FreeTDS Development Group

[Rick Qing Xu <qinx AT microsoft.com>]

Hi FreeTDS team,

I am new to the TDS community and hi to everyone. I am working on a project 
doing in-depth detection on encryption characteristics on SQL TDS protocol. 
For example, by only talking to the server thru network on TDS protocol, I 
want to detect which TLS versions the server supports, what cipher suites are 
supported and what the order of it. In that case, I need to have more fine 
control of which TLS version is going to be used.

Usually I need to call SSL_CTX_set_verify before the handshake starts to 
trust all kinds of server certificate. In addition, I'd like to use 
SSL_set_tlsext_host_name to control whether to use Server Name Indication 
extension in the handshake. Another example is I want to call 
SSL_set_tlsext_status_type before the handshake to ask server to send back an 
OCSP status response to me.

After reading the tls.c in tds project, the tds_init_openssl() 
function<https://github.com/FreeTDS/freetds/blob/513ed1a7dd5ed3be866407a2ef50d8dea3664943/src/tds/tls.c#L729>
 actually hardcoded the TLS method to be TLS_client_method, which is the 
general-purpose version-flexible SSL/TLS methods. The actual protocol version 
used will be negotiated to the highest version mutually supported by the 
client and the server. The supported protocols are TLSv1, TLSv1.1 and TLSv1.2.

I can see that now I can control what cipher get used by setting the 
tds->login->openssl_ciphers to whatever I need to achieve the cipher suite 
ask.

Can you give me advice on how to do it in existing code? If not in existing 
code, I am very happy to write some code to implement that in tds project.

Thanks!

Rick Qing Xu

https://github.com/qinxgit