599     {"tds72", "TDS 7.2", TDS_PROTOCOL_7_2},
 600     {"tds73", "TDS 7.3", TDS_PROTOCOL_7_3},
 601     {NULL, NULL, -1}
 602 };
 603
 604 #define TDS_PROTO_PREF_NOT_SPECIFIED (tds_protocol_type == TDS_PROTOCOL_NOT_SPECIFIED)
 605 #define TDS_PROTO_PREF_TDS4 (tds_protocol_type == TDS_PROTOCOL_4)
 606 #define TDS_PROTO_PREF_TDS5 (tds_protocol_type == TDS_PROTOCOL_5)
 607 #define TDS_PROTO_PREF_TDS7_0 (tds_protocol_type == TDS_PROTOCOL_7_0)
 608 #define TDS_PROTO_PREF_TDS7_1 (tds_protocol_type == TDS_PROTOCOL_7_1)
 609 #define TDS_PROTO_PREF_TDS7_2 (tds_protocol_type == TDS_PROTOCOL_7_2)
 610 #define TDS_PROTO_PREF_TDS7_3 (tds_protocol_type == TDS_PROTOCOL_7_3)
 611 #define TDS_PROTO_PREF_TDS7 (tds_protocol_type >= TDS_PROTOCOL_7_0 && tds_protocol_type <= TDS_PROTOCOL_7_3)
 612
 613 #define TDS_PROTO_TDS4 TDS_PROTO_PREF_TDS4
 614 #define TDS_PROTO_TDS7 (TDS_PROTO_PREF_TDS7 || \
 615                         (TDS_PROTO_PREF_NOT_SPECIFIED && (tds_info->tds7_version != TDS_PROTOCOL_NOT_SPECIFIED)))
 616 #define TDS_PROTO_TDS7_2_OR_GREATER ((tds_protocol_type >= TDS_PROTOCOL_7_2) || \
 617                                      (TDS_PROTO_PREF_NOT_SPECIFIED && (tds_info->tds7_version >= TDS_PROTOCOL_7_2)))
 618
 619 /* TDS "endian type" */
 620 /*   XXX: Assumption is that all TDS conversations being decoded in a particular capture */
 621 /*        have the same endian type                                                      */
 622 /*   TODO: consider storing endian type with each conversation                           */
 623 /*         (using pref as the default)                                                   */
 624
 625 static gboolean tds_little_endian = TRUE;
 626
 627 static const enum_val_t tds_endian_type_options[] = {
 628     {"little_endian", "Little Endian", TRUE},
 629     {"big_endian"   , "Big Endian"   , FALSE},
 630     {NULL, NULL, -1}
 631 };
 632
 633 /* TCP port preferences for TDS decode */
 634
 635 static range_t *tds_tcp_ports = NULL;
 636
 637 /* These correspond to the netlib packet type field */
 638 static const value_string packet_type_names[] = {
 639     {TDS_QUERY_PKT,     "SQL batch"},
 640     {TDS_LOGIN_PKT,     "Pre-TDS7 login"},
 641     {TDS_RPC_PKT,       "Remote Procedure Call"},
 642     {TDS_RESP_PKT,      "Response"},
 643     {TDS_RAW_PKT,       "Unused"},
 644     {TDS_ATTENTION_PKT, "Attention"},
 645     {TDS_BULK_DATA_PKT, "Bulk load data"},
 646     {TDS_QUERY5_PKT,    "TDS5 query"},
 647     {TDS_LOGIN7_PKT,    "TDS7 login"},
 648     {TDS_SSPI_PKT,      "SSPI message"},
 649     {TDS_PRELOGIN_PKT,  "TDS7 pre-login message"},
 650     {0, NULL}
 651 };
 652
 653 enum {
 654     TDS_HEADER_QUERY_NOTIF = 0x0001,
 655     TDS_HEADER_TRANS_DESCR = 0x0002
 656 };
 657
 658 static const value_string header_type_names[] = {
 659     {TDS_HEADER_QUERY_NOTIF, "Query notifications"},
 660     {TDS_HEADER_TRANS_DESCR, "Transaction descriptor"},
 661     {0, NULL}
 662 };
 663
 664 /* The status field */
 665
 666 #define is_valid_tds_status(x) ((x) <= STATUS_EVENT_NOTIFICATION)
 667
 668 #define STATUS_LAST_BUFFER              0x01
 669 #define STATUS_IGNORE_EVENT             0x02
 670 #define STATUS_EVENT_NOTIFICATION       0x04
 671 #define STATUS_RESETCONNECTION          0x08
 672 #define STATUS_RESETCONNECTIONSKIPTRAN  0x10
 673
 674 /* The one byte token at the start of each TDS PDU */
 675 static const value_string token_names[] = {
 676     {TDS5_DYNAMIC_TOKEN,        "TDS5 Dynamic SQL"},
 677     {TDS5_PARAMFMT_TOKEN,       "TDS5 Parameter Format"},
 678     {TDS5_PARAMFMT2_TOKEN,      "TDS5 Parameter2 Format"},
 679     {TDS5_PARAMS_TOKEN,         "TDS5 Parameters"},
 680     {TDS_LANG_TOKEN,            "Language"},
 681     {TDS_LOGOUT_TOKEN,          "Logout"},
 682     {TDS_RET_STAT_TOKEN,        "Return Status"},
 683     {TDS_PROCID_TOKEN,          "Proc ID"},
 684     {TDS7_RESULT_TOKEN,         "TDS7+ Results"},
 685     {TDS_COL_NAME_TOKEN,        "Column Names"},
 686     {TDS_COL_INFO_TOKEN,        "Column Info"},
 687     {TDS_COMPUTE_NAMES_TOKEN,   "Compute Names"},
 688     {TDS_COMPUTE_RESULT_TOKEN,  "Compute Results"},
 689     {TDS_ORDER_BY_TOKEN,        "Order By"},
 690     {TDS_ERR_TOKEN,             "Error Message"},
 691     {TDS_MSG_TOKEN,             "Info Message"},
 692     {TDS_PARAM_TOKEN,           "Parameter"},
 693     {TDS_LOGIN_ACK_TOKEN,       "Login Acknowledgement"},
 694     {TDS_CONTROL_TOKEN,         "TDS Control"},
 695     {TDS_KEY_TOKEN,             "TDS Key"},
 696     {TDS_ROW_TOKEN,             "Row"},
 697     {TDS_CMP_ROW_TOKEN,         "Compute Row"},
 698     {TDS_CAP_TOKEN,             "Capabilities"},
 699     {TDS_ENV_CHG_TOKEN,         "Environment Change"},
 700     {TDS_EED_TOKEN,             "Extended Error"},
 701     {TDS_AUTH_TOKEN,            "Authentication"},
 702     {TDS_RESULT_TOKEN,          "Results"},
 703     {TDS_DONE_TOKEN,            "Done"},
 704     {TDS_DONEPROC_TOKEN,        "Done Proc"},
 705     {TDS_DONEINPROC_TOKEN,      "Done In Proc"},
 706     {TDS5_DYNAMIC2_TOKEN,       "TDS5 Dynamic2"},
 707     {TDS5_ORDERBY2_TOKEN,       "TDS5 OrderBy2"},
 708     {TDS5_CURDECLARE2_TOKEN,    "TDS5 CurDeclare2"},
 709     {TDS5_ROWFMT2_TOKEN,        "TDS5 RowFmt2"},
 710     {TDS5_MSG_TOKEN,            "TDS5 Msg"},
 711     {0, NULL}
 712 };
 713
 714 #define TDS_RPC_SEPARATOR_BATCH_FLAG            0x80
 715 #define TDS_RPC_SEPARATOR_BATCH_FLAG_7_2        0xFF
 716 #define TDS_RPC_SEPARATOR_NO_EXEC_FLAG          0xFE
 717
 718 static const value_string tds_rpc_separators[] = {
 719     {TDS_RPC_SEPARATOR_BATCH_FLAG,     "Batch flag"},
 720     {TDS_RPC_SEPARATOR_BATCH_FLAG_7_2, "Batch flag 7.2"},
 721     {TDS_RPC_SEPARATOR_NO_EXEC_FLAG,   "No exec flag"},
 722     {0, NULL }
 723 };
 724
 725 static const value_string internal_stored_proc_id_names[] = {
 726     {TDS_SP_CURSOR,          "sp_cursor"         },
 727     {TDS_SP_CURSOROPEN,      "sp_cursoropen"     },
 728     {TDS_SP_CURSORPREPARE,   "sp_cursorprepare"  },
 729     {TDS_SP_CURSOREXECUTE,   "sp_cursorexecute"  },
 730     {TDS_SP_CURSORPREPEXEC,  "sp_cursorprepexec" },
 731     {TDS_SP_CURSORUNPREPARE, "sp_cursorunprepare"},
 732     {TDS_SP_CURSORFETCH,     "sp_cursorfetch"    },
 733     {TDS_SP_CURSOROPTION,    "sp_cursoroption"   },
 734     {TDS_SP_CURSORCLOSE,     "sp_cursorclose"    },
 735     {TDS_SP_EXECUTESQL,      "sp_executesql"     },
 736     {TDS_SP_PREPARE,         "sp_prepare"        },
 737     {TDS_SP_EXECUTE,         "sp_execute"        },
 738     {TDS_SP_PREPEXEC,        "sp_prepexec"       },
 739     {TDS_SP_PREPEXECRPC,     "sp_prepexecrpc"    },
 740     {TDS_SP_UNPREPARE,       "sp_unprepare"      },
 741     {0,                      NULL                },
 742 };
 743
 744 static const value_string env_chg_names[] = {
 745     {1, "Database"},
 746     {2, "Language"},
 747     {3, "Sort Order"},
 748     {4, "Blocksize"},
 749     {5, "Unicode Locale ID"},
 750     {6, "Unicode Comparison Style"},
 751     {7, "Collation Info"},
 752     {0, NULL},
 753 };
 754
 755 static const value_string login_field_names[] = {
 756     {0, "Client Name"},
 757     {1, "Username"},
 758     {2, "Password"},
 759     {3, "App Name"},
 760     {4, "Server Name"},
 761     {5, "Unknown1"},
 762     {6, "Library Name"},
 763     {7, "Locale"},
 764     {8, "Database Name"},
 765     {0, NULL},
 766 };
 767
 768
 769 #define MAX_COLUMNS 256
 770
 771 /*
 772  * This is where we store the column information to be used in decoding the
 773  * TDS_ROW_TOKEN tokens.
 774  */
 775 struct _tds_col {
 776     gchar name[256];
 777     guint16 utype;
 778     guint8 ctype;
 779     guint csize;
 780 };
 781
 782 struct _netlib_data {
 783     guint num_cols;
 784     struct _tds_col *columns[MAX_COLUMNS];
 785 };
 786
 787 struct tds7_login_packet_hdr {
 788     guint32 total_packet_size;
 789     guint32 tds_version;
 790     guint32 packet_size;
 791     guint32 client_version;
 792     guint32 client_pid;
 793     guint32 connection_id;
 794     guint8  option_flags1;
 795     guint8  option_flags2;
 796     guint8  sql_type_flags;
 797     guint8  reserved_flags;
 798     guint32 time_zone;
 799     guint32 collation;
 800 };
 801
 802 /* support routines */
 803
 804 static void
 805 dissect_tds_nt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 806                guint offset, guint length)
 807 {
 808     tvbuff_t *nt_tvb;
 809
 810     nt_tvb = tvb_new_subset(tvb, offset, -1, length);
 811     if(tvb_strneql(tvb, offset, "NTLMSSP", 7) == 0)
 812         call_dissector(ntlmssp_handle, nt_tvb, pinfo, tree);
 813     else
 814         call_dissector(gssapi_handle, nt_tvb, pinfo, tree);
 815 }
 816
 817 /*  */
 818
 819 static guint16
 820 tds_tvb_get_xxtohs(tvbuff_t *tvb, gint offset, gboolean tds_little_endian_flag) {
 821     if (tds_little_endian_flag)
 822         return tvb_get_letohs(tvb, offset);
 823     else
 824         return tvb_get_ntohs(tvb, offset);
 825 }
 826
 827 static guint32
 828 tds_tvb_get_xxtohl(tvbuff_t *tvb, gint offset, gboolean tds_little_endian_flag) {
 829     if (tds_little_endian_flag)
 830         return tvb_get_letohl(tvb, offset);
 831     else
 832         return tvb_get_ntohl(tvb, offset);
 833 }
 834
 835 static guint64
 836 tds_tvb_get_xxtoh64(tvbuff_t *tvb, gint offset, gboolean tds_little_endian_flag) {
 837     if (tds_little_endian_flag)
 838         return tvb_get_letoh64(tvb, offset);
 839     else
 840         return tvb_get_ntoh64(tvb, offset);
 841 }
 842
 843 static int
 844 tds_token_is_fixed_size(guint8 token)
 845 {
 846     switch (token) {
 847         case TDS_DONE_TOKEN:
 848         case TDS_DONEPROC_TOKEN:
 849         case TDS_DONEINPROC_TOKEN:
 850         case TDS_RET_STAT_TOKEN:
 851         case TDS7_RESULT_TOKEN:
 852         case TDS_PROCID_TOKEN:
 853         case TDS_LOGOUT_TOKEN:
 854             return 1;
 855         default:
 856             return 0;
 857     }
 858 }
 859
 860
 861 static int
 862 tds_get_fixed_token_size(guint8 token, tds_conv_info_t *tds_info)
 863 {
 864     switch(token) {
 865         case TDS_DONE_TOKEN:
 866         case TDS_DONEPROC_TOKEN:
 867         case TDS_DONEINPROC_TOKEN:
 868             if (TDS_PROTO_TDS7_2_OR_GREATER) {
 869                 return 12;
 870             } else {
 871                 return 8;
 872             }
 873         case TDS_PROCID_TOKEN:
 874             return 8;
 875         case TDS_RET_STAT_TOKEN:
 876             return 4;
 877         case TDS_LOGOUT_TOKEN:
 878             return 1;
 879         case TDS7_RESULT_TOKEN:
 880         default:
 881             return 0;
 882     }
 883 }
 884
 885 static guint
 886 tds_get_variable_token_size(tvbuff_t *tvb, gint offset, guint8 token,
 887                             guint *len_field_size_p, guint *len_field_val_p)
 888 {
 889     switch(token) {
 890         /* some tokens have a 4 byte length field */
 891         case TDS5_PARAMFMT2_TOKEN:
 892         case TDS_LANG_TOKEN:
 893         case TDS5_ORDERBY2_TOKEN:
 894         case TDS5_CURDECLARE2_TOKEN:
 895         case TDS5_ROWFMT2_TOKEN:
 896         case TDS5_DYNAMIC2_TOKEN:
 897             *len_field_size_p = 4;
 898             *len_field_val_p = tds_tvb_get_xxtohl(tvb, offset, tds_little_endian);
 899             break;
 900             /* some have a 1 byte length field */
 901         case TDS5_MSG_TOKEN:
 902             *len_field_size_p = 1;
 903             *len_field_val_p = tvb_get_guint8(tvb, offset);
 904             break;
 905             /* and most have a 2 byte length field */
 906         default:
 907             *len_field_size_p = 2;
 908             *len_field_val_p = tds_tvb_get_xxtohs(tvb, offset, tds_little_endian);
 909             break;
 910     }
 911     return *len_field_val_p + *len_field_size_p + 1;
 912 }
 913
 914
 915 static void
 916 dissect_tds_all_headers(tvbuff_t *tvb, guint *offset, packet_info *pinfo, proto_tree *tree)
 917 {
 918     proto_item *item = NULL, *total_length_item = NULL;
 919     proto_tree *sub_tree = NULL;
 920     guint32 total_length;
 921     guint final_offset;
 922
 923     total_length = tvb_get_letohl(tvb, *offset);
 924     /* Try to find out heuristically whether the ALL_HEADERS rule is actually present.
