FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

2016-09-16 16:28 GMT+01:00 Scott Morken <scott.morken AT phoenixcollege.edu>:
> I think you guys are correct.  I looked at the updated cipher list and it
> looks like the one that is getting picked is in the removed list.  Since I'm
> sure our server admins won't want to install freetds from source on multiple
> servers, is there a way to pass an allowed cipher list/suite to freetds?
> Either through the config or environment?  If I could find a workable one, I
> could probably limp along until we get to a new version... Although 16.04LTS
> is still 0.91-6.1build1.  Not very up to date :(
>

Looks like they (Debian and Ubuntu) has a patch for the ciphers, that is

@@ -1280,25 +1282,6 @@
 {
        gnutls_session session;
        gnutls_certificate_credentials xcred;
-
-       static const int kx_priority[] = {
-               GNUTLS_KX_RSA_EXPORT,
-               GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA,
-               0
-       };
-       static const int cipher_priority[] = {
-               GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
-               GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128,
-#if 0
-               GNUTLS_CIPHER_ARCFOUR_40,
-               GNUTLS_CIPHER_DES_CBC,
-#endif
-               0
-       };
-       static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 };
-       static const int mac_priority[] = {
-               GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0
-       };
        int ret;
        const char *tls_msg;

@@ -1338,10 +1321,9 @@
                gnutls_set_default_priority(session);

                /* ... but overwrite some */
-               gnutls_cipher_set_priority(session, cipher_priority);
-               gnutls_compression_set_priority(session, comp_priority);
-               gnutls_kx_set_priority(session, kx_priority);
-               gnutls_mac_set_priority(session, mac_priority);
+               ret = gnutls_priority_set_direct (session,
+                               "NORMAL:%COMPAT", NULL);
+
                /* mssql does not like padding too much */
 #ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
                gnutls_record_disable_padding(session);

Our current string is "NORMAL:%COMPAT:-VERS-SSL3.0".
But these strings are by the way encoded inside the binaries so they
require recompiling
from sources. You could try downloading the Ubuntu sources and replace
that string.
If you looks on internet "rebuild debian packages" you can found lot
of easy documents.
If you are able to verify that changing that string is enough you
should then open a bug to
Ubuntu to get official packages.
Another way would be to build your own personal repository which could
be used in
the future for events like this.

Frediano



> On Fri, Sep 16, 2016 at 8:23 AM, Frediano Ziglio <freddy77 AT gmail.com> wrote:
>>
>> 2016-09-16 16:02 GMT+01:00 Ramiro Morales <cramm0 AT gmail.com>:
>> > On Fri, Sep 16, 2016 at 11:54 AM, Scott Morken <
>> > scott.morken AT phoenixcollege.edu> wrote:
>> >
>> >> I've recently (around the first part of August) starting getting random
>> >> "
>> >> SQLSTATE[01002] Adaptive Server connection failed" errors from FreeTDS.
>> >> It
>> >> seems to be related to the TLS handshake.  It doesn't happen every
>> >> time...
>> >> it took me about 45 minutes of clicking around to get the attached
>> >> failure
>> >> log but the next time only took a couple of minutes to get another.  It
>> >> happens from multiple Ubuntu 14.04.5 LTS servers connecting to the same
>> >> MS
>> >> SQL Server.  These are mostly PHP web apps but Python also has the same
>> >> issue - naturally since it's the same backend library :)
>> >>
>> >> MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1
>> >>
>> >> The error on SQL Server isn't super helpful but it gave me a starting
>> >> point
>> >> to look into the TLS connection:
>> >> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event";>
>> >> <System>
>> >> <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}"
>> >> />
>> >> <EventID>36888</EventID>
>> >> <Version>0</Version>
>> >> <Level>2</Level>
>> >> <Task>0</Task>
>> >> <Opcode>0</Opcode>
>> >> <Keywords>0x8000000000000000</Keywords>
>> >> <TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
>> >> <EventRecordID>81739</EventRecordID>
>> >> <Correlation />
>> >> <Execution ProcessID="524" ThreadID="2464" />
>> >> <Channel>System</Channel>
>> >> <Computer>xxxx</Computer>
>> >> <Security UserID="xxxx" />
>> >> </System>
>> >> <EventData>
>> >> <Data Name="AlertDesc">20</Data>
>> >> <Data Name="ErrorState">960</Data>
>> >> </EventData>
>> >> </Event>
>> >>
>> >> I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
>> >> gnutls26 is installed (2.12.23-12ubuntu2.5)
>> >> freetds 0.91-5
>> >>
>> >> I'm at a loss as to what would cause these errors.  I've spent a lot of
>> >> time searching for an answer but haven't found anything that really
>> >> fits.
>> >> Our server admins tried uninstalling the Microsoft TLS 1.2 patch that
>> >> apparently broke a few things but that didn't help:
>> >> http://www.infoworld.com/article/2848574/operating-
>> >> systems/microsoft-botches-kb-2992611-schannel-patch-tls-
>> >> alert-code-40-slow-sql-server-block-iis-sites.html
>> >>
>> >> I've tried encryption = off but it seems it still tries to negotiate it
>> >> and
>> >> fails.
>> >>
>> >> I've attached a log of the debug output from freeTDS for a failure and
>> >> a
>> >> success.  Any thoughts or obvious things I've missed would be greatly
>> >> appreciated.  I've run out of ideas.
>> >>
>> >> Scott,
>> >
>> > Take a look at the FreeTDS GitHub repo commit history for the master
>> > branch
>> > and for the 1.0.x  maintenance branch for the last month or so and
>> > verify
>> > if it could be related.
>> >
>> > It might be your copy of FreeTDS is too old.
>> >
>> > Regards,
>> >
>> > --
>> > Ramiro Morales
>> > @ramiromorales
>>
>> I confirmed what Ramiro said.
>> Unfortunately we seem we should try to push some new version to Debian.
>> We don't release very often but 0.91 is 2 main release ago that is years
>> ago,
>> many changes were introduced since.
>> We try very hard to maintain ABI so you should have not much issues
>> updating from sources.
>> We are a really small group nowadays and we cannot effort to maintain much
>> old releases (actually we maintain the last). A very recent patch was
>> introduced
>> to fix a problem with OpenSSL but probably 0.91 contains some old setting
>> even
>> using GnuTLS (from https://packages.debian.org/jessie/freetds-bin or
>> Ubuntu
>> package you can see GnuTLS is used).
>>
>> Frediano
>
>
>
>
> --
> Scott Morken
> Programmer
> Phoenix College - Information Technology
> 602.285.7554
> scott.morken AT phoenixcollege.edu