FreeTDS Development Group

[Scott Morken <scott.morken AT phoenixcollege.edu>]

It looks like this *mostly* worked.  I've had one schannel error in the
last two days.  Considerably better than the dozens I was getting before.
Not perfect, but much much better.  For the record, and for anyone else who
might need to build this bailing wire and duct tape fix, here are the steps
I took to make this work:

Install build packages:

$ sudo apt-get install build-essential dpatch fakeroot devscripts equivs
lintian quilt

Add/replace the deb src for main restricted to use Xenial’s repo in
/etc/apt/sources.list - this gets you the latest 0.91-6.1build1 which has
the *almost* necessary patches in place to work.

Mine went from:

deb-src http://us.archive.ubuntu.com/ubuntu/ trust main restricted

To

deb-src http://us.archive.ubuntu.com/ubuntu/ xenial main restricted

Update package list

$ apt-get update

Make a work dir

$ mkdir ~/src

Install the source

$ apt-get source freetds

$ cd /freetds-0.91

Get build deps

$ sudo mk-build-deps -i -r freetds

Modify the src/tds/net.c for the allowed cipher suite (remove SSLV3)

--------------------------------------------------------------------------------------------------

@@ -1322,7 +1322,7 @@

/* ... but overwrite some */

ret = gnutls_priority_set_direct (session,

- "NORMAL:%COMPAT", NULL);

+ "NORMAL:%COMPAT:-VERS-SSL3.0", NULL);

/* mssql does not like padding too much */

#ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
--------------------------------------------------------------------------------------------------

Build it

$ fakeroot debian/rules binary

Install dependencies

libgnutls28 odbcinst1debian2 libodbc1 unixodbc

Install all the pieces

$ sudo dpkg -i ../libct4_0.91-6.1build1_amd64.deb

$ sudo dpkg -i ../libsybdb5_0.91-6.1build1_amd64.deb

$ sudo dpkg -i ../tdsodbc_0.91-6.1build1_amd64.deb

$ sudo dpkg -i ../freetds-common_0.91-6.1build1_all.deb

$ sudo dpkg -i ../freetds-bin_0.91-6.1build1_amd64.deb


On Fri, Sep 16, 2016 at 8:44 AM, Frediano Ziglio <freddy77 AT gmail.com> wrote:

