Strict encryption option #412, hostname_in_certificate option #340, t…

Cargo.toml

@@ -57,9 +57,10 @@ winauth = { version = "0.0.4", optional = true }
 
 [target.'cfg(unix)'.dependencies]
 libgssapi = { version = "0.8.1", optional = true, default-features = false }
+libc = "0.2"
 
 [dependencies.async-native-tls]
-version = "0.4"
+version = "0.5"
 features = ["runtime-async-std"]
 optional = true
 
@@ -191,7 +192,8 @@ all = [
     "bigdecimal",
     "native-tls",
 ]
-default = ["tds73", "winauth", "native-tls"]
+default = ["tds80", "winauth", "native-tls"]
+tds80 = ["tds73"]
 tds73 = []
 docs = []
 sql-browser-async-std = ["async-std"]

src/client/config.rs

@@ -32,6 +32,8 @@ pub struct Config {
     pub(crate) trust: TrustConfig,
     pub(crate) auth: AuthMethod,
     pub(crate) readonly: bool,
+    pub(crate) hostname_in_certificate: Option<String>,
+    pub(crate) client_name: Option<String>,
 }
 
 #[derive(Clone, Debug)]
@@ -65,6 +67,8 @@ impl Default for Config {
             trust: TrustConfig::Default,
             auth: AuthMethod::None,
             readonly: false,
+            hostname_in_certificate: None,
+            client_name: None,
         }
     }
 }
@@ -149,14 +153,29 @@ impl Config {
     /// Will panic in case `trust_cert` was called before.
     ///
     /// - Defaults to validating the server certificate is validated against system's certificate storage.
-    pub fn trust_cert_ca(&mut self, path: impl ToString) {
+    pub fn trust_cert_ca(&mut self, path: impl Into<PathBuf>) {
         if let TrustConfig::TrustAll = &self.trust {
             panic!("'trust_cert' and 'trust_cert_ca' are mutual exclusive! Only use one.")
         } else {
-            self.trust = TrustConfig::CaCertificateLocation(PathBuf::from(path.to_string()))
+            self.trust = TrustConfig::CaCertificateLocation(path.into())
         }
     }
 
+    /// Sets the hostname to be used for certificate validation.
+    /// If not set, the hostname from `host` will be used.
+    ///
+    /// - Defaults to the value of `host`.
+    pub fn hostname_in_certificate(&mut self, hostname: impl ToString) {
+        self.hostname_in_certificate = Some(hostname.to_string());
+    }
+
+    /// Sets the client name to be sent to the server.
+    ///
+    /// - Defaults to the current workstation id (hostname).
+    pub fn client_name(&mut self, name: impl ToString) {
+        self.client_name = Some(name.to_string());
+    }
+
     /// Sets the authentication method.
     ///
     /// - Defaults to `None`.
@@ -190,6 +209,12 @@ impl Config {
         }
     }
 
+    pub(crate) fn get_hostname_in_certificate(&self) -> &str {
+        self.hostname_in_certificate
+            .as_deref()
+            .unwrap_or_else(|| self.get_host())
+    }
+
     /// Get the host address including port
     pub fn get_addr(&self) -> String {
         format!("{}:{}", self.get_host(), self.get_port())
@@ -210,7 +235,7 @@ impl Config {
     /// |`database`|`<string>`|The name of the database.|
     /// |`TrustServerCertificate`|`true`,`false`,`yes`,`no`|Specifies whether the driver trusts the server certificate when connecting using TLS. Cannot be used toghether with `TrustServerCertificateCA`|
     /// |`TrustServerCertificateCA`|`<path>`|Path to a `pem`, `crt` or `der` certificate file. Cannot be used together with `TrustServerCertificate`|
-    /// |`encrypt`|`true`,`false`,`yes`,`no`,`DANGER_PLAINTEXT`|Specifies whether the driver uses TLS to encrypt communication.|
+    /// |`encrypt`|`strict`,`true`,`false`,`yes`,`no`,`DANGER_PLAINTEXT`|Specifies whether the driver uses TLS to encrypt communication.|
     /// |`Application Name`, `ApplicationName`|`<string>`|Sets the application name for the connection.|
     ///
     /// [ADO.NET connection string]: https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/connection-strings
@@ -265,10 +290,18 @@ impl Config {
             builder.trust_cert_ca(ca);
         }
 
+        if let Some(hostname_in_cert) = s.hostname_in_certificate() {
+            builder.hostname_in_certificate(hostname_in_cert);
+        }
+
         builder.encryption(s.encrypt()?);
 
         builder.readonly(s.readonly());
 
