Skip to Content.
Sympa Menu

freetds - Re: [freetds] Certification verification

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Peter Deacon <peterd AT iea-software.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Certification verification
  • Date: Mon, 6 Apr 2015 08:54:49 -0700 (Pacific Daylight Time)

On Mon, 6 Apr 2015, Frediano Ziglio wrote:

Hi,
this is my last stopover before release. I wrote a patch to start
doing certificate verification, see
https://github.com/freddy77/freetds/commit/557caf0e0af1c385d6cfd1602f593f9683ed6fc8.

Now the problem is when to check. If a mssql is installed without
certificate a dummy certificate (self signed with a
"Self_Signed_Fallback" common name) is generate every time the sql
instance is started (not during the install so you cannot cache the
certificate of a given server). So there is no way to check these
certificates, FreeTDS (and MSSQL driver too) has to accept by default
these certificates.
The patch add two options to freetds.conf, "ca file" and "crl file",
respectively the file containing the root authorities and the
certificates revocation list (list of certificates to not accept). So
the key of the patch is: if you specify CA list you want to check
certificate, if not accept any certificates sent. Now, the questions
are:

- should FreeTDS check the common name (with server name inside) of
the certificate?

Important if a global CA is used. Without checking an attacker can buy a cert from that CA and compromise security.

Might also be important for company-wide CAs. Company might hand out a cert for a test server in a satellite office that compromises an important production server without the name checking.

Ususally hostname TDS is using (e.g. sqlserver.mydomain.com) would match CN of servers public key.

In OpenSSL after you SSL_accept connection fetching CN might look something like:

peer = SSL_get_peer_certificate(myconnection);
X509_NAME_get_text_by_NID(X509_get_subject_name(peer),NID_commonName,output_cn_goes_here...)
X509_free(peer);


Sometimes CN can contain wildcards *.mydomain.com or additional valid hosts present in subject alternate name attributes of servers public key.. not sure either is needed/useful here.

- should I add an option to disable name verification?

- should I read system CA list so to check the global list installed
in the system? I don't know if this is useful, are mssql with proper
certificate using a public CA?

Dunno might be useful for someone connecting to a commercially hosted server..?

Have Fun!
Peter




Archive powered by MHonArc 2.6.24.

Top of Page