Re: intermittent TLS packet with unexpected length error

I'll do that the end of next week. Thanks again for the help!

On Sep 23, 2016 3:44 AM, "Frediano Ziglio" <[email protected]> wrote:

> Good, would be a great idea to open a bug to Debian and Ubuntu asking
> to change the string.
>
> Frediano
>
> 2016-09-21 22:18 GMT+01:00 Scott Morken <[email protected]>:
> > It looks like this *mostly* worked.  I've had one schannel error in the
> > last two days.  Considerably better than the dozens I was getting before.
> > Not perfect, but much much better.  For the record, and for anyone else
> who
> > might need to build this bailing wire and duct tape fix, here are the
> steps
> > I took to make this work:
> >
> > Install build packages:
> >
> > $ sudo apt-get install build-essential dpatch fakeroot devscripts equivs
> > lintian quilt
> >
> > Add/replace the deb src for main restricted to use Xenial’s repo in
> > /etc/apt/sources.list - this gets you the latest 0.91-6.1build1 which has
> > the *almost* necessary patches in place to work.
> >
> > Mine went from:
> >
> > deb-src http://us.archive.ubuntu.com/ubuntu/ trust main restricted
> >
> > To
> >
> > deb-src http://us.archive.ubuntu.com/ubuntu/ xenial main restricted
> >
> > Update package list
> >
> > $ apt-get update
> >
> > Make a work dir
> >
> > $ mkdir ~/src
> >
> > Install the source
> >
> > $ apt-get source freetds
> >
> > $ cd /freetds-0.91
> >
> > Get build deps
> >
> > $ sudo mk-build-deps -i -r freetds
> >
> > Modify the src/tds/net.c for the allowed cipher suite (remove SSLV3)
> >
> > ------------------------------------------------------------
> --------------------------------------
> >
> > @@ -1322,7 +1322,7 @@
> >
> > /* ... but overwrite some */
> >
> > ret = gnutls_priority_set_direct (session,
> >
> > - "NORMAL:%COMPAT", NULL);
> >
> > + "NORMAL:%COMPAT:-VERS-SSL3.0", NULL);
> >
> > /* mssql does not like padding too much */
> >
> > #ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
> > ------------------------------------------------------------
> --------------------------------------
> >
> > Build it
> >
> > $ fakeroot debian/rules binary
> >
> > Install dependencies
> >
> > libgnutls28 odbcinst1debian2 libodbc1 unixodbc
> >
> > Install all the pieces
> >
> > $ sudo dpkg -i ../libct4_0.91-6.1build1_amd64.deb
> >
> > $ sudo dpkg -i ../libsybdb5_0.91-6.1build1_amd64.deb
> >
> > $ sudo dpkg -i ../tdsodbc_0.91-6.1build1_amd64.deb
> >
> > $ sudo dpkg -i ../freetds-common_0.91-6.1build1_all.deb
> >
> > $ sudo dpkg -i ../freetds-bin_0.91-6.1build1_amd64.deb
> >
> >
> > On Fri, Sep 16, 2016 at 8:44 AM, Frediano Ziglio <[email protected]>
> wrote:
> >
> >> 2016-09-16 16:28 GMT+01:00 Scott Morken <scott.morken@phoenixcollege.
> edu>:
> >> > I think you guys are correct.  I looked at the updated cipher list
> and it
> >> > looks like the one that is getting picked is in the removed list.
> Since
> >> I'm
> >> > sure our server admins won't want to install freetds from source on
> >> multiple
> >> > servers, is there a way to pass an allowed cipher list/suite to
> freetds?