 925      * In practice total_length is a single byte value, so if the extracted value exceeds 1 byte,
 926      * then the headers are most likely absent. */
 927     if(total_length >= 0x100)
 928         return;
 929     item = proto_tree_add_item(tree, hf_tds_all_headers, tvb, *offset, total_length, ENC_NA);
 930     sub_tree = proto_item_add_subtree(item, ett_tds_all_headers);
 931     total_length_item = proto_tree_add_item(sub_tree, hf_tds_all_headers_total_length, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
 932
 933     final_offset = *offset + total_length;
 934     *offset += 4;
 935     do {
 936         /* dissect a stream header */
 937         proto_tree *header_sub_tree = NULL;
 938         proto_item *length_item = NULL, *type_item = NULL;
 939         guint32 header_length;
 940         guint16 header_type;
 941
 942         header_length = tvb_get_letohl(tvb, *offset);
 943         item = proto_tree_add_text(sub_tree, tvb, *offset, header_length, "Header");
 944         header_sub_tree = proto_item_add_subtree(item, ett_tds_all_headers_header);
 945         length_item = proto_tree_add_item(header_sub_tree, hf_tds_all_headers_header_length, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
 946         if(header_length == 0 ) {
 947             expert_add_info_format(pinfo, length_item, &ei_tds_invalid_length, "Empty header");
 948             break;
 949         }
 950
 951         header_type = tvb_get_letohs(tvb, *offset + 4);
 952         type_item = proto_tree_add_item(header_sub_tree, hf_tds_all_headers_header_type, tvb, *offset + 4, 2, ENC_LITTLE_ENDIAN);
 953
 954         switch(header_type) {
 955             case TDS_HEADER_QUERY_NOTIF:
 956                 break;
 957             case TDS_HEADER_TRANS_DESCR:
 958                 if(header_length != 18)
 959                     expert_add_info_format(pinfo, length_item, &ei_tds_invalid_length, "Length should equal 18");
 960                 proto_tree_add_item(header_sub_tree, hf_tds_all_headers_trans_descr, tvb, *offset + 6, 8, ENC_LITTLE_ENDIAN);
 961                 proto_tree_add_item(header_sub_tree, hf_tds_all_headers_request_cnt, tvb, *offset + 14, 4, ENC_LITTLE_ENDIAN);
 962                 break;
 963             default:
 964                 expert_add_info(pinfo, type_item, &ei_tds_all_headers_header_type);
 965         }
 966
 967         *offset += header_length;
 968     } while(*offset < final_offset);
 969     if(*offset != final_offset) {
 970         expert_add_info_format(pinfo, total_length_item, &ei_tds_invalid_length, "Sum of headers' lengths (%d) differs from total headers length (%d)", total_length + *offset - final_offset, total_length);
 971         return;
 972     }
 973 }
 974
 975
 976 static void
 977 dissect_tds_query_packet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, tds_conv_info_t *tds_info)
 978 {
 979     guint offset, len;
 980     gboolean is_unicode = TRUE;
 981     char *msg;
 982
 983     proto_item *query_hdr;
 984     proto_tree *query_tree;
 985
 986     offset = 0;
 987     query_hdr = proto_tree_add_text(tree, tvb, offset, -1, "TDS Query Packet");
 988     query_tree = proto_item_add_subtree(query_hdr, ett_tds7_query);
 989     dissect_tds_all_headers(tvb, &offset, pinfo, query_tree);
 990     len = tvb_reported_length_remaining(tvb, offset);
 991
 992     if (TDS_PROTO_TDS4 ||
 993         (!TDS_PROTO_TDS7 &&
 994          ((len < 2) || tvb_get_guint8(tvb, offset+1) != 0)))
 995         is_unicode = FALSE;
 996
 997     if (is_unicode)
 998         msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, len, ENC_LITTLE_ENDIAN);
 999     else
1000         msg = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset, len);
1001
1002     proto_tree_add_text(query_tree, tvb, offset, len, "Query: %s", msg);
1003     offset += len;
1004 }
1005
1006
1007 static void
1008 dissect_tds5_lang_token(tvbuff_t *tvb, guint offset, guint len, proto_tree *tree) {
1009     char *msg;
1010
1011     proto_tree_add_text(tree, tvb, offset, 1 , "Status: %u", tvb_get_guint8(tvb, offset));
1012     offset += 1;
1013     len    -= 1;
1014
1015     msg = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset, len);
1016     proto_tree_add_text(tree, tvb, offset, len, "Language text: %s", msg);
1017 }
1018
1019 static void
1020 dissect_tds_query5_packet(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, tds_conv_info_t *tds_info)
1021 {
1022     guint offset;
1023     guint pos;
1024     guint token_len_field_size = 2;
1025     guint token_len_field_val = 0;
1026     guint8 token;
1027     guint token_sz;
1028     proto_item *query_hdr;
1029     proto_tree *query_tree;
1030     proto_item *token_item;
1031     proto_tree *token_tree;
1032
1033     offset = 0;
1034     query_hdr = proto_tree_add_text(tree, tvb, offset, -1, "TDS5 Query Packet");
1035     query_tree = proto_item_add_subtree(query_hdr, ett_tds7_query);
1036
1037     /*
1038      * Until we reach the end of the packet, read tokens.
1039      */
1040     pos = offset;
1041     while (tvb_reported_length_remaining(tvb, pos) > 0) {
1042
1043         /* our token */
1044         token = tvb_get_guint8(tvb, pos);
1045         if (tds_token_is_fixed_size(token))
1046             token_sz = tds_get_fixed_token_size(token, tds_info) + 1;
1047         else
1048             token_sz = tds_get_variable_token_size(tvb, pos+1, token, &token_len_field_size,
1049                                                    &token_len_field_val);
1050
1051         /* XXX - Should this check be done in tds_get_variable_token_size()
1052          * instead? */
1053         if ((int) token_sz < 0) {
1054             proto_tree_add_text(query_tree, tvb, 0, 0, "Bogus token size: %u",
1055                                 token_sz);
1056             break;
1057         }
1058
1059         token_item = proto_tree_add_text(query_tree, tvb, pos, token_sz,
1060                                          "Token 0x%02x %s", token,
1061                                          val_to_str_const(token, token_names, "Unknown Token Type"));
1062         token_tree = proto_item_add_subtree(token_item, ett_tds_token);
1063
1064         /*
1065          * If it's a variable token, put the length field in here
1066          * instead of replicating this for each token subdissector.
1067          */
1068         if (!tds_token_is_fixed_size(token))
1069             proto_tree_add_text(token_tree, tvb, pos+1, token_len_field_size, "Length: %u", token_len_field_val);
1070
1071         switch (token) {
1072             case TDS_LANG_TOKEN:
1073                 dissect_tds5_lang_token(tvb, pos + 5, token_sz -5, token_tree);
1074                 break;
1075             default:
1076                 break;
1077         }
1078
1079         pos += token_sz;
1080
1081     }  /* while */
1082 }
1083
1084
1085 static void
1086 dissect_tds7_login(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1087 {
1088     guint offset, i, j, k, offset2, len;
1089     char *val, *val2;
1090
1091     proto_item *login_hdr;
1092     proto_tree *login_tree;
1093     proto_item *header_hdr;
1094     proto_tree *header_tree;
1095     proto_item *length_hdr;
1096     proto_tree *length_tree;
1097
1098     struct tds7_login_packet_hdr td7hdr;
1099     gint length_remaining;
1100
1101
1102     /* create display subtree for the protocol */
1103     offset = 0;
1104     login_hdr = proto_tree_add_text(tree, tvb, offset, -1, "TDS7 Login Packet");
1105     login_tree = proto_item_add_subtree(login_hdr, ett_tds7_login);
1106     header_hdr = proto_tree_add_text(login_tree, tvb, offset, 36, "Login Packet Header");
1107     header_tree = proto_item_add_subtree(header_hdr, ett_tds7_hdr);
1108
1109     td7hdr.total_packet_size = tvb_get_letohl(tvb, offset);
1110     proto_tree_add_uint(header_tree, hf_tds7_login_total_size, tvb, offset,
1111                         sizeof(td7hdr.total_packet_size), td7hdr.total_packet_size);
1112     offset += (int)sizeof(td7hdr.total_packet_size);
1113
1114     td7hdr.tds_version = tvb_get_ntohl(tvb, offset);
1115     proto_tree_add_uint(header_tree, hf_tds7_version, tvb, offset, sizeof(td7hdr.tds_version), td7hdr.tds_version);
1116     offset += (int)sizeof(td7hdr.tds_version);
1117
1118     td7hdr.packet_size = tvb_get_ntohl(tvb, offset);
1119     proto_tree_add_uint(header_tree, hf_tds7_packet_size, tvb, offset, sizeof(td7hdr.packet_size), td7hdr.packet_size);
1120     offset += (int)sizeof(td7hdr.packet_size);
1121
1122     td7hdr.client_version = tvb_get_ntohl(tvb, offset);
1123     proto_tree_add_uint(header_tree, hf_tds7_client_version, tvb, offset, sizeof(td7hdr.client_version), td7hdr.client_version);
1124     offset += (int)sizeof(td7hdr.client_version);
1125
1126     td7hdr.client_pid = tvb_get_letohl(tvb, offset);
1127     proto_tree_add_uint(header_tree, hf_tds7_client_pid, tvb, offset, sizeof(td7hdr.client_pid), td7hdr.client_pid);
1128     offset += (int)sizeof(td7hdr.client_pid);
1129
1130     td7hdr.connection_id= tvb_get_letohl(tvb, offset);
1131     proto_tree_add_uint(header_tree, hf_tds7_connection_id, tvb, offset, sizeof(td7hdr.connection_id), td7hdr.connection_id);
1132     offset += (int)sizeof(td7hdr.connection_id);
1133
1134     td7hdr.option_flags1 = tvb_get_guint8(tvb, offset);
1135     proto_tree_add_uint(header_tree, hf_tds7_option_flags1, tvb, offset, sizeof(td7hdr.option_flags1), td7hdr.option_flags1);
1136     offset += (int)sizeof(td7hdr.option_flags1);
1137
1138     td7hdr.option_flags2 = tvb_get_guint8(tvb, offset);
1139     proto_tree_add_uint(header_tree, hf_tds7_option_flags2, tvb, offset, sizeof(td7hdr.option_flags2), td7hdr.option_flags2);
1140     offset += (int)sizeof(td7hdr.option_flags2);
1141
1142     td7hdr.sql_type_flags = tvb_get_guint8(tvb, offset);
1143     proto_tree_add_uint(header_tree, hf_tds7_sql_type_flags, tvb, offset, sizeof(td7hdr.sql_type_flags), td7hdr.sql_type_flags);
1144     offset += (int)sizeof(td7hdr.sql_type_flags);
1145
1146     td7hdr.reserved_flags = tvb_get_guint8(tvb, offset);
1147     proto_tree_add_uint(header_tree, hf_tds7_reserved_flags, tvb, offset, sizeof(td7hdr.reserved_flags), td7hdr.reserved_flags);
1148     offset += (int)sizeof(td7hdr.reserved_flags);
1149
1150     td7hdr.time_zone = tvb_get_ntohl(tvb, offset);
1151     proto_tree_add_uint(header_tree, hf_tds7_time_zone, tvb, offset, sizeof(td7hdr.time_zone), td7hdr.time_zone);
1152     offset += (int)sizeof(td7hdr.time_zone);
1153
1154     td7hdr.collation = tvb_get_ntohl(tvb, offset);
1155     proto_tree_add_uint(header_tree, hf_tds7_collation, tvb, offset, sizeof(td7hdr.collation), td7hdr.collation);
1156     offset += (int)sizeof(td7hdr.collation);
1157
1158     length_hdr = proto_tree_add_text(login_tree, tvb, offset, 50, "Lengths and offsets");
1159     length_tree = proto_item_add_subtree(length_hdr, ett_tds7_hdr);
1160
1161     for (i = 0; i < 9; i++) {
1162         offset2 = tvb_get_letohs(tvb, offset + i*4);
1163         len = tvb_get_letohs(tvb, offset + i*4 + 2);
1164         proto_tree_add_text(length_tree, tvb, offset + i*4, 2,
1165                             "%s offset: %u",
1166                             val_to_str_const(i, login_field_names, "Unknown"),
1167                             offset2);
1168         proto_tree_add_text(length_tree, tvb, offset + i*4 + 2, 2,
1169                             "%s length: %u",
1170                             val_to_str_const(i, login_field_names, "Unknown"),
1171                             len);
1172         if (len != 0) {
1173             if( i != 2) {
1174                 /* tds 7 is always unicode */
1175                 len *= 2;
1176                 val = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset2, len, ENC_LITTLE_ENDIAN);
1177                 proto_tree_add_text(login_tree, tvb, offset2, len, "%s: %s", val_to_str_const(i, login_field_names, "Unknown"), val);
1178             } else {
1179                 /* This field is the password.  We retrieve it from the packet
1180                  * as a non-unicode string and then perform two operations on it
1181                  * to "decrypt" it.  Finally, we create a new string that consists
1182                  * of ASCII characters instead of unicode by skipping every other
1183                  * byte in the original string.
1184                  */
1185
1186                 len *= 2;
1187                 val = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset2, len);
1188                 val2 = (char *)wmem_alloc(wmem_packet_scope(), len/2+1);
1189
1190                 for(j = 0, k = 0; j < len; j += 2, k++) {
1191                     val[j] ^= 0xA5;
1192
1193                     /* Swap the most and least significant bits */
1194                     val[j] = ((val[j] & 0x0F) << 4) | ((val[j] & 0xF0) >> 4);
1195
1196                     val2[k] = val[j];
1197                 }
1198                 val2[k] = '\0'; /* Null terminate our new string */
1199
1200                 proto_tree_add_text(login_tree, tvb, offset2, len, "%s: %s", val_to_str_const(i, login_field_names, "Unknown"), val2);
1201             }
1202         }
1203     }
1204
1205     /*
1206      * XXX - what about the client MAC address, etc.?
1207      */
1208     length_remaining = tvb_reported_length_remaining(tvb, offset2 + len);
1209     if (length_remaining > 0) {
1210         dissect_tds_nt(tvb, pinfo, login_tree, offset2 + len,
1211                        length_remaining);
1212     }
1213 }
1214
1215 static int
1216 get_size_by_coltype(int servertype)
1217 {
1218     switch(servertype)
1219     {
1220         case SYBINT1:        return 1;
1221         case SYBINT2:        return 2;
1222         case SYBINT4:        return 4;
1223         case SYBINT8:        return 8;
1224         case SYBREAL:        return 4;
1225         case SYBFLT8:        return 8;
1226         case SYBDATETIME:    return 8;
1227         case SYBDATETIME4:   return 4;
1228         case SYBBIT:         return 1;
1229         case SYBBITN:        return 1;
1230         case SYBMONEY:       return 8;
1231         case SYBMONEY4:      return 4;
1232         case SYBUNIQUE:      return 16;
1233         default:             return -1;
1234     }
1235 }
1236 # if 0
1237 /*
1238  * data_to_string should take column data and turn it into something we can
1239  * display on the tree.
