FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

2016-09-16 16:02 GMT+01:00 Ramiro Morales <cramm0 AT gmail.com>:
> On Fri, Sep 16, 2016 at 11:54 AM, Scott Morken <
> scott.morken AT phoenixcollege.edu> wrote:
>
>> I've recently (around the first part of August) starting getting random "
>> SQLSTATE[01002] Adaptive Server connection failed" errors from FreeTDS.  It
>> seems to be related to the TLS handshake.  It doesn't happen every time...
>> it took me about 45 minutes of clicking around to get the attached failure
>> log but the next time only took a couple of minutes to get another.  It
>> happens from multiple Ubuntu 14.04.5 LTS servers connecting to the same MS
>> SQL Server.  These are mostly PHP web apps but Python also has the same
>> issue - naturally since it's the same backend library :)
>>
>> MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1
>>
>> The error on SQL Server isn't super helpful but it gave me a starting point
>> to look into the TLS connection:
>> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event";>
>> <System>
>> <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
>> <EventID>36888</EventID>
>> <Version>0</Version>
>> <Level>2</Level>
>> <Task>0</Task>
>> <Opcode>0</Opcode>
>> <Keywords>0x8000000000000000</Keywords>
>> <TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
>> <EventRecordID>81739</EventRecordID>
>> <Correlation />
>> <Execution ProcessID="524" ThreadID="2464" />
>> <Channel>System</Channel>
>> <Computer>xxxx</Computer>
>> <Security UserID="xxxx" />
>> </System>
>> <EventData>
>> <Data Name="AlertDesc">20</Data>
>> <Data Name="ErrorState">960</Data>
>> </EventData>
>> </Event>
>>
>> I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
>> gnutls26 is installed (2.12.23-12ubuntu2.5)
>> freetds 0.91-5
>>
>> I'm at a loss as to what would cause these errors.  I've spent a lot of
>> time searching for an answer but haven't found anything that really fits.
>> Our server admins tried uninstalling the Microsoft TLS 1.2 patch that
>> apparently broke a few things but that didn't help:
>> http://www.infoworld.com/article/2848574/operating-
>> systems/microsoft-botches-kb-2992611-schannel-patch-tls-
>> alert-code-40-slow-sql-server-block-iis-sites.html
>>
>> I've tried encryption = off but it seems it still tries to negotiate it and
>> fails.
>>
>> I've attached a log of the debug output from freeTDS for a failure and a
>> success.  Any thoughts or obvious things I've missed would be greatly
>> appreciated.  I've run out of ideas.
>>
>> Scott,
>
> Take a look at the FreeTDS GitHub repo commit history for the master branch
> and for the 1.0.x  maintenance branch for the last month or so and verify
> if it could be related.
>
> It might be your copy of FreeTDS is too old.
>
> Regards,
>
> --
> Ramiro Morales
> @ramiromorales

I confirmed what Ramiro said.
Unfortunately we seem we should try to push some new version to Debian.
We don't release very often but 0.91 is 2 main release ago that is years ago,
many changes were introduced since.
We try very hard to maintain ABI so you should have not much issues
updating from sources.
We are a really small group nowadays and we cannot effort to maintain much
old releases (actually we maintain the last). A very recent patch was 
introduced
to fix a problem with OpenSSL but probably 0.91 contains some old setting even
using GnuTLS (from https://packages.debian.org/jessie/freetds-bin or Ubuntu
package you can see GnuTLS is used).

Frediano