How to have a better control on how the tds use the openssl?

Hi FreeTDS team,

I am new to the TDS community and hi to everyone. I am working on a project doing in-depth detection on encryption characteristics on SQL TDS protocol. For example, by only talking to the server thru network on TDS protocol, I want to detect which TLS versions the server supports, what cipher suites are supported and what the order of it. In that case, I need to have more fine control of which TLS version is going to be used.

Usually I need to call SSL_CTX_set_verify before the handshake starts to trust all kinds of server certificate. In addition, I'd like to use SSL_set_tlsext_host_name to control whether to use Server Name Indication extension in the handshake. Another example is I want to call SSL_set_tlsext_status_type before the handshake to ask server to send back an OCSP status response to me.

After reading the tls.c in tds project, the tds_init_openssl() function<https://github.com/FreeTDS/freetds/blob/513ed1a7dd5ed3be866407a2ef50d8dea3664943/src/tds/tls.c#L729> actually hardcoded the TLS method to be TLS_client_method, which is the general-purpose version-flexible SSL/TLS methods. The actual protocol version used will be negotiated to the highest version mutually supported by the client and the server. The supported protocols are TLSv1, TLSv1.1 and TLSv1.2.

I can see that now I can control what cipher get used by setting the tds->login->openssl_ciphers to whatever I need to achieve the cipher suite ask.

Can you give me advice on how to do it in existing code? If not in existing code, I am very happy to write some code to implement that in tds project.

Thanks!

Rick Qing Xu

https://github.com/qinxgit