1240  */
1241 static char *data_to_string(void *data, guint col_type, guint col_size)
1242 {
1243     char *result;
1244     guint i;
1245
1246     result=wmem_alloc(wmem_packet_scope(), 256);
1247     switch(col_type) {
1248         case SYBVARCHAR:
1249             /* strncpy(result, (char *)data, col_size); */
1250             for (i=0;i<col_size && i<(256-1);i++)
1251                 if (!isprint(((char *)data)[i])) result[i]='.';
1252                 else result[i]=((char *)data)[i];
1253             result[i] = '\0';
1254             break;
1255         case SYBINT2:
1256             g_snprintf(result, 256, "%d", *(short *)data);
1257             break;
1258         case SYBINT4:
1259             g_snprintf(result, 256, "%d", *(int *)data);
1260             break;
1261         default:
1262             g_snprintf(result, 256, "Unexpected column_type %d", col_type);
1263             break;
1264     }
1265     return result;
1266 }
1267 #endif
1268
1269 /*
1270  * Since rows are special PDUs in that they are not fixed and lack a size field,
1271  * the length must be computed using the column information seen in the result
1272  * PDU. This function does just that.
1273  */
1274 static guint
1275 tds_get_row_size(tvbuff_t *tvb, struct _netlib_data *nl_data, guint offset)
1276 {
1277     guint cur, i, csize;
1278
1279     cur = offset;
1280     for (i = 0; i < nl_data->num_cols; i++) {
1281         if (!is_fixed_coltype(nl_data->columns[i]->ctype)) {
1282             csize = tvb_get_guint8(tvb, cur);
1283             cur++;
1284         } else
1285             csize = get_size_by_coltype(nl_data->columns[i]->ctype);
1286         cur += csize;
1287     }
1288
1289     return (cur - offset + 1);
1290 }
1291
1292 /*
1293  * Process TDS 4 "COL_INFO" token and store relevant information in the
1294  * _netlib_data structure for later use (see tds_get_row_size)
1295  *
1296  * XXX Can TDS 4 be "big-endian" ? we'll assume yes.
1297  *
1298  */
1299 static gboolean
1300 dissect_tds_col_info_token(tvbuff_t *tvb, struct _netlib_data *nl_data, guint offset)
1301 {
1302     guint next, cur;
1303     guint col;
1304
1305     next = offset + tds_tvb_get_xxtohs(tvb, offset+1, tds_little_endian) + 3;
1306     cur = offset + 3;
1307
1308     col = 0;
1309     while (cur < next) {
1310
1311         if (col >= MAX_COLUMNS) {
1312             nl_data->num_cols = 0;
1313             return FALSE;
1314         }
1315
1316         nl_data->columns[col] = wmem_new(wmem_packet_scope(), struct _tds_col);
1317
1318         nl_data->columns[col]->name[0] ='\0';
1319
1320         nl_data->columns[col]->utype = tds_tvb_get_xxtohs(tvb, cur, tds_little_endian);
1321         cur += 2;
1322
1323         cur += 2; /* unknown */
1324
1325         nl_data->columns[col]->ctype = tvb_get_guint8(tvb,cur);
1326         cur++;
1327
1328         if (!is_fixed_coltype(nl_data->columns[col]->ctype)) {
1329             nl_data->columns[col]->csize = tvb_get_guint8(tvb,cur);
1330             cur ++;
1331         } else {
1332             nl_data->columns[col]->csize =
1333                 get_size_by_coltype(nl_data->columns[col]->ctype);
1334         }
1335
1336         col += 1;
1337
1338     } /* while */
1339
1340     nl_data->num_cols = col;
1341     return TRUE;
1342 }
1343
1344
1345 /*
1346  * Read the results token and store the relevant information in the
1347  * _netlib_data structure for later use (see tds_get_row_size).
1348  *
1349  * TODO: check we don't go past end of the token
1350  */
1351 static gboolean
1352 read_results_tds5(tvbuff_t *tvb, struct _netlib_data *nl_data, guint offset, guint len _U_)
1353 {
1354     guint name_len;
1355     guint cur;
1356     guint i;
1357
1358     cur = offset;
1359
1360     /*
1361      * This would be the logical place to check for little/big endianess
1362      * if we didn't see the login packet.
1363      * XXX: We'll take a hint
1364      */
1365     nl_data->num_cols = tds_tvb_get_xxtohs(tvb, cur, tds_little_endian);
1366     if (nl_data->num_cols > MAX_COLUMNS) {
1367         nl_data->num_cols = 0;
1368         return FALSE;
1369     }
1370
1371     cur += 2;
1372
1373     for (i = 0; i < nl_data->num_cols; i++) {
1374         nl_data->columns[i] = wmem_new(wmem_packet_scope(), struct _tds_col);
1375         name_len = tvb_get_guint8(tvb,cur);
1376         cur ++;
1377         cur += name_len;
1378
1379         cur++; /* unknown */
1380
1381         nl_data->columns[i]->utype = tds_tvb_get_xxtohs(tvb, cur, tds_little_endian);
1382         cur += 2;
1383
1384         cur += 2; /* unknown */
1385
1386         nl_data->columns[i]->ctype = tvb_get_guint8(tvb,cur);
1387         cur++;
1388
1389         if (!is_fixed_coltype(nl_data->columns[i]->ctype)) {
1390             nl_data->columns[i]->csize = tvb_get_guint8(tvb,cur);
1391             cur ++;
1392         } else {
1393             nl_data->columns[i]->csize =
1394                 get_size_by_coltype(nl_data->columns[i]->ctype);
1395         }
1396         cur++; /* unknown */
1397     }
1398     return TRUE;
1399 }
1400
1401 /*
1402  * If the packet type from the netlib header is a login packet, then dig into
1403  * the packet to see if this is a supported TDS version and verify the otherwise
1404  * weak heuristics of the netlib check.
1405  */
1406 static gboolean
1407 netlib_check_login_pkt(tvbuff_t *tvb, guint offset, packet_info *pinfo, guint8 type)
1408 {
1409     guint tds_major, bytes_avail;
1410
1411     bytes_avail = tvb_length(tvb) - offset;
1412     /*
1413      * we have two login packet styles, one for TDS 4.2 and 5.0
1414      */
1415     if (type==TDS_LOGIN_PKT) {
1416         /* Use major version number to validate TDS 4/5 login
1417          * packet */
1418
1419         /* Login packet is first in stream and should not be fragmented...
1420          * if it is we are screwed */
1421         if (bytes_avail < 467) return FALSE;
1422         tds_major = tvb_get_guint8(tvb, 466);
1423         if (tds_major != 4 && tds_major != 5) {
1424             return FALSE;
1425         }
1426         /*
1427          * and one added by Microsoft in SQL Server 7
1428          */
1429     } else if (type==TDS_LOGIN7_PKT) {
1430         if (bytes_avail < 16) return FALSE;
1431         tds_major = tvb_get_guint8(tvb, 15);
1432         if (tds_major != 0x70 && tds_major != 0x80) {
1433             return FALSE;
1434         }
1435     } else if (type==TDS_QUERY5_PKT) {
1436         if (bytes_avail < 9) return FALSE;
1437         /* if this is a TDS 5.0 query check the token */
1438         if (tvb_get_guint8(tvb, 8) != TDS_LANG_TOKEN) {
1439             return FALSE;
1440         }
1441     }
1442     /*
1443      * See if either tcp.destport or tcp.srcport is specified
1444      * in the preferences as being a TDS port.
1445      */
1446     else if (!value_is_in_range(tds_tcp_ports, pinfo->srcport) &&
1447              !value_is_in_range(tds_tcp_ports, pinfo->destport)) {
1448         return FALSE;
1449     }
1450
1451     return TRUE;
1452 }
1453
1454 static void
1455 dissect_tds_env_chg(tvbuff_t *tvb, guint offset, guint token_sz,
1456                     proto_tree *tree)
1457 {
1458     guint8 env_type;
1459     guint old_len, new_len, old_len_offset;
1460     char *new_val = NULL, *old_val = NULL;
1461     guint32 string_offset;
1462     gboolean is_unicode = FALSE;
1463
1464     env_type = tvb_get_guint8(tvb, offset);
1465     proto_tree_add_text(tree, tvb, offset, 1, "Type: %u (%s)", env_type,
1466                         val_to_str_const(env_type, env_chg_names, "Unknown"));
1467
1468     new_len = tvb_get_guint8(tvb, offset+1);
1469     old_len_offset = offset + new_len + 2;
1470     old_len = tvb_get_guint8(tvb, old_len_offset);
1471
1472     /*
1473      * If our lengths plus the lengths of the type and the lengths
1474      * don't add up to the token size, it must be UCS2.
1475      */
1476     if (old_len + new_len + 3 != token_sz) {
1477         is_unicode = TRUE;
1478         old_len_offset = offset + (new_len * 2) + 2;
1479         old_len = tvb_get_guint8(tvb, old_len_offset);
1480     }
1481
1482     proto_tree_add_text(tree, tvb, offset + 1, 1, "New Value Length: %u",
1483                         new_len);
1484     if (new_len) {
1485         if (env_type != 7) { /* if it's not 'Collation Info - which is not textual! */
1486             string_offset = offset + 2;
1487             if (is_unicode == TRUE) {
1488                 new_len *= 2;
1489                 new_val = tvb_get_unicode_string(wmem_packet_scope(), tvb, string_offset,
1490                                                           new_len, ENC_LITTLE_ENDIAN);
1491             } else
1492                 new_val = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, string_offset, new_len);
1493             proto_tree_add_text(tree, tvb, string_offset, new_len,
1494                                 "New Value: %s", new_val);
1495         }
1496         else { /* parse collation info structure. From http://www.freetds.org/tds.html#collate */
1497             offset +=2;
1498             proto_tree_add_item(tree, hf_tds_collate_codepage, tvb, offset, 2, ENC_LITTLE_ENDIAN );
1499             offset += 2;
1500             proto_tree_add_item(tree, hf_tds_collate_flags, tvb, offset, 2, ENC_LITTLE_ENDIAN );
1501             offset += 2;
1502             proto_tree_add_item(tree, hf_tds_collate_charset_id, tvb, offset, 1, ENC_LITTLE_ENDIAN );
1503             /*offset +=1;*/
1504         }
1505     }
1506
1507     proto_tree_add_text(tree, tvb, old_len_offset, 1, "Old Value Length: %u",
1508                         old_len);
1509     if (old_len) {
1510         string_offset = old_len_offset + 1;
1511         if (is_unicode == TRUE) {
1512             old_len *= 2;
1513             old_val = tvb_get_unicode_string(wmem_packet_scope(), tvb, string_offset,
1514                                                       old_len, ENC_LITTLE_ENDIAN);
1515         } else
1516             old_val = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, string_offset, old_len);
1517         proto_tree_add_text(tree, tvb, string_offset, old_len,
1518                             "Old Value: %s", old_val);
1519     }
1520 }
1521
1522 static void
1523 dissect_tds_err_token(tvbuff_t *tvb, guint offset, guint token_sz _U_, proto_tree *tree, tds_conv_info_t *tds_info)
1524 {
1525     guint16 msg_len;
1526     guint8 srvr_len, proc_len;
1527     char *msg;
1528     gboolean is_unicode = FALSE;
1529
1530     proto_tree_add_text(tree, tvb, offset, 4, "SQL Error Number: %d", tds_tvb_get_xxtohl(tvb, offset, tds_little_endian));
1531     offset += 4;
1532     proto_tree_add_text(tree, tvb, offset, 1, "State: %u", tvb_get_guint8(tvb, offset));
1533     offset +=1;
1534     proto_tree_add_text(tree, tvb, offset, 1, "Severity Level: %u", tvb_get_guint8(tvb, offset));
1535     offset +=1;
1536
1537     msg_len = tds_tvb_get_xxtohs(tvb, offset, tds_little_endian);
1538     proto_tree_add_text(tree, tvb, offset, 1, "Error message length: %u characters", msg_len);
1539     offset +=2;
1540
1541     if(tvb_get_guint8(tvb, offset+1) == 0) /* FIXME: It's probably unicode, if the 2nd byte of the message is zero. It's not a good detection method, but it works */
1542         is_unicode = TRUE;
1543
1544     if(is_unicode) {
1545         msg_len *= 2;
1546         msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, msg_len, ENC_LITTLE_ENDIAN);
1547     } else {
1548         msg = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset, msg_len);
1549     }
1550     proto_tree_add_text(tree, tvb, offset, msg_len, "Error: %s", format_text((guchar*)msg, strlen(msg)));
1551     offset += msg_len;
1552
1553     srvr_len = tvb_get_guint8(tvb, offset);
1554
1555     proto_tree_add_text(tree, tvb, offset, 1, "Server name length: %u characters", srvr_len);
1556     offset +=1;
1557     if(srvr_len) {
1558         if (is_unicode) {
1559             srvr_len *=2;
1560             msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, srvr_len, ENC_LITTLE_ENDIAN);
1561         } else {
1562             msg = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset, srvr_len);
1563         }
1564         proto_tree_add_text(tree, tvb, offset, srvr_len, "Server name: %s", msg);
1565         offset += srvr_len;
1566     }
1567
1568     proc_len = tvb_get_guint8(tvb, offset);
1569
1570     proto_tree_add_text(tree, tvb, offset, 1, "Process name length: %u characters", proc_len);
1571     offset +=1;
1572     if(proc_len) {
1573         if (is_unicode) {
1574             proc_len *=2;
1575             msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, proc_len, ENC_LITTLE_ENDIAN);
1576         } else {
1577             msg = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset, proc_len);
1578         }
1579         proto_tree_add_text(tree, tvb, offset, proc_len, "Process name: %s", msg);
1580         offset += proc_len;
1581     }
1582
1583     if (TDS_PROTO_TDS7_2_OR_GREATER) {
1584         proto_tree_add_text(tree, tvb, offset, 4, "line number: %d", tds_tvb_get_xxtohl(tvb, offset, tds_little_endian));
1585     } else {
1586         proto_tree_add_text(tree, tvb, offset, 2, "line number: %d", tds_tvb_get_xxtohs(tvb, offset, tds_little_endian));
1587     }
1588 }
1589
1590 static int
1591 dissect_tds_login_ack_token(tvbuff_t *tvb, guint offset, guint token_sz, proto_tree *tree, tds_conv_info_t *tds_info)
1592 {
1593     guint8 msg_len;
1594     guint32 tds_version;
1595     char *msg;
1596     gboolean is_unicode = FALSE;
1597
1598     proto_tree_add_text(tree, tvb, offset, 1, "Ack: %u", tvb_get_guint8(tvb, offset));
1599     offset +=1;
1600     tds_version = tvb_get_ntohl(tvb, offset);
1601     switch (tds_version) {
1602         case 0x07000000:
1603             tds_info->tds7_version = TDS_PROTOCOL_7_0;
1604             break;
1605         case 0x07010000:
1606         case 0x71000001:
1607             tds_info->tds7_version = TDS_PROTOCOL_7_1;
1608             break;
1609         case 0x72090002:
1610             tds_info->tds7_version = TDS_PROTOCOL_7_2;
1611             break;
1612         case 0x730A0003:
1613         case 0x730B0003:
1614         default:
1615             tds_info->tds7_version = TDS_PROTOCOL_7_3;
1616             break;
1617     }
1618     proto_tree_add_uint(tree, hf_tds7_loginack_version, tvb, offset, 4, tds_version);
1619     offset += 4;
1620
1621     msg_len = tvb_get_guint8(tvb, offset);
1622     proto_tree_add_text(tree, tvb, offset, 1, "Text length: %u characters", msg_len);
1623     offset +=1;
1624
1625     if(msg_len + 6U + 3U != token_sz - 1) /* 6 is the length of ack(1), version (4), text length (1) fields */
1626         is_unicode = TRUE;
1627     proto_tree_add_text(tree, tvb, offset, 0, "msg_len: %d, token_sz: %d, total: %d",msg_len, token_sz, msg_len + 6U + 3U);
1628     if(is_unicode) {
1629         msg_len *= 2;
1630         msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, msg_len, ENC_LITTLE_ENDIAN);
1631     } else {
1632         msg = (gchar*)tvb_get_string(wmem_packet_scope(), tvb, offset, msg_len);
1633     }
1634     proto_tree_add_text(tree, tvb, offset, msg_len, "Text: %s", format_text((guchar*)msg, strlen(msg)));
1635     offset += msg_len;
1636
1637     proto_tree_add_text(tree, tvb, offset, 4, "Server Version");
1638     offset += 4;
1639
1640     return offset;
1641 }
1642
1643 static int
1644 dissect_tds7_results_token(tvbuff_t *tvb, guint offset, proto_tree *tree, tds_conv_info_t *tds_info)
1645 {
1646     guint16 num_columns, table_len;
1647     guint8 type, msg_len;
1648     int i;
1649     char *msg;
1650
1651     num_columns = tvb_get_letohs(tvb, offset);
1652     proto_tree_add_text(tree, tvb, offset, 2, "Columns: %u", tvb_get_letohs(tvb, offset));
1653     offset +=2;
1654     for(i=0; i != num_columns; i++) {
1655         proto_tree_add_text(tree, tvb, offset, 0, "Column %d", i + 1);
1656         if (TDS_PROTO_TDS7_2_OR_GREATER) {
1657             proto_tree_add_text(tree, tvb, offset, 4, "usertype: %d", tvb_get_letohl(tvb, offset));
1658             offset +=4;
1659         } else {