> 2016-09-16 16:28 GMT+01:00 Scott Morken <scott.morken AT phoenixcollege.edu>:
> > I think you guys are correct.  I looked at the updated cipher list and it
> > looks like the one that is getting picked is in the removed list.  Since
> I'm
> > sure our server admins won't want to install freetds from source on
> multiple
> > servers, is there a way to pass an allowed cipher list/suite to freetds?
> > Either through the config or environment?  If I could find a workable
> one, I
> > could probably limp along until we get to a new version... Although
> 16.04LTS
> > is still 0.91-6.1build1.  Not very up to date :(
> >
>
> Looks like they (Debian and Ubuntu) has a patch for the ciphers, that is
>
> @@ -1280,25 +1282,6 @@
>  {
>         gnutls_session session;
>         gnutls_certificate_credentials xcred;
> -
> -       static const int kx_priority[] = {
> -               GNUTLS_KX_RSA_EXPORT,
> -               GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA,
> -               0
> -       };
> -       static const int cipher_priority[] = {
> -               GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
> -               GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128,
> -#if 0
> -               GNUTLS_CIPHER_ARCFOUR_40,
> -               GNUTLS_CIPHER_DES_CBC,
> -#endif
> -               0
> -       };
> -       static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 };
> -       static const int mac_priority[] = {
> -               GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0
> -       };
>         int ret;
>         const char *tls_msg;
>
> @@ -1338,10 +1321,9 @@
>                 gnutls_set_default_priority(session);
>
>                 /* ... but overwrite some */
> -               gnutls_cipher_set_priority(session, cipher_priority);
> -               gnutls_compression_set_priority(session, comp_priority);
> -               gnutls_kx_set_priority(session, kx_priority);
> -               gnutls_mac_set_priority(session, mac_priority);
> +               ret = gnutls_priority_set_direct (session,
> +                               "NORMAL:%COMPAT", NULL);
> +
>                 /* mssql does not like padding too much */
>  #ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
>                 gnutls_record_disable_padding(session);
>
> Our current string is "NORMAL:%COMPAT:-VERS-SSL3.0".
> But these strings are by the way encoded inside the binaries so they
> require recompiling
> from sources. You could try downloading the Ubuntu sources and replace
> that string.
> If you looks on internet "rebuild debian packages" you can found lot
> of easy documents.
> If you are able to verify that changing that string is enough you
> should then open a bug to
> Ubuntu to get official packages.
> Another way would be to build your own personal repository which could
> be used in
> the future for events like this.
>
> Frediano
>
>
>
> > On Fri, Sep 16, 2016 at 8:23 AM, Frediano Ziglio <freddy77 AT gmail.com>
> wrote:
> >>
> >> 2016-09-16 16:02 GMT+01:00 Ramiro Morales <cramm0 AT gmail.com>:
> >> > On Fri, Sep 16, 2016 at 11:54 AM, Scott Morken <
> >> > scott.morken AT phoenixcollege.edu> wrote:
> >> >
> >> >> I've recently (around the first part of August) starting getting
> random
> >> >> "
> >> >> SQLSTATE[01002] Adaptive Server connection failed" errors from
> FreeTDS.
> >> >> It
> >> >> seems to be related to the TLS handshake.  It doesn't happen every
> >> >> time...
> >> >> it took me about 45 minutes of clicking around to get the attached
> >> >> failure
> >> >> log but the next time only took a couple of minutes to get another.
> It
> >> >> happens from multiple Ubuntu 14.04.5 LTS servers connecting to the
> same
> >> >> MS
> >> >> SQL Server.  These are mostly PHP web apps but Python also has the
> same
> >> >> issue - naturally since it's the same backend library :)
> >> >>
> >> >> MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1
> >> >>
> >> >> The error on SQL Server isn't super helpful but it gave me a starting
> >> >> point
> >> >> to look into the TLS connection:
> >> >> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event
> ">
> >> >> <System>
> >> >> <Provider Name="Schannel" Guid="{1F678132-5938-4686-
> 9FDC-C8FF68F15C85}"
> >> >> />
> >> >> <EventID>36888</EventID>
> >> >> <Version>0</Version>
> >> >> <Level>2</Level>
> >> >> <Task>0</Task>
> >> >> <Opcode>0</Opcode>
> >> >> <Keywords>0x8000000000000000</Keywords>
> >> >> <TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
> >> >> <EventRecordID>81739</EventRecordID>
> >> >> <Correlation />
> >> >> <Execution ProcessID="524" ThreadID="2464" />
> >> >> <Channel>System</Channel>
> >> >> <Computer>xxxx</Computer>
> >> >> <Security UserID="xxxx" />
> >> >> </System>
> >> >> <EventData>
> >> >> <Data Name="AlertDesc">20</Data>
> >> >> <Data Name="ErrorState">960</Data>
> >> >> </EventData>
> >> >> </Event>
> >> >>
> >> >> I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
> >> >> gnutls26 is installed (2.12.23-12ubuntu2.5)
> >> >> freetds 0.91-5
> >> >>
> >> >> I'm at a loss as to what would cause these errors.  I've spent a lot
> of
> >> >> time searching for an answer but haven't found anything that really
> >> >> fits.
> >> >> Our server admins tried uninstalling the Microsoft TLS 1.2 patch that
> >> >> apparently broke a few things but that didn't help:
> >> >> http://www.infoworld.com/article/2848574/operating-
> >> >> systems/microsoft-botches-kb-2992611-schannel-patch-tls-
> >> >> alert-code-40-slow-sql-server-block-iis-sites.html
> >> >>
> >> >> I've tried encryption = off but it seems it still tries to negotiate
> it
> >> >> and
> >> >> fails.
> >> >>
> >> >> I've attached a log of the debug output from freeTDS for a failure
> and
> >> >> a
> >> >> success.  Any thoughts or obvious things I've missed would be greatly
> >> >> appreciated.  I've run out of ideas.
> >> >>
> >> >> Scott,
> >> >
> >> > Take a look at the FreeTDS GitHub repo commit history for the master
> >> > branch
> >> > and for the 1.0.x  maintenance branch for the last month or so and
> >> > verify
> >> > if it could be related.
> >> >
> >> > It might be your copy of FreeTDS is too old.
> >> >
> >> > Regards,
> >> >
> >> > --
> >> > Ramiro Morales
> >> > @ramiromorales
> >>
> >> I confirmed what Ramiro said.
> >> Unfortunately we seem we should try to push some new version to Debian.
> >> We don't release very often but 0.91 is 2 main release ago that is years
> >> ago,
> >> many changes were introduced since.
> >> We try very hard to maintain ABI so you should have not much issues
> >> updating from sources.
> >> We are a really small group nowadays and we cannot effort to maintain
> much
> >> old releases (actually we maintain the last). A very recent patch was
> >> introduced
> >> to fix a problem with OpenSSL but probably 0.91 contains some old
> setting
> >> even
> >> using GnuTLS (from https://packages.debian.org/jessie/freetds-bin or
> >> Ubuntu
> >> package you can see GnuTLS is used).
> >>
> >> Frediano
> >
> >
> >
> >
> > --
> > Scott Morken
> > Programmer
> > Phoenix College - Information Technology
> > 602.285.7554
> > scott.morken AT phoenixcollege.edu
>



-- 
*Scott Morken*
Programmer
Phoenix College <http://www.phoenixcollege.edu> - Information Technology
602.285.7554
scott.morken AT phoenixcollege.edu