Update Encrypt property default value to true

doc/snippets/Microsoft.Data.SqlClient/SqlConnection.xml

@@ -537,7 +537,7 @@ End Module
 |Current Language<br /><br /> -or-<br /><br /> Language|N/A|Sets the language used for database server warning or error messages.<br /><br /> The language name can be 128 characters or less.|  
 |Data Source<br /><br /> -or-<br /><br /> Server<br /><br /> -or-<br /><br /> Address<br /><br /> -or-<br /><br /> Addr<br /><br /> -or-<br /><br /> Network Address|N/A|The name or network address of the instance of SQL Server to which to connect. The port number can be specified after the server name:<br /><br /> `server=tcp:servername, portnumber`<br /><br /> When specifying a local instance, always use (local). To force a protocol, add one of the following prefixes:<br /><br /> `np:(local),  tcp:(local), lpc:(local)`<br /><br /> You can also connect to a LocalDB database as follows:<br /><br /> `server=(localdb)\\myInstance`<br /><br /> For more information about LocalDB, see [SqlClient Support for LocalDB](/sql/connect/ado-net/sql/sqlclient-support-localdb).<br /><br /> **Data Source** must use the TCP format or the Named Pipes format.<br /><br /> TCP format is as follows:<br /><br /> -   tcp:\<host name>\\<instance name\><br />-   tcp:\<host name>,\<TCP/IP port number><br /><br /> The TCP format must start with the prefix "tcp:" and is followed by the database instance, as specified by a host name and an instance name. This format is not applicable when connecting to Azure SQL Database. TCP is automatically selected for connections to Azure SQL Database when no protocol is specified.<br /><br /> The host name MUST be specified in one of the following ways:<br /><br /> -   NetBIOSName<br />-   IPv4Address<br />-   IPv6Address<br /><br /> The instance name is used to resolve to a particular TCP/IP port number on which a database instance is hosted. Alternatively, specifying a TCP/IP port number directly is also allowed. If both instance name and port number are not present, the default database instance is used.<br /><br /> The Named Pipes format is as follows:<br /><br /> -   np:\\\\<host name\>\pipe\\<pipe name\><br /><br /> The Named Pipes format MUST start with the prefix "np:" and is followed by a named pipe name.<br /><br /> The host name MUST be specified in one of the following ways:<br /><br /> -   NetBIOSName<br />-   IPv4Address<br />-   IPv6Address<br /><br /> The pipe name is used to identify the database instance to which the .NET application will connect.<br /><br /> If the value of the **Network** key is specified, the prefixes "tcp:" and "np:" should not be specified. **Note:**  You can force the use of TCP instead of shared memory, either by prefixing **tcp:** to the server name in the connection string, or by using **localhost**.|  
 |Enclave Attestation Url|N/A|Gets or sets the enclave attestation URL to be used with enclave based Always Encrypted.|
-|Encrypt|'false'|When `true`, SQL Server uses SSL encryption for all data sent between the client and server if the server has a certificate installed. Recognized values are `true`, `false`, `yes`, and `no`. For more information, see [Connection String Syntax](/sql/connect/ado-net/connection-string-syntax).<br /><br /> When `TrustServerCertificate` is false and `Encrypt` is true, the server name (or IP address) in a SQL Server SSL certificate must exactly match the server name (or IP address) specified in the connection string. Otherwise, the connection attempt will fail. For information about support for certificates whose subject starts with a wildcard character (*), see [Accepted wildcards used by server certificates for server authentication](https://support.microsoft.com/kb/258858).|  
+|Encrypt|'true'|When `true`, SQL Server uses SSL encryption for all data sent between the client and server if the server has a certificate installed. Recognized values are `true`, `false`, `yes`, and `no`. For more information, see [Connection String Syntax](/sql/connect/ado-net/connection-string-syntax).<br /><br /> When `TrustServerCertificate` is false and `Encrypt` is true, the server name (or IP address) in a SQL Server SSL certificate must exactly match the server name (or IP address) specified in the connection string. Otherwise, the connection attempt will fail. For information about support for certificates whose subject starts with a wildcard character (*), see [Accepted wildcards used by server certificates for server authentication](https://support.microsoft.com/kb/258858).|  
 |Enlist|'true'|`true` indicates that the SQL Server connection pooler automatically enlists the connection in the creation thread's current transaction context.|  
 |Failover Partner|N/A|The name of the failover partner server where database mirroring is configured.<br /><br /> If the value of this key is "", then **Initial Catalog** must be present, and its value must not be "".<br /><br /> The server name can be 128 characters or less.<br /><br /> If you specify a failover partner but the failover partner server is not configured for database mirroring and the primary server (specified with the Server keyword) is not available, then the connection will fail.<br /><br /> If you specify a failover partner and the primary server is not configured for database mirroring, the connection to the primary server (specified with the Server keyword) will succeed if the primary server is available.|  
 |Initial Catalog<br /><br /> -or-<br /><br /> Database|N/A|The name of the database.<br /><br /> The database name can be 128 characters or less.|  

