How to downgrade a TLS connection to TCP without an TLS Alert exchange

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

How to downgrade a TLS connection to TCP without an TLS Alert exchange

saintderanged
Hi

Is there a way to downgrade a TLS connection to TCP without an TLS Alert exchange in Erlang/Elixir?

To give a bit of context: We've implemented the MS-TDS protocol (used by Microsoft SQL Server) using Elixir and the ssl and gen_tcp libraries. A TDS connection typically is unencrypted apart from the login. It starts unencrypted with a prelogin handshake, after that comes the TLS handshake, and encrypted login packet is sent and then all further packets are unencrypted. 

Using :ssl.close to downgrade the socket to TCP expects a TLS alert exchange to end the SSL connection however TDS does not expect or support TLS alerts, it simply goes back to being unencrypted after the login. I appreciate this is not standard TLS but I'm not expecting to change Microsoft's protocol to SQL Server any time soon! 

Currently we stop encryption by sending data directly to the TCP socket and changing the controlling process of the TCP socket to our receiving process. This works however it leaves the ssl_connection process hanging around. It monitors our receiving process and if that process dies a TLS alert is sent which TDS is not expecting. The alert is only sent in some teardown scenarios but it just seems rather messy. We're wondering if there's a better way to approach our problem?

Many thanks

Rob

_______________________________________________
erlang-questions mailing list
[hidden email]
http://erlang.org/mailman/listinfo/erlang-questions
Reply | Threaded
Open this post in threaded view
|

Re: How to downgrade a TLS connection to TCP without an TLS Alert exchange

Ingela Andin
Hi!

2017-10-24 11:38 GMT+02:00 Rob A'Court <[hidden email]>:
Hi

Is there a way to downgrade a TLS connection to TCP without an TLS Alert exchange in Erlang/Elixir?


No! That would break the TLS protocol:

FROM the RFC.

  "If the application protocol using TLS provides that any data may be
   carried over the underlying transport after the TLS connection is
   closed, the TLS implementation must receive the responding
   close_notify alert before indicating to the application layer that 
      the TLS connection has ended. "



To give a bit of context: We've implemented the MS-TDS protocol (used by Microsoft SQL Server) using Elixir and the ssl and gen_tcp libraries. A TDS connection typically is unencrypted apart from the login. It starts unencrypted with a prelogin handshake, after that comes the TLS handshake, and encrypted login packet is sent and then all further packets are unencrypted. 

Using :ssl.close to downgrade the socket to TCP expects a TLS alert exchange to end the SSL connection however TDS does not expect or support TLS alerts, it simply goes back to being unencrypted after the login. I appreciate this is not standard TLS but I'm not expecting to change Microsoft's protocol to SQL Server any time soon! 

Currently we stop encryption by sending data directly to the TCP socket and changing the controlling process of the TCP socket to our receiving process. This works however it leaves the ssl_connection process hanging around. It monitors our receiving process and if that process dies a TLS alert is sent which TDS is not expecting. The alert is only sent in some teardown scenarios but it just seems rather messy. We're wondering if there's a better way to approach our problem?


Not any clean way that I can think of, but you might be a able to make an unclean one if you are willing to do what you describe above, which is  not very clean.
 

Regards Ingela Erlang/OTP Team - Ericsson AB
 
Many thanks

Rob

_______________________________________________
erlang-questions mailing list
[hidden email]
http://erlang.org/mailman/listinfo/erlang-questions



_______________________________________________
erlang-questions mailing list
[hidden email]
http://erlang.org/mailman/listinfo/erlang-questions