Re: force security by sql server

Frediano Ziglio wrote:
> 2009/9/17 Pawel <[email protected]>:
>   
>> Hi,
>> regarding to my last post:
>>
>> Is it possible to make a connection to sql 2000 that uses "force
>> secucirty" ?
>>
>> My tsql result :
>> Msg 20003, Level 6, State -1, Server OpenClient, Line -1
>> Adaptive Server connection timed out
>>
>> And  debug log:
>> ....
>> (net.c:1011):before read
>> (util.c:334):tdserror(0xbeab4342c0, 0xbeab434520, 20003, 2)
>> (util.c:368):tdserror: client library returned TDS_INT_CANCEL(2)
>> (util.c:389):tdserror: returning TDS_INT_CANCEL(2)
>> (util.c:162):Changed query state from IDLE to DEAD
>> (net.c:1050):GNUTLS: level 7:
>> ..
>>
>>
>> connection with sql 2008 that force encryption works correctly
>>
>> Thanks
>> Pawel Z
>>
>>     
>
> So are you saying that sql 2008 works while sql 2000 not ??
> Did you install certificate on server?
>
> freddy77
> _______________________________________________
>   
Yes I did
For tests  - I install sql 2008 and 2000 on the same machine ....  2008 
works , 2000 not - both must use the same certificate . Additionally I 
chack that server sends certifiacate to client  (on tcp level)
Test on another machine confirms that my freetds is not able to connect 
to sql 2000
FreeTds was compiled on 2 independent systems with different version of 
libs (gentoo and ubuntu)
"encryption = request" &   "encryption = required" do not change anything

my freetds config:

[test]
    host = 192.168.0.2
    port = 1433
    client charset = UTF8
    debug flags = 0xffff
    dump file = /tmp/freetds.log
    #encryption = request
    #encryption = required
    timeout = 100
    connect timeout = 30
    tds version = 8.0

my compilation options:
./configure --prefix=/usr/local/freetds    -enable-msdblib --with-gnutls

There is 19 packet in transmission  between  sql and  freetds.
Server sends packet nr 18:  after that client waits until timeout and 
close connection (packet nr 19)...
I'm not expert of binary data exchanged between server and client...

tail of my freetds logs:
14:54:16.888381 5012 (net.c:786):Sending packet
0000 12 01 00 46 00 00 00 00-2c c4 13 10 ca 6e 8e 98 |...F.... ,....n..|
0010 74 62 da 19 a9 80 b8 79-33 04 9a 14 03 01 00 01 |tb.....y 3.......|
0020 01 16 03 01 00 20 0b a4-23 12 6e 82 da a0 fc c2 |..... .. #.n.....|
0030 f8 60 16 f3 a0 b3 6d 1b-5d f7 f0 e4 d0 35 19 a9 |.`....m. ]....5..|
0040 88 36 8f a6 9e 15      -                        |.6....|

14:54:16.888444 5012 (net.c:1303):have 0
14:54:16.888456 5012 (net.c:1307):before read
14:54:46.917316 5012 (util.c:336):tdserror(0x1e60134be00, 0x1e60134c060, 
20003, 2)
14:54:46.917447 5012 (util.c:366):tdserror: client library returned 
TDS_INT_CANCEL(2)
14:54:46.917463 5012 (util.c:395):tdserror: returning TDS_INT_CANCEL(2)
14:54:46.917492 5012 (util.c:162):Changed query state from IDLE to DEAD
14:54:46.917509 5012 (net.c:1348):GNUTLS: level 7:
  READ: -1 returned from 20234336, errno=2 gerrno=0
14:54:46.917521 5012 (net.c:1348):GNUTLS: level 2:
  ASSERT: gnutls_buffers.c:368
14:54:46.917540 5012 (net.c:1348):GNUTLS: level 2:
  ASSERT: gnutls_buffers.c:623
14:54:46.917551 5012 (net.c:1348):GNUTLS: level 2:
  ASSERT: gnutls_record.c:909
14:54:46.917561 5012 (net.c:1348):GNUTLS: level 2:
  ASSERT: gnutls_handshake.c:2525
14:54:46.917600 5012 (net.c:1348):GNUTLS: level 2:
  ASSERT: gnutls_handshake.c:2697
14:54:46.917624 5012 (net.c:1348):GNUTLS: level 6:
  BUF[HSK]: Cleared Data from buffer
14:54:46.917688 5012 (net.c:1453):handshake failed: A TLS packet with 
unexpected length was received.
14:54:46.917704 5012 (login.c:470):login packet rejected
14:54:46.917714 5012 (util.c:336):tdserror(0x1e60134be00, 0x1e60134c060, 
20002, 0)
14:54:46.917782 5012 (util.c:366):tdserror: client library returned 
TDS_INT_CANCEL(2)
14:54:46.917796 5012 (util.c:395):tdserror: returning TDS_INT_CANCEL(2)
14:54:46.917806 5012 (mem.c:603):tds_free_all_results()



When I use sql 2008 there is 20 packets that makes connection (packet nr 
21 is a first keep alive )

It is a bug in freeTds ?
Or I do something wrong way...
maybe I need  appropriate version of gnutls ?

Thanks
Pawel Z