FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

2017-07-04 14:15 GMT+01:00 Fredy Paquet <fredy AT opag.ch>:
> Hello Frediano
>
> Thank you for the fix of the encryption flag in the login packet.
> (I will verify correct operation next saturday)
>
> What can we do about the fallback problem (see below) ?
>
> --- Proposal 1
>
> Change the statment to use TDS_ENCRYPTION_OFF:
>
>   if (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
>     login->encryption_level = TDS_ENCRYPTION_OFF;
>
> Because default encryption level is defined as OFF.
>

In master is changed to request for MSSQL as MSSQL support encrypted login
by default since 2005 and recent version started forbidding not
encrypted logins.

> --- Proposal 2
>
> I propose using a temporary local variable  for the tds71-try,
> instead of modifying an entry in the login record, which is being
> used later for other protocol tries.
>
> in function tds71_do_login():
>
> TDS_TINYINT my_encryption_level
>   = (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
>     ? TDS_ENCRYPTION_REQUEST : login->encryption_level;
>
> then try with locally with my_encryption_level
>
> (this may be combined with Proposal 1)

Already done this change in master, login structure is not changed now.

>
> --- Proposal 3
>
> Drop the whole statement, because encryption_level should be controlled
> by a freetds.conf setting. But on the other side, this might kill
> working freetds.conf configurations.
>

Does not sound that great.

> What do you think about it ?
>
> fp
>
> On Wed, 2017-06-28 at 09:12 +0200, Fredy Paquet wrote:
>>
>> This is due to the fact that in login.c(Line 1128) in function
>> tds71_do_login() the encryption level is set to REQUEST, but never
>> reset
>> again:
>>
>>         if (login->encryption_level == TDS_ENCRYPTION_DEFAULT)
>>                 login->encryption_level = TDS_ENCRYPTION_REQUEST;
>>
>> This could easily fixed by saving/restoring the encryption level, but
>> i'm asking me whether if there are other modified fields not being
>> restored properly. The protocol fallback loop is in login.c Line 404.
>
> --
> Fredy Paquet
> Mitglied der Geschäftsleitung
> OPAG Informatik AG
> Fabrikmattenweg 11
> CH-4144 Arlesheim
> http://www.opag.ch
> Tel. ++41 61 716 92 22
> Fax. ++41 61 716 92 29
>