[freetds] intermittent TLS packet with unexpected length error

Scott Morken scott.morken at phoenixcollege.edu
Fri Sep 16 10:54:15 EDT 2016


I've recently (around the first part of August) starting getting random "
SQLSTATE[01002] Adaptive Server connection failed" errors from FreeTDS.  It
seems to be related to the TLS handshake.  It doesn't happen every time...
it took me about 45 minutes of clicking around to get the attached failure
log but the next time only took a couple of minutes to get another.  It
happens from multiple Ubuntu 14.04.5 LTS servers connecting to the same MS
SQL Server.  These are mostly PHP web apps but Python also has the same
issue - naturally since it's the same backend library :)

MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1

The error on SQL Server isn't super helpful but it gave me a starting point
to look into the TLS connection:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
<EventID>36888</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
<EventRecordID>81739</EventRecordID>
<Correlation />
<Execution ProcessID="524" ThreadID="2464" />
<Channel>System</Channel>
<Computer>xxxx</Computer>
<Security UserID="xxxx" />
</System>
<EventData>
<Data Name="AlertDesc">20</Data>
<Data Name="ErrorState">960</Data>
</EventData>
</Event>

I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
gnutls26 is installed (2.12.23-12ubuntu2.5)
freetds 0.91-5

I'm at a loss as to what would cause these errors.  I've spent a lot of
time searching for an answer but haven't found anything that really fits.
Our server admins tried uninstalling the Microsoft TLS 1.2 patch that
apparently broke a few things but that didn't help:
http://www.infoworld.com/article/2848574/operating-systems/microsoft-botches-kb-2992611-schannel-patch-tls-alert-code-40-slow-sql-server-block-iis-sites.html

I've tried encryption = off but it seems it still tries to negotiate it and
fails.

I've attached a log of the debug output from freeTDS for a failure and a
success.  Any thoughts or obvious things I've missed would be greatly
appreciated.  I've run out of ideas.

Scott
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freetds_failure.log
Type: text/x-log
Size: 29812 bytes
Desc: not available
URL: <http://lists.ibiblio.org/pipermail/freetds/attachments/20160916/5ef81bb7/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freetds_success.log
Type: text/x-log
Size: 31078 bytes
Desc: not available
URL: <http://lists.ibiblio.org/pipermail/freetds/attachments/20160916/5ef81bb7/attachment-0003.bin>


More information about the FreeTDS mailing list