feat(connect): add --server-name flag for tunneled connections#678
Open
jimmystridh wants to merge 6 commits intomicrosoft:mainfrom
Open
feat(connect): add --server-name flag for tunneled connections#678jimmystridh wants to merge 6 commits intomicrosoft:mainfrom
jimmystridh wants to merge 6 commits intomicrosoft:mainfrom
Conversation
Allows specifying the server name sent in the TDS LOGIN7 packet separately from the dial address. Fixes connections through SSH tunnels or proxies to Azure SQL where the server validates hostname. Refs: microsoft#576
Author
|
@microsoft-github-policy-service agree |
There was a problem hiding this comment.
Pull request overview
Adds support for overriding the server name used during TDS login (and related connection metadata) so sqlcmd can connect through tunnels/proxies (e.g., 127.0.0.1:11433) while authenticating as the real Azure SQL hostname.
Changes:
- Introduces
ConnectSettings.ServerNameOverrideand applies it when building the connection string. - Adds a
proxyDialerto rewrite the actual dial target while keeping the overridden server name for login. - Adds unit tests covering the new connection string behavior and dialer behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/sqlcmd/connect.go | Adds ServerNameOverride and applies it during connection string construction. |
| pkg/sqlcmd/sqlcmd.go | Attempts to attach a custom dialer when ServerNameOverride is set. |
| pkg/sqlcmd/dialer.go | Implements a dialer that rewrites dial host/port while reporting an overridden hostname. |
| pkg/sqlcmd/dialer_test.go | Adds unit tests for proxyDialer. |
| pkg/sqlcmd/sqlcmd_test.go | Extends connection string tests to cover ServerNameOverride. |
Author
|
Addressed the remaining review notes:
|
shueybubbles
reviewed
Feb 3, 2026
| targetPort: targetPort, | ||
| } | ||
| } else { | ||
| return localizer.Errorf("Server name override is not supported with the current authentication method") |
Collaborator
Collaborator
There was a problem hiding this comment.
or maybe just go generate but I'm not sure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When connecting to Azure SQL through an SSH tunnel or proxy (e.g.,
127.0.0.1:11433), connections fail because SQL Server validates the hostname in the TDS LOGIN7 packet. The server receives127.0.0.1as the server name and rejects it with "Cannot open server '127.0.0.1' requested by the login".Current workaround requires adding
/etc/hostsentries mapping the real server name to 127.0.0.1.Fixes #576
Solution
Add a
--server-nameflag that specifies the server name to send in the login packet, separate from the dial address (-S).# Connect via tunnel on localhost:11433, authenticate as the real server sqlcmd -S 127.0.0.1,11433 --server-name myserver.database.windows.net \ -U myuser -P mypass -N -CImplementation
ServerNameOverridefield toConnectSettings-Shost/port