mirror of https://github.com/go-gitea/gitea.git
1233 lines
31 KiB
Go
1233 lines
31 KiB
Go
package mssql
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"encoding/binary"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"io/ioutil"
|
|
"net"
|
|
"sort"
|
|
"strconv"
|
|
"strings"
|
|
"unicode/utf16"
|
|
"unicode/utf8"
|
|
)
|
|
|
|
func parseInstances(msg []byte) map[string]map[string]string {
|
|
results := map[string]map[string]string{}
|
|
if len(msg) > 3 && msg[0] == 5 {
|
|
out_s := string(msg[3:])
|
|
tokens := strings.Split(out_s, ";")
|
|
instdict := map[string]string{}
|
|
got_name := false
|
|
var name string
|
|
for _, token := range tokens {
|
|
if got_name {
|
|
instdict[name] = token
|
|
got_name = false
|
|
} else {
|
|
name = token
|
|
if len(name) == 0 {
|
|
if len(instdict) == 0 {
|
|
break
|
|
}
|
|
results[strings.ToUpper(instdict["InstanceName"])] = instdict
|
|
instdict = map[string]string{}
|
|
continue
|
|
}
|
|
got_name = true
|
|
}
|
|
}
|
|
}
|
|
return results
|
|
}
|
|
|
|
func getInstances(ctx context.Context, d Dialer, address string) (map[string]map[string]string, error) {
|
|
conn, err := d.DialContext(ctx, "udp", address+":1434")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer conn.Close()
|
|
deadline, _ := ctx.Deadline()
|
|
conn.SetDeadline(deadline)
|
|
_, err = conn.Write([]byte{3})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var resp = make([]byte, 16*1024-1)
|
|
read, err := conn.Read(resp)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return parseInstances(resp[:read]), nil
|
|
}
|
|
|
|
// tds versions
|
|
const (
|
|
verTDS70 = 0x70000000
|
|
verTDS71 = 0x71000000
|
|
verTDS71rev1 = 0x71000001
|
|
verTDS72 = 0x72090002
|
|
verTDS73A = 0x730A0003
|
|
verTDS73 = verTDS73A
|
|
verTDS73B = 0x730B0003
|
|
verTDS74 = 0x74000004
|
|
)
|
|
|
|
// packet types
|
|
// https://msdn.microsoft.com/en-us/library/dd304214.aspx
|
|
const (
|
|
packSQLBatch packetType = 1
|
|
packRPCRequest packetType = 3
|
|
packReply packetType = 4
|
|
|
|
// 2.2.1.7 Attention: https://msdn.microsoft.com/en-us/library/dd341449.aspx
|
|
// 4.19.2 Out-of-Band Attention Signal: https://msdn.microsoft.com/en-us/library/dd305167.aspx
|
|
packAttention packetType = 6
|
|
|
|
packBulkLoadBCP packetType = 7
|
|
packFedAuthToken packetType = 8
|
|
packTransMgrReq packetType = 14
|
|
packNormal packetType = 15
|
|
packLogin7 packetType = 16
|
|
packSSPIMessage packetType = 17
|
|
packPrelogin packetType = 18
|
|
)
|
|
|
|
// prelogin fields
|
|
// http://msdn.microsoft.com/en-us/library/dd357559.aspx
|
|
const (
|
|
preloginVERSION = 0
|
|
preloginENCRYPTION = 1
|
|
preloginINSTOPT = 2
|
|
preloginTHREADID = 3
|
|
preloginMARS = 4
|
|
preloginTRACEID = 5
|
|
preloginFEDAUTHREQUIRED = 6
|
|
preloginNONCEOPT = 7
|
|
preloginTERMINATOR = 0xff
|
|
)
|
|
|
|
const (
|
|
encryptOff = 0 // Encryption is available but off.
|
|
encryptOn = 1 // Encryption is available and on.
|
|
encryptNotSup = 2 // Encryption is not available.
|
|
encryptReq = 3 // Encryption is required.
