Add hostname override for MSSQL TLS verification

cyberark · Apr 15, 2020 · 80f61d3 · 80f61d3
1 parent 30c8dfc
commit 80f61d3
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/internal/plugin/connectors/tcp/mssql/connection_details.go b/internal/plugin/connectors/tcp/mssql/connection_details.go
@@ -90,6 +90,11 @@ func newSSLParams(credentials map[string][]byte) map[string]string {
 
 	if sslMode == sslModeVerifyFull  {
 		params["rawcertificate"] = string(credentials["sslrootcert"])
+
+		// Ability to override hostname for verification
+		if len(credentials["sslhost"]) > 0 {
+			params["hostnameincertificate"] = string(credentials["sslhost"])
+		}
 	}
 
 	return params

diff --git a/internal/plugin/connectors/tcp/mssql/connection_details_test.go b/internal/plugin/connectors/tcp/mssql/connection_details_test.go
@@ -177,6 +177,23 @@ func TestConnectionDetails_NewSSLOptions(t *testing.T) {
 				"rawcertificate":         "foo",
 			},
 		},
+		{
+			description: "sslmode:verify-full with sslhost",
+			args: args{
+				credentials: map[string][]byte{
+					"sslmode":     []byte("verify-full"),
+					"sslhost":     []byte("foo.bar"),
+					"sslrootcert": []byte("foo"),
+				},
+			},
+			expected: map[string]string{
+				"encrypt":                "true",
+				"trustservercertificate": "false",
+				"disableverifyhostname":  "false",
+				"rawcertificate":         "foo",
+				"hostnameincertificate":  "foo.bar",
+			},
+		},
 	}
 
 	for _, tc := range testCases {