FreeTDS Development Group

[Fredy Paquet <fredy AT opag.ch>]

Hello Igor

The FreeTDS user guide defines default encryption level is OFF:
(see http://www.freetds.org/userguide/freetdsconf.htm)

The config file parser initializes encryption_level to
TDS_ENCRYPTION_DEFAULT. If you do not set encryption in any section of
your freetds.conf, the encryption_level in the login struct remains at
TDS_ENCRYPTION_DEFAULT.

Today, the TDS 7.1 driver changes this value to TDS_ENCRYPTION_REQUEST,
which doesn't implement the documented behaviour. 

I do not know wether MSSQL can accept unencrypted requests (no test
system available).

If MSSQL cannot accept unencrypted connections, it may be ok to fallback
to TDS_ENCRYPTION_REQUEST for TDS 7.1. But this clearly must not affect
further trials on the lower protocol levels.

Agree, it would be good programming practise to introduce a #define for
the default encryption level.

fp

On Tue, 2017-07-04 at 10:37 -0400, Igor Korot wrote:
> Hi, Fredy,
> 
> On Tue, Jul 4, 2017 at 9:15 AM, Fredy Paquet <fredy AT opag.ch> wrote:
> > Hello Frediano
> >
> > Thank you for the fix of the encryption flag in the login packet.
> > (I will verify correct operation next saturday)
> >
> > What can we do about the fallback problem (see below) ?
> >
> > --- Proposal 1
> >
> > Change the statment to use TDS_ENCRYPTION_OFF:
> >
> >   if (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
> >     login->encryption_level = TDS_ENCRYPTION_OFF;
> >
> > Because default encryption level is defined as OFF.
> 
> What if the encryption becomes ON?
> How do you differentiate between them?
> 
> Maybe we need to introduce something like DEFAULT for the encryption
> the configuration file?
> 
> >
> > --- Proposal 2
> >
> > I propose using a temporary local variable  for the tds71-try,
> > instead of modifying an entry in the login record, which is being
> > used later for other protocol tries.
> >
> > in function tds71_do_login():
> >
> > TDS_TINYINT my_encryption_level
> >   = (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
> >     ? TDS_ENCRYPTION_REQUEST : login->encryption_level;
> >
> > then try with locally with my_encryption_level
> >
> > (this may be combined with Proposal 1)
> >
> > --- Proposal 3
> >
> > Drop the whole statement, because encryption_level should be controlled
> > by a freetds.conf setting. But on the other side, this might kill
> > working freetds.conf configurations.
> 
> Probably not a good idea.
> 
> Thank you.
> 
> >
> > What do you think about it ?
> >
> > fp
> >
> > On Wed, 2017-06-28 at 09:12 +0200, Fredy Paquet wrote:
> >>
> >> This is due to the fact that in login.c(Line 1128) in function
> >> tds71_do_login() the encryption level is set to REQUEST, but never
> >> reset
> >> again:
> >>
> >>         if (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
> >>                 login->encryption_level = TDS_ENCRYPTION_REQUEST;
> >>
> >> This could easily fixed by saving/restoring the encryption level, but
> >> i'm asking me whether if there are other modified fields not being
> >> restored properly. The protocol fallback loop is in login.c Line 404.
> >
> > --
> > Fredy Paquet
> > Mitglied der Geschäftsleitung
> > OPAG Informatik AG
> > Fabrikmattenweg 11
> > CH-4144 Arlesheim
> > http://www.opag.ch
> > Tel. ++41 61 716 92 22
> > Fax. ++41 61 716 92 29
> >
> > _______________________________________________
> > FreeTDS mailing list
> > FreeTDS AT lists.ibiblio.org
> > https://lists.ibiblio.org/mailman/listinfo/freetds
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> https://lists.ibiblio.org/mailman/listinfo/freetds

-- 
Fredy Paquet
Mitglied der Geschäftsleitung
OPAG Informatik AG
Fabrikmattenweg 11
CH-4144 Arlesheim
http://www.opag.ch
Tel. ++41 61 716 92 22
Fax. ++41 61 716 92 29