|
|
)
|
|
|
|
const (
|
|
featExtSESSIONRECOVERY byte = 0x01
|
|
featExtFEDAUTH byte = 0x02
|
|
featExtCOLUMNENCRYPTION byte = 0x04
|
|
featExtGLOBALTRANSACTIONS byte = 0x05
|
|
featExtAZURESQLSUPPORT byte = 0x08
|
|
featExtDATACLASSIFICATION byte = 0x09
|
|
featExtUTF8SUPPORT byte = 0x0A
|
|
featExtTERMINATOR byte = 0xFF
|
|
)
|
|
|
|
type tdsSession struct {
|
|
buf *tdsBuffer
|
|
loginAck loginAckStruct
|
|
database string
|
|
partner string
|
|
columns []columnStruct
|
|
tranid uint64
|
|
logFlags uint64
|
|
log optionalLogger
|
|
routedServer string
|
|
routedPort uint16
|
|
returnStatus *ReturnStatus
|
|
}
|
|
|
|
const (
|
|
logErrors = 1
|
|
logMessages = 2
|
|
logRows = 4
|
|
logSQL = 8
|
|
logParams = 16
|
|
logTransaction = 32
|
|
logDebug = 64
|
|
)
|
|
|
|
type columnStruct struct {
|
|
UserType uint32
|
|
Flags uint16
|
|
ColName string
|
|
ti typeInfo
|
|
}
|
|
|
|
type keySlice []uint8
|
|
|
|
func (p keySlice) Len() int { return len(p) }
|
|
func (p keySlice) Less(i, j int) bool { return p[i] < p[j] }
|
|
func (p keySlice) Swap(i, j int) { p[i], p[j] = p[j], p[i] }
|
|
|
|
// http://msdn.microsoft.com/en-us/library/dd357559.aspx
|
|
func writePrelogin(packetType packetType, w *tdsBuffer, fields map[uint8][]byte) error {
|
|
var err error
|
|
|
|
w.BeginPacket(packetType, false)
|
|
offset := uint16(5*len(fields) + 1)
|
|
keys := make(keySlice, 0, len(fields))
|
|
for k := range fields {
|
|
keys = append(keys, k)
|
|
}
|
|
sort.Sort(keys)
|
|
// writing header
|
|
for _, k := range keys {
|
|
err = w.WriteByte(k)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
err = binary.Write(w, binary.BigEndian, offset)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
v := fields[k]
|
|
size := uint16(len(v))
|
|
err = binary.Write(w, binary.BigEndian, size)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
offset += size
|
|
}
|
|
err = w.WriteByte(preloginTERMINATOR)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// writing values
|
|
for _, k := range keys {
|
|
v := fields[k]
|
|
written, err := w.Write(v)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if written != len(v) {
|
|
return errors.New("Write method didn't write the whole value")
|
|
}
|
|
}
|
|
return w.FinishPacket()
|
|
}
|
|
|
|
func readPrelogin(r *tdsBuffer) (map[uint8][]byte, error) {
|
|
packet_type, err := r.BeginRead()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
struct_buf, err := ioutil.ReadAll(r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if packet_type != packReply {
|
|
return nil, errors.New("invalid respones, expected packet type 4, PRELOGIN RESPONSE")
|
|
}
|
|
if len(struct_buf) == 0 {
|
|
return nil, errors.New("invalid empty PRELOGIN response, it must contain at least one byte")
|
|
}
|
|
offset := 0
|
|
results := map[uint8][]byte{}
|
|
for {
|
|
rec_type := struct_buf[offset]
|
|
if rec_type == preloginTERMINATOR {
|
|
break
|
|
}
|
|
|
|
rec_offset := binary.BigEndian.Uint16(struct_buf[offset+1:])
|
|
rec_len := binary.BigEndian.Uint16(struct_buf[offset+3:])
|
|
value := struct_buf[rec_offset : rec_offset+rec_len]
|
|
results[rec_type] = value
|
|
offset += 5
|
|
}
|
|
return results, nil
|
|
}
|
|
|
|
// OptionFlags2
|
|
// http://msdn.microsoft.com/en-us/library/dd304019.aspx
|
|
const (
|
|
fLanguageFatal = 1
|
|
fODBC = 2
|
|
fTransBoundary = 4
|
|
fCacheConnect = 8
|
|
fIntSecurity = 0x80
|
|
)
|
|
|
|
// OptionFlags3
|
|
// http://msdn.microsoft.com/en-us/library/dd304019.aspx
|
|
const (
|
|
fChangePassword = 1
|
|
fSendYukonBinaryXML = 2
|
|
fUserInstance = 4
|
|
fUnknownCollationHandling = 8
|
|
fExtension = 0x10
|
|
)
|
|
|
|
// TypeFlags
|
|
const (
|
|
// 4 bits for fSQLType
|
|
// 1 bit for fOLEDB
|
|
fReadOnlyIntent = 32
|
|
)
|
|
|
|
type login struct {
|
|
TDSVersion uint32
|
|
PacketSize uint32
|
|
ClientProgVer uint32
|
|
ClientPID uint32
|
|
ConnectionID uint32
|
|
OptionFlags1 uint8
|
|
OptionFlags2 uint8
|
|
TypeFlags uint8
|
|
OptionFlags3 uint8
|
|
ClientTimeZone int32
|
|
ClientLCID uint32
|
|
HostName string
|
|
UserName string
|
|
Password string
|
|
AppName string
|
|
ServerName string
|
|
CtlIntName string
|
|
Language string
|
|
Database string
|
|
ClientID [6]byte
|
|
SSPI []byte
|
|
AtchDBFile string
|
|
ChangePassword string
|
|
FeatureExt featureExts
|
|
}
|
|
|
|
type featureExts struct {
|
|
features map[byte]featureExt
|
|
}
|
|
|
|
type featureExt interface {
|
|
featureID() byte
|
|
toBytes() []byte
|
|
}
|
|
|
|
func (e *featureExts) Add(f featureExt) error {
|
|
if f == nil {
|
|
return nil
|
|
}
|
|
id := f.featureID()
|
|
if _, exists := e.features[id]; exists {
|
|
f := "login error: Feature with ID '%v' is already present in FeatureExt block"
|
|
return fmt.Errorf(f, id)
|
|
}
|
|
if e.features == nil {
|
|
e.features = make(map[byte]featureExt)
|
|
}
|
|
e.features[id] = f
|
|
return nil
|
|
}
|
|
|
|
func (e featureExts) toBytes() []byte {
|
|
if len(e.features) == 0 {
|
|
return nil
|
|
}
|
|
var d []byte
|
|
for featureID, f := range e.features {
|
|
featureData := f.toBytes()
|
|
|
|
hdr := make([]byte, 5)
|
|
hdr[0] = featureID // FedAuth feature extension BYTE
|
|
binary.LittleEndian.PutUint32(hdr[1:], uint32(len(featureData))) // FeatureDataLen DWORD
|
|
d = append(d, hdr...)