1660             proto_tree_add_text(tree, tvb, offset, 2, "usertype: %d", tvb_get_letohs(tvb, offset));
1661             offset +=2;
1662         }
1663         proto_tree_add_text(tree, tvb, offset, 2, "flags: %d", tvb_get_letohs(tvb, offset));
1664         offset +=2;
1665         type  = tvb_get_guint8(tvb, offset);
1666         proto_tree_add_text(tree, tvb, offset, 1, "Type: %d", type);
1667         offset +=1;
1668         if(type == 38 || type == 104 || type == 109 || type == 111) { /* ugly, ugly hack. Wish I knew what it really means!*/
1669             proto_tree_add_text(tree, tvb, offset, 1, "unknown 1 byte (%x)", tvb_get_guint8(tvb, offset));
1670             offset +=1;
1671         }
1672         else if (type == 35) {
1673             proto_tree_add_text(tree, tvb, offset, 4, "unknown 4 bytes (%x)", tvb_get_letohl(tvb, offset));
1674             offset += 4;
1675             proto_tree_add_item(tree, hf_tds_collate_codepage, tvb, offset, 2, ENC_LITTLE_ENDIAN );
1676             offset += 2;
1677             proto_tree_add_item(tree, hf_tds_collate_flags, tvb, offset, 2, ENC_LITTLE_ENDIAN );
1678             offset += 2;
1679             proto_tree_add_item(tree, hf_tds_collate_charset_id, tvb, offset, 1, ENC_LITTLE_ENDIAN );
1680             offset +=1;
1681             table_len = tvb_get_letohs(tvb, offset);
1682             offset +=2;
1683             if(table_len != 0) {
1684                 table_len *= 2;
1685                 msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, table_len, ENC_LITTLE_ENDIAN);
1686                 proto_tree_add_text(tree, tvb, offset, table_len, "Table name: %s", msg);
1687                 offset += table_len;
1688             }
1689         }
1690         else if (type == 106 || type == 108) {
1691             proto_tree_add_text(tree, tvb, offset, 3, "unknown 3 bytes");
1692             offset +=3;
1693         }
1694         else if(type > 128) {
1695             proto_tree_add_text(tree, tvb, offset, 2, "Large type size: 0x%x", tvb_get_letohs(tvb, offset));
1696             offset += 2;
1697             if (type != 165) {
1698                 proto_tree_add_item(tree, hf_tds_collate_codepage, tvb, offset, 2, ENC_LITTLE_ENDIAN );
1699                 offset += 2;
1700                 proto_tree_add_item(tree, hf_tds_collate_flags, tvb, offset, 2, ENC_LITTLE_ENDIAN );
1701                 offset += 2;
1702                 proto_tree_add_item(tree, hf_tds_collate_charset_id, tvb, offset, 1, ENC_LITTLE_ENDIAN );
1703                 offset +=1;
1704             }
1705         }
1706         msg_len = tvb_get_guint8(tvb, offset);
1707         proto_tree_add_text(tree, tvb, offset, 1, "message length: %d",msg_len);
1708         offset += 1;
1709         if(msg_len != 0) {
1710             msg_len *= 2;
1711             msg = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, msg_len, ENC_LITTLE_ENDIAN);
1712             proto_tree_add_text(tree, tvb, offset, msg_len, "Text: %s", msg);
1713             offset += msg_len;
1714         }
1715     }
1716     return offset;
1717 }
1718
1719 static void
1720 dissect_tds_done_token(tvbuff_t *tvb, guint offset, proto_tree *tree, tds_conv_info_t *tds_info)
1721 {
1722     proto_tree_add_text(tree, tvb, offset, 2, "Status flags");
1723     offset += 2;
1724     proto_tree_add_text(tree, tvb, offset, 2, "Operation");
1725     offset += 2;
1726     if (TDS_PROTO_TDS7_2_OR_GREATER) {
1727         proto_tree_add_text(tree, tvb, offset, 8, "row count: %" G_GINT64_MODIFIER "u",
1728                             tds_tvb_get_xxtoh64(tvb, offset, tds_little_endian));
1729     } else {
1730         proto_tree_add_text(tree, tvb, offset, 4, "row count: %u",
1731                             tds_tvb_get_xxtohl(tvb, offset, tds_little_endian));
1732     }
1733 }
1734
1735 static guint8
1736 dissect_tds_type_info(tvbuff_t *tvb, guint *offset, packet_info *pinfo, proto_tree *tree, gboolean *plp)
1737 {
1738     proto_item *item = NULL, *item1 = NULL, *data_type_item = NULL;
1739     proto_tree *sub_tree = NULL, *collation_tree;
1740     guint32 varlen, varlen_len = 0;
1741     guint8 data_type;
1742
1743     *plp = FALSE; /* most types are not Partially Length-Prefixed */
1744     item = proto_tree_add_item(tree, hf_tds_type_info, tvb, *offset, 0, ENC_NA);
1745     data_type = tvb_get_guint8(tvb, *offset);
1746     proto_item_append_text(item, " (%s)", val_to_str(data_type, tds_data_type_names, "Invalid data type: %02X"));
1747     sub_tree = proto_item_add_subtree(item, ett_tds_type_info);
1748     data_type_item = proto_tree_add_item(sub_tree, hf_tds_type_info_type, tvb, *offset, 1, ENC_LITTLE_ENDIAN);
1749     *offset += 1;
1750
1751     /* optional TYPE_VARLEN for variable length types */
1752     switch(data_type) {
1753         /* FIXEDLENTYPE */
1754         case TDS_DATA_TYPE_NULL:            /* Null (no data associated with this type) */
1755         case TDS_DATA_TYPE_INT1:            /* TinyInt (1 byte data representation) */
1756         case TDS_DATA_TYPE_BIT:             /* Bit (1 byte data representation) */
1757         case TDS_DATA_TYPE_INT2:            /* SmallInt (2 byte data representation) */
1758         case TDS_DATA_TYPE_INT4:            /* Int (4 byte data representation) */
1759         case TDS_DATA_TYPE_FLT4:            /* Real (4 byte data representation) */
1760         case TDS_DATA_TYPE_DATETIM4:        /* SmallDateTime (4 byte data representation) */
1761         case TDS_DATA_TYPE_MONEY4:          /* SmallMoney (4 byte data representation) */
1762         case TDS_DATA_TYPE_INT8:            /* BigInt (8 byte data representation) */
1763         case TDS_DATA_TYPE_FLT8:            /* Float (8 byte data representation) */
1764         case TDS_DATA_TYPE_MONEY:           /* Money (8 byte data representation) */
1765         case TDS_DATA_TYPE_DATETIME:        /* DateTime (8 byte data representation) */
1766         /* BYTELEN_TYPE with length determined by SCALE */
1767         case TDS_DATA_TYPE_TIMEN:           /* (introduced in TDS 7.3) */
1768         case TDS_DATA_TYPE_DATETIME2N:      /* (introduced in TDS 7.3) */
1769         case TDS_DATA_TYPE_DATETIMEOFFSETN: /* (introduced in TDS 7.3) */
1770             varlen_len = 0;
1771             break;
1772         /* BYTELEN_TYPE */
1773         case TDS_DATA_TYPE_GUID:            /* UniqueIdentifier */
1774         case TDS_DATA_TYPE_INTN:
1775         case TDS_DATA_TYPE_DECIMAL:         /* Decimal (legacy support) */
1776         case TDS_DATA_TYPE_NUMERIC:         /* Numeric (legacy support) */
1777         case TDS_DATA_TYPE_BITN:
1778         case TDS_DATA_TYPE_DECIMALN:        /* Decimal */
1779         case TDS_DATA_TYPE_NUMERICN:        /* Numeric */
1780         case TDS_DATA_TYPE_FLTN:
1781         case TDS_DATA_TYPE_MONEYN:
1782         case TDS_DATA_TYPE_DATETIMN:
1783         case TDS_DATA_TYPE_DATEN:           /* (introduced in TDS 7.3) */
1784         case TDS_DATA_TYPE_CHAR:            /* Char (legacy support) */
1785         case TDS_DATA_TYPE_VARCHAR:         /* VarChar (legacy support) */
1786         case TDS_DATA_TYPE_BINARY:          /* Binary (legacy support) */
1787         case TDS_DATA_TYPE_VARBINARY:       /* VarBinary (legacy support) */
1788             varlen_len = 1;
1789             varlen = tvb_get_guint8(tvb, *offset);
1790             break;
1791         /* USHORTLEN_TYPE */
1792         case TDS_DATA_TYPE_BIGVARCHR:       /* VarChar */
1793         case TDS_DATA_TYPE_BIGVARBIN:       /* VarBinary */
1794         case TDS_DATA_TYPE_NVARCHAR:        /* NVarChar */
1795             varlen_len = 2;
1796             varlen = tvb_get_letohs(tvb, *offset);
1797             /* A type with unlimited max size, known as varchar(max), varbinary(max) and nvarchar(max),
1798                which has a max size of 0xFFFF, defined by PARTLENTYPE. This class of types was introduced in TDS 7.2. */
1799             if(varlen == 0xFFFF)
1800                 *plp = TRUE;
1801             break;
1802         case TDS_DATA_TYPE_BIGBINARY:       /* Binary */
1803         case TDS_DATA_TYPE_BIGCHAR:         /* Char */
1804         case TDS_DATA_TYPE_NCHAR:           /* NChar */
1805             varlen_len = 2;
1806             varlen = tvb_get_letohs(tvb, *offset);
1807             break;
1808         /* LONGLEN_TYPE */
1809         case TDS_DATA_TYPE_XML:             /* XML (introduced in TDS 7.2) */
1810         case TDS_DATA_TYPE_UDT:             /* CLR-UDT (introduced in TDS 7.2) */
1811             *plp = TRUE;
1812         case TDS_DATA_TYPE_TEXT:            /* Text */
1813         case TDS_DATA_TYPE_IMAGE:           /* Image */
1814         case TDS_DATA_TYPE_NTEXT:           /* NText */
1815         case TDS_DATA_TYPE_SSVARIANT:       /* Sql_Variant (introduced in TDS 7.2) */
1816             varlen_len = 4;
1817             varlen = tvb_get_letohl(tvb, *offset);
1818             break;
1819         default:
1820             expert_add_info(pinfo, data_type_item, &ei_tds_type_info_type);
1821             THROW(ReportedBoundsError); /* No point in continuing */
1822     }
1823
1824     if(varlen_len)
1825         item1 = proto_tree_add_uint(sub_tree, hf_tds_type_info_varlen, tvb, *offset, varlen_len, varlen);
1826     if(*plp)
1827         proto_item_append_text(item1, " (PLP - Partially Length-Prefixed data type)");
1828     *offset += varlen_len;
1829
1830     /* Optional data dependent on type */
1831     switch(data_type) {
1832         /* PRECISION and SCALE */
1833         case TDS_DATA_TYPE_DECIMAL:         /* Decimal (legacy support) */
1834         case TDS_DATA_TYPE_NUMERIC:         /* Numeric (legacy support) */
1835         case TDS_DATA_TYPE_DECIMALN:        /* Decimal */
1836         case TDS_DATA_TYPE_NUMERICN:        /* Numeric */
1837             proto_tree_add_item(sub_tree, hf_tds_type_info_precision, tvb, *offset, 1, ENC_LITTLE_ENDIAN);
1838             *offset += 1;
1839         /* SCALE */
1840         case TDS_DATA_TYPE_TIMEN:           /* (introduced in TDS 7.3) */
1841         case TDS_DATA_TYPE_DATETIME2N:      /* (introduced in TDS 7.3) */
1842         case TDS_DATA_TYPE_DATETIMEOFFSETN: /* (introduced in TDS 7.3) */
1843             proto_tree_add_item(sub_tree, hf_tds_type_info_scale, tvb, *offset, 1, ENC_LITTLE_ENDIAN);
1844             *offset += 1;
1845             break;
1846         /* COLLATION */
1847         case TDS_DATA_TYPE_BIGCHAR:         /* Char */
1848         case TDS_DATA_TYPE_BIGVARCHR:       /* VarChar */
1849         case TDS_DATA_TYPE_TEXT:            /* Text */
1850         case TDS_DATA_TYPE_NTEXT:           /* NText */
1851         case TDS_DATA_TYPE_NCHAR:           /* NChar */
1852         case TDS_DATA_TYPE_NVARCHAR:        /* NVarChar */
1853             item1 = proto_tree_add_item(sub_tree, hf_tds_type_info_collation, tvb, *offset, 5, ENC_NA);
1854             collation_tree = proto_item_add_subtree(item1, ett_tds_type_info_collation);
1855             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_lcid, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1856             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_ign_case, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1857             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_ign_accent, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1858             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_ign_kana, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1859             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_ign_width, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1860             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_binary, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1861             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_version, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1862             proto_tree_add_item(collation_tree, hf_tds_type_info_collation_sortid, tvb, *offset + 4, 1, ENC_LITTLE_ENDIAN);
1863             *offset += 5;
1864             break;
1865     }
1866
1867     proto_item_set_end(item, tvb, *offset);
1868     return data_type;
1869 }
1870
1871 static void
1872 dissect_tds_type_varbyte(tvbuff_t *tvb, guint *offset, packet_info *pinfo, proto_tree *tree, int hf, guint8 data_type, gboolean plp)
1873 {
1874 #define GEN_NULL        0x00U
1875 #define CHARBIN_NULL    0xFFFFU
1876 #define CHARBIN_NULL32  0xFFFFFFFFU
1877     guint32 length;
1878     char *string_value;
1879     proto_tree *sub_tree = NULL;
1880     proto_item *item = NULL, *length_item = NULL;
1881
1882     item = proto_tree_add_item(tree, hf, tvb, *offset, 0, ENC_NA);
1883     sub_tree = proto_item_add_subtree(item, ett_tds_type_varbyte);
1884
1885     if(plp) {
1886 #define PLP_TERMINATOR  G_GINT64_CONSTANT(0x0000000000000000U)
1887 #define UNKNOWN_PLP_LEN G_GINT64_CONSTANT(0xFFFFFFFFFFFFFFFEU)
1888 #define PLP_NULL        G_GINT64_CONSTANT(0xFFFFFFFFFFFFFFFFU)
1889         guint64 plp_length = tvb_get_letoh64(tvb, *offset);
1890         length_item = proto_tree_add_item(sub_tree, hf_tds_type_varbyte_plp_len, tvb, *offset, 8, ENC_LITTLE_ENDIAN);
1891         *offset += 8;
1892         if(plp_length == PLP_NULL)
1893             proto_item_append_text(length_item, " (PLP_NULL)");
1894         else {
1895             if(plp_length == UNKNOWN_PLP_LEN)
1896                 proto_item_append_text(length_item, " (UNKNOWN_PLP_LEN)");
1897             while(TRUE) {
1898                 length = tvb_get_letohl(tvb, *offset);
1899                 length_item = proto_tree_add_item(sub_tree, hf_tds_type_varbyte_plp_chunk_len, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1900                 *offset += 4;
1901                 if(length == PLP_TERMINATOR) {
1902                     proto_item_append_text(length_item, " (PLP_TERMINATOR)");
1903                     break;
1904                 }
1905                 switch(data_type) {
1906                     case TDS_DATA_TYPE_BIGVARBIN: /* VarBinary */
1907                         proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_bytes, tvb, *offset, length, ENC_NA);
1908                         break;
1909                     case TDS_DATA_TYPE_BIGVARCHR: /* VarChar */
1910                         proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_string, tvb, *offset, length, ENC_ASCII|ENC_NA);
1911                         break;
1912                     case TDS_DATA_TYPE_NVARCHAR:  /* NVarChar */
1913                         string_value = tvb_get_unicode_string(wmem_packet_scope(), tvb, *offset, length, ENC_LITTLE_ENDIAN);
1914                         proto_tree_add_string(sub_tree, hf_tds_type_varbyte_data_string, tvb, *offset, length, string_value);
1915                         break;
1916                     case TDS_DATA_TYPE_XML:       /* XML (introduced in TDS 7.2) */
1917                     case TDS_DATA_TYPE_UDT:       /* CLR-UDT (introduced in TDS 7.2) */
1918                         proto_tree_add_expert_format(sub_tree, pinfo, &ei_tds_type_info_type_undecoded, tvb, *offset, length, "Data type %d not supported yet", data_type);
1919                         /* No point in continuing: we need to parse the full data_type to know where it ends */
1920                         THROW(ReportedBoundsError);
1921                     default:
1922                         /* no other data type sets plp = TRUE */
1923                         DISSECTOR_ASSERT_NOT_REACHED();
1924                 }
1925                 *offset += length;
1926             }
1927         }
1928     }
1929     else switch(data_type) {
1930         /* FIXEDLENTYPE */
1931         case TDS_DATA_TYPE_NULL:            /* Null (no data associated with this type) */
1932             break;
1933         case TDS_DATA_TYPE_BIT:             /* Bit (1 byte data representation) */
1934             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_boolean, tvb, *offset, 1, ENC_LITTLE_ENDIAN);
1935             *offset += 1;
1936             break;
1937         case TDS_DATA_TYPE_INT1:            /* TinyInt (1 byte data representation) */
