Re: force security by sql server

2009/9/18 Pawel <[email protected]>:
> Frediano Ziglio wrote:
>> 2009/9/17 Pawel <[email protected]>:
>>
>>> Hi,
>>> regarding to my last post:
>>>
>>> Is it possible to make a connection to sql 2000 that uses "force
>>> secucirty" ?
>>>
>>> My tsql result :
>>> Msg 20003, Level 6, State -1, Server OpenClient, Line -1
>>> Adaptive Server connection timed out
>>>
>>> And  debug log:
>>> ....
>>> (net.c:1011):before read
>>> (util.c:334):tdserror(0xbeab4342c0, 0xbeab434520, 20003, 2)
>>> (util.c:368):tdserror: client library returned TDS_INT_CANCEL(2)
>>> (util.c:389):tdserror: returning TDS_INT_CANCEL(2)
>>> (util.c:162):Changed query state from IDLE to DEAD
>>> (net.c:1050):GNUTLS: level 7:
>>> ..
>>>
>>>
>>> connection with sql 2008 that force encryption works correctly
>>>
>>> Thanks
>>> Pawel Z
>>>
>>>
>>
>> So are you saying that sql 2008 works while sql 2000 not ??
>> Did you install certificate on server?
>>
>> freddy77
>> _______________________________________________
>>
> Yes I did
> For tests  - I install sql 2008 and 2000 on the same machine ....  2008
> works , 2000 not - both must use the same certificate . Additionally I
> chack that server sends certifiacate to client  (on tcp level)
> Test on another machine confirms that my freetds is not able to connect
> to sql 2000
> FreeTds was compiled on 2 independent systems with different version of
> libs (gentoo and ubuntu)
> "encryption = request" &   "encryption = required" do not change anything
>
> my freetds config:
>
> [test]
>    host = 192.168.0.2
>    port = 1433
>    client charset = UTF8
>    debug flags = 0xffff
>    dump file = /tmp/freetds.log
>    #encryption = request
>    #encryption = required
>    timeout = 100
>    connect timeout = 30
>    tds version = 8.0
>
> my compilation options:
> ./configure --prefix=/usr/local/freetds    -enable-msdblib --with-gnutls
>
> There is 19 packet in transmission  between  sql and  freetds.
> Server sends packet nr 18:  after that client waits until timeout and
> close connection (packet nr 19)...
> I'm not expert of binary data exchanged between server and client...
>
> tail of my freetds logs:
> 14:54:16.888381 5012 (net.c:786):Sending packet
> 0000 12 01 00 46 00 00 00 00-2c c4 13 10 ca 6e 8e 98 |...F.... ,....n..|
> 0010 74 62 da 19 a9 80 b8 79-33 04 9a 14 03 01 00 01 |tb.....y 3.......|
> 0020 01 16 03 01 00 20 0b a4-23 12 6e 82 da a0 fc c2 |..... .. #.n.....|
> 0030 f8 60 16 f3 a0 b3 6d 1b-5d f7 f0 e4 d0 35 19 a9 |.`....m. ]....5..|
> 0040 88 36 8f a6 9e 15      -                        |.6....|
>
> 14:54:16.888444 5012 (net.c:1303):have 0
> 14:54:16.888456 5012 (net.c:1307):before read
> 14:54:46.917316 5012 (util.c:336):tdserror(0x1e60134be00, 0x1e60134c060,
> 20003, 2)
> 14:54:46.917447 5012 (util.c:366):tdserror: client library returned
> TDS_INT_CANCEL(2)
> 14:54:46.917463 5012 (util.c:395):tdserror: returning TDS_INT_CANCEL(2)
> 14:54:46.917492 5012 (util.c:162):Changed query state from IDLE to DEAD
> 14:54:46.917509 5012 (net.c:1348):GNUTLS: level 7:
>  READ: -1 returned from 20234336, errno=2 gerrno=0
> 14:54:46.917521 5012 (net.c:1348):GNUTLS: level 2:
>  ASSERT: gnutls_buffers.c:368
> 14:54:46.917540 5012 (net.c:1348):GNUTLS: level 2:
>  ASSERT: gnutls_buffers.c:623
> 14:54:46.917551 5012 (net.c:1348):GNUTLS: level 2:
>  ASSERT: gnutls_record.c:909
> 14:54:46.917561 5012 (net.c:1348):GNUTLS: level 2:
>  ASSERT: gnutls_handshake.c:2525
> 14:54:46.917600 5012 (net.c:1348):GNUTLS: level 2:
>  ASSERT: gnutls_handshake.c:2697
> 14:54:46.917624 5012 (net.c:1348):GNUTLS: level 6:
>  BUF[HSK]: Cleared Data from buffer
> 14:54:46.917688 5012 (net.c:1453):handshake failed: A TLS packet with
> unexpected length was received.
> 14:54:46.917704 5012 (login.c:470):login packet rejected
> 14:54:46.917714 5012 (util.c:336):tdserror(0x1e60134be00, 0x1e60134c060,
> 20002, 0)
> 14:54:46.917782 5012 (util.c:366):tdserror: client library returned
> TDS_INT_CANCEL(2)
> 14:54:46.917796 5012 (util.c:395):tdserror: returning TDS_INT_CANCEL(2)
> 14:54:46.917806 5012 (mem.c:603):tds_free_all_results()
>
>
>
> When I use sql 2008 there is 20 packets that makes connection (packet nr
> 21 is a first keep alive )
>
> It is a bug in freeTds ?
> Or I do something wrong way...
> maybe I need  appropriate version of gnutls ?
>
> Thanks
> Pawel Z
>

I found the problem. Here you are the patch (already in CVS HEAD and
post 0.82 patch at freetds.sf.net):

Index: src/tds/login.c
===================================================================
RCS file: /cvs/freetds/freetds/src/tds/login.c,v
retrieving revision 1.188
retrieving revision 1.189
diff -u -r1.188 -r1.189
--- src/tds/login.c     25 Aug 2009 14:25:35 -0000      1.188
+++ src/tds/login.c     28 Sep 2009 14:07:04 -0000      1.189
@@ -976,6 +976,13 @@
        assert(start_pos >= 21 && start_pos <= sizeof(buf));
        assert(buf[start_pos-1] == 0xff);

+       /*
+        * fix a problem with mssql2k which doesn't like
+        * packet splitted during SSL handshake
+        */
+       if (tds->env.block_size < 4096)
+               tds_realloc_socket(tds, 4096);
+
        /* do prelogin */
        tds->out_flag = TDS8_PRELOGIN;


It seems that mssql2k doesn't like splitted packet :(

freddy77
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds