Support encryption options

Author: lovasoa

sqlx-core/src/mssql/connection/establish.rs

@@ -18,20 +18,14 @@ impl MssqlConnection {
         // TODO: Encryption
         // TODO: Send the version of SQLx over
 
-        let encryption = match options.encrypt {
-            Some(true) => Encrypt::Required,
-            Some(false) => Encrypt::NotSupported,
-            None => Encrypt::On,
-        };
-
-        log::debug!("Sending T-SQL PRELOGIN with encryption: {:?}", encryption);
+        log::debug!("Sending T-SQL PRELOGIN with encryption: {:?}", options.encrypt);
 
         stream
             .write_packet_and_flush(
                 PacketType::PreLogin,
                 PreLogin {
                     version: Version::default(),
-                    encryption,
+                    encryption: options.encrypt,
                     instance: options.instance.clone(),
 
                     ..Default::default()
@@ -47,7 +41,7 @@ impl MssqlConnection {
             Encrypt::Required | Encrypt::On
         ) {
             stream.setup_encryption().await?;
-        } else if encryption == Encrypt::Required {
+        } else if options.encrypt == Encrypt::Required {
             return Err(Error::Tls(Box::new(std::io::Error::new(
                 std::io::ErrorKind::Other,
                 "TLS encryption required but not supported by server",

sqlx-core/src/mssql/connection/stream.rs

@@ -244,10 +244,10 @@ impl MssqlStream {
 
     pub(crate) async fn setup_encryption(&mut self) -> Result<(), Error> {
         let tls_config = TlsConfig {
-            accept_invalid_certs: true,
-            hostname: &self.options.host,
-            accept_invalid_hostnames: true,
-            root_cert_path: None,
+            accept_invalid_certs: self.options.trust_server_certificate,
+            hostname: self.options.hostname_in_certificate.as_deref().unwrap_or(&self.options.host),
+            accept_invalid_hostnames: self.options.hostname_in_certificate.is_none(),
+            root_cert_path: self.options.ssl_root_cert.as_ref(),
             client_cert_path: None,
             client_key_path: None,
         };

sqlx-core/src/mssql/options/mod.rs

@@ -1,4 +1,7 @@
-use crate::connection::LogSettings;
+use std::path::Path;
+
+use crate::{connection::LogSettings, net::CertificateInput};
+use super::protocol::pre_login::Encrypt;
 
 mod connect;
 mod parse;
@@ -27,7 +30,10 @@ pub struct MssqlConnectOptions {
     pub(crate) language: String,
     /// Size in bytes of TDS packets to exchange with the server
     pub(crate) requested_packet_size: u32,
-    pub(crate) encrypt: Option<bool>, // Added field
+    pub(crate) encrypt: Encrypt,
+    pub(crate) trust_server_certificate: bool,
+    pub(crate) hostname_in_certificate: Option<String>,
+    pub(crate) ssl_root_cert: Option<CertificateInput>,
 }
 
 impl Default for MssqlConnectOptions {
@@ -49,12 +55,15 @@ impl MssqlConnectOptions {
             requested_packet_size: 4096,
             client_program_version: 0,
             client_pid: 0,
-            hostname: "".to_string(),
-            app_name: "".to_string(),
-            server_name: "".to_string(),
-            client_interface_name: "".to_string(),
-            language: "".to_string(),
-            encrypt: None,
+            hostname: String::new(),
+            app_name: String::new(),
+            server_name: String::new(),
+            client_interface_name: String::new(),
+            language: String::new(),
+            encrypt: Encrypt::On,
+            trust_server_certificate: true,
+            hostname_in_certificate: None,
+            ssl_root_cert: None,
         }
     }
 
@@ -89,12 +98,12 @@ impl MssqlConnectOptions {
     }
 
     pub fn client_program_version(mut self, client_program_version: u32) -> Self {
-        self.client_program_version = client_program_version.to_owned();
+        self.client_program_version = client_program_version;
         self
     }
 
     pub fn client_pid(mut self, client_pid: u32) -> Self {
-        self.client_pid = client_pid.to_owned();
+        self.client_pid = client_pid;
         self
     }
 
@@ -134,8 +143,26 @@ impl MssqlConnectOptions {
         }
     }
 
-    pub fn encrypt(mut self, encrypt: bool) -> Self {
-        self.encrypt = Some(encrypt);
+    pub fn encrypt(mut self, encrypt: Encrypt) -> Self {
+        self.encrypt = encrypt;
+        self
+    }
+
+    pub fn trust_server_certificate(mut self, trust: bool) -> Self {
+        self.trust_server_certificate = trust;
+        self
+    }
+
+    pub fn hostname_in_certificate(mut self, hostname: &str) -> Self {
+        self.hostname_in_certificate = Some(hostname.to_owned());
+        self
+    }
+
+    /// Sets the name of a file containing SSL certificate authority (CA) certificate(s).
+    /// If the file exists, the server's certificate will be verified to be signed by
+    /// one of these authorities.
+    pub fn ssl_root_cert(mut self, cert: impl AsRef<Path>) -> Self {
+        self.ssl_root_cert = Some(CertificateInput::File(cert.as_ref().to_path_buf()));
         self
     }
 }

sqlx-core/src/mssql/options/parse.rs

@@ -1,4 +1,5 @@
 use crate::error::Error;
+use crate::mssql::protocol::pre_login::Encrypt;
 use crate::mssql::MssqlConnectOptions;
 use percent_encoding::percent_decode_str;
 use std::str::FromStr;
@@ -9,9 +10,39 @@ impl FromStr for MssqlConnectOptions {
 