|
|
|
|
d = append(d, featureData...) // FeatureData *BYTE
|
|
}
|
|
if d != nil {
|
|
d = append(d, 0xff) // Terminator
|
|
}
|
|
return d
|
|
}
|
|
|
|
// featureExtFedAuth tracks federated authentication state before and during login
|
|
type featureExtFedAuth struct {
|
|
// FedAuthLibrary is populated by the federated authentication provider.
|
|
FedAuthLibrary int
|
|
|
|
// ADALWorkflow is populated by the federated authentication provider.
|
|
ADALWorkflow byte
|
|
|
|
// FedAuthEcho is populated from the prelogin response
|
|
FedAuthEcho bool
|
|
|
|
// FedAuthToken is populated during login with the value from the provider.
|
|
FedAuthToken string
|
|
|
|
// Nonce is populated during login with the value from the provider.
|
|
Nonce []byte
|
|
|
|
// Signature is populated during login with the value from the server.
|
|
Signature []byte
|
|
}
|
|
|
|
func (e *featureExtFedAuth) featureID() byte {
|
|
return featExtFEDAUTH
|
|
}
|
|
|
|
func (e *featureExtFedAuth) toBytes() []byte {
|
|
if e == nil {
|
|
return nil
|
|
}
|
|
|
|
options := byte(e.FedAuthLibrary) << 1
|
|
if e.FedAuthEcho {
|
|
options |= 1 // fFedAuthEcho
|
|
}
|
|
|
|
// Feature extension format depends on the federated auth library.
|
|
// Options are described at
|
|
// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/773a62b6-ee89-4c02-9e5e-344882630aac
|
|
var d []byte
|
|
|
|
switch e.FedAuthLibrary {
|
|
case fedAuthLibrarySecurityToken:
|
|
d = make([]byte, 5)
|
|
d[0] = options
|
|
|
|
// looks like string in
|
|
// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/f88b63bb-b479-49e1-a87b-deda521da508
|
|
tokenBytes := str2ucs2(e.FedAuthToken)
|
|
binary.LittleEndian.PutUint32(d[1:], uint32(len(tokenBytes))) // Should be a signed int32, but since the length is relatively small, this should work
|
|
d = append(d, tokenBytes...)
|
|
|
|
if len(e.Nonce) == 32 {
|
|
d = append(d, e.Nonce...)
|
|
}
|
|
|
|
case fedAuthLibraryADAL:
|
|
d = []byte{options, e.ADALWorkflow}
|
|
}
|
|
|
|
return d
|
|
}
|
|
|
|
type loginHeader struct {
|
|
Length uint32
|
|
TDSVersion uint32
|
|
PacketSize uint32
|
|
ClientProgVer uint32
|
|
ClientPID uint32
|
|
ConnectionID uint32
|
|
OptionFlags1 uint8
|
|
OptionFlags2 uint8
|
|
TypeFlags uint8
|
|
OptionFlags3 uint8
|
|
ClientTimeZone int32
|
|
ClientLCID uint32
|
|
HostNameOffset uint16
|
|
HostNameLength uint16
|
|
UserNameOffset uint16
|
|
UserNameLength uint16
|
|
PasswordOffset uint16
|
|
PasswordLength uint16
|
|
AppNameOffset uint16
|
|
AppNameLength uint16
|
|
ServerNameOffset uint16
|
|
ServerNameLength uint16
|
|
ExtensionOffset uint16
|
|
ExtensionLength uint16
|
|
CtlIntNameOffset uint16
|
|
CtlIntNameLength uint16
|
|
LanguageOffset uint16
|
|
LanguageLength uint16
|
|
DatabaseOffset uint16
|
|
DatabaseLength uint16
|
|
ClientID [6]byte
|
|
SSPIOffset uint16
|
|
SSPILength uint16
|
|
AtchDBFileOffset uint16
|
|
AtchDBFileLength uint16
|
|
ChangePasswordOffset uint16
|
|
ChangePasswordLength uint16
|
|
SSPILongLength uint32
|
|
}
|
|
|
|
// convert Go string to UTF-16 encoded []byte (littleEndian)
|
|
// done manually rather than using bytes and binary packages
|
|
// for performance reasons
|
|
func str2ucs2(s string) []byte {
|
|
res := utf16.Encode([]rune(s))
|
|
ucs2 := make([]byte, 2*len(res))
|
|
for i := 0; i < len(res); i++ {
|
|
ucs2[2*i] = byte(res[i])
|
|
ucs2[2*i+1] = byte(res[i] >> 8)
|
|
}
|
|
return ucs2
|
|
}
|
|
|
|
func ucs22str(s []byte) (string, error) {
|
|
if len(s)%2 != 0 {
|
|
return "", fmt.Errorf("illegal UCS2 string length: %d", len(s))
|
|
}
|
|
buf := make([]uint16, len(s)/2)
|
|
for i := 0; i < len(s); i += 2 {
|
|
buf[i/2] = binary.LittleEndian.Uint16(s[i:])
|
|
}
|
|
return string(utf16.Decode(buf)), nil
|
|
}
|
|
|
|
func manglePassword(password string) []byte {
|
|
var ucs2password []byte = str2ucs2(password)
|
|
for i, ch := range ucs2password {
|
|
ucs2password[i] = ((ch<<4)&0xff | (ch >> 4)) ^ 0xA5
|
|
}
|
|
return ucs2password
|
|
}
|
|
|
|
// http://msdn.microsoft.com/en-us/library/dd304019.aspx
|
|
func sendLogin(w *tdsBuffer, login *login) error {
|
|
w.BeginPacket(packLogin7, false)
|
|