1938             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int1, tvb, *offset, 1, ENC_LITTLE_ENDIAN);
1939             *offset += 1;
1940             break;
1941         case TDS_DATA_TYPE_INT2:            /* SmallInt (2 byte data representation) */
1942             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int2, tvb, *offset, 2, ENC_LITTLE_ENDIAN);
1943             *offset += 2;
1944             break;
1945         case TDS_DATA_TYPE_INT4:            /* Int (4 byte data representation) */
1946             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int4, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1947             *offset += 4;
1948             break;
1949         case TDS_DATA_TYPE_INT8:            /* BigInt (8 byte data representation) */
1950             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int8, tvb, *offset, 8, ENC_LITTLE_ENDIAN);
1951             *offset += 8;
1952             break;
1953         case TDS_DATA_TYPE_FLT4:            /* Real (4 byte data representation) */
1954             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_float, tvb, *offset, 4, ENC_LITTLE_ENDIAN);
1955             *offset += 4;
1956             break;
1957         case TDS_DATA_TYPE_FLT8:            /* Float (8 byte data representation) */
1958             proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_double, tvb, *offset, 8, ENC_LITTLE_ENDIAN);
1959             *offset += 8;
1960             break;
1961         case TDS_DATA_TYPE_MONEY4:          /* SmallMoney (4 byte data representation) */
1962         case TDS_DATA_TYPE_DATETIM4:        /* SmallDateTime (4 byte data representation) */
1963             /*TODO*/
1964             *offset += 4;
1965             break;
1966         case TDS_DATA_TYPE_MONEY:           /* Money (8 byte data representation) */
1967         case TDS_DATA_TYPE_DATETIME:        /* DateTime (8 byte data representation) */
1968             /*TODO*/
1969             *offset += 8;
1970             break;
1971
1972
1973         /* BYTELEN_TYPE - types prefixed with 1-byte length */
1974         case TDS_DATA_TYPE_GUID:            /* UniqueIdentifier */
1975             length = tvb_get_guint8(tvb, *offset);
1976             length_item = proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 1, length);
1977             switch(length) {
1978                 case GEN_NULL: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_null, tvb, *offset, 0, ENC_NA); break;
1979                 case 16: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_guid, tvb, *offset + 1, length, ENC_LITTLE_ENDIAN); break;
1980                 default: expert_add_info(pinfo, length_item, &ei_tds_invalid_length);
1981             }
1982             *offset += 1 + length;
1983             break;
1984         case TDS_DATA_TYPE_BITN:
1985             length = tvb_get_guint8(tvb, *offset);
1986             length_item = proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 1, length);
1987             switch(length) {
1988                 case GEN_NULL: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_null, tvb, *offset, 0, ENC_NA); break;
1989                 case 1: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_boolean, tvb, *offset + 1, 1, ENC_LITTLE_ENDIAN); break;
1990                 default: expert_add_info(pinfo, length_item, &ei_tds_invalid_length);
1991             }
1992             *offset += 1 + length;
1993             break;
1994         case TDS_DATA_TYPE_INTN:
1995             length = tvb_get_guint8(tvb, *offset);
1996             length_item = proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 1, length);
1997             switch(length) {
1998                 case GEN_NULL: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_null, tvb, *offset, 0, ENC_NA); break;
1999                 case 1: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int1, tvb, *offset + 1, 1, ENC_LITTLE_ENDIAN); break;
2000                 case 2: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int2, tvb, *offset + 1, 2, ENC_LITTLE_ENDIAN); break;
2001                 case 4: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int4, tvb, *offset + 1, 4, ENC_LITTLE_ENDIAN); break;
2002                 case 8: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_int8, tvb, *offset + 1, 8, ENC_LITTLE_ENDIAN); break;
2003                 default: expert_add_info(pinfo, length_item, &ei_tds_invalid_length);
2004             }
2005             *offset += 1 + length;
2006             break;
2007         case TDS_DATA_TYPE_FLTN:
2008             length = tvb_get_guint8(tvb, *offset);
2009             length_item = proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 1, length);
2010             switch(length) {
2011                 case GEN_NULL: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_null, tvb, *offset, 0, ENC_NA); break;
2012                 case 4: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_float, tvb, *offset + 1, 4, ENC_LITTLE_ENDIAN); break;
2013                 case 8: proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_double, tvb, *offset + 1, 8, ENC_LITTLE_ENDIAN); break;
2014                 default: expert_add_info(pinfo, length_item, &ei_tds_invalid_length);
2015             }
2016             *offset += 1 + length;
2017             break;
2018         case TDS_DATA_TYPE_DECIMAL:         /* Decimal (legacy support) */
2019         case TDS_DATA_TYPE_NUMERIC:         /* Numeric (legacy support) */
2020         case TDS_DATA_TYPE_DECIMALN:        /* Decimal */
2021         case TDS_DATA_TYPE_NUMERICN:        /* Numeric */
2022         case TDS_DATA_TYPE_MONEYN:
2023         case TDS_DATA_TYPE_DATETIMN:
2024         case TDS_DATA_TYPE_DATEN:           /* (introduced in TDS 7.3) */
2025         case TDS_DATA_TYPE_TIMEN:           /* (introduced in TDS 7.3) */
2026         case TDS_DATA_TYPE_DATETIME2N:      /* (introduced in TDS 7.3) */
2027         case TDS_DATA_TYPE_DATETIMEOFFSETN: /* (introduced in TDS 7.3) */
2028         case TDS_DATA_TYPE_CHAR:            /* Char (legacy support) */
2029         case TDS_DATA_TYPE_VARCHAR:         /* VarChar (legacy support) */
2030         case TDS_DATA_TYPE_BINARY:          /* Binary (legacy support) */
2031         case TDS_DATA_TYPE_VARBINARY:       /* VarBinary (legacy support) */
2032             length = tvb_get_guint8(tvb, *offset);
2033             proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 1, length);
2034             *offset += 1;
2035             if(length > 0) {
2036                 proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_bytes, tvb, *offset, length, ENC_NA);
2037                 *offset += length;
2038             }
2039             break;
2040
2041         /* USHORTLEN_TYPE - types prefixed with 2-byte length */
2042         case TDS_DATA_TYPE_BIGVARBIN:       /* VarBinary */
2043         case TDS_DATA_TYPE_BIGBINARY:       /* Binary */
2044         case TDS_DATA_TYPE_BIGVARCHR:       /* VarChar */
2045         case TDS_DATA_TYPE_BIGCHAR:         /* Char */
2046         case TDS_DATA_TYPE_NVARCHAR:        /* NVarChar */
2047         case TDS_DATA_TYPE_NCHAR:           /* NChar */
2048             length = tvb_get_letohs(tvb, *offset);
2049             length_item = proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 2, length);
2050             *offset += 2;
2051             if(length == CHARBIN_NULL) {
2052                 proto_item_append_text(length_item, " (CHARBIN_NULL)");
2053                 proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_null, tvb, *offset, 0, ENC_NA);
2054             }
2055             else {
2056                 switch(data_type) {
2057                     case TDS_DATA_TYPE_BIGVARBIN: /* VarBinary */
2058                     case TDS_DATA_TYPE_BIGBINARY: /* Binary */
2059                         proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_bytes, tvb, *offset, length, ENC_NA);
2060                         break;
2061                     case TDS_DATA_TYPE_BIGVARCHR: /* VarChar */
2062                     case TDS_DATA_TYPE_BIGCHAR:   /* Char */
2063                         proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_string, tvb, *offset, length, ENC_ASCII|ENC_NA);
2064                         break;
2065                     case TDS_DATA_TYPE_NVARCHAR:  /* NVarChar */
2066                     case TDS_DATA_TYPE_NCHAR:     /* NChar */
2067                         string_value = tvb_get_unicode_string(wmem_packet_scope(), tvb, *offset, length, ENC_LITTLE_ENDIAN);
2068                         proto_tree_add_string(sub_tree, hf_tds_type_varbyte_data_string, tvb, *offset, length, string_value);
2069                         break;
2070                     default:
2071                         DISSECTOR_ASSERT_NOT_REACHED();
2072                 }
2073                 *offset += length;
2074             }
2075             break;
2076
2077         /* LONGLEN_TYPE - types prefixed with 2-byte length */
2078         case TDS_DATA_TYPE_NTEXT:           /* NText */
2079         case TDS_DATA_TYPE_XML:             /* XML (introduced in TDS 7.2) */
2080         case TDS_DATA_TYPE_UDT:             /* CLR-UDT (introduced in TDS 7.2) */
2081         case TDS_DATA_TYPE_TEXT:            /* Text */
2082         case TDS_DATA_TYPE_IMAGE:           /* Image */
2083         case TDS_DATA_TYPE_SSVARIANT:       /* Sql_Variant (introduced in TDS 7.2) */
2084             length = tvb_get_letohl(tvb, *offset);
2085             length_item = proto_tree_add_uint(sub_tree, hf_tds_type_varbyte_length, tvb, *offset, 4, length);
2086             *offset += 4;
2087             if(length == CHARBIN_NULL32) {
2088                 proto_item_append_text(length_item, " (CHARBIN_NULL)");
2089                 proto_tree_add_item(sub_tree, hf_tds_type_varbyte_data_null, tvb, *offset, 0, ENC_NA);
2090             }
2091             else {
2092                 switch(data_type) {
2093                     case TDS_DATA_TYPE_NTEXT: /* NText */
2094                         string_value = tvb_get_unicode_string(wmem_packet_scope(), tvb, *offset, length, ENC_LITTLE_ENDIAN);
2095                         proto_tree_add_string(sub_tree, hf_tds_type_varbyte_data_string, tvb, *offset, length, string_value);
2096                         break;
2097                     default: /*TODO*/
2098                         proto_tree_add_expert_format(sub_tree, pinfo, &ei_tds_type_info_type_undecoded, tvb, *offset, length, "Data type %d not supported yet", data_type);
2099                         /* No point in continuing: we need to parse the full data_type to know where it ends */
2100                         THROW(ReportedBoundsError);
2101                 }
2102                 *offset += length;
2103             }
2104             break;
2105     }
2106     proto_item_set_end(item, tvb, *offset);
2107 }
2108
2109 static void
2110 dissect_tds_rpc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2111 {
2112     proto_item *item = NULL, *param_item = NULL;
2113     proto_tree *sub_tree = NULL, *status_sub_tree = NULL;
2114     int offset = 0;
2115     guint len;
2116     char *val;
2117     guint8 data_type;
2118
2119     item = proto_tree_add_item(tree, hf_tds_rpc, tvb, 0, -1, ENC_NA);
2120     tree = proto_item_add_subtree(item, ett_tds_message);
2121
2122     dissect_tds_all_headers(tvb, &offset, pinfo, tree);
2123     while(tvb_length_remaining(tvb, offset) > 0) {
2124         /*
2125          * RPC name.
2126          */
2127         switch(tds_protocol_type) {
2128             case TDS_PROTOCOL_4:
2129                 len = tvb_get_guint8(tvb, offset);
2130                 proto_tree_add_item(tree, hf_tds_rpc_name_length8, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2131                 proto_tree_add_item(tree, hf_tds_rpc_name, tvb, offset + 1, len, ENC_ASCII|ENC_NA);
2132                 offset += 1 + len;
2133                 break;
2134
2135             case TDS_PROTOCOL_7_0:
2136             case TDS_PROTOCOL_7_1:
2137             case TDS_PROTOCOL_7_2:
2138             case TDS_PROTOCOL_7_3:
2139             default: /* unspecified: try as if TDS7 */
2140                 len = tvb_get_letohs(tvb, offset);
2141                 proto_tree_add_item(tree, hf_tds_rpc_name_length, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2142                 offset += 2;
2143                 if (len == 0xFFFF) {
2144                     proto_tree_add_item(tree, hf_tds_rpc_proc_id, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2145                     offset += 2;
2146                 }
2147                 else if (len != 0) {
2148                     len *= 2;
2149                     val = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, len, ENC_LITTLE_ENDIAN);
2150                     proto_tree_add_string(tree, hf_tds_rpc_name, tvb, offset, len, val);
2151                     offset += len;
2152                 }
2153                 break;
2154         }
2155         item = proto_tree_add_item(tree, hf_tds_rpc_options, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2156         sub_tree = proto_item_add_subtree(item, ett_tds_rpc_options);
2157         proto_tree_add_item(sub_tree, hf_tds_rpc_options_with_recomp, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2158         proto_tree_add_item(sub_tree, hf_tds_rpc_options_no_metadata, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2159         proto_tree_add_item(sub_tree, hf_tds_rpc_options_reuse_metadata, tvb, offset, 2, ENC_LITTLE_ENDIAN);
2160         offset += 2;
2161
2162         /* dissect parameters */
2163         while(tvb_length_remaining(tvb, offset) > 0) {
2164             gboolean plp;
2165
2166             len = tvb_get_guint8(tvb, offset);
2167             /* check for BatchFlag or NoExecFlag */
2168             if((gint8)len < 0) {
2169                 proto_tree_add_item(tree, hf_tds_rpc_separator, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2170                 ++offset;
2171                 break;
2172             }
2173             param_item = proto_tree_add_item(tree, hf_tds_rpc_parameter, tvb, offset, 0, ENC_NA);
2174             sub_tree = proto_item_add_subtree(param_item, ett_tds_rpc_parameter);
2175             proto_tree_add_item(sub_tree, hf_tds_rpc_parameter_name_length, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2176             ++offset;
2177             if(len) {
2178                 len *= 2;
2179                 val = tvb_get_unicode_string(wmem_packet_scope(), tvb, offset, len, ENC_LITTLE_ENDIAN);
2180                 proto_tree_add_string(sub_tree, hf_tds_rpc_parameter_name, tvb, offset, len, val);
2181                 offset += len;
2182             }
2183             item = proto_tree_add_item(sub_tree, hf_tds_rpc_parameter_status, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2184             status_sub_tree = proto_item_add_subtree(item, ett_tds_rpc_parameter_status);
2185             proto_tree_add_item(status_sub_tree, hf_tds_rpc_parameter_status_by_ref, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2186             proto_tree_add_item(status_sub_tree, hf_tds_rpc_parameter_status_default, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2187             ++offset;
2188             data_type = dissect_tds_type_info(tvb, &offset, pinfo, sub_tree, &plp);
2189             dissect_tds_type_varbyte(tvb, &offset, pinfo, sub_tree, hf_tds_rpc_parameter_value, data_type, plp);
2190             proto_item_set_end(param_item, tvb, offset);
2191         }
2192     }
2193 }
2194
2195 static void
2196 dissect_tds_resp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, tds_conv_info_t *tds_info)
2197 {
2198     int offset = 0;
2199     proto_item *token_item;
2200     proto_tree *token_tree;
2201     guint pos, token_sz = 0;
2202     guint token_len_field_size = 2;
2203     guint token_len_field_val = 0;
2204     guint8 token;
2205     struct _netlib_data nl_data;
2206     gint length_remaining;
2207
2208     memset(&nl_data, '\0', sizeof nl_data);
2209
2210     /*
2211      * Until we reach the end of the packet, read tokens.
