Module auth 

SQL Server authentication, and the TLS that has to happen first.

What this module does not do

Only SQL Server authentication — a username and a password held by the server — is implemented. Windows integrated authentication (NTLM, Kerberos, SSPI) and Microsoft Entra federated authentication are not: they need a full GSS-API negotiation and a Windows credential cache, and a half-built one that silently falls back to something weaker would be worse than none. A server that demands SSPI is told so by name rather than being retried.

The part that surprises everyone

TDS negotiates TLS inside its own pre-login exchange. The sequence is:

1. The client sends a PRELOGIN packet naming the encryption it wants.
2. The server answers with a PRELOGIN packet naming what it will do.
3. If either side asked for encryption, a complete TLS handshake now runs — but every handshake record is wrapped in a TDS packet of type PRELOGIN, header and all. TLS is being tunnelled through a protocol that has not started yet.
4. The moment the handshake finishes, the wrapping stops. From the next byte on, the connection is ordinary TLS carrying ordinary TDS packets.

TdsHandshakeStream is what makes step 3 and step 4 the same object: it frames while wrapping is set and passes bytes straight through afterwards, so tokio-rustls can drive a normal handshake over it without knowing that anything unusual is happening underneath.

Why TLS 1.2 and not 1.3

Under TLS 1.3 a server considers the handshake finished as soon as it has sent its own Finished, and immediately sends session tickets — which would arrive unwrapped while this side is still reading wrapped packets. TLS 1.2 has no post-handshake traffic and both sides stop wrapping at the same byte, so the wrapped handshake is pinned to TLS 1.2. TDS 8.0, which starts TLS before TDS rather than inside it, is what lifts that restriction; this driver speaks TDS 7.4.

Structs

TdsHandshakeStream

A socket that frames the TLS handshake into TDS packets, and stops once the handshake is done.

TlsOptions

How the certificate the server presents is checked.

Enums

Encryption

How much of the session is encrypted.

Negotiated

What the two sides settled on, once both have spoken.

TdsStream

A TDS connection, before or after encryption.

Functions

deobfuscate_password

Undo obfuscate_password. Only the tests need it — but a scheme whose inverse is never written is a scheme nobody has checked.

negotiate

Work out what happens next from the two ENCRYPTION bytes.

obfuscate_password

Encode a password for LOGIN7.

start_tls

Run the TLS handshake through the pre-login tunnel.