hostname := str2ucs2(login.HostName)
|
|
username := str2ucs2(login.UserName)
|
|
password := manglePassword(login.Password)
|
|
appname := str2ucs2(login.AppName)
|
|
servername := str2ucs2(login.ServerName)
|
|
ctlintname := str2ucs2(login.CtlIntName)
|
|
language := str2ucs2(login.Language)
|
|
database := str2ucs2(login.Database)
|
|
atchdbfile := str2ucs2(login.AtchDBFile)
|
|
changepassword := str2ucs2(login.ChangePassword)
|
|
featureExt := login.FeatureExt.toBytes()
|
|
|
|
hdr := loginHeader{
|
|
TDSVersion: login.TDSVersion,
|
|
PacketSize: login.PacketSize,
|
|
ClientProgVer: login.ClientProgVer,
|
|
ClientPID: login.ClientPID,
|
|
ConnectionID: login.ConnectionID,
|
|
OptionFlags1: login.OptionFlags1,
|
|
OptionFlags2: login.OptionFlags2,
|
|
TypeFlags: login.TypeFlags,
|
|
OptionFlags3: login.OptionFlags3,
|
|
ClientTimeZone: login.ClientTimeZone,
|
|
ClientLCID: login.ClientLCID,
|
|
HostNameLength: uint16(utf8.RuneCountInString(login.HostName)),
|
|
UserNameLength: uint16(utf8.RuneCountInString(login.UserName)),
|
|
PasswordLength: uint16(utf8.RuneCountInString(login.Password)),
|
|
AppNameLength: uint16(utf8.RuneCountInString(login.AppName)),
|
|
ServerNameLength: uint16(utf8.RuneCountInString(login.ServerName)),
|
|
CtlIntNameLength: uint16(utf8.RuneCountInString(login.CtlIntName)),
|
|
LanguageLength: uint16(utf8.RuneCountInString(login.Language)),
|
|
DatabaseLength: uint16(utf8.RuneCountInString(login.Database)),
|
|
ClientID: login.ClientID,
|
|
SSPILength: uint16(len(login.SSPI)),
|
|
AtchDBFileLength: uint16(utf8.RuneCountInString(login.AtchDBFile)),
|
|
ChangePasswordLength: uint16(utf8.RuneCountInString(login.ChangePassword)),
|
|
}
|
|
offset := uint16(binary.Size(hdr))
|
|
hdr.HostNameOffset = offset
|
|
offset += uint16(len(hostname))
|
|
hdr.UserNameOffset = offset
|
|
offset += uint16(len(username))
|
|
hdr.PasswordOffset = offset
|
|
offset += uint16(len(password))
|
|
hdr.AppNameOffset = offset
|
|
offset += uint16(len(appname))
|
|
hdr.ServerNameOffset = offset
|
|
offset += uint16(len(servername))
|
|
hdr.CtlIntNameOffset = offset
|
|
offset += uint16(len(ctlintname))
|
|
hdr.LanguageOffset = offset
|
|
offset += uint16(len(language))
|
|
hdr.DatabaseOffset = offset
|
|
offset += uint16(len(database))
|
|
hdr.SSPIOffset = offset
|
|
offset += uint16(len(login.SSPI))
|
|
hdr.AtchDBFileOffset = offset
|
|
offset += uint16(len(atchdbfile))
|
|
hdr.ChangePasswordOffset = offset
|
|
offset += uint16(len(changepassword))
|
|
|
|
featureExtOffset := uint32(0)
|
|
featureExtLen := len(featureExt)
|
|
if featureExtLen > 0 {
|
|
hdr.OptionFlags3 |= fExtension
|
|
hdr.ExtensionOffset = offset
|
|
hdr.ExtensionLength = 4
|
|
offset += hdr.ExtensionLength // DWORD
|
|
featureExtOffset = uint32(offset)
|
|
}
|
|
hdr.Length = uint32(offset) + uint32(featureExtLen)
|
|
|
|
var err error
|
|
err = binary.Write(w, binary.LittleEndian, &hdr)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(hostname)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(username)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(password)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(appname)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(servername)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(ctlintname)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(language)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(database)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(login.SSPI)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(atchdbfile)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(changepassword)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if featureExtOffset > 0 {
|
|
err = binary.Write(w, binary.LittleEndian, featureExtOffset)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(featureExt)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return w.FinishPacket()
|
|
}
|
|
|
|
// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/827d9632-2957-4d54-b9ea-384530ae79d0
|
|
func sendFedAuthInfo(w *tdsBuffer, fedAuth *featureExtFedAuth) (err error) {
|
|
fedauthtoken := str2ucs2(fedAuth.FedAuthToken)
|
|
tokenlen := len(fedauthtoken)