2212      */
2213     pos = offset;
2214     while (tvb_reported_length_remaining(tvb, pos) > 0) {
2215         /* our token */
2216         token = tvb_get_guint8(tvb, pos);
2217
2218         /* TODO Handle TDS_PARAMFMT, TDS_PARAMS [similar to TDS_RESULTS, TDS_ROW] */
2219         if (tds_token_is_fixed_size(token)) {
2220             token_sz = tds_get_fixed_token_size(token, tds_info) + 1;
2221         } else if (token == TDS_ROW_TOKEN) {
2222             /*
2223              * Rows are special; they have no size field and
2224              * aren't fixed length.
2225              */
2226             token_sz = tds_get_row_size(tvb, &nl_data, pos + 1);
2227         } else
2228             token_sz = tds_get_variable_token_size(tvb, pos + 1,
2229                                                    token, &token_len_field_size, &token_len_field_val);
2230
2231         length_remaining = tvb_ensure_length_remaining(tvb, pos);
2232
2233         if ((int) token_sz < 0) {
2234             token_item = proto_tree_add_text(tree, tvb, pos, 0, "Token");
2235             expert_add_info_format(pinfo, token_item, &ei_tds_token_length_invalid, "Bogus token size: %u", token_sz);
2236             break;
2237         }
2238         token_item = proto_tree_add_text(tree, tvb, pos, token_sz,
2239                                          "Token 0x%02x %s", token,
2240                                          val_to_str_const(token, token_names, "Unknown Token Type"));
2241
2242         if ((int) token_len_field_size < 0) {
2243             expert_add_info_format(pinfo, token_item, &ei_tds_token_length_invalid, "Bogus token length field size: %u", token_len_field_size);
2244             break;
2245         }
2246
2247         token_tree = proto_item_add_subtree(token_item, ett_tds_token);
2248
2249         /*
2250          * If it's a variable token, put the length field in here
2251          * instead of replicating this for each token subdissector.
2252          */
2253         if (!tds_token_is_fixed_size(token) && token != TDS_ROW_TOKEN) {
2254             proto_tree_add_text(token_tree, tvb, pos + 1,
2255                                 token_len_field_size, "Length: %u",
2256                                 token_len_field_val);
2257         }
2258
2259         if (token_sz > (guint)length_remaining)
2260             token_sz = (guint)length_remaining;
2261
2262         switch (token) {
2263
2264             case TDS_COL_NAME_TOKEN:
2265                 /*
2266                  * TDS 4.2
2267                  * TODO dissect token to get "column names" to fill in _netlib_data
2268                  */
2269                 break;
2270
2271             case TDS_COL_INFO_TOKEN:
2272                 /*
2273                  * TDS 4.2: get the column info
2274                  */
2275                 dissect_tds_col_info_token(tvb, &nl_data, pos);
2276                 break;
2277
2278             case TDS_RESULT_TOKEN:
2279                 /*
2280                  * If it's a result token, we need to stash the
2281                  * column info.
2282                  */
2283                 read_results_tds5(tvb, &nl_data, pos + 3, token_sz - 3);
2284                 break;
2285
2286             case TDS_ENV_CHG_TOKEN:
2287                 dissect_tds_env_chg(tvb, pos + 3, token_sz - 3, token_tree);
2288                 break;
2289
2290             case TDS_AUTH_TOKEN:
2291                 dissect_tds_nt(tvb, pinfo, token_tree, pos + 3, token_sz - 3);
2292                 break;
2293             case TDS_ERR_TOKEN:
2294             case TDS_MSG_TOKEN:
2295                 dissect_tds_err_token(tvb, pos + 3, token_sz - 3, token_tree, tds_info);
2296                 break;
2297
2298             case TDS_DONE_TOKEN:
2299             case TDS_DONEPROC_TOKEN:
2300             case TDS_DONEINPROC_TOKEN:
2301                 dissect_tds_done_token(tvb, pos + 1, token_tree, tds_info);
2302                 break;
2303             case TDS_LOGIN_ACK_TOKEN:
2304                 dissect_tds_login_ack_token(tvb, pos + 3, token_sz - 3, token_tree, tds_info);
2305                 break;
2306             case TDS7_RESULT_TOKEN:
2307                 pos = (dissect_tds7_results_token(tvb, pos + 1, token_tree, tds_info)-1);
2308                 break;
2309         }
2310
2311         /* and step to the end of the token, rinse, lather, repeat */
2312         pos += token_sz;
2313     }
2314 }
2315
2316 static void
2317 dissect_netlib_buffer(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2318 {
2319     int offset = 0;
2320     proto_item *tds_item = NULL;
2321     proto_tree *tds_tree = NULL;
2322     proto_tree *tds_status_tree = NULL;
2323     guint8 type;
2324     guint8 status;
2325     guint16 channel;
2326     guint8 packet_number;
2327     gboolean save_fragmented;
2328     int len;
2329     fragment_head *fd_head;
2330     tvbuff_t *next_tvb;
2331     conversation_t *conv;
2332     tds_conv_info_t *tds_info;
2333
2334     conv = find_or_create_conversation(pinfo);
2335     tds_info = (tds_conv_info_t*)conversation_get_proto_data(conv, proto_tds);
2336     if (!tds_info) {
2337         tds_info = wmem_new(wmem_file_scope(), tds_conv_info_t);
2338         tds_info->tds7_version = TDS_PROTOCOL_NOT_SPECIFIED;
2339         conversation_add_proto_data(conv, proto_tds, tds_info);
2340     }
2341
2342     type = tvb_get_guint8(tvb, offset);
2343     status = tvb_get_guint8(tvb, offset + 1);
2344     channel = tvb_get_ntohs(tvb, offset + 4);
2345     packet_number = tvb_get_guint8(tvb, offset + 6);
2346
2347     /* create display subtree for the protocol */
2348     tds_item = proto_tree_add_item(tree, proto_tds, tvb, offset, -1, ENC_NA);
2349     tds_tree = proto_item_add_subtree(tds_item, ett_tds);
2350     proto_tree_add_item(tds_tree, hf_tds_type, tvb, offset, 1, ENC_LITTLE_ENDIAN);
2351     tds_item = proto_tree_add_item(tds_tree, hf_tds_status, tvb, offset + 1, 1, ENC_LITTLE_ENDIAN);
2352     tds_status_tree = proto_item_add_subtree(tds_item, ett_tds_status);
2353     proto_tree_add_item(tds_status_tree, hf_tds_status_eom, tvb, offset + 1, 1, ENC_BIG_ENDIAN);
2354     proto_tree_add_item(tds_status_tree, hf_tds_status_ignore, tvb, offset + 1, 1, ENC_BIG_ENDIAN);
2355     proto_tree_add_item(tds_status_tree, hf_tds_status_event_notif, tvb, offset + 1, 1, ENC_BIG_ENDIAN);
2356     proto_tree_add_item(tds_status_tree, hf_tds_status_reset_conn, tvb, offset + 1, 1, ENC_BIG_ENDIAN);
2357     proto_tree_add_item(tds_status_tree, hf_tds_status_reset_conn_skip_tran,tvb, offset + 1, 1, ENC_BIG_ENDIAN);
2358     proto_tree_add_item(tds_tree, hf_tds_length, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
2359     proto_tree_add_item(tds_tree, hf_tds_channel, tvb, offset + 4, 2, ENC_BIG_ENDIAN);
2360     proto_tree_add_item(tds_tree, hf_tds_packet_number, tvb, offset + 6, 1, ENC_LITTLE_ENDIAN);
2361     proto_tree_add_item(tds_tree, hf_tds_window, tvb, offset + 7, 1, ENC_LITTLE_ENDIAN);
2362     offset += 8;        /* skip Netlib header */
2363
2364     /*
2365      * Deal with fragmentation.
2366      *
2367      * TODO: handle case where netlib headers 'packet-number'.is always 0
2368      *       use fragment_add_seq_next in this case ?
2369      *
2370      */
2371     save_fragmented = pinfo->fragmented;
2372     if (tds_defragment &&
2373         (packet_number > 1 || (status & STATUS_LAST_BUFFER) == 0)) {
2374         if ((status & STATUS_LAST_BUFFER) == 0) {
2375             col_append_str(pinfo->cinfo, COL_INFO,
2376                            " (Not last buffer)");
2377         }
2378         len = tvb_reported_length_remaining(tvb, offset);
2379         /*
2380          * XXX - I've seen captures that start with a login
2381          * packet with a sequence number of 2.
2382          */
2383         fd_head = fragment_add_seq_check(&tds_reassembly_table, tvb, offset,
2384                                          pinfo, channel, NULL,
2385                                          packet_number - 1, len, (status & STATUS_LAST_BUFFER) == 0);
2386         next_tvb = process_reassembled_data(tvb, offset, pinfo,
2387                                             "Reassembled TDS", fd_head, &tds_frag_items, NULL,
2388                                             tds_tree);
2389     } else {
2390         /*
2391          * If this isn't the last buffer, just show it as a fragment.
2392          * (XXX - it'd be nice to dissect it if it's the first
2393          * buffer, but we'd need to do reassembly in order to
2394          * discover that.)
2395          *
2396          * If this is the last buffer, dissect it.
2397          * (XXX - it'd be nice to show it as a fragment if it's part
2398          * of a fragmented message, but we'd need to do reassembly
2399          * in order to discover that.)
2400          */
2401         if ((status & STATUS_LAST_BUFFER) == 0)
2402             next_tvb = NULL;
2403         else {
2404             next_tvb = tvb_new_subset_remaining(tvb, offset);
2405         }
2406     }
2407
2408     if (next_tvb != NULL) {
2409
2410         switch (type) {
2411
2412             case TDS_RPC_PKT:
2413                 dissect_tds_rpc(next_tvb, pinfo, tds_tree);
2414                 break;
2415
2416             case TDS_RESP_PKT:
2417                 dissect_tds_resp(next_tvb, pinfo, tds_tree, tds_info);
2418                 break;
2419
2420             case TDS_LOGIN7_PKT:
2421                 dissect_tds7_login(next_tvb, pinfo, tds_tree);
2422                 break;
2423             case TDS_QUERY_PKT:
2424                 dissect_tds_query_packet(next_tvb, pinfo, tds_tree, tds_info);
2425                 break;
2426             case TDS_QUERY5_PKT:
2427                 dissect_tds_query5_packet(next_tvb, pinfo, tds_tree, tds_info);
2428                 break;
2429             case TDS_SSPI_PKT:
2430                 dissect_tds_nt(next_tvb, pinfo, tds_tree, offset - 8, -1);
2431                 break;
2432             default:
2433                 proto_tree_add_text(tds_tree, next_tvb, 0, -1,
2434                                     "TDS Packet");
2435                 break;
2436         }
2437     } else {
2438         next_tvb = tvb_new_subset_remaining (tvb, offset);
2439         call_dissector(data_handle, next_tvb, pinfo, tds_tree);
2440     }
2441     pinfo->fragmented = save_fragmented;
2442 }
2443
2444 static void
2445 dissect_tds_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
2446 {
2447     volatile gboolean first_time = TRUE;
2448     volatile int offset = 0;
2449     guint length_remaining;
2450     guint8 type;
2451     guint16 plen;
2452     guint length;
2453     tvbuff_t *volatile next_tvb;
2454     proto_item *tds_item = NULL;
2455     proto_tree *tds_tree = NULL;
2456     void *pd_save;
2457
2458     while (tvb_reported_length_remaining(tvb, offset) != 0) {
2459         length_remaining = tvb_ensure_length_remaining(tvb, offset);
2460
2461         /*
2462          * Can we do reassembly?
2463          */
2464         if (tds_desegment && pinfo->can_desegment) {
2465             /*
2466              * Yes - is the fixed-length part of the PDU
2467              * split across segment boundaries?
2468              */
2469             if (length_remaining < 8) {
2470                 /*
2471                  * Yes.  Tell the TCP dissector where the data for this message
2472                  * starts in the data it handed us and that we need "some more
2473                  * data."  Don't tell it exactly how many bytes we need because
2474                  * if/when we ask for even more (after the header) that will
2475                  * break reassembly.
2476                  */
2477                 pinfo->desegment_offset = offset;
2478                 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
2479                 return;
2480             }
2481         }
2482
2483         type = tvb_get_guint8(tvb, offset);
2484
2485         /*
2486          * Get the length of the PDU.
2487          */
2488         plen = tvb_get_ntohs(tvb, offset + 2);
2489         if (plen < 8) {
2490             /*
2491              * The length is less than the header length.
2492              * Put in the type, status, and length, and
2493              * report the length as bogus.
2494              */
2495             if (tree) {
2496                 /* create display subtree for the protocol */
2497                 tds_item = proto_tree_add_item(tree, proto_tds,
2498                                                tvb, offset, -1, ENC_NA);
2499
2500                 tds_tree = proto_item_add_subtree(tds_item,
2501                                                   ett_tds);
2502                 proto_tree_add_uint(tds_tree, hf_tds_type, tvb,
2503                                     offset, 1, type);
2504                 proto_tree_add_item(tds_tree, hf_tds_status,
2505                                     tvb, offset + 1, 1, ENC_BIG_ENDIAN);
2506                 tds_item = proto_tree_add_uint(tds_tree, hf_tds_length, tvb, offset + 2, 2, plen);
2507                 expert_add_info_format(pinfo, tds_item, &ei_tds_invalid_length, "bogus, should be >= 8");
2508             }
2509
2510             /*
2511              * Give up - we can't dissect any more of this
2512              * data.
2513              */
2514             break;
2515         }
2516
2517         /*
2518          * Can we do reassembly?
2519          */
2520         if (tds_desegment && pinfo->can_desegment) {
2521             /*
2522              * Yes - is the PDU split across segment boundaries?
2523              */
2524             if (length_remaining < plen) {
2525                 /*
2526                  * Yes.  Tell the TCP dissector where the
2527                  * data for this message starts in the data
2528                  * it handed us, and how many more bytes we
2529                  * need, and return.
