Wireshark-dev: Re: [Wireshark-dev] Drop sql-oracle dissector?
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 16 Mar 2013 19:49:50 -0700
On Mar 16, 2013, at 7:17 PM, Evan Huus <eapache@xxxxxxxxx> wrote: > packet-sqloracle.c is currently not being built (not listed in either > Makefile.common or CMakeLists.txt). > > It was mentioned in bug #8449 because Moshe noticed that it had a > really egregious buffer overflow condition while doing random code > review. > > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8449 > > Having taken a look at the dissector, it is an absolute mess. Tons of > obvious bugs, bad practices, etc. There is no way it would be accepted > as a patch, were it filed new today (and nobody seems to know who > wrote it anyways). > > So, since nobody has complained about the fact that it's disabled, and > it looks like nearly as much work to rewrite as it is to fix, I'm > happy just removing it completely. I presume it's intended to dissect whatever protocol Oracle uses to send SQL over the wire, probably encapsulated on top of TNS. Some poking around the Web found http://packetpushers.net/sqlnet-a-k-a-oracle-tns-and-firewalls/ which says a bit about how TNS works but just speaks of SQL being transported atop it, with no other details of how that's done (or of whether services *other* than SQL are transported over TNS or how you identify the service). I saw some stuff referring to an Oracle "net8" or "Net8" protocol - perhaps that's version 8 of their SQL protocol - and a Google search for net8 protocol found, among other thing: http://www.pythian.com/blog/repost-oracle-protocol/ which doesn't *look* as if it's TNS, so it might be what runs atop TNS, or might be an alternative to TNS, or.... It spoke of "TTCCode"s; Googling for "TTCCode" found some stuff and a lot of irrelevant stuff, and Googling for TTCCode TTIPro found various bits of stuff for Java packages with names starting with "oracle.jdbc", which *might* be Java code that puts Oracle SQL on the wire. This book: http://www.amazon.com/The-Oracle-Hackers-Handbook-ebook/dp/B000SEIC3K looks as if it has some protocol details as well. Oracle has some information at http://docs.oracle.com/cd/A87860_01/doc/network.817/a76933/architec.htm but that's more of a software stack description than a protocol stack description. The source file in question might have some useful information in combination with various other bits of information about Net8/SQL*Net/TTC-7/whatever the heck the name or names of the protocols are; perhaps either: it should be renamed as "oracle_sql.txt" with a huge comment saying "this code is crap, but it might be one source of useful protocol information in case anybody wants to make an Oracle SQL dissector" and left in the tree; we should create an "OracleSQL" page on the Wiki with that file as an attachment and various links for the benefit of anybody trying to write an Oracle SQL dissector; we should file a bug in Bugzilla saying "we need to dissect Oracle SQL messages" and make that file an attachment.
- Follow-Ups:
- Re: [Wireshark-dev] Drop sql-oracle dissector?
- From: Evan Huus
- Re: [Wireshark-dev] Drop sql-oracle dissector?
- References:
- [Wireshark-dev] Drop sql-oracle dissector?
- From: Evan Huus
- [Wireshark-dev] Drop sql-oracle dissector?
- Prev by Date: [Wireshark-dev] Drop sql-oracle dissector?
- Next by Date: Re: [Wireshark-dev] Drop sql-oracle dissector?
- Previous by thread: [Wireshark-dev] Drop sql-oracle dissector?
- Next by thread: Re: [Wireshark-dev] Drop sql-oracle dissector?
- Index(es):
- Get Wireshark
- Download
- Code of Conduct