> >> > Either through the config or environment?  If I could find a workable
> >> one, I
> >> > could probably limp along until we get to a new version... Although
> >> 16.04LTS
> >> > is still 0.91-6.1build1.  Not very up to date :(
> >> >
> >>
> >> Looks like they (Debian and Ubuntu) has a patch for the ciphers, that is
> >>
> >> @@ -1280,25 +1282,6 @@
> >>  {
> >>         gnutls_session session;
> >>         gnutls_certificate_credentials xcred;
> >> -
> >> -       static const int kx_priority[] = {
> >> -               GNUTLS_KX_RSA_EXPORT,
> >> -               GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA,
> >> -               0
> >> -       };
> >> -       static const int cipher_priority[] = {
> >> -               GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
> >> -               GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128,
> >> -#if 0
> >> -               GNUTLS_CIPHER_ARCFOUR_40,
> >> -               GNUTLS_CIPHER_DES_CBC,
> >> -#endif
> >> -               0
> >> -       };
> >> -       static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 };
> >> -       static const int mac_priority[] = {
> >> -               GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0
> >> -       };
> >>         int ret;
> >>         const char *tls_msg;
> >>
> >> @@ -1338,10 +1321,9 @@
> >>                 gnutls_set_default_priority(session);
> >>
> >>                 /* ... but overwrite some */
> >> -               gnutls_cipher_set_priority(session, cipher_priority);
> >> -               gnutls_compression_set_priority(session,
> comp_priority);
> >> -               gnutls_kx_set_priority(session, kx_priority);
> >> -               gnutls_mac_set_priority(session, mac_priority);
> >> +               ret = gnutls_priority_set_direct (session,
> >> +                               "NORMAL:%COMPAT", NULL);
> >> +
> >>                 /* mssql does not like padding too much */
> >>  #ifdef HAVE_GNUTLS_RECORD_DISABLE_PADDING
> >>                 gnutls_record_disable_padding(session);
> >>
> >> Our current string is "NORMAL:%COMPAT:-VERS-SSL3.0".
> >> But these strings are by the way encoded inside the binaries so they
> >> require recompiling
> >> from sources. You could try downloading the Ubuntu sources and replace
> >> that string.
> >> If you looks on internet "rebuild debian packages" you can found lot
> >> of easy documents.
> >> If you are able to verify that changing that string is enough you
> >> should then open a bug to
> >> Ubuntu to get official packages.
> >> Another way would be to build your own personal repository which could
> >> be used in
> >> the future for events like this.
> >>
> >> Frediano
> >>
> >>
> >>
> >> > On Fri, Sep 16, 2016 at 8:23 AM, Frediano Ziglio <[email protected]>
> >> wrote:
> >> >>
> >> >> 2016-09-16 16:02 GMT+01:00 Ramiro Morales <[email protected]>:
> >> >> > On Fri, Sep 16, 2016 at 11:54 AM, Scott Morken <
> >> >> > [email protected]> wrote:
> >> >> >
> >> >> >> I've recently (around the first part of August) starting getting
> >> random
> >> >> >> "
> >> >> >> SQLSTATE[01002] Adaptive Server connection failed" errors from
> >> FreeTDS.
> >> >> >> It
> >> >> >> seems to be related to the TLS handshake.  It doesn't happen every
> >> >> >> time...
> >> >> >> it took me about 45 minutes of clicking around to get the attached
> >> >> >> failure
> >> >> >> log but the next time only took a couple of minutes to get
> another.
> >> It
> >> >> >> happens from multiple Ubuntu 14.04.5 LTS servers connecting to the
> >> same
> >> >> >> MS
> >> >> >> SQL Server.  These are mostly PHP web apps but Python also has the
> >> same
> >> >> >> issue - naturally since it's the same backend library :)
> >> >> >>
> >> >> >> MS SQL Server 2012 (11.0.6020) on Windows Server 2008 R2 SP1
> >> >> >>
> >> >> >> The error on SQL Server isn't super helpful but it gave me a
> starting
> >> >> >> point
> >> >> >> to look into the TLS connection:
> >> >> >> <Event xmlns="http://schemas.microsoft.com/win/2004/08/
> events/event
> >> ">
> >> >> >> <System>
> >> >> >> <Provider Name="Schannel" Guid="{1F678132-5938-4686-
> >> 9FDC-C8FF68F15C85}"
> >> >> >> />
> >> >> >> <EventID>36888</EventID>
> >> >> >> <Version>0</Version>
> >> >> >> <Level>2</Level>
> >> >> >> <Task>0</Task>
> >> >> >> <Opcode>0</Opcode>
> >> >> >> <Keywords>0x8000000000000000</Keywords>
> >> >> >> <TimeCreated SystemTime="2016-09-16T13:20:01.639041100Z" />
> >> >> >> <EventRecordID>81739</EventRecordID>
> >> >> >> <Correlation />
> >> >> >> <Execution ProcessID="524" ThreadID="2464" />
> >> >> >> <Channel>System</Channel>
> >> >> >> <Computer>xxxx</Computer>
> >> >> >> <Security UserID="xxxx" />
> >> >> >> </System>
> >> >> >> <EventData>
> >> >> >> <Data Name="AlertDesc">20</Data>
> >> >> >> <Data Name="ErrorState">960</Data>
> >> >> >> </EventData>
> >> >> >> </Event>
> >> >> >>
> >> >> >> I'm connecting from multiple Ubuntu 14.04.5 LTS servers.
