add the tls min version to dsn

msdsn/conn_str.go

@@ -75,11 +75,11 @@ type Config struct {
 	PacketSize  uint16
 }
 
-func SetupTLS(certificate string, insecureSkipVerify bool, hostInCertificate string) (*tls.Config, error) {
+func SetupTLS(certificate string, insecureSkipVerify bool, hostInCertificate string, tlsMinVer uint16) (*tls.Config, error) {
 	config := tls.Config{
 		ServerName:         hostInCertificate,
 		InsecureSkipVerify: insecureSkipVerify,
-
+		MinVersion:         tlsMinVer,
 		// fix for https://github.com/denisenkom/go-mssqldb/issues/166
 		// Go implementation of TLS payload size heuristic algorithm splits single TDS package to multiple TCP segments,
 		// while SQL Server seems to expect one TCP segment per encrypted TDS package.
@@ -254,10 +254,29 @@ func Parse(dsn string) (Config, map[string]string, error) {
 		hostInCertificate = p.Host
 		p.HostInCertificateProvided = false
 	}
+	tlsversion, ok := params["tlsminversion"]
+	tlsMinVer := uint16(0)
+	if ok {
+		tlsversion = strings.ToUpper(tlsversion)
+		switch tlsversion {
+		case "TLS1.0":
+			tlsMinVer = tls.VersionTLS10
+		case "TLS1.1":
+			tlsMinVer = tls.VersionTLS11
+		case "TLS1.2":
+			tlsMinVer = tls.VersionTLS12
+		/*comment by go1.8 ~ go1.11 has no tls.VersionTLS13
+		case "TLS1.3":
+			tlsMinVer = tls.VersionTLS13
+		*/
+		default:
+			tlsMinVer = 0
+		}
+	}
 
 	if p.Encryption != EncryptionDisabled {
 		var err error
-		p.TLSConfig, err = SetupTLS(certificate, trustServerCert, hostInCertificate)
+		p.TLSConfig, err = SetupTLS(certificate, trustServerCert, hostInCertificate, tlsMinVer)
 		if err != nil {
 			return p, params, fmt.Errorf("failed to setup TLS: %w", err)
 		}

msdsn/conn_str_test.go

@@ -1,6 +1,7 @@
 package msdsn
 
 import (
+	"crypto/tls"
 	"reflect"
 	"testing"
 	"time"
@@ -196,3 +197,31 @@ func TestConnParseRoundTripFixed(t *testing.T) {
 		t.Fatal("Parameters do not match after roundtrip", params, rtParams)
 	}
 }
+
+func TestConnParseWithTlsVersion(t *testing.T) {
+	tests := []struct {
+		name    string
+		connStr string
+		wantCfg *Config
+	}{
+		{name: "1.TLS1.0", connStr: "sqlserver://someuser@somehost?tlsminversion=tls1.0", wantCfg: &Config{TLSConfig: &tls.Config{MinVersion: tls.VersionTLS10}}},
+		{name: "2.TLS1.1", connStr: "sqlserver://someuser@somehost?tlsminversion=tls1.1", wantCfg: &Config{TLSConfig: &tls.Config{MinVersion: tls.VersionTLS11}}},
+		{name: "3.TLS1.2", connStr: "sqlserver://someuser@somehost?tlsminversion=tls1.2", wantCfg: &Config{TLSConfig: &tls.Config{MinVersion: tls.VersionTLS12}}},
+		{name: "4.no tlsminversion parameter", connStr: "sqlserver://someuser@somehost", wantCfg: &Config{TLSConfig: &tls.Config{MinVersion: 0}}},
+		{name: "5.wrong tlsminversion parameter", connStr: "sqlserver://someuser@somehost?tlsminversion=wrongtlsversion", wantCfg: &Config{TLSConfig: &tls.Config{MinVersion: 0}}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, _, err := Parse(tt.connStr)
+			if err != nil {
+				t.Errorf("%s Parse Error:%+v", tt.name, err)
+				return
+			}
+			if got.TLSConfig.MinVersion != tt.wantCfg.TLSConfig.MinVersion {
+				t.Errorf("%s Parse MinVersion not match. want:%d, got:%d", tt.name, tt.wantCfg.TLSConfig.MinVersion, got.TLSConfig.MinVersion)
+				return
+			}
+		})
+	}
+
+}

tds.go

@@ -1150,7 +1150,7 @@ initiate_connection:
 			}
 		}
 		if config == nil {
-			config, err = msdsn.SetupTLS("", false, p.Host)
+			config, err = msdsn.SetupTLS("", false, p.Host, 0)
 			if err != nil {
 				return nil, err
 			}