[freetds] OpenSSL, Sql Server 2000

ZIGLIO, Frediano, VF-IT Frediano.Ziglio at vodafone.com
Wed Oct 18 09:56:56 EDT 2006


> 
> Hi,
> 
> I have an MS SQL Server 2000, with a certificate. We are successfully
> connecting with encryption from .NET clients, but I can't seem to get
> things working with FC5 / freetds 0.64 / unixODBC 2.2.11. I also tried
> with freetds 0.65.dev.20061016.
> 
> When I compile using "--with-openssl", the connection hangs at
> process_login_tokens(). If I switch to protocol version 7.0, 
> things work
> again using the same credentials (but of course not encrypted). What's
> going on here?
> 
> Thanks in advance for any help.
> -Kurt
> 
> 17:18:01.709610 31444 (net.c:1165):handshake succeeded!!
> 17:18:01.709699 31444 (write.c:134):tds_put_string converting 
> 8 bytes of
> "(name of client machine)"
> 17:18:01.709789 31444 (write.c:162):tds_put_string wrote 16 bytes
> 17:18:01.709828 31444 (write.c:134):tds_put_string converting 
> 8 bytes of
> "(username)"
> 17:18:01.709861 31444 (write.c:162):tds_put_string wrote 16 bytes
> 17:18:01.709893 31444 (write.c:134):tds_put_string converting 
> 4 bytes of
> "TSQL"
> 17:18:01.709926 31444 (write.c:162):tds_put_string wrote 8 bytes
> 17:18:01.709955 31444 (write.c:134):tds_put_string converting 10 bytes
> of "(name of server from freetds.conf)"
> 17:18:01.709987 31444 (write.c:162):tds_put_string wrote 20 bytes
> 17:18:01.710016 31444 (write.c:134):tds_put_string converting 11 bytes
> of "TDS-Library"
> 17:18:01.710047 31444 (write.c:162):tds_put_string wrote 22 bytes
> 17:18:01.710077 31444 (write.c:134):tds_put_string converting 10 bytes
> of "us_english"
> 17:18:01.710107 31444 (write.c:162):tds_put_string wrote 20 bytes
> 17:18:01.710137 31444 (write.c:162):tds_put_string wrote 0 bytes
> 17:18:01.710468 31444 (token.c:312):tds_process_login_tokens()

I tried with snapshot and it give same problem. If I remember old
mssql2k (that is not correctly patched versions) do not like tlsv1...

You should solve with a fix like

Index: src/tds/net.c
===================================================================
RCS file: /cvsroot/freetds/freetds/src/tds/net.c,v
retrieving revision 1.44
diff -u -1 -0 -r1.44 net.c
--- src/tds/net.c       16 Oct 2006 07:49:05 -0000      1.44
+++ src/tds/net.c       18 Oct 2006 13:53:37 -0000
@@ -1073,26 +1073,27 @@
 };

 static SSL_CTX *ssl_ctx;

 static int
 tds_init_openssl(void)
 {
        SSL_METHOD *meth;

        SSL_library_init ();
-       meth = TLSv1_client_method ();
+       meth = SSLv23_client_method();
        if (meth == NULL)
                return 1;
        ssl_ctx = SSL_CTX_new (meth);
        if (ssl_ctx == NULL)
                return 1;
+       SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2);
        return 0;
 }

 #ifdef TDS_ATTRIBUTE_DESTRUCTOR
 static void __attribute__((destructor))
 tds_tls_deinit(void)
 {
        if (ssl_ctx)
                SSL_CTX_free (ssl_ctx);
 }

(it enable SSLv3 and TLSv1, not only TLSv1)

If it works as expected for you I'll commit into HEAD and 0.64 branch.

freddy77



More information about the FreeTDS mailing list