> >> >> >> gnutls26 is installed (2.12.23-12ubuntu2.5)
> >> >> >> freetds 0.91-5
> >> >> >>
> >> >> >> I'm at a loss as to what would cause these errors.  I've spent a
> lot
> >> of
> >> >> >> time searching for an answer but haven't found anything that
> really
> >> >> >> fits.
> >> >> >> Our server admins tried uninstalling the Microsoft TLS 1.2 patch
> that
> >> >> >> apparently broke a few things but that didn't help:
> >> >> >> http://www.infoworld.com/article/2848574/operating-
> >> >> >> systems/microsoft-botches-kb-2992611-schannel-patch-tls-
> >> >> >> alert-code-40-slow-sql-server-block-iis-sites.html
> >> >> >>
> >> >> >> I've tried encryption = off but it seems it still tries to
> negotiate
> >> it
> >> >> >> and
> >> >> >> fails.
> >> >> >>
> >> >> >> I've attached a log of the debug output from freeTDS for a failure
> >> and
> >> >> >> a
> >> >> >> success.  Any thoughts or obvious things I've missed would be
> greatly
> >> >> >> appreciated.  I've run out of ideas.
> >> >> >>
> >> >> >> Scott,
> >> >> >
> >> >> > Take a look at the FreeTDS GitHub repo commit history for the
> master
> >> >> > branch
> >> >> > and for the 1.0.x  maintenance branch for the last month or so and
> >> >> > verify
> >> >> > if it could be related.
> >> >> >
> >> >> > It might be your copy of FreeTDS is too old.
> >> >> >
> >> >> > Regards,
> >> >> >
> >> >> > --
> >> >> > Ramiro Morales
> >> >> > @ramiromorales
> >> >>
> >> >> I confirmed what Ramiro said.
> >> >> Unfortunately we seem we should try to push some new version to
> Debian.
> >> >> We don't release very often but 0.91 is 2 main release ago that is
> years
> >> >> ago,
> >> >> many changes were introduced since.
> >> >> We try very hard to maintain ABI so you should have not much issues
> >> >> updating from sources.
> >> >> We are a really small group nowadays and we cannot effort to maintain
> >> much
> >> >> old releases (actually we maintain the last). A very recent patch was
> >> >> introduced
> >> >> to fix a problem with OpenSSL but probably 0.91 contains some old
> >> setting
> >> >> even
> >> >> using GnuTLS (from https://packages.debian.org/jessie/freetds-bin or
> >> >> Ubuntu
> >> >> package you can see GnuTLS is used).
> >> >>
> >> >> Frediano
> >> >
> >> >
> >> >
> >> >
> >> > --
> >> > Scott Morken
> >> > Programmer
> >> > Phoenix College - Information Technology
> >> > 602.285.7554
> >> > [email protected]
> >>
> >
> >
> >
> > --
> > *Scott Morken*
> > Programmer
> > Phoenix College <http://www.phoenixcollege.edu> - Information Technology
> > 602.285.7554
> > [email protected]
> > _______________________________________________
> > FreeTDS mailing list
> > [email protected]
> > http://lists.ibiblio.org/mailman/listinfo/freetds
>
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds