FreeTDS Development Group

[Rick Qing Xu <qinx AT microsoft.com>]

Yes. We want to detect which one supports bad protocols so we can ask people 
to stop using them. So we want to specify which protocol to use instead of 
having the system to choose for us.

I am not actually using dblib, ctlib and odbc. I am using libtds directly. 

Do you think we can add some TLS protocol parameter somewhere?

-----Original Message-----
Hi Rick,
  SSL 3.0 ?? I think was declared insecure time ago, some people are
disabling TLSv1.0 already.
New OpenSSL provide a "MinProtocol" setting. Similar property would be
good to have in libTDS too.
About callback can be done. I would add a parameter to specify the SSL
library kind (currently OpenSSL or GnuTLS). Which library are you
using? dblib, ctlib or odbc?

Frediano
-----Original Message-----
From: FreeTDS <freetds-bounces AT lists.ibiblio.org> On Behalf Of Rick Qing Xu 
via FreeTDS
Sent: Tuesday, December 18, 2018 10:35 AM
To: Frediano Ziglio <freddy77 AT gmail.com>; FreeTDS Development Group 
<freetds AT lists.ibiblio.org>
Cc: Rick Qing Xu <qinx AT microsoft.com>
Subject: Re: [freetds] How to have a better control on how the tds use the 
openssl?

The actual issue is:

1. I'd like to set the TLS version to SSL 3.0 or TLS 1.2 before the 
handshake, instead of let the system choose for me. Disabling TLS 1 will end 
up with two possibilities, TLS 1.1 and TLS 1.2. In my case, it has to be very 
specific, my client only wants to negotiate on TLS 1.1 or even SSLv3. It 
would be better if we can have a TLS version parameter in TDSLOGIN structure.
2. The tds lib doesn't give me chance to call SSL_set_tlsext_host_name and 
SSL_set_tlsext_status_type before the TLS handshake happens. If it can 
provide a call back mechanism, e.g., call just before it start the handshake, 
it would be helpful.

-----Original Message-----
From: Frediano Ziglio <freddy77 AT gmail.com> 
Sent: Tuesday, December 18, 2018 10:19 AM
To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
Cc: Rick Qing Xu <qinx AT microsoft.com>
Subject: Re: [freetds] How to have a better control on how the tds use the 
openssl?

Il giorno sab 15 dic 2018 alle ore 09:36 Rick Qing Xu via FreeTDS 
<freetds AT lists.ibiblio.org> ha scritto:
>
> Hi FreeTDS team,
>
> I am new to the TDS community and hi to everyone. I am working on a project 
> doing in-depth detection on encryption characteristics on SQL TDS protocol. 
> For example, by only talking to the server thru network on TDS protocol, I 
> want to detect which TLS versions the server supports, what cipher suites 
> are supported and what the order of it. In that case, I need to have more 
> fine control of which TLS version is going to be used.
>
> Usually I need to call SSL_CTX_set_verify before the handshake starts to 
> trust all kinds of server certificate. In addition, I'd like to use 
> SSL_set_tlsext_host_name to control whether to use Server Name Indication 
> extension in the handshake. Another example is I want to call 
> SSL_set_tlsext_status_type before the handshake to ask server to send back 
> an OCSP status response to me.
>
> After reading the tls.c in tds project, the tds_init_openssl() 
> function<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeTDS%2Ffreetds%2Fblob%2F513ed1a7dd5ed3be866407a2ef50d8dea3664943%2Fsrc%2Ftds%2Ftls.c%23L729&amp;data=02%7C01%7Cqinx%40microsoft.com%7C7238c81c58af448af4a008d66545b580%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636807747412319244&amp;sdata=pua151nd5G1yvTGjUr6MDrUUI2Mo5Fd4aUKGcdoCprE%3D&amp;reserved=0>
>  actually hardcoded the TLS method to be TLS_client_method, which is the 
> general-purpose version-flexible SSL/TLS methods. The actual protocol 
> version used will be negotiated to the highest version mutually supported 
> by the client and the server. The supported protocols are TLSv1, TLSv1.1 
> and TLSv1.2.
>
> I can see that now I can control what cipher get used by setting the 
> tds->login->openssl_ciphers to whatever I need to achieve the cipher suite 
> ask.
>
> Can you give me advice on how to do it in existing code? If not in existing 
> code, I am very happy to write some code to implement that in tds project.
>
> Thanks!
>
> Rick Qing Xu
>
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> ub.com%2Fqinxgit&amp;data=02%7C01%7Cqinx%40microsoft.com%7C1d5c081f274
> 643a3870708d665155aea%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636
> 807539737754130&amp;sdata=EXWK4pfPIZMEa3tw8vQUiwPirpvAjxOGq8m0qG45gwg%
> 3D&amp;reserved=0
>

Hi,
  I think you got everything right. You can set openssl_ciphers through the 
"openssl ciphers" settings. In master there's an option to disable TLSv1 
(which for compatibility by default is enabled).
It would be great to have same settings for GnuTLS/OpenSSL (the "openssl 
ciphers" is only available with OpenSSL).

Frediano
_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ibiblio.org%2Fmailman%2Flistinfo%2Ffreetds&amp;data=02%7C01%7Cqinx%40microsoft.com%7C7238c81c58af448af4a008d66545b580%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636807747412319244&amp;sdata=QRlNBxApz7wk3Y4y0oTBzJHa1mcFjhoDqqNLe%2F%2Fq2Xc%3D&amp;reserved=0