Skip to Content.
Sympa Menu

freetds - Re: [freetds] How to have a better control on how the tds use the openssl?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddy77 AT gmail.com>
  • To: Rick Qing Xu <qinx AT microsoft.com>
  • Cc: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] How to have a better control on how the tds use the openssl?
  • Date: Fri, 21 Dec 2018 22:39:17 +0000

Hi Rick,
SSL 3.0 ?? I think was declared insecure time ago, some people are
disabling TLSv1.0 already.
New OpenSSL provide a "MinProtocol" setting. Similar property would be
good to have in libTDS too.
About callback can be done. I would add a parameter to specify the SSL
library kind (currently OpenSSL or GnuTLS). Which library are you
using? dblib, ctlib or odbc?

Frediano

Il giorno mar 18 dic 2018 alle ore 18:35 Rick Qing Xu
<qinx AT microsoft.com> ha scritto:
>
> The actual issue is:
>
> 1. I'd like to set the TLS version to SSL 3.0 or TLS 1.2 before the
> handshake, instead of let the system choose for me. Disabling TLS 1 will
> end up with two possibilities, TLS 1.1 and TLS 1.2. In my case, it has to
> be very specific, my client only wants to negotiate on TLS 1.1 or even
> SSLv3. It would be better if we can have a TLS version parameter in
> TDSLOGIN structure.
> 2. The tds lib doesn't give me chance to call SSL_set_tlsext_host_name and
> SSL_set_tlsext_status_type before the TLS handshake happens. If it can
> provide a call back mechanism, e.g., call just before it start the
> handshake, it would be helpful.
>
> -----Original Message-----
> From: Frediano Ziglio <freddy77 AT gmail.com>
> Sent: Tuesday, December 18, 2018 10:19 AM
> To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
> Cc: Rick Qing Xu <qinx AT microsoft.com>
> Subject: Re: [freetds] How to have a better control on how the tds use the
> openssl?
>
> Il giorno sab 15 dic 2018 alle ore 09:36 Rick Qing Xu via FreeTDS
> <freetds AT lists.ibiblio.org> ha scritto:
> >
> > Hi FreeTDS team,
> >
> > I am new to the TDS community and hi to everyone. I am working on a
> > project doing in-depth detection on encryption characteristics on SQL TDS
> > protocol. For example, by only talking to the server thru network on TDS
> > protocol, I want to detect which TLS versions the server supports, what
> > cipher suites are supported and what the order of it. In that case, I
> > need to have more fine control of which TLS version is going to be used.
> >
> > Usually I need to call SSL_CTX_set_verify before the handshake starts to
> > trust all kinds of server certificate. In addition, I'd like to use
> > SSL_set_tlsext_host_name to control whether to use Server Name Indication
> > extension in the handshake. Another example is I want to call
> > SSL_set_tlsext_status_type before the handshake to ask server to send
> > back an OCSP status response to me.
> >
> > After reading the tls.c in tds project, the tds_init_openssl()
> > function<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeTDS%2Ffreetds%2Fblob%2F513ed1a7dd5ed3be866407a2ef50d8dea3664943%2Fsrc%2Ftds%2Ftls.c%23L729&amp;data=02%7C01%7Cqinx%40microsoft.com%7C1d5c081f274643a3870708d665155aea%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636807539737754130&amp;sdata=3PuL8ARN7ad%2Bprqoc8chfIIMRhCveB%2BwH7q5Zy1MfXQ%3D&amp;reserved=0>
> > actually hardcoded the TLS method to be TLS_client_method, which is the
> > general-purpose version-flexible SSL/TLS methods. The actual protocol
> > version used will be negotiated to the highest version mutually supported
> > by the client and the server. The supported protocols are TLSv1, TLSv1.1
> > and TLSv1.2.
> >
> > I can see that now I can control what cipher get used by setting the
> > tds->login->openssl_ciphers to whatever I need to achieve the cipher
> > suite ask.
> >
> > Can you give me advice on how to do it in existing code? If not in
> > existing code, I am very happy to write some code to implement that in
> > tds project.
> >
> > Thanks!
> >
> > Rick Qing Xu
> >
> > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> > ub.com%2Fqinxgit&amp;data=02%7C01%7Cqinx%40microsoft.com%7C1d5c081f274
> > 643a3870708d665155aea%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636
> > 807539737754130&amp;sdata=EXWK4pfPIZMEa3tw8vQUiwPirpvAjxOGq8m0qG45gwg%
> > 3D&amp;reserved=0
> >
>
> Hi,
> I think you got everything right. You can set openssl_ciphers through the
> "openssl ciphers" settings. In master there's an option to disable TLSv1
> (which for compatibility by default is enabled).
> It would be great to have same settings for GnuTLS/OpenSSL (the "openssl
> ciphers" is only available with OpenSSL).
>
> Frediano




Archive powered by MHonArc 2.6.24.

Top of Page