2530                  */
2531                 pinfo->desegment_offset = offset;
2532                 pinfo->desegment_len = plen - length_remaining;
2533                 return;
2534             }
2535         }
2536
2537         if (first_time) {
2538             col_set_str(pinfo->cinfo, COL_PROTOCOL, "TDS");
2539
2540             /*
2541              * Set the packet description based on its TDS packet
2542              * type.
2543              */
2544             col_add_str(pinfo->cinfo, COL_INFO,
2545                         val_to_str(type, packet_type_names,
2546                                    "Unknown Packet Type: %u"));
2547             first_time = FALSE;
2548         }
2549
2550         /*
2551          * Construct a tvbuff containing the amount of the payload
2552          * we have available.  Make its reported length the amount
2553          * of data in the PDU.
2554          *
2555          * XXX - if reassembly isn't enabled. the subdissector will
2556          * throw a BoundsError exception, rather than a
2557          * ReportedBoundsError exception.  We really want a tvbuff
2558          * where the length is "length", the reported length is
2559          * "plen", and the "if the snapshot length were infinite"
2560          * length is the minimum of the reported length of the tvbuff
2561          * handed to us and "plen", with a new type of exception
2562          * thrown if the offset is within the reported length but
2563          * beyond that third length, with that exception getting the
2564          * "Unreassembled Packet" error.
2565          */
2566         length = length_remaining;
2567         if (length > plen)
2568             length = plen;
2569         next_tvb = tvb_new_subset(tvb, offset, length, plen);
2570
2571         /*
2572          * Dissect the Netlib buffer.
2573          *
2574          * If it gets an error that means there's no point in
2575          * dissecting any more Netlib buffers, rethrow the
2576          * exception in question.
2577          *
2578          * If it gets any other error, report it and continue, as that
2579          * means that Netlib buffer got an error, but that doesn't mean
2580          * we should stop dissecting Netlib buffers within this frame
2581          * or chunk of reassembled data.
2582          */
2583         pd_save = pinfo->private_data;
2584         TRY {
2585             dissect_netlib_buffer(next_tvb, pinfo, tree);
2586         }
2587         CATCH_NONFATAL_ERRORS {
2588             /*  Restore the private_data structure in case one of the
2589              *  called dissectors modified it (and, due to the exception,
2590              *  was unable to restore it).
2591              */
2592             pinfo->private_data = pd_save;
2593
2594             show_exception(tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
2595         }
2596         ENDTRY;
2597
2598         /*
2599          * Step to the next Netlib buffer.
2600          */
2601         offset += plen;
2602     }
2603 }
2604
2605 static gboolean
2606 dissect_tds_tcp_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
2607 {
2608     int offset = 0;
2609     guint8 type;
2610     guint8 status;
2611     guint16 plen;
2612     conversation_t *conv;
2613
2614     /*
2615      * If we don't have even enough data for a Netlib header,
2616      * just say it's not TDS.
2617      */
2618     if (tvb_length(tvb) < 8)
2619         return FALSE;
2620
2621     /*
2622      * Quickly scan all the data we have in order to see if
2623      * everything in it looks like Netlib traffic.
2624      */
2625     while (tvb_bytes_exist(tvb, offset, 1)) {
2626         /*
2627          * Check the type field.
2628          */
2629         type = tvb_get_guint8(tvb, offset);
2630         if (!is_valid_tds_type(type))
2631             return FALSE;
2632
2633         /*
2634          * Check the status field, if it's present.
2635          */
2636         if (!tvb_bytes_exist(tvb, offset + 1, 1))
2637             break;
2638         status = tvb_get_guint8(tvb, offset + 1);
2639         if (!is_valid_tds_status(status))
2640             return FALSE;
2641
2642         /*
2643          * Get the length of the PDU.
2644          */
2645         if (!tvb_bytes_exist(tvb, offset + 2, 2))
2646             break;
2647         plen = tvb_get_ntohs(tvb, offset + 2);
2648         if (plen < 8) {
2649             /*
2650              * The length is less than the header length.
2651              * That's bogus.
2652              */
2653             return FALSE;
2654         }
2655
2656         /*
2657          * If we're at the beginning of the segment, check the
2658          * payload if it's a login packet.
2659          */
2660         if (offset == 0) {
2661             if (!netlib_check_login_pkt(tvb, offset, pinfo, type))
2662                 return FALSE;
2663         }
2664
2665         /*
2666          * Step to the next Netlib buffer.
2667          */
2668         offset += plen;
2669     }
2670
2671     /*
2672      * OK, it passes the test; assume the rest of this conversation
2673      * is TDS.
2674      */
2675     conv = find_or_create_conversation(pinfo);
2676     conversation_set_dissector(conv, tds_tcp_handle);
2677
2678     /*
2679      * Now dissect it as TDS.
2680      */
2681     dissect_tds_tcp(tvb, pinfo, tree);
2682     return TRUE;
2683 }
2684
2685 static void
2686 tds_init(void)
2687 {
2688     /*
2689      * Initialize the reassembly table.
2690      *
2691      * XXX - should fragments be reassembled across multiple TCP
2692      * connections?
2693      */
2694     reassembly_table_init(&tds_reassembly_table,
2695                           &addresses_ports_reassembly_table_functions);
2696 }
2697
2698 /* Register the protocol with Wireshark */
2699
2700 /* this format is required because a script is used to build the C function
2701    that calls all the protocol registration.
2702 */
2703
2704 void
2705 proto_register_tds(void)
2706 {
2707     static hf_register_info hf[] = {
2708         { &hf_tds_type,
2709           { "Type",             "tds.type",
2710             FT_UINT8, BASE_DEC, VALS(packet_type_names), 0x0,
2711             "Packet type", HFILL }
2712         },
2713         { &hf_tds_status,
2714           { "Status",           "tds.status",
2715             FT_UINT8, BASE_HEX, NULL, 0x0,
2716             "Packet status", HFILL }
2717         },
2718         { &hf_tds_status_eom,
2719           { "End of message",   "tds.status.eom",
2720             FT_BOOLEAN, 8, NULL, STATUS_LAST_BUFFER,
2721             "The packet is the last packet in the whole request", HFILL }
2722         },
2723         { &hf_tds_status_ignore,
2724           { "Ignore this event", "tds.status.ignore",
2725             FT_BOOLEAN, 8, NULL, STATUS_IGNORE_EVENT,
2726             "(From client to server) Ignore this event (EOM MUST also be set)", HFILL }
2727         },
2728         { &hf_tds_status_event_notif,
2729           { "Event notification", "tds.status.event_notif",
2730             FT_BOOLEAN, 8, NULL, STATUS_EVENT_NOTIFICATION,
2731             NULL, HFILL }
2732         },
2733         { &hf_tds_status_reset_conn,
2734           { "Reset connection", "tds.status.reset_conn",
2735             FT_BOOLEAN, 8, NULL, STATUS_RESETCONNECTION,
2736             "(From client to server) Reset this connection before processing event", HFILL }
2737         },
2738         { &hf_tds_status_reset_conn_skip_tran,
2739           { "Reset connection keeping transaction state", "tds.status.reset_conn_skip_tran",
2740             FT_BOOLEAN, 8, NULL, STATUS_RESETCONNECTIONSKIPTRAN,
2741             "(From client to server) Reset the connection before processing event but do not modify the transaction state", HFILL }
2742         },
2743         { &hf_tds_length,
2744           { "Length",           "tds.length",
2745             FT_UINT16, BASE_DEC, NULL, 0x0,
2746             "Packet length", HFILL }
2747         },
2748         { &hf_tds_channel,
2749           { "Channel",          "tds.channel",
2750             FT_UINT16, BASE_DEC, NULL, 0x0,
2751             "Channel Number", HFILL }
2752         },
2753         { &hf_tds_packet_number,
2754           { "Packet Number",    "tds.packet_number",
2755             FT_UINT8, BASE_DEC, NULL, 0x0,
2756             NULL, HFILL }
2757         },
2758         { &hf_tds_window,
2759           { "Window",           "tds.window",
2760             FT_UINT8, BASE_DEC, NULL, 0x0,
2761             NULL, HFILL }
2762         },
2763         { &hf_tds_collate_codepage,
2764           { "Codepage",           "tds.collate_codepage",
2765             FT_UINT16, BASE_DEC, NULL, 0x0,
2766             NULL, HFILL }
2767         },
2768         { &hf_tds_collate_flags,
2769           { "Flags",           "tds.collate_flags",
2770             FT_UINT16, BASE_HEX, NULL, 0x0,
2771             NULL, HFILL }
2772         },
2773         { &hf_tds_collate_charset_id,
2774           { "Charset ID",           "tds.collate_charset_id",
2775             FT_UINT8, BASE_DEC, NULL, 0x0,
2776             NULL, HFILL }
2777         },
2778         { &hf_tds_fragment_overlap,
2779           { "Segment overlap",  "tds.fragment.overlap",
2780             FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2781             "Fragment overlaps with other fragments", HFILL }
2782         },
2783         { &hf_tds_fragment_overlap_conflict,
2784           { "Conflicting data in fragment overlap", "tds.fragment.overlap.conflict",
2785             FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2786             "Overlapping fragments contained conflicting data", HFILL }
2787         },
2788         { &hf_tds_fragment_multiple_tails,
2789           { "Multiple tail fragments found", "tds.fragment.multipletails",
2790             FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2791             "Several tails were found when defragmenting the packet", HFILL }
2792         },
2793         { &hf_tds_fragment_too_long_fragment,
2794           { "Segment too long", "tds.fragment.toolongfragment",
2795             FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2796             "Segment contained data past end of packet", HFILL }
2797         },
2798         { &hf_tds_fragment_error,
2799           { "Defragmentation error",    "tds.fragment.error",
2800             FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2801             "Defragmentation error due to illegal fragments", HFILL }
2802         },
2803         { &hf_tds_fragment_count,
2804           { "Segment count", "tds.fragment.count",
2805             FT_UINT32, BASE_DEC, NULL, 0x0,
2806             NULL, HFILL }
2807         },
2808         { &hf_tds_fragment,
2809           { "TDS Fragment",     "tds.fragment",
2810             FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2811             NULL, HFILL }
2812         },
2813         { &hf_tds_fragments,
2814           { "TDS Fragments",    "tds.fragments",
2815             FT_NONE, BASE_NONE, NULL, 0x0,
2816             NULL, HFILL }
2817         },
2818         { &hf_tds_reassembled_in,
2819           { "Reassembled TDS in frame", "tds.reassembled_in",
2820             FT_FRAMENUM, BASE_NONE, NULL, 0x0,
2821             "This TDS packet is reassembled in this frame", HFILL }
2822         },
2823         { &hf_tds_reassembled_length,
2824           { "Reassembled TDS length", "tds.reassembled.length",
2825             FT_UINT32, BASE_DEC, NULL, 0x0,
2826             "The total length of the reassembled payload", HFILL }
2827         },
2828         { &hf_tds7_login_total_size,
2829           { "Total Packet Length", "tds.7login.total_len",
2830             FT_UINT32, BASE_DEC, NULL, 0x0,
2831             "TDS7 Login Packet total packet length", HFILL }
2832         },
2833         { &hf_tds7_version,
2834           { "TDS version", "tds.7login.version",
2835             FT_UINT32, BASE_HEX, NULL, 0x0,
2836             NULL, HFILL }
2837         },
2838         { &hf_tds7_packet_size,
2839           { "Packet Size", "tds.7login.packet_size",
2840             FT_UINT32, BASE_DEC, NULL, 0x0,
2841             NULL, HFILL }
2842         },
2843         { &hf_tds7_client_version,
2844           { "Client version", "tds.7login.client_version",
2845             FT_UINT32, BASE_DEC, NULL, 0x0,
2846             NULL, HFILL }
2847         },
2848         { &hf_tds7_client_pid,
2849           { "Client PID", "tds.7login.client_pid",
2850             FT_UINT32, BASE_DEC, NULL, 0x0,
2851             NULL, HFILL }
2852         },
2853         { &hf_tds7_connection_id,
2854           { "Connection ID", "tds.7login.connection_id",
2855             FT_UINT32, BASE_DEC, NULL, 0x0,
2856             NULL, HFILL }
2857         },
2858         { &hf_tds7_option_flags1,
2859           { "Option Flags 1", "tds.7login.option_flags1",
2860             FT_UINT8, BASE_HEX, NULL, 0x0,
2861             NULL, HFILL }
2862         },
2863         { &hf_tds7_option_flags2,
2864           { "Option Flags 2", "tds.7login.option_flags2",
2865             FT_UINT8, BASE_HEX, NULL, 0x0,
2866             NULL, HFILL }
2867         },
2868         { &hf_tds7_sql_type_flags,
2869           { "SQL Type Flags", "tds.7login.sql_type_flags",
2870             FT_UINT8, BASE_HEX, NULL, 0x0,
2871             NULL, HFILL }
2872         },
2873         { &hf_tds7_reserved_flags,
2874           { "Reserved Flags", "tds.7login.reserved_flags",
2875             FT_UINT8, BASE_HEX, NULL, 0x0,
2876             NULL, HFILL }
2877         },
2878         { &hf_tds7_time_zone,
2879           { "Time Zone", "tds.7login.time_zone",
2880             FT_UINT32, BASE_HEX, NULL, 0x0,
2881             NULL, HFILL }
2882         },
2883         { &hf_tds7_collation,
2884           { "Collation", "tds.7login.collation",
2885             FT_UINT32, BASE_HEX, NULL, 0x0,
2886             NULL, HFILL }
2887         },
2888         { &hf_tds7_loginack_version,
2889           { "TDS version", "tds.7loginack.version",
2890             FT_UINT32, BASE_HEX, NULL, 0x0,
2891             NULL, HFILL }
2892         },
2893         { &hf_tds_all_headers,
2894           { "Packet data stream headers", "tds.all_headers",
2895             FT_NONE, BASE_NONE, NULL, 0x0,
2896             "The ALL_HEADERS rule", HFILL }
2897         },
2898         { &hf_tds_all_headers_total_length,
2899           { "Total length",     "tds.all_headers.total_length",
2900             FT_UINT32, BASE_DEC, NULL, 0x0,
2901             "Total length of ALL_HEADERS stream", HFILL }
2902         },
2903         { &hf_tds_all_headers_header_length,
2904           { "Length",           "tds.all_headers.header.length",
2905             FT_UINT32, BASE_DEC, NULL, 0x0,
2906             "Total length of an individual header", HFILL }
2907         },
2908         { &hf_tds_all_headers_header_type,
2909           { "Type",             "tds.all_headers.header.type",
2910             FT_UINT16, BASE_HEX, VALS(header_type_names), 0x0,
2911             NULL, HFILL }
2912         },
2913         { &hf_tds_all_headers_trans_descr,
2914           { "Transaction descriptor", "tds.all_headers.header.trans_descr",
2915             FT_UINT64, BASE_DEC, NULL, 0x0,
2916             "For each connection, a number that uniquely identifies the transaction the request is associated with. Initially generated by the server when a new transaction is created and returned to the client as part of the ENVCHANGE token stream.", HFILL }