+        if let Some(client_name) = s.client_name() {
+            builder.client_name(client_name);
+        }
+
         Ok(builder)
     }
 }
@@ -346,6 +379,20 @@ pub(crate) trait ConfigString {
             .map(|ca| ca.to_string())
     }
 
+    fn hostname_in_certificate(&self) -> Option<String> {
+        self.dict()
+            .get("hostnameincertificate")
+            .or_else(|| self.dict().get("hostname in certificate"))
+            .map(|ca| ca.to_string())
+    }
+
+    fn client_name(&self) -> Option<String> {
+        self.dict()
+            .get("workstationid")
+            .or_else(|| self.dict().get("workstation id"))
+            .map(|name| name.to_string())
+    }
+
     #[cfg(any(
         feature = "rustls",
         feature = "native-tls",
@@ -358,6 +405,9 @@ pub(crate) trait ConfigString {
                 Ok(true) => Ok(EncryptionLevel::Required),
                 Ok(false) => Ok(EncryptionLevel::Off),
                 Err(_) if val == "DANGER_PLAINTEXT" => Ok(EncryptionLevel::NotSupported),
+                Err(_) if val.eq_ignore_ascii_case("strict") && cfg!(feature = "tds80") => {
+                    Ok(EncryptionLevel::Strict)
+                }
                 Err(e) => Err(e),
             })
             .unwrap_or(Ok(EncryptionLevel::Off))

src/client/config/ado_net.rs

@@ -470,6 +470,21 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    #[cfg(any(
+        feature = "rustls",
+        feature = "native-tls",
+        feature = "vendored-openssl"
+    ))]
+    fn encryption_parsing_strict() -> crate::Result<()> {
+        let test_str = "encrypt=strict";
+        let ado: AdoNetConfig = test_str.parse()?;
+
+        assert_eq!(EncryptionLevel::Strict, ado.encrypt()?);
+
+        Ok(())
+    }
+
     #[test]
     fn application_name_parsing() -> crate::Result<()> {
         let test_str = "Application Name=meow";
@@ -484,4 +499,40 @@ mod tests {
 
         Ok(())
     }
+
+    #[test]
+    fn client_name_parsing() -> crate::Result<()> {
+        let test_str = "workstationid=meow";
+        let ado: AdoNetConfig = test_str.parse()?;
+
+        assert_eq!(Some("meow".into()), ado.client_name());
+
+        let test_str = "Workstation ID=meow";
+        let ado: AdoNetConfig = test_str.parse()?;
+
+        assert_eq!(Some("meow".into()), ado.client_name());
+
+        Ok(())
+    }
+
+    #[test]
+    fn hostname_in_certificate_parsing() -> crate::Result<()> {
+        let test_str = "HostNameInCertificate=foo.example.com";
+        let ado: AdoNetConfig = test_str.parse()?;
+
+        assert_eq!(
+            Some("foo.example.com".into()),
+            ado.hostname_in_certificate()
+        );
+
+        let test_str = "HostName In Certificate=foo.example.com";
+        let ado: AdoNetConfig = test_str.parse()?;
+
+        assert_eq!(
+            Some("foo.example.com".into()),
+            ado.hostname_in_certificate()
+        );
+
+        Ok(())
+    }
 }

src/client/connection.rs

@@ -79,7 +79,17 @@ impl<S: AsyncRead + AsyncWrite + Unpin + Send> Connection<S> {
             context
         };
 
-        let transport = Framed::new(MaybeTlsStream::Raw(tcp_stream), PacketCodec);
+        let transport = match config.encryption {
+            EncryptionLevel::Strict => {
+                event!(Level::INFO, "Performing a TLS handshake");
+                let mut pre_login_stream = TlsPreloginWrapper::new(tcp_stream);
+                pre_login_stream.handshake_complete();
+                let stream = create_tls_stream(&config, pre_login_stream).await?;
+                event!(Level::INFO, "TLS handshake successful");
+                Framed::new(MaybeTlsStream::Tls(stream), PacketCodec)
+            }
+            _ => Framed::new(MaybeTlsStream::Raw(tcp_stream), PacketCodec),
+        };
 
         let mut connection = Self {
             transport,
@@ -98,17 +108,7 @@ impl<S: AsyncRead + AsyncWrite + Unpin + Send> Connection<S> {
 
         let connection = connection.tls_handshake(&config, encryption).await?;
 