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNILoadHandle.cs

@@ -55,5 +55,11 @@ public EncryptionOptions Options
                 return _encryptionOption;
             }
         }
+
+        /// <summary>
+        /// Verify client encryption possibility
+        /// </summary>
+        // TODO: by adding support ENCRYPT_NOT_SUP, it could be calculated.
+        public bool ClientOSEncryptionSupport => true;
     }
 }

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SqlConnectionString.cs

@@ -28,7 +28,7 @@ internal static partial class DEFAULT
             internal const int Connect_Timeout = ADP.DefaultConnectionTimeout;
             internal const string Current_Language = _emptyString;
             internal const string Data_Source = _emptyString;
-            internal const bool Encrypt = false;
+            internal const bool Encrypt = true;
             internal const bool Enlist = true;
             internal const string FailoverPartner = _emptyString;
             internal const string Initial_Catalog = _emptyString;

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParser.cs

@@ -47,6 +47,11 @@ internal sealed partial class TdsParser
         internal readonly int _objectID = Interlocked.Increment(ref _objectTypeCount);
         internal int ObjectID => _objectID;
 
+        /// <summary>
+        /// Verify client encryption possibility.
+        /// </summary>
+        private bool ClientOSEncryptionSupport => TdsParserStateObjectFactory.Singleton.ClientOSEncryptionSupport;
+
         // Default state object for parser
         internal TdsParserStateObject _physicalStateObj = null; // Default stateObj and connection for Dbnetlib and non-MARS SNI.
 
@@ -464,6 +469,18 @@ internal void ProcessPendingAck(TdsParserStateObject stateObj)
                 _physicalStateObj.AssignPendingDNSInfo(serverInfo.UserProtocol, FQDNforDNSCahce, ref _connHandler.pendingSQLDNSObject);
             }
 
+            if (!ClientOSEncryptionSupport)
+            {
+                //If encryption is required, an error will throw.
+                if (encrypt)
+                {
+                    _physicalStateObj.AddError(new SqlError(TdsEnums.ENCRYPTION_NOT_SUPPORTED, (byte)0x00, TdsEnums.FATAL_ERROR_CLASS, _server, SQLMessage.EncryptionNotSupportedByClient(), "", 0));
+                    _physicalStateObj.Dispose();
+                    ThrowExceptionAndWarning(_physicalStateObj);
+                }
+                _encryptionOption = EncryptionOptions.NOT_SUP;
+            }
+
             SqlClientEventSource.Log.TryTraceEvent("<sc.TdsParser.Connect|SEC> Sending prelogin handshake");
             SendPreLoginHandshake(instanceName, encrypt);
 
@@ -674,7 +691,7 @@ private void SendPreLoginHandshake(byte[] instanceName, bool encrypt)
                     case (int)PreLoginOptions.ENCRYPT:
                         if (_encryptionOption == EncryptionOptions.NOT_SUP)
                         {
-                            // If OS doesn't support encryption, inform server not supported.
+                            //If encryption is not required.
                             payload[payloadLength] = (byte)EncryptionOptions.NOT_SUP;
                         }
                         else
@@ -865,7 +882,7 @@ private PreLoginHandshakeStatus ConsumePreLoginHandshake(bool encrypt, bool trus
                         switch (_encryptionOption)
                         {
                             case (EncryptionOptions.ON):
-                                if (serverOption == EncryptionOptions.NOT_SUP)
+                                if (serverOption != EncryptionOptions.ON)
                                 {
                                     _physicalStateObj.AddError(new SqlError(TdsEnums.ENCRYPTION_NOT_SUPPORTED, (byte)0x00, TdsEnums.FATAL_ERROR_CLASS, _server, SQLMessage.EncryptionNotSupportedByServer(), "", 0));
                                     _physicalStateObj.Dispose();
@@ -885,11 +902,12 @@ private PreLoginHandshakeStatus ConsumePreLoginHandshake(bool encrypt, bool trus
                                     // Encrypt all.
                                     _encryptionOption = EncryptionOptions.ON;
                                 }
-
+                                // NOT_SUP: No encryption.
                                 break;
 
                             case (EncryptionOptions.NOT_SUP):
-                                if (serverOption == EncryptionOptions.REQ)
+                                // Server required encryption
+                                if (serverOption != EncryptionOptions.NOT_SUP)
                                 {
                                     _physicalStateObj.AddError(new SqlError(TdsEnums.ENCRYPTION_NOT_SUPPORTED, (byte)0x00, TdsEnums.FATAL_ERROR_CLASS, _server, SQLMessage.EncryptionNotSupportedByClient(), "", 0));
                                     _physicalStateObj.Dispose();

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParserSafeHandles.cs

@@ -18,7 +18,8 @@ internal sealed partial class SNILoadHandle : SafeHandle
         internal readonly SNINativeMethodWrapper.SqlAsyncCallbackDelegate WriteAsyncCallbackDispatcher = new SNINativeMethodWrapper.SqlAsyncCallbackDelegate(WriteDispatcher);
 
         private readonly uint _sniStatus = TdsEnums.SNI_UNINITIALIZED;