|
|
datalen := 4 + tokenlen + len(fedAuth.Nonce)
|
|
|
|
w.BeginPacket(packFedAuthToken, false)
|
|
err = binary.Write(w, binary.LittleEndian, uint32(datalen))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
err = binary.Write(w, binary.LittleEndian, uint32(tokenlen))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
_, err = w.Write(fedauthtoken)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
_, err = w.Write(fedAuth.Nonce)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
return w.FinishPacket()
|
|
}
|
|
|
|
func readUcs2(r io.Reader, numchars int) (res string, err error) {
|
|
buf := make([]byte, numchars*2)
|
|
_, err = io.ReadFull(r, buf)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return ucs22str(buf)
|
|
}
|
|
|
|
func readUsVarChar(r io.Reader) (res string, err error) {
|
|
numchars, err := readUshort(r)
|
|
if err != nil {
|
|
return
|
|
}
|
|
return readUcs2(r, int(numchars))
|
|
}
|
|
|
|
func writeUsVarChar(w io.Writer, s string) (err error) {
|
|
buf := str2ucs2(s)
|
|
var numchars int = len(buf) / 2
|
|
if numchars > 0xffff {
|
|
panic("invalid size for US_VARCHAR")
|
|
}
|
|
err = binary.Write(w, binary.LittleEndian, uint16(numchars))
|
|
if err != nil {
|
|
return
|
|
}
|
|
_, err = w.Write(buf)
|
|
return
|
|
}
|
|
|
|
func readBVarChar(r io.Reader) (res string, err error) {
|
|
numchars, err := readByte(r)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
// A zero length could be returned, return an empty string
|
|
if numchars == 0 {
|
|
return "", nil
|
|
}
|
|
return readUcs2(r, int(numchars))
|
|
}
|
|
|
|
func writeBVarChar(w io.Writer, s string) (err error) {
|
|
buf := str2ucs2(s)
|
|
var numchars int = len(buf) / 2
|
|
if numchars > 0xff {
|
|
panic("invalid size for B_VARCHAR")
|
|
}
|
|
err = binary.Write(w, binary.LittleEndian, uint8(numchars))
|
|
if err != nil {
|
|
return
|
|
}
|
|
_, err = w.Write(buf)
|
|
return
|
|
}
|
|
|
|
func readBVarByte(r io.Reader) (res []byte, err error) {
|
|
length, err := readByte(r)
|
|
if err != nil {
|
|
return
|
|
}
|
|
res = make([]byte, length)
|
|
_, err = io.ReadFull(r, res)
|
|
return
|
|
}
|
|
|
|
func readUshort(r io.Reader) (res uint16, err error) {
|
|
err = binary.Read(r, binary.LittleEndian, &res)
|
|
return
|
|
}
|
|
|
|
func readByte(r io.Reader) (res byte, err error) {
|
|
var b [1]byte
|
|
_, err = r.Read(b[:])
|
|
res = b[0]
|
|
return
|
|
}
|
|
|
|
// Packet Data Stream Headers
|
|
// http://msdn.microsoft.com/en-us/library/dd304953.aspx
|
|
type headerStruct struct {
|
|
hdrtype uint16
|
|
data []byte
|
|
}
|
|
|
|
const (
|
|
dataStmHdrQueryNotif = 1 // query notifications
|
|
dataStmHdrTransDescr = 2 // MARS transaction descriptor (required)
|
|
dataStmHdrTraceActivity = 3
|
|
)
|
|
|
|
// Query Notifications Header
|
|
// http://msdn.microsoft.com/en-us/library/dd304949.aspx
|
|
type queryNotifHdr struct {
|
|
notifyId string
|
|
ssbDeployment string
|
|
notifyTimeout uint32
|
|
}
|
|
|
|
func (hdr queryNotifHdr) pack() (res []byte) {
|
|
notifyId := str2ucs2(hdr.notifyId)
|
|
ssbDeployment := str2ucs2(hdr.ssbDeployment)
|
|
|
|
res = make([]byte, 2+len(notifyId)+2+len(ssbDeployment)+4)
|
|
b := res
|
|
|
|
binary.LittleEndian.PutUint16(b, uint16(len(notifyId)))
|
|
b = b[2:]
|
|
copy(b, notifyId)
|
|
b = b[len(notifyId):]
|
|
|
|
binary.LittleEndian.PutUint16(b, uint16(len(ssbDeployment)))
|
|
b = b[2:]
|
|
copy(b, ssbDeployment)
|
|
b = b[len(ssbDeployment):]
|
|
|
|
binary.LittleEndian.PutUint32(b, hdr.notifyTimeout)
|
|
|
|
return res
|
|
}
|
|
|
|
// MARS Transaction Descriptor Header
|
|
// http://msdn.microsoft.com/en-us/library/dd340515.aspx
|
|
type transDescrHdr struct {
|
|
transDescr uint64 // transaction descriptor returned from ENVCHANGE
|
|
outstandingReqCnt uint32 // outstanding request count
|
|
}
|
|
|
|
func (hdr transDescrHdr) pack() (res []byte) {
|
|
res = make([]byte, 8+4)
|
|
binary.LittleEndian.PutUint64(res, hdr.transDescr)
|
|
binary.LittleEndian.PutUint32(res[8:], hdr.outstandingReqCnt)
|
|
return res
|
|
}
|
|
|
|
func writeAllHeaders(w io.Writer, headers []headerStruct) (err error) {
|
|
// Calculating total length.
