FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

Il giorno sab 15 dic 2018 alle ore 09:36 Rick Qing Xu via FreeTDS
<freetds AT lists.ibiblio.org> ha scritto:
>
> Hi FreeTDS team,
>
> I am new to the TDS community and hi to everyone. I am working on a project 
> doing in-depth detection on encryption characteristics on SQL TDS protocol. 
> For example, by only talking to the server thru network on TDS protocol, I 
> want to detect which TLS versions the server supports, what cipher suites 
> are supported and what the order of it. In that case, I need to have more 
> fine control of which TLS version is going to be used.
>
> Usually I need to call SSL_CTX_set_verify before the handshake starts to 
> trust all kinds of server certificate. In addition, I'd like to use 
> SSL_set_tlsext_host_name to control whether to use Server Name Indication 
> extension in the handshake. Another example is I want to call 
> SSL_set_tlsext_status_type before the handshake to ask server to send back 
> an OCSP status response to me.
>
> After reading the tls.c in tds project, the tds_init_openssl() 
> function<https://github.com/FreeTDS/freetds/blob/513ed1a7dd5ed3be866407a2ef50d8dea3664943/src/tds/tls.c#L729>
>  actually hardcoded the TLS method to be TLS_client_method, which is the 
> general-purpose version-flexible SSL/TLS methods. The actual protocol 
> version used will be negotiated to the highest version mutually supported 
> by the client and the server. The supported protocols are TLSv1, TLSv1.1 
> and TLSv1.2.
>
> I can see that now I can control what cipher get used by setting the 
> tds->login->openssl_ciphers to whatever I need to achieve the cipher suite 
> ask.
>
> Can you give me advice on how to do it in existing code? If not in existing 
> code, I am very happy to write some code to implement that in tds project.
>
> Thanks!
>
> Rick Qing Xu
>
> https://github.com/qinxgit
>

Hi,
  I think you got everything right. You can set openssl_ciphers
through the "openssl ciphers" settings. In master there's an option to
disable TLSv1 (which for compatibility by default is enabled).
It would be great to have same settings for GnuTLS/OpenSSL (the
"openssl ciphers" is only available with OpenSSL).

Frediano