Merge pull request #16 from microsoft/20210903_TDSHeaderCheck

IPV6 formatting fixes

Author: Malcolm-Stewart

SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/.suo

@@ -124,6 +124,7 @@ public SQLServer GetSQLServer(uint IP, ulong IPHi, ulong IPLo, ushort Port, bool
 
             // not found - create new SQLServer and return it
             SQLServer s2 = new SQLServer();
+            s2.isIPV6 = isIPV6;
             s2.sqlIP = IP;
             s2.sqlIPHi = IPHi;
             s2.sqlIPLo = IPLo;
@@ -173,6 +174,7 @@ public SSRPData GetSSRPRequest(uint IP, ulong IPHi, ulong IPLo, bool isIPV6)
 
             // not found - create new SSRPRequestr and return it
             SSRPData s2 = new SSRPData();
+            s2.isIPV6 = isIPV6;
             s2.sqlIP = IP;
             s2.sqlIPHi = IPHi;
             s2.sqlIPLo = IPLo;

SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/Server/sqlite3/storage.ide

@@ -205,7 +205,7 @@ private static void DisplaySQLServerSummary(NetworkTrace Trace)
                     ulong totalBytes = 0;
                     int totalFrames = 0, totalResets = 0, totalRetransmits = 0;
                     ArrayList clientIPs = new ArrayList();
-                    string IPAddress = null;  // client IP address
+                    string IPAddress = null;  // client IP address or Server IP address
                     string sqlIP = (s.isIPV6) ? utility.FormatIPV6Address(s.sqlIPHi, s.sqlIPLo) : utility.FormatIPV4Address(s.sqlIP);
                     int firstFile = 0;
                     if (s.conversations.Count > 0) firstFile = Trace.files.IndexOf(((FrameData)(((ConversationData)s.conversations[0]).frames[0])).file);
@@ -245,6 +245,11 @@ private static void DisplaySQLServerSummary(NetworkTrace Trace)
 
                     if (totalResets > 0) s.hasResets = true;
 
+                    if (s.isIPV6)
+                        IPAddress = utility.FormatIPV6Address(s.sqlIPHi, s.sqlIPLo);
+                    else
+                        IPAddress = utility.FormatIPV4Address(s.sqlIP);
+
                     rf.SetcolumnData(sqlIP,
                          s.sqlHostName,
                          s.sqlPort.ToString(),

SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/Server/sqlite3/storage.ide-shm

@@ -32,5 +32,5 @@
 // You can specify all the values or you can default the Build and Revision Numbers 
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.5.1852.0")]
-[assembly: AssemblyFileVersion("1.5.1852.0")]
+[assembly: AssemblyVersion("1.5.1862.0")]
+[assembly: AssemblyFileVersion("1.5.1862.0")]

SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/Server/sqlite3/storage.ide-wal

@@ -237,18 +237,39 @@ public static void ProcessTDS(NetworkTrace trace)
                             (firstByte != (int)TDSPacketType.DTC) &&        //   14   0x0E
                             (firstByte != (int)TDSPacketType.SSPI) &&       //   17   0x11
                             (firstByte != (int)TDSPacketType.PRELOGIN) &&   //   18   0x12
-                            (firstByte != (int)TDSPacketType.APPDATA))      //   23   0x17
+                            (firstByte != (int)TDSPacketType.APPDATA))      //   23   0x17 - next 2 bytes give TLS version 0200, 0300 to 0303
                         {
                             continue;
                         }
 
-                        // read header parts that we are interested in
-                        bool tdsEOM = (fd.payload[1] & 0x1) == 1;
-                        ushort tdsLength = utility.B2UInt16(fd.payload, 2);
+                        // define TDS header fields
+                        byte status = 0;
+                        bool tdsEOM = false;
+                        bool tdsResetConnection = false;
+                        ushort tdsLength = 0;  // length of current packet data (includes 8 bytes for the header)
+                        ushort SPID = 0;
+                        byte PacketID = 0;
+                        byte Window = 0;
 
                         // APPDATA does not have a TDS payload, but a TLS payload, so skip these tests if APPDATA
-                        if (firstByte != (int)TDSPacketType.APPDATA)
+                        if (firstByte == (int)TDSPacketType.APPDATA) // TLS version 0200, 0300 to 0303
                         {
+                            byte sslMajor = fd.payload[1];
+                            byte sslMinor = fd.payload[2];
+                            bool validPayload = (sslMajor == 2 && sslMinor == 0) || (sslMajor == 3 && sslMinor < 4);
+                            // do something here - ignore if validPayload == false??? TODO
+                        }
+                        else   // (firstByte != (int)TDSPacketType.APPDATA)
+                        {
+                            // get header values
+                            status = fd.payload[1];
+                            tdsEOM = (status & 0x1) == 1;
+                            tdsResetConnection = (status & 0x18) != 0;
+                            tdsLength = utility.B2UInt16(fd.payload, 2);  // length of current packet data (includes 8 bytes for the header)
+                            SPID = utility.B2UInt16(fd.payload, 4);
+                            PacketID = fd.payload[6];
+                            Window = fd.payload[7];
+
                             // TDS header Length argument needs to be non-zero and also >= payload length
                             if (tdsLength == 0 || tdsLength < fd.payloadLength) continue;
 

SQL_Network_Analyzer/SQLNA/NetworkTrace.cs

@@ -164,25 +164,25 @@ public static String FormatIPV4Address(uint IP)
 
         public static String FormatIPV6Address(ulong Hi, ulong Lo)
         {
-            string s = "";
+            string sHi = "", sLo = "";
 
-            s = (Hi & 0xffff).ToString("X");
+            sHi = (Hi & 0xffff).ToString("X");
             Hi >>= 16;
-            s = (Hi & 0xffff).ToString("X") + ":" + s;
+            sHi = (Hi & 0xffff).ToString("X") + ":" + sHi;
             Hi >>= 16;
-            s = (Hi & 0xffff).ToString("X") + ":" + s;
+            sHi = (Hi & 0xffff).ToString("X") + ":" + sHi;
             Hi >>= 16;
-            s = (Hi & 0xffff).ToString("X") + ":" + s;
+            sHi = (Hi & 0xffff).ToString("X") + ":" + sHi;
 
-            s = (Lo & 0xffff).ToString("X") + ":" + s;
+            sLo = (Lo & 0xffff).ToString("X");
             Lo >>= 16;
-            s = (Lo & 0xffff).ToString("X") + ":" + s;
+            sLo = (Lo & 0xffff).ToString("X") + ":" + sLo;
             Lo >>= 16;
-            s = (Lo & 0xffff).ToString("X") + ":" + s;
+            sLo = (Lo & 0xffff).ToString("X") + ":" + sLo;
             Lo >>= 16;
-            s = (Lo & 0xffff).ToString("X") + ":" + s;
+            sLo = (Lo & 0xffff).ToString("X") + ":" + sLo;
 
-            return s;
+            return sHi + ":" + sLo;
         }
 
         public static void ParseIPPortString(string value, ref bool isIPV6, ref ushort port, ref uint ipv4, ref ulong ipv6hi, ref ulong ipv6lo)
@@ -195,6 +195,7 @@ public static void ParseIPPortString(string value, ref bool isIPV6, ref ushort p
             addr = System.Net.IPAddress.Parse(words[0]);
             if (addr.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
             {
+                isIPV6 = false;
                 ipv4 = B2UInt32(addr.GetAddressBytes(),0);
             }
             else if (addr.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6)