-        let mut connection = connection
-            .login(
-                config.auth,
-                encryption,
-                config.database,
-                config.host,
-                config.application_name,
-                config.readonly,
-                prelogin,
-            )
-            .await?;
+        let mut connection = connection.login(config, encryption, prelogin).await?;
 
         connection.flush_done().await?;
 
@@ -284,34 +284,33 @@ impl<S: AsyncRead + AsyncWrite + Unpin + Send> Connection<S> {
 
     /// Defines the login record rules with SQL Server. Authentication with
     /// connection options.
-    #[allow(clippy::too_many_arguments)]
-    async fn login<'a>(
+    async fn login(
         mut self,
-        auth: AuthMethod,
+        config: Config,
         encryption: EncryptionLevel,
-        db: Option<String>,
-        server_name: Option<String>,
-        application_name: Option<String>,
-        readonly: bool,
         prelogin: PreloginMessage,
     ) -> crate::Result<Self> {
         let mut login_message = LoginMessage::new();
 
-        if let Some(db) = db {
+        if let Some(db) = config.database {
             login_message.db_name(db);
         }
 
-        if let Some(server_name) = server_name {
+        if let Some(server_name) = config.host {
             login_message.server_name(server_name);
         }
 
-        if let Some(app_name) = application_name {
+        if let Some(app_name) = config.application_name {
             login_message.app_name(app_name);
         }
 
-        login_message.readonly(readonly);
+        if let Some(client_name) = config.client_name {
+            login_message.hostname(client_name);
+        }
+
+        login_message.readonly(config.readonly);
 
-        match auth {
+        match config.auth {
             #[cfg(all(windows, feature = "winauth"))]
             AuthMethod::Integrated => {
                 let mut client = NtlmSspiBuilder::new()
@@ -444,37 +443,47 @@ impl<S: AsyncRead + AsyncWrite + Unpin + Send> Connection<S> {
         config: &Config,
         encryption: EncryptionLevel,
     ) -> crate::Result<Self> {
-        if encryption != EncryptionLevel::NotSupported {
-            event!(Level::INFO, "Performing a TLS handshake");
-
-            let Self {
-                transport, context, ..
-            } = self;
-            let mut stream = match transport.into_inner() {
-                MaybeTlsStream::Raw(tcp) => {
-                    create_tls_stream(config, TlsPreloginWrapper::new(tcp)).await?
-                }
-                _ => unreachable!(),
-            };
-
-            stream.get_mut().handshake_complete();
-            event!(Level::INFO, "TLS handshake successful");
+        match encryption {
+            EncryptionLevel::NotSupported => {
+                event!(
+                    Level::WARN,
+                    "TLS encryption is not enabled. All traffic including the login credentials are not encrypted."
+                );
+                Ok(self)
+            }
+            EncryptionLevel::Strict => {
+                // In Strict mode, we should already be in TLS stream after prelogin, so just return self.
+                event!(
+                    Level::TRACE,
+                    "Already in TLS stream due to Strict encryption level, skipping handshake."
+                );
+                Ok(self)
+            }
+            EncryptionLevel::Off | EncryptionLevel::On | EncryptionLevel::Required => {
+                event!(Level::INFO, "Performing a TLS handshake");
+
+                let Self {
+                    transport, context, ..
+                } = self;
+                let mut stream = match transport.into_inner() {
+                    MaybeTlsStream::Raw(tcp) => {
+                        create_tls_stream(config, TlsPreloginWrapper::new(tcp)).await?
+                    }
+                    _ => unreachable!(),
+                };
 
-            let transport = Framed::new(MaybeTlsStream::Tls(stream), PacketCodec);
+                stream.get_mut().handshake_complete();
+                event!(Level::INFO, "TLS handshake successful");
 
-            Ok(Self {
-                transport,
-                context,
-                flushed: false,
-                buf: BytesMut::new(),
-            })
-        } else {
-            event!(
-                Level::WARN,
-                "TLS encryption is not enabled. All traffic including the login credentials are not encrypted."
-            );
+                let transport = Framed::new(MaybeTlsStream::Tls(stream), PacketCodec);
 
-            Ok(self)
+                Ok(Self {
+                    transport,
+                    context,
+                    flushed: false,
+                    buf: BytesMut::new(),
+                })
+            }
         }
     }
 

src/client/tls_stream.rs

@@ -1,6 +1,8 @@
 use crate::Config;
 use futures_util::io::{AsyncRead, AsyncWrite};
 
+pub(crate) const TDS_ALPN_PROTOCOL_NAME: &str = "tds/8.0";
+
 #[cfg(feature = "native-tls")]
 mod native_tls_stream;