     /// Parse a connection string into a set of connection options.
     ///
-    /// The connection string is expected to be a valid URL with the following format:
+    /// The connection string should be a valid URL with the following format:
     /// ```text
-    /// mssql://[username[:password]@]host/database[?instance=instance_name&packet_size=packet_size&client_program_version=client_program_version&client_pid=client_pid&hostname=hostname&app_name=app_name&server_name=server_name&client_interface_name=client_interface_name&language=language&encrypt=true|false]
+    /// mssql://[username[:password]@]host[:port][/database][?param1=value1&param2=value2...]
+    /// ```
+    ///
+    /// Components:
+    /// - `username`: The username for SQL Server authentication.
+    /// - `password`: The password for SQL Server authentication.
+    /// - `host`: The hostname or IP address of the SQL Server.
+    /// - `port`: The port number (default is 1433).
+    /// - `database`: The name of the database to connect to.
+    ///
+    /// Supported query parameters:
+    /// - `instance`: SQL Server named instance.
+    /// - `encrypt`: Controls connection encryption:
+    ///   - `strict`: Requires encryption and validates the server certificate.
+    ///   - `mandatory` or `true` or `yes`: Requires encryption but doesn't validate the server certificate.
+    ///   - `optional` or `false` or `no`: Uses encryption if available, falls back to unencrypted.
+    /// - `sslrootcert` or `ssl-root-cert` or `ssl-ca`: Path to the root certificate for validating the server's SSL certificate.
+    /// - `trust_server_certificate`: When true, skips validation of the server's SSL certificate. Use with caution as it makes the connection vulnerable to man-in-the-middle attacks.
+    /// - `hostname_in_certificate`: The hostname expected in the server's SSL certificate. Use this when the server's hostname doesn't match the certificate.
+    /// - `packet_size`: Size of TDS packets in bytes. Larger sizes can improve performance but consume more memory on the server
+    /// - `client_program_version`: Version number of the client program, sent to the server for logging purposes.
+    /// - `client_pid`: Process ID of the client, sent to the server for logging purposes.
+    /// - `hostname`: Name of the client machine, sent to the server for logging purposes.
+    /// - `app_name`: Name of the client application, sent to the server for logging purposes.
+    /// - `server_name`: Name of the server to connect to. Useful when connecting through a proxy or load balancer.
+    /// - `client_interface_name`: Name of the client interface, sent to the server for logging purposes.
+    /// - `language`: Sets the language for server messages. Affects date formats and system messages.
+    ///
+    /// Example:
+    /// ```text
+    /// mssql://user:pass@localhost:1433/mydb?encrypt=strict&app_name=MyApp&packet_size=4096
     /// ```
     fn from_str(s: &str) -> Result<Self, Self::Err> {
         let url: Url = s.parse().map_err(Error::config)?;
@@ -52,6 +83,27 @@ impl FromStr for MssqlConnectOptions {
                 "instance" => {
                     options = options.instance(&*value);
                 }
+                "encrypt" => {
+                    match value.to_lowercase().as_str() {
+                        "strict" => options = options.encrypt(Encrypt::Required),
+                        "mandatory" | "true" | "yes" => options = options.encrypt(Encrypt::On),
+                        "optional" | "false" | "no" => options = options.encrypt(Encrypt::NotSupported),
+                        _ => return Err(Error::config(MssqlInvalidOption(format!(
+                            "encrypt={} is not a valid value for encrypt. Valid values are: strict, mandatory, optional, true, false, yes, no",
+                            value
+                        )))),
+                    }
+                }
+                "sslrootcert" | "ssl-root-cert" | "ssl-ca" => {
+                    options = options.ssl_root_cert(&*value);
+                }
+                "trust_server_certificate" => {
+                    let trust = value.parse::<bool>().map_err(Error::config)?;
+                    options = options.trust_server_certificate(trust);
+                }
+                "hostname_in_certificate" => {
+                    options = options.hostname_in_certificate(&*value);
+                }
                 "packet_size" => {
                     let size = value.parse().map_err(Error::config)?;
                     options = options.requested_packet_size(size).map_err(|_| {
@@ -67,10 +119,6 @@ impl FromStr for MssqlConnectOptions {
                 "server_name" => options = options.server_name(&*value),
                 "client_interface_name" => options = options.client_interface_name(&*value),
                 "language" => options = options.language(&*value),
-                "encrypt" => {
-                    let encrypt = value.parse::<bool>().map_err(Error::config)?;
-                    options = options.encrypt(encrypt);
-                }
                 _ => {
                     return Err(Error::config(MssqlInvalidOption(key.into())));
                 }

sqlx-core/src/mssql/protocol/pre_login.rs

@@ -277,7 +277,7 @@ impl Display for Version {
 /// During the Pre-Login handshake, the client and the server negotiate the
 /// wire encryption to be used.
 #[derive(Default, Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub(crate) enum Encrypt {
+pub enum Encrypt {
     /// Encryption is available but off.
     Off = 0x00,