|
|
var totallen uint32 = 4
|
|
for _, hdr := range headers {
|
|
totallen += 4 + 2 + uint32(len(hdr.data))
|
|
}
|
|
// writing
|
|
err = binary.Write(w, binary.LittleEndian, totallen)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for _, hdr := range headers {
|
|
var headerlen uint32 = 4 + 2 + uint32(len(hdr.data))
|
|
err = binary.Write(w, binary.LittleEndian, headerlen)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
err = binary.Write(w, binary.LittleEndian, hdr.hdrtype)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = w.Write(hdr.data)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func sendSqlBatch72(buf *tdsBuffer, sqltext string, headers []headerStruct, resetSession bool) (err error) {
|
|
buf.BeginPacket(packSQLBatch, resetSession)
|
|
|
|
if err = writeAllHeaders(buf, headers); err != nil {
|
|
return
|
|
}
|
|
|
|
_, err = buf.Write(str2ucs2(sqltext))
|
|
if err != nil {
|
|
return
|
|
}
|
|
return buf.FinishPacket()
|
|
}
|
|
|
|
// 2.2.1.7 Attention: https://msdn.microsoft.com/en-us/library/dd341449.aspx
|
|
// 4.19.2 Out-of-Band Attention Signal: https://msdn.microsoft.com/en-us/library/dd305167.aspx
|
|
func sendAttention(buf *tdsBuffer) error {
|
|
buf.BeginPacket(packAttention, false)
|
|
return buf.FinishPacket()
|
|
}
|
|
|
|
type auth interface {
|
|
InitialBytes() ([]byte, error)
|
|
NextBytes([]byte) ([]byte, error)
|
|
Free()
|
|
}
|
|
|
|
// SQL Server AlwaysOn Availability Group Listeners are bound by DNS to a
|
|
// list of IP addresses. So if there is more than one, try them all and
|
|
// use the first one that allows a connection.
|
|
func dialConnection(ctx context.Context, c *Connector, p connectParams) (conn net.Conn, err error) {
|
|
var ips []net.IP
|
|
ip := net.ParseIP(p.host)
|
|
if ip == nil {
|
|
ips, err = net.LookupIP(p.host)
|
|
if err != nil {
|
|
return
|
|
}
|
|
} else {
|
|
ips = []net.IP{ip}
|
|
}
|
|
if len(ips) == 1 {
|
|
d := c.getDialer(&p)
|
|
addr := net.JoinHostPort(ips[0].String(), strconv.Itoa(int(resolveServerPort(p.port))))
|
|
conn, err = d.DialContext(ctx, "tcp", addr)
|
|
|
|
} else {
|
|
//Try Dials in parallel to avoid waiting for timeouts.
|
|
connChan := make(chan net.Conn, len(ips))
|
|
errChan := make(chan error, len(ips))
|
|
portStr := strconv.Itoa(int(resolveServerPort(p.port)))
|
|
for _, ip := range ips {
|
|
go func(ip net.IP) {
|
|
d := c.getDialer(&p)
|
|
addr := net.JoinHostPort(ip.String(), portStr)
|
|
conn, err := d.DialContext(ctx, "tcp", addr)
|
|
if err == nil {
|
|
connChan <- conn
|
|
} else {
|
|
errChan <- err
|
|
}
|
|
}(ip)
|
|
}
|
|
// Wait for either the *first* successful connection, or all the errors
|
|
wait_loop:
|
|
for i := range ips {
|
|
select {
|
|
case conn = <-connChan:
|
|
// Got a connection to use, close any others
|
|
go func(n int) {
|
|
for i := 0; i < n; i++ {
|
|
select {
|
|
case conn := <-connChan:
|
|
conn.Close()
|
|
case <-errChan:
|
|
}
|
|
}
|
|
}(len(ips) - i - 1)
|
|
// Remove any earlier errors we may have collected
|
|
err = nil
|
|
break wait_loop
|
|
case err = <-errChan:
|
|
}
|
|
}
|
|
}
|
|
// Can't do the usual err != nil check, as it is possible to have gotten an error before a successful connection
|
|
if conn == nil {
|
|
f := "unable to open tcp connection with host '%v:%v': %v"
|
|
return nil, fmt.Errorf(f, p.host, resolveServerPort(p.port), err.Error())
|
|
}
|
|
return conn, err
|
|
}
|
|
|
|
func preparePreloginFields(p connectParams, fe *featureExtFedAuth) map[uint8][]byte {
|
|
instance_buf := []byte(p.instance)
|
|
instance_buf = append(instance_buf, 0) // zero terminate instance name
|
|
|
|
var encrypt byte
|
|
if p.disableEncryption {
|
|
encrypt = encryptNotSup
|
|
} else if p.encrypt {
|
|
encrypt = encryptOn
|
|
} else {
|
|
encrypt = encryptOff
|
|
}
|
|
|
|
fields := map[uint8][]byte{
|
|
preloginVERSION: {0, 0, 0, 0, 0, 0},
|
|
preloginENCRYPTION: {encrypt},
|
|
preloginINSTOPT: instance_buf,
|
|
preloginTHREADID: {0, 0, 0, 0},
|
|
preloginMARS: {0}, // MARS disabled
|
|
}
|
|
|
|
if fe.FedAuthLibrary != fedAuthLibraryReserved {
|
|
fields[preloginFEDAUTHREQUIRED] = []byte{1}
|
|
}
|
|
|
|
return fields
|
|
}
|
|
|
|
func interpretPreloginResponse(p connectParams, fe *featureExtFedAuth, fields map[uint8][]byte) (encrypt byte, err error) {
|
|
// If the server returns the preloginFEDAUTHREQUIRED field, then federated authentication
|
|
// is supported. The actual value may be 0 or 1, where 0 means either SSPI or federated
|
|
// authentication is allowed, while 1 means only federated authentication is allowed.
