Re: intermittent TLS packet with unexpected length error

Good, would be a great idea to open a bug to Debian and Ubuntu asking
to change the string.

Frediano

2016-09-21 22:18 GMT+01:00 Scott Morken <[email protected]>:
> It looks like this *mostly* worked.  I've had one schannel error in the
> last two days.  Considerably better than the dozens I was getting before.
> Not perfect, but much much better.  For the record, and for anyone else who
> might need to build this bailing wire and duct tape fix, here are the steps
> I took to make this work:
>
> Install build packages:
>
> $ sudo apt-get install build-essential dpatch fakeroot devscripts equivs
> lintian quilt
>
> Add/replace the deb src for main restricted to use Xenial’s repo in
> /etc/apt/sources.list - this gets you the latest 0.91-6.1build1 which has
> the *almost* necessary patches in place to work.
>
> Mine went from:
>
> deb-src http://us.archive.ubuntu.com/ubuntu/ trust main restricted
>
> To
>
> deb-src http://us.archive.ubuntu.com/ubuntu/ xenial main restricted
>
> Update package list
>
> $ apt-get update
>
> Make a work dir
>
> $ mkdir ~/src
>
> Install the source
>
> $ apt-get source freetds
>
> $ cd /freetds-0.91
>
> Get build deps
>
> $ sudo mk-build-deps -i -r freetds
>
> Modify the src/tds/net.c for the allowed cipher suite (remove SSLV3)
>
> --------------------------------------------------------------------------------------------------
>
> @@ -1322,7 +1322,7 @@
>
> /* ... but overwrite some */
>
> ret = gnutls_priority_set_direct (session,
>
> - "NORMAL:%COMPAT", NULL);
>
> + "NORMAL:%COMPAT:-VERS-SSL3.0", NULL);
>
> /* mssql does not like padding too much */
>
> #ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
> --------------------------------------------------------------------------------------------------
>
> Build it
>
> $ fakeroot debian/rules binary
>
> Install dependencies
>
> libgnutls28 odbcinst1debian2 libodbc1 unixodbc
>
> Install all the pieces
>
> $ sudo dpkg -i ../libct4_0.91-6.1build1_amd64.deb
>
> $ sudo dpkg -i ../libsybdb5_0.91-6.1build1_amd64.deb
>
> $ sudo dpkg -i ../tdsodbc_0.91-6.1build1_amd64.deb
>
> $ sudo dpkg -i ../freetds-common_0.91-6.1build1_all.deb
>
> $ sudo dpkg -i ../freetds-bin_0.91-6.1build1_amd64.deb
>
>
> On Fri, Sep 16, 2016 at 8:44 AM, Frediano Ziglio <[email protected]> wrote:
>
>> 2016-09-16 16:28 GMT+01:00 Scott Morken <[email protected]>:
>> > I think you guys are correct.  I looked at the updated cipher list and it
>> > looks like the one that is getting picked is in the removed list.  Since
>> I'm
>> > sure our server admins won't want to install freetds from source on
>> multiple
>> > servers, is there a way to pass an allowed cipher list/suite to freetds?
>> > Either through the config or environment?  If I could find a workable
>> one, I
>> > could probably limp along until we get to a new version... Although
>> 16.04LTS
>> > is still 0.91-6.1build1.  Not very up to date :(
>> >
>>
>> Looks like they (Debian and Ubuntu) has a patch for the ciphers, that is
>>
>> @@ -1280,25 +1282,6 @@
>>  {
>>         gnutls_session session;
>>         gnutls_certificate_credentials xcred;
>> -
>> -       static const int kx_priority[] = {
>> -               GNUTLS_KX_RSA_EXPORT,
>> -               GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA,
>> -               0
>> -       };
>> -       static const int cipher_priority[] = {
>> -               GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
>> -               GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128,
>> -#if 0
>> -               GNUTLS_CIPHER_ARCFOUR_40,
>> -               GNUTLS_CIPHER_DES_CBC,
>> -#endif
>> -               0
>> -       };
>> -       static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 };
>> -       static const int mac_priority[] = {
>> -               GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0
>> -       };
>>         int ret;
>>         const char *tls_msg;
>>
>> @@ -1338,10 +1321,9 @@
>>                 gnutls_set_default_priority(session);
>>
>>                 /* ... but overwrite some */
>> -               gnutls_cipher_set_priority(session, cipher_priority);
>> -               gnutls_compression_set_priority(session, comp_priority);
>> -               gnutls_kx_set_priority(session, kx_priority);
>> -               gnutls_mac_set_priority(session, mac_priority);
>> +               ret = gnutls_priority_set_direct (session,
>> +                               "NORMAL:%COMPAT", NULL);
>> +
>>                 /* mssql does not like padding too much */
>>  #ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
>>                 gnutls_record_disable_padding(session);
>>
>> Our current string is "NORMAL:%COMPAT:-VERS-SSL3.0".
>> But these strings are by the way encoded inside the binaries so they
>> require recompiling
>> from sources. You could try downloading the Ubuntu sources and replace
>> that string.
>> If you looks on internet "rebuild debian packages" you can found lot
