Skip to Content.
Sympa Menu

freetds - Re: [freetds] Sybase Connection - trouble without protocol fallback

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Fredy Paquet <fredy AT opag.ch>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Cc: Frediano Ziglio <freddy77 AT gmail.com>, Igor Korot <ikorot01 AT gmail.com>
  • Subject: Re: [freetds] Sybase Connection - trouble without protocol fallback
  • Date: Tue, 04 Jul 2017 17:28:17 +0200

Hello Igor

The FreeTDS user guide defines default encryption level is OFF:
(see http://www.freetds.org/userguide/freetdsconf.htm)

The config file parser initializes encryption_level to
TDS_ENCRYPTION_DEFAULT. If you do not set encryption in any section of
your freetds.conf, the encryption_level in the login struct remains at
TDS_ENCRYPTION_DEFAULT.

Today, the TDS 7.1 driver changes this value to TDS_ENCRYPTION_REQUEST,
which doesn't implement the documented behaviour.

I do not know wether MSSQL can accept unencrypted requests (no test
system available).

If MSSQL cannot accept unencrypted connections, it may be ok to fallback
to TDS_ENCRYPTION_REQUEST for TDS 7.1. But this clearly must not affect
further trials on the lower protocol levels.

Agree, it would be good programming practise to introduce a #define for
the default encryption level.

fp

On Tue, 2017-07-04 at 10:37 -0400, Igor Korot wrote:
> Hi, Fredy,
>
> On Tue, Jul 4, 2017 at 9:15 AM, Fredy Paquet <fredy AT opag.ch> wrote:
> > Hello Frediano
> >
> > Thank you for the fix of the encryption flag in the login packet.
> > (I will verify correct operation next saturday)
> >
> > What can we do about the fallback problem (see below) ?
> >
> > --- Proposal 1
> >
> > Change the statment to use TDS_ENCRYPTION_OFF:
> >
> > if (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
> > login->encryption_level = TDS_ENCRYPTION_OFF;
> >
> > Because default encryption level is defined as OFF.
>
> What if the encryption becomes ON?
> How do you differentiate between them?
>
> Maybe we need to introduce something like DEFAULT for the encryption
> the configuration file?
>
> >
> > --- Proposal 2
> >
> > I propose using a temporary local variable for the tds71-try,
> > instead of modifying an entry in the login record, which is being
> > used later for other protocol tries.
> >
> > in function tds71_do_login():
> >
> > TDS_TINYINT my_encryption_level
> > = (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
> > ? TDS_ENCRYPTION_REQUEST : login->encryption_level;
> >
> > then try with locally with my_encryption_level
> >
> > (this may be combined with Proposal 1)
> >
> > --- Proposal 3
> >
> > Drop the whole statement, because encryption_level should be controlled
> > by a freetds.conf setting. But on the other side, this might kill
> > working freetds.conf configurations.
>
> Probably not a good idea.
>
> Thank you.
>
> >
> > What do you think about it ?
> >
> > fp
> >
> > On Wed, 2017-06-28 at 09:12 +0200, Fredy Paquet wrote:
> >>
> >> This is due to the fact that in login.c(Line 1128) in function
> >> tds71_do_login() the encryption level is set to REQUEST, but never
> >> reset
> >> again:
> >>
> >> if (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
> >> login->encryption_level = TDS_ENCRYPTION_REQUEST;
> >>
> >> This could easily fixed by saving/restoring the encryption level, but
> >> i'm asking me whether if there are other modified fields not being
> >> restored properly. The protocol fallback loop is in login.c Line 404.
> >
> > --
> > Fredy Paquet
> > Mitglied der Geschäftsleitung
> > OPAG Informatik AG
> > Fabrikmattenweg 11
> > CH-4144 Arlesheim
> > http://www.opag.ch
> > Tel. ++41 61 716 92 22
> > Fax. ++41 61 716 92 29
> >
> > _______________________________________________
> > FreeTDS mailing list
> > FreeTDS AT lists.ibiblio.org
> > https://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> https://lists.ibiblio.org/mailman/listinfo/freetds

--
Fredy Paquet
Mitglied der Geschäftsleitung
OPAG Informatik AG
Fabrikmattenweg 11
CH-4144 Arlesheim
http://www.opag.ch
Tel. ++41 61 716 92 22
Fax. ++41 61 716 92 29





Archive powered by MHonArc 2.6.24.

Top of Page