Skip to Content.
Sympa Menu

freetds - Re: [freetds] OpenSSL, Sql Server 2000

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] OpenSSL, Sql Server 2000
  • Date: Wed, 18 Oct 2006 15:56:56 +0200

>
> Hi,
>
> I have an MS SQL Server 2000, with a certificate. We are successfully
> connecting with encryption from .NET clients, but I can't seem to get
> things working with FC5 / freetds 0.64 / unixODBC 2.2.11. I also tried
> with freetds 0.65.dev.20061016.
>
> When I compile using "--with-openssl", the connection hangs at
> process_login_tokens(). If I switch to protocol version 7.0,
> things work
> again using the same credentials (but of course not encrypted). What's
> going on here?
>
> Thanks in advance for any help.
> -Kurt
>
> 17:18:01.709610 31444 (net.c:1165):handshake succeeded!!
> 17:18:01.709699 31444 (write.c:134):tds_put_string converting
> 8 bytes of
> "(name of client machine)"
> 17:18:01.709789 31444 (write.c:162):tds_put_string wrote 16 bytes
> 17:18:01.709828 31444 (write.c:134):tds_put_string converting
> 8 bytes of
> "(username)"
> 17:18:01.709861 31444 (write.c:162):tds_put_string wrote 16 bytes
> 17:18:01.709893 31444 (write.c:134):tds_put_string converting
> 4 bytes of
> "TSQL"
> 17:18:01.709926 31444 (write.c:162):tds_put_string wrote 8 bytes
> 17:18:01.709955 31444 (write.c:134):tds_put_string converting 10 bytes
> of "(name of server from freetds.conf)"
> 17:18:01.709987 31444 (write.c:162):tds_put_string wrote 20 bytes
> 17:18:01.710016 31444 (write.c:134):tds_put_string converting 11 bytes
> of "TDS-Library"
> 17:18:01.710047 31444 (write.c:162):tds_put_string wrote 22 bytes
> 17:18:01.710077 31444 (write.c:134):tds_put_string converting 10 bytes
> of "us_english"
> 17:18:01.710107 31444 (write.c:162):tds_put_string wrote 20 bytes
> 17:18:01.710137 31444 (write.c:162):tds_put_string wrote 0 bytes
> 17:18:01.710468 31444 (token.c:312):tds_process_login_tokens()

I tried with snapshot and it give same problem. If I remember old
mssql2k (that is not correctly patched versions) do not like tlsv1...

You should solve with a fix like

Index: src/tds/net.c
===================================================================
RCS file: /cvsroot/freetds/freetds/src/tds/net.c,v
retrieving revision 1.44
diff -u -1 -0 -r1.44 net.c
--- src/tds/net.c 16 Oct 2006 07:49:05 -0000 1.44
+++ src/tds/net.c 18 Oct 2006 13:53:37 -0000
@@ -1073,26 +1073,27 @@
};

static SSL_CTX *ssl_ctx;

static int
tds_init_openssl(void)
{
SSL_METHOD *meth;

SSL_library_init ();
- meth = TLSv1_client_method ();
+ meth = SSLv23_client_method();
if (meth == NULL)
return 1;
ssl_ctx = SSL_CTX_new (meth);
if (ssl_ctx == NULL)
return 1;
+ SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2);
return 0;
}

#ifdef TDS_ATTRIBUTE_DESTRUCTOR
static void __attribute__((destructor))
tds_tls_deinit(void)
{
if (ssl_ctx)
SSL_CTX_free (ssl_ctx);
}

(it enable SSLv3 and TLSv1, not only TLSv1)

If it works as expected for you I'll commit into HEAD and 0.64 branch.

freddy77





Archive powered by MHonArc 2.6.24.

Top of Page