FreeTDS Development Group

[Plot Lost <plot.lost AT gmail.com>]

On Thu, Oct 7, 2010 at 9:17 AM, Ryan Lavelle <rylavelle AT gmail.com> wrote:

>
>
> Ok I recompiled with Gnutls, and now I see something about SSL-Self Signed
> fallback in the tcp dump, is that because the server does not have an SSL
> certificate? Because I can still see some plain-text unencrypted chars in
> the tcp dump.
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>
> If the server does not have it's own certificate, then it will
auto-generate a self signed one. This is fine for use with things like
FreeTDS, only clients that do strict certificate checking will complain.

Sounds like FreeTDS is not actually seing your encryption=required setting.
It notices that the server supports encryption so will use that during the
login phase, but once that is complete it reverts back to clear text.

As a quick hack to prove this one way or the other, you could add the
following to the login.c file (in src/tds) in the tds8_do_login function

connection->encryption_level=TDS_ENCRYPTION_REQUIRE;

This should go before it actually builds the pre-login packet, so maybe just
after the line that has

tds->out_flag = TDS8_PRELOGIN;

What this will do is force FreeTDS to think that encryption=require has been
set (as for some reason it is not seeing it at the moment). A side effect of
this will be though that you can never then use FreeTDS to connect to a
server that does not support encryption, which is why I mention this just as
a 'quick-hack' type test. (dependant on TDS version being used to connect
actually supporting encryption)