|
|
if fedAuthSupport, ok := fields[preloginFEDAUTHREQUIRED]; ok {
|
|
if len(fedAuthSupport) != 1 {
|
|
return 0, fmt.Errorf("Federated authentication flag length should be 1: is %d", len(fedAuthSupport))
|
|
}
|
|
|
|
// We need to be able to echo the value back to the server
|
|
fe.FedAuthEcho = fedAuthSupport[0] != 0
|
|
} else if fe.FedAuthLibrary != fedAuthLibraryReserved {
|
|
return 0, fmt.Errorf("Federated authentication is not supported by the server")
|
|
}
|
|
|
|
encryptBytes, ok := fields[preloginENCRYPTION]
|
|
if !ok {
|
|
return 0, fmt.Errorf("encrypt negotiation failed")
|
|
}
|
|
encrypt = encryptBytes[0]
|
|
if p.encrypt && (encrypt == encryptNotSup || encrypt == encryptOff) {
|
|
return 0, fmt.Errorf("server does not support encryption")
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func prepareLogin(ctx context.Context, c *Connector, p connectParams, log optionalLogger, auth auth, fe *featureExtFedAuth, packetSize uint32) (l *login, err error) {
|
|
l = &login{
|
|
TDSVersion: verTDS74,
|
|
PacketSize: packetSize,
|
|
Database: p.database,
|
|
OptionFlags2: fODBC, // to get unlimited TEXTSIZE
|
|
HostName: p.workstation,
|
|
ServerName: p.host,
|
|
AppName: p.appname,
|
|
TypeFlags: p.typeFlags,
|
|
}
|
|
switch {
|
|
case fe.FedAuthLibrary == fedAuthLibrarySecurityToken:
|
|
if p.logFlags&logDebug != 0 {
|
|
log.Println("Starting federated authentication using security token")
|
|
}
|
|
|
|
fe.FedAuthToken, err = c.securityTokenProvider(ctx)
|
|
if err != nil {
|
|
if p.logFlags&logDebug != 0 {
|
|
log.Printf("Failed to retrieve service principal token for federated authentication security token library: %v", err)
|
|
}
|
|
return nil, err
|
|
}
|
|
|
|
l.FeatureExt.Add(fe)
|
|
|
|
case fe.FedAuthLibrary == fedAuthLibraryADAL:
|
|
if p.logFlags&logDebug != 0 {
|
|
log.Println("Starting federated authentication using ADAL")
|
|
}
|
|
|
|
l.FeatureExt.Add(fe)
|
|
|
|
case auth != nil:
|
|
if p.logFlags&logDebug != 0 {
|
|
log.Println("Starting SSPI login")
|
|
}
|
|
|
|
l.SSPI, err = auth.InitialBytes()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
l.OptionFlags2 |= fIntSecurity
|
|
return l, nil
|
|
|
|
default:
|
|
// Default to SQL server authentication with user and password
|
|
l.UserName = p.user
|
|
l.Password = p.password
|
|
}
|
|
|
|
return l, nil
|
|
}
|
|
|
|
func connect(ctx context.Context, c *Connector, log optionalLogger, p connectParams) (res *tdsSession, err error) {
|
|
dialCtx := ctx
|
|
if p.dial_timeout > 0 {
|
|
var cancel func()
|
|
dialCtx, cancel = context.WithTimeout(ctx, p.dial_timeout)
|
|
defer cancel()
|
|
}
|
|
// if instance is specified use instance resolution service
|
|
if p.instance != "" && p.port != 0 {
|
|
// both instance name and port specified
|
|
// when port is specified instance name is not used
|
|
// you should not provide instance name when you provide port
|
|
log.Println("WARN: You specified both instance name and port in the connection string, port will be used and instance name will be ignored")
|
|
}
|
|
if p.instance != "" && p.port == 0 {
|
|
p.instance = strings.ToUpper(p.instance)
|
|
d := c.getDialer(&p)
|
|
instances, err := getInstances(dialCtx, d, p.host)
|
|
if err != nil {
|
|
f := "unable to get instances from Sql Server Browser on host %v: %v"
|
|
return nil, fmt.Errorf(f, p.host, err.Error())
|
|
}
|
|
strport, ok := instances[p.instance]["tcp"]
|
|
if !ok {
|
|
f := "no instance matching '%v' returned from host '%v'"
|
|
return nil, fmt.Errorf(f, p.instance, p.host)
|
|
}
|
|
port, err := strconv.ParseUint(strport, 0, 16)
|
|
if err != nil {
|
|
f := "invalid tcp port returned from Sql Server Browser '%v': %v"
|
|
return nil, fmt.Errorf(f, strport, err.Error())
|
|
}
|
|
p.port = port
|
|
}
|
|
|
|
initiate_connection:
|
|
conn, err := dialConnection(dialCtx, c, p)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
toconn := newTimeoutConn(conn, p.conn_timeout)
|
|
|
|
outbuf := newTdsBuffer(p.packetSize, toconn)
|
|
sess := tdsSession{
|
|
buf: outbuf,
|
|
log: log,
|
|
logFlags: p.logFlags,
|
|
}
|
|
|
|
fedAuth := &featureExtFedAuth{
|
|
FedAuthLibrary: p.fedAuthLibrary,
|
|
ADALWorkflow: p.fedAuthADALWorkflow,
|
|
}
|
|
|
|
fields := preparePreloginFields(p, fedAuth)
|
|
|
|
err = writePrelogin(packPrelogin, outbuf, fields)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
fields, err = readPrelogin(outbuf)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
encrypt, err := interpretPreloginResponse(p, fedAuth, fields)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if encrypt != encryptNotSup {
|
|
var config tls.Config
|
|
if p.certificate != "" {
|
|
pem, err := ioutil.ReadFile(p.certificate)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("cannot read certificate %q: %v", p.certificate, err)
|
|
}
|
|
certs := x509.NewCertPool()
|
|
certs.AppendCertsFromPEM(pem)
|
|
config.RootCAs = certs
|
|
}
|
|
if p.trustServerCertificate {
|
|
config.InsecureSkipVerify = true
|
|
}
|
|
config.ServerName = p.hostInCertificate
|
|
// fix for https://github.com/denisenkom/go-mssqldb/issues/166
|
|
// Go implementation of TLS payload size heuristic algorithm splits single TDS package to multiple TCP segments,
|
|
// while SQL Server seems to expect one TCP segment per encrypted TDS package.