>> of easy documents.
>> If you are able to verify that changing that string is enough you
>> should then open a bug to
>> Ubuntu to get official packages.
>> Another way would be to build your own personal repository which could
>> be used in
>> the future for events like this.
>>
>> Frediano
>>
>>
>>
>> > On Fri, Sep 16, 2016 at 8:23 AM, Frediano Ziglio <[email protected]>
>> wrote:
>> >>
>> >> 2016-09-16 16:02 GMT+01:00 Ramiro Morales <[email protected]>:
>> >> > On Fri, Sep 16, 2016 at 11:54 AM, Scott Morken <
>> >> > [email protected]> wrote:
>> >> >
>> >> >> I've recently (around the first part of August) starting getting
>> random
>> >> >> "
>> >> >> SQLSTATE[01002] Adaptive Server connection failed" errors from
>> FreeTDS.
>> >> >> It
>> >> >> seems to be related to the TLS handshake.  It doesn't happen every
>> >> >> time...
>> >> >> it took me about 45 minutes of clicking around to get the attached
>> >> >> failure
>> >> >> log but the next time only took a couple of minutes to get another.
>> It
>> >> >> happens from multiple Ubuntu 14.04.5 LTS servers connecting to the
>> same
>> >> >> MS
>> >> >> SQL Server.  These are mostly PHP web apps but Python also has the
>> same
>> >> >> issue - naturally since it's the same backend library :)
>> >> >>
>> >> >> MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1
>> >> >>
>> >> >> The error on SQL Server isn't super helpful but it gave me a starting
>> >> >> point
>> >> >> to look into the TLS connection:
>> >> >> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event
>> ">
>> >> >> <System>
>> >> >> <Provider Name="Schannel" Guid="{1F678132-5938-4686-
>> 9FDC-C8FF68F15C85}"
>> >> >> />
>> >> >> <EventID>36888</EventID>
>> >> >> <Version>0</Version>
>> >> >> <Level>2</Level>
>> >> >> <Task>0</Task>
>> >> >> <Opcode>0</Opcode>
>> >> >> <Keywords>0x8000000000000000</Keywords>
>> >> >> <TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
>> >> >> <EventRecordID>81739</EventRecordID>
>> >> >> <Correlation />
>> >> >> <Execution ProcessID="524" ThreadID="2464" />
>> >> >> <Channel>System</Channel>
>> >> >> <Computer>xxxx</Computer>
>> >> >> <Security UserID="xxxx" />
>> >> >> </System>
>> >> >> <EventData>
>> >> >> <Data Name="AlertDesc">20</Data>
>> >> >> <Data Name="ErrorState">960</Data>
>> >> >> </EventData>
>> >> >> </Event>
>> >> >>
>> >> >> I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
>> >> >> gnutls26 is installed (2.12.23-12ubuntu2.5)
>> >> >> freetds 0.91-5
>> >> >>
>> >> >> I'm at a loss as to what would cause these errors.  I've spent a lot
>> of
>> >> >> time searching for an answer but haven't found anything that really
>> >> >> fits.
>> >> >> Our server admins tried uninstalling the Microsoft TLS 1.2 patch that
>> >> >> apparently broke a few things but that didn't help:
>> >> >> http://www.infoworld.com/article/2848574/operating-
>> >> >> systems/microsoft-botches-kb-2992611-schannel-patch-tls-
>> >> >> alert-code-40-slow-sql-server-block-iis-sites.html
>> >> >>
>> >> >> I've tried encryption = off but it seems it still tries to negotiate
>> it
>> >> >> and
>> >> >> fails.
>> >> >>
>> >> >> I've attached a log of the debug output from freeTDS for a failure
>> and
>> >> >> a
>> >> >> success.  Any thoughts or obvious things I've missed would be greatly
>> >> >> appreciated.  I've run out of ideas.
>> >> >>
>> >> >> Scott,
>> >> >
>> >> > Take a look at the FreeTDS GitHub repo commit history for the master
>> >> > branch
>> >> > and for the 1.0.x  maintenance branch for the last month or so and
>> >> > verify
>> >> > if it could be related.
>> >> >
>> >> > It might be your copy of FreeTDS is too old.
>> >> >
>> >> > Regards,
>> >> >
>> >> > --
>> >> > Ramiro Morales
>> >> > @ramiromorales
>> >>
>> >> I confirmed what Ramiro said.
>> >> Unfortunately we seem we should try to push some new version to Debian.
>> >> We don't release very often but 0.91 is 2 main release ago that is years
>> >> ago,
>> >> many changes were introduced since.
>> >> We try very hard to maintain ABI so you should have not much issues
>> >> updating from sources.
>> >> We are a really small group nowadays and we cannot effort to maintain
>> much
>> >> old releases (actually we maintain the last). A very recent patch was
>> >> introduced
>> >> to fix a problem with OpenSSL but probably 0.91 contains some old
>> setting
>> >> even
>> >> using GnuTLS (from https://packages.debian.org/jessie/freetds-bin or
>> >> Ubuntu
>> >> package you can see GnuTLS is used).
>> >>
>> >> Frediano
>> >
>> >
>> >
>> >
>> > --
>> > Scott Morken
>> > Programmer
>> > Phoenix College - Information Technology
>> > 602.285.7554
>> > [email protected]
>>
>
>
>
> --
> *Scott Morken*
> Programmer
> Phoenix College <http://www.phoenixcollege.edu> - Information Technology
> 602.285.7554
> [email protected]
> _______________________________________________
> FreeTDS mailing list
> [email protected]
> http://lists.ibiblio.org/mailman/listinfo/freetds
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds