Skip to Content.
Sympa Menu

freetds - [freetds] How to have a better control on how the tds use the openssl?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Rick Qing Xu <qinx AT microsoft.com>
  • To: "freetds AT lists.ibiblio.org" <freetds AT lists.ibiblio.org>
  • Subject: [freetds] How to have a better control on how the tds use the openssl?
  • Date: Thu, 13 Dec 2018 19:58:25 +0000

Hi FreeTDS team,

I am new to the TDS community and hi to everyone. I am working on a project
doing in-depth detection on encryption characteristics on SQL TDS protocol.
For example, by only talking to the server thru network on TDS protocol, I
want to detect which TLS versions the server supports, what cipher suites are
supported and what the order of it. In that case, I need to have more fine
control of which TLS version is going to be used.

Usually I need to call SSL_CTX_set_verify before the handshake starts to
trust all kinds of server certificate. In addition, I'd like to use
SSL_set_tlsext_host_name to control whether to use Server Name Indication
extension in the handshake. Another example is I want to call
SSL_set_tlsext_status_type before the handshake to ask server to send back an
OCSP status response to me.

After reading the tls.c in tds project, the tds_init_openssl()
function<https://github.com/FreeTDS/freetds/blob/513ed1a7dd5ed3be866407a2ef50d8dea3664943/src/tds/tls.c#L729>
actually hardcoded the TLS method to be TLS_client_method, which is the
general-purpose version-flexible SSL/TLS methods. The actual protocol version
used will be negotiated to the highest version mutually supported by the
client and the server. The supported protocols are TLSv1, TLSv1.1 and TLSv1.2.

I can see that now I can control what cipher get used by setting the
tds->login->openssl_ciphers to whatever I need to achieve the cipher suite
ask.

Can you give me advice on how to do it in existing code? If not in existing
code, I am very happy to write some code to implement that in tds project.

Thanks!

Rick Qing Xu

https://github.com/qinxgit





Archive powered by MHonArc 2.6.24.

Top of Page