2917         },
2918         { &hf_tds_all_headers_request_cnt,
2919           { "Outstanding request count", "tds.all_headers.header.request_cnt",
2920             FT_UINT32, BASE_DEC, NULL, 0x0,
2921             "Number of requests currently active on the connection", HFILL }
2922         },
2923         { &hf_tds_type_info,
2924           { "Type info",        "tds.type_info",
2925             FT_NONE, BASE_NONE, NULL, 0x0,
2926             "The TYPE_INFO rule applies to several messages used to describe column information", HFILL }
2927         },
2928         { &hf_tds_type_info_type,
2929           { "Type",             "tds.type_info.type",
2930             FT_UINT8, BASE_HEX, VALS(tds_data_type_names), 0x0,
2931             NULL, HFILL }
2932         },
2933         { &hf_tds_type_info_varlen,
2934           { "Maximal length",   "tds.type_info.varlen",
2935             FT_UINT32, BASE_DEC, NULL, 0x0,
2936             "Defines the length of the data contained within the column", HFILL }
2937         },
2938         { &hf_tds_type_info_precision,
2939           { "Precision",        "tds.type_info.precision",
2940             FT_UINT8, BASE_DEC, NULL, 0x0,
2941             NULL, HFILL }
2942         },
2943         { &hf_tds_type_info_scale,
2944           { "Scale",            "tds.type_info.scale",
2945             FT_UINT8, BASE_DEC, NULL, 0x0,
2946             NULL, HFILL }
2947         },
2948         { &hf_tds_type_info_collation,
2949           { "Collation",        "tds.type_info.collation",
2950             FT_NONE, BASE_NONE, NULL, 0x0,
2951             "Specifies collation information for character data or metadata describing character data", HFILL }
2952         },
2953         { &hf_tds_type_info_collation_lcid,
2954           { "LCID",             "tds.type_info.collation.lcid",
2955             FT_UINT32, BASE_HEX, NULL, 0x000FFFFF,
2956             "For a SortId==0 collation, the LCID bits correspond to a LocaleId as defined by the National Language Support (NLS) functions", HFILL }
2957         },
2958         { &hf_tds_type_info_collation_ign_case,
2959           { "Ignore case",      "tds.type_info.collation.ignore_case",
2960             FT_BOOLEAN, 32, NULL, 0x00100000,
2961             NULL, HFILL }
2962         },
2963         { &hf_tds_type_info_collation_ign_accent,
2964           { "Ignore accent",    "tds.type_info.collation.ignore_accent",
2965             FT_BOOLEAN, 32, NULL, 0x00200000,
2966             NULL, HFILL }
2967         },
2968         { &hf_tds_type_info_collation_ign_kana,
2969           { "Ignore kana",      "tds.type_info.collation.ignore_kana",
2970             FT_BOOLEAN, 32, NULL, 0x00400000,
2971             NULL, HFILL }
2972         },
2973         { &hf_tds_type_info_collation_ign_width,
2974           { "Ignore width",     "tds.type_info.collation.ignore_width",
2975             FT_BOOLEAN, 32, NULL, 0x00800000,
2976             NULL, HFILL }
2977         },
2978         { &hf_tds_type_info_collation_binary,
2979           { "Binary",           "tds.type_info.collation.binary",
2980             FT_BOOLEAN, 32, NULL, 0x01000000,
2981             NULL, HFILL }
2982         },
2983         { &hf_tds_type_info_collation_version,
2984           { "Version",          "tds.type_info.collation.version",
2985             FT_UINT32, BASE_DEC, NULL, 0xF0000000,
2986             NULL, HFILL }
2987         },
2988         { &hf_tds_type_info_collation_sortid,
2989           { "SortId",           "tds.type_info.collation.sortid",
2990             FT_UINT8, BASE_DEC, NULL, 0x0,
2991             NULL, HFILL }
2992         },
2993         { &hf_tds_type_varbyte_length,
2994           { "Length",           "tds.type_varbyte.length",
2995             FT_UINT32, BASE_DEC, NULL, 0x0,
2996             NULL, HFILL }
2997         },
2998         { &hf_tds_type_varbyte_data_null,
2999           { "Data: NULL",       "tds.type_varbyte.data.null",
3000             FT_NONE, BASE_NONE, NULL, 0x0,
3001             NULL, HFILL }
3002         },
3003         { &hf_tds_type_varbyte_data_boolean,
3004           { "Data",             "tds.type_varbyte.data.bool",
3005             FT_BOOLEAN, BASE_NONE, NULL, 0x0,
3006             NULL, HFILL }
3007         },
3008         { &hf_tds_type_varbyte_data_int1,
3009           { "Data",             "tds.type_varbyte.data.int",
3010             FT_INT8, BASE_DEC, NULL, 0x0,
3011             NULL, HFILL }
3012         },
3013         { &hf_tds_type_varbyte_data_int2,
3014           { "Data",             "tds.type_varbyte.data.int",
3015             FT_INT16, BASE_DEC, NULL, 0x0,
3016             NULL, HFILL }
3017         },
3018         { &hf_tds_type_varbyte_data_int4,
3019           { "Data",             "tds.type_varbyte.data.int",
3020             FT_INT32, BASE_DEC, NULL, 0x0,
3021             NULL, HFILL }
3022         },
3023         { &hf_tds_type_varbyte_data_int8,
3024           { "Data",             "tds.type_varbyte.data.int64",
3025             FT_INT64, BASE_DEC, NULL, 0x0,
3026             NULL, HFILL }
3027         },
3028         { &hf_tds_type_varbyte_data_float,
3029           { "Data",             "tds.type_varbyte.data.float",
3030             FT_FLOAT, BASE_NONE, NULL, 0x0,
3031             NULL, HFILL }
3032         },
3033         { &hf_tds_type_varbyte_data_double,
3034           { "Data",             "tds.type_varbyte.data.float",
3035             FT_DOUBLE, BASE_NONE, NULL, 0x0,
3036             NULL, HFILL }
3037         },
3038         { &hf_tds_type_varbyte_data_bytes,
3039           { "Data",             "tds.type_varbyte.data.bytes",
3040             FT_BYTES, BASE_NONE, NULL, 0x0,
3041             NULL, HFILL }
3042         },
3043         { &hf_tds_type_varbyte_data_guid,
3044           { "Data",             "tds.type_varbyte.data.guid",
3045             FT_GUID, BASE_NONE, NULL, 0x0,
3046             NULL, HFILL }
3047         },
3048         { &hf_tds_type_varbyte_data_string,
3049           { "Data",             "tds.type_varbyte.data.string",
3050             FT_STRING, BASE_NONE, NULL, 0x0,
3051             NULL, HFILL }
3052         },
3053         { &hf_tds_type_varbyte_plp_len,
3054           { "PLP length",       "tds.type_varbyte.plp_len",
3055             FT_INT64, BASE_DEC, NULL, 0x0,
3056             NULL, HFILL }
3057         },
3058         { &hf_tds_type_varbyte_plp_chunk_len,
3059           { "PLP chunk length", "tds.type_varbyte.plp_chunk_len",
3060             FT_INT32, BASE_DEC, NULL, 0x0,
3061             NULL, HFILL }
3062         },
3063         { &hf_tds_rpc,
3064           { "Remote Procedure Call", "tds.rpc",
3065             FT_NONE, BASE_NONE, NULL, 0x0,
3066             NULL, HFILL }
3067         },
3068         { &hf_tds_rpc_name_length8,
3069           { "Procedure name length", "tds.rpc.name_length",
3070             FT_UINT8, BASE_DEC, NULL, 0x0,
3071             NULL, HFILL }
3072         },
3073         { &hf_tds_rpc_name_length,
3074           { "Procedure name length", "tds.rpc.name_length",
3075             FT_UINT16, BASE_DEC, NULL, 0x0,
3076             NULL, HFILL }
3077         },
3078         { &hf_tds_rpc_name,
3079           { "Procedure name",   "tds.rpc.name",
3080             FT_STRING, BASE_NONE, NULL, 0x0,
3081             NULL, HFILL }
3082         },
3083         { &hf_tds_rpc_proc_id,
3084           { "Stored procedure ID", "tds.rpc.proc_id",
3085             FT_UINT16, BASE_DEC, VALS(internal_stored_proc_id_names), 0x0,
3086             "The number identifying the special stored procedure to be executed", HFILL }
3087         },
3088         { &hf_tds_rpc_options,
3089           { "Option flags",     "tds.rpc.options",
3090             FT_UINT16, BASE_HEX, NULL, 0x0,
3091             "The number identifying the special stored procedure to be executed", HFILL }
3092         },
3093         { &hf_tds_rpc_options_with_recomp,
3094           { "With recompile",   "tds.rpc.options.with_recomp",
3095             FT_BOOLEAN, 16, NULL, TDS_RPC_OPT_WITH_RECOMP,
3096             "The number identifying the special stored procedure to be executed", HFILL }
3097         },
3098         { &hf_tds_rpc_options_no_metadata,
3099           { "No metadata",      "tds.rpc.options.no_metadata",
3100             FT_BOOLEAN, 16, NULL, TDS_RPC_OPT_NO_METADATA,
3101             "The number identifying the special stored procedure to be executed", HFILL }
3102         },
3103         { &hf_tds_rpc_options_reuse_metadata,
3104           { "Reuse metadata",   "tds.rpc.options.reuse_metadata",
3105             FT_BOOLEAN, 16, NULL, TDS_RPC_OPT_REUSE_METADATA,
3106             "The number identifying the special stored procedure to be executed", HFILL }
3107         },
3108         { &hf_tds_rpc_separator,
3109           { "RPC batch separator", "tds.rpc.separator",
3110             FT_UINT8, BASE_DEC, VALS(tds_rpc_separators), 0x0,
3111             NULL, HFILL }
3112         },
3113         { &hf_tds_rpc_parameter,
3114           { "Parameter",        "tds.rpc.parameter",
3115             FT_NONE, BASE_NONE, NULL, 0x0,
3116             NULL, HFILL }
3117         },
3118         { &hf_tds_rpc_parameter_name_length,
3119           { "Name length",      "tds.rpc.parameter.name_length",
3120             FT_UINT8, BASE_DEC, NULL, 0x0,
3121             NULL, HFILL }
3122         },
3123         { &hf_tds_rpc_parameter_name,
3124           { "Name",             "tds.rpc.parameter.name",
3125             FT_STRING, BASE_NONE, NULL, 0x0,
3126             NULL, HFILL }
3127         },
3128         { &hf_tds_rpc_parameter_status,
3129           { "Status flags",     "tds.rpc.parameter.status",
3130             FT_UINT8, BASE_HEX, NULL, 0x0,
3131             "Information on how the parameter is passed", HFILL }
3132         },
3133         { &hf_tds_rpc_parameter_status_by_ref,
3134           { "By reference",     "tds.rpc.parameter.status.by_ref",
3135             FT_BOOLEAN, 16, NULL, TDS_RPC_PARAMETER_STATUS_BY_REF,
3136             NULL, HFILL }
3137         },
3138         { &hf_tds_rpc_parameter_status_default,
3139           { "Default value",    "tds.rpc.parameter.status.default",
3140             FT_BOOLEAN, 16, NULL, TDS_RPC_PARAMETER_STATUS_DEFAULT,
3141             NULL, HFILL }
3142         },
3143         { &hf_tds_rpc_parameter_value,
3144           { "Value",            "tds.rpc.parameter.value",
3145             FT_NONE, BASE_NONE, NULL, 0x0,
3146             NULL, HFILL }
3147         },
3148     };
3149
3150     static gint *ett[] = {
3151         &ett_tds,
3152         &ett_tds_status,
3153         &ett_tds_fragments,
3154         &ett_tds_fragment,
3155         &ett_tds_all_headers,
3156         &ett_tds_all_headers_header,
3157         &ett_tds_type_info,
3158         &ett_tds_type_info_collation,
3159         &ett_tds_type_varbyte,
3160         &ett_tds_message,
3161         &ett_tds_rpc_options,
3162         &ett_tds_rpc_parameter,
3163         &ett_tds_rpc_parameter_status,
3164         &ett_tds_token,
3165         &ett_tds7_query,
3166         &ett_tds7_login,
3167         &ett_tds7_hdr,
3168     };
3169
3170     static ei_register_info ei[] = {
3171         { &ei_tds_all_headers_header_type, { "tds.all_headers.header.type.invalid", PI_PROTOCOL, PI_WARN, "Invalid header type", EXPFILL }},
3172         { &ei_tds_type_info_type, { "tds.type_info.type.invalid", PI_PROTOCOL, PI_WARN, "Invalid data type", EXPFILL }},
3173         { &ei_tds_type_info_type_undecoded, { "tds.type_info.type.undecoded", PI_UNDECODED, PI_ERROR, "Data type not supported yet", EXPFILL }},
3174         { &ei_tds_invalid_length, { "tds.invalid_length", PI_MALFORMED, PI_ERROR, "Invalid length", EXPFILL }},
3175         { &ei_tds_token_length_invalid, { "tds.token.length.invalid", PI_PROTOCOL, PI_WARN, "Bogus token size", EXPFILL }},
3176     };
3177
3178     module_t *tds_module;
3179     expert_module_t* expert_tds;
3180
3181 /* Register the protocol name and description */
3182     proto_tds = proto_register_protocol("Tabular Data Stream", "TDS", "tds");
3183
3184 /* Required function calls to register the header fields and subtrees used */
3185     proto_register_field_array(proto_tds, hf, array_length(hf));
3186     proto_register_subtree_array(ett, array_length(ett));
3187     expert_tds = expert_register_protocol(proto_tds);
3188     expert_register_field_array(expert_tds, ei, array_length(ei));
3189
3190 /* Allow dissector to be found by name. */
3191     tds_tcp_handle = register_dissector("tds", dissect_tds_tcp, proto_tds);
3192
3193     tds_module = prefs_register_protocol(proto_tds, NULL);
3194     prefs_register_bool_preference(tds_module, "desegment_buffers",
3195                                    "Reassemble TDS buffers spanning multiple TCP segments",
3196                                    "Whether the TDS dissector should reassemble TDS buffers spanning multiple TCP segments. "
3197                                    "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
3198                                    &tds_desegment);
3199     prefs_register_bool_preference(tds_module, "defragment",
3200                                    "Reassemble fragmented TDS messages with multiple buffers",
3201                                    "Whether the TDS dissector should defragment messages spanning multiple Netlib buffers",
3202                                    &tds_defragment);
3203     prefs_register_enum_preference(tds_module, "protocol_type",
3204                                    "TDS Protocol Type",
3205                                    "Hint as to version of TDS protocol being decoded",
3206                                    &tds_protocol_type, tds_protocol_type_options, FALSE);
3207     prefs_register_enum_preference(tds_module, "endian_type",
3208                                    "TDS decode as",
3209                                    "Hint as to whether to decode TDS protocol as little-endian or big-endian. (TDS7/8 always decoded as little-endian)",
3210                                    &tds_little_endian, tds_endian_type_options, FALSE);
3211     prefs_register_range_preference(tds_module, "tcp_ports",
3212                                     "TDS TCP ports",
3213                                     "Additional TCP ports to decode as TDS",
3214                                     &tds_tcp_ports, 0xFFFF);
3215
3216     register_init_routine(tds_init);
3217 }
3218
3219 /* If this dissector uses sub-dissector registration add a registration routine.
3220    This format is required because a script is used to find these routines and
3221    create the code that calls these routines.
3222 */
3223 void
3224 proto_reg_handoff_tds(void)
3225 {
3226     /* Initial TDS ports: MS SQL default ports */
3227     dissector_add_uint("tcp.port", 1433, tds_tcp_handle);
3228     dissector_add_uint("tcp.port", 2433, tds_tcp_handle);
3229
3230     heur_dissector_add("tcp", dissect_tds_tcp_heur, proto_tds);
3231
3232     ntlmssp_handle = find_dissector("ntlmssp");
3233     gssapi_handle = find_dissector("gssapi");
3234     data_handle = find_dissector("data");
3235 }
3236
3237 /*
3238  * Editor modelines
3239  *
3240  * Local Variables:
3241  * c-basic-offset: 4
3242  * tab-width: 8
3243  * indent-tabs-mode: nil
3244  * End:
3245  *
3246  * ex: set shiftwidth=4 tabstop=8 expandtab:
3247  * :indentSize=4:tabSize=8:noTabs=true:
3248  */