|
|
// Setting DynamicRecordSizingDisabled to true disables that algorithm and uses 16384 bytes per TLS package
|
|
config.DynamicRecordSizingDisabled = true
|
|
// setting up connection handler which will allow wrapping of TLS handshake packets inside TDS stream
|
|
handshakeConn := tlsHandshakeConn{buf: outbuf}
|
|
passthrough := passthroughConn{c: &handshakeConn}
|
|
tlsConn := tls.Client(&passthrough, &config)
|
|
err = tlsConn.Handshake()
|
|
passthrough.c = toconn
|
|
outbuf.transport = tlsConn
|
|
if err != nil {
|
|
return nil, fmt.Errorf("TLS Handshake failed: %v", err)
|
|
}
|
|
if encrypt == encryptOff {
|
|
outbuf.afterFirst = func() {
|
|
outbuf.transport = toconn
|
|
}
|
|
}
|
|
}
|
|
|
|
auth, authOk := getAuth(p.user, p.password, p.serverSPN, p.workstation)
|
|
if authOk {
|
|
defer auth.Free()
|
|
} else {
|
|
auth = nil
|
|
}
|
|
|
|
login, err := prepareLogin(ctx, c, p, log, auth, fedAuth, uint32(outbuf.PackageSize()))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err = sendLogin(outbuf, login)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// Loop until a packet containing a login acknowledgement is received.
|
|
// SSPI and federated authentication scenarios may require multiple
|
|
// packet exchanges to complete the login sequence.
|
|
for loginAck := false; !loginAck; {
|
|
reader := startReading(&sess, ctx, nil)
|
|
|
|
for {
|
|
tok, err := reader.nextToken()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if tok == nil {
|
|
break
|
|
}
|
|
|
|
switch token := tok.(type) {
|
|
case sspiMsg:
|
|
sspi_msg, err := auth.NextBytes(token)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if len(sspi_msg) > 0 {
|
|
outbuf.BeginPacket(packSSPIMessage, false)
|
|
_, err = outbuf.Write(sspi_msg)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
err = outbuf.FinishPacket()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sspi_msg = nil
|
|
}
|
|
// TODO: for Live ID authentication it may be necessary to
|
|
// compare fedAuth.Nonce == token.Nonce and keep track of signature
|
|
//case fedAuthAckStruct:
|
|
//fedAuth.Signature = token.Signature
|
|
case fedAuthInfoStruct:
|
|
// For ADAL workflows this contains the STS URL and server SPN.
|
|
// If received outside of an ADAL workflow, ignore.
|
|
if c == nil || c.adalTokenProvider == nil {
|
|
continue
|
|
}
|
|
|
|
// Request the AD token given the server SPN and STS URL
|
|
fedAuth.FedAuthToken, err = c.adalTokenProvider(ctx, token.ServerSPN, token.STSURL)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// Now need to send the token as a FEDINFO packet
|
|
err = sendFedAuthInfo(outbuf, fedAuth)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
case loginAckStruct:
|
|
sess.loginAck = token
|
|
loginAck = true
|
|
case doneStruct:
|
|
if token.isError() {
|
|
return nil, fmt.Errorf("login error: %s", token.getError())
|
|
}
|
|
case error:
|
|
return nil, fmt.Errorf("login error: %s", token.Error())
|
|
}
|
|
}
|
|
}
|
|
|
|
if sess.routedServer != "" {
|
|
toconn.Close()
|
|
p.host = sess.routedServer
|
|
p.port = uint64(sess.routedPort)
|
|
if !p.hostInCertificateProvided {
|
|
p.hostInCertificate = sess.routedServer
|
|
}
|
|
goto initiate_connection
|
|
}
|
|
return &sess, nil
|
|
}
|
|
|
|
func (sess *tdsSession) setReturnStatus(status ReturnStatus) {
|
|
if sess.returnStatus != nil {
|
|
*sess.returnStatus = status
|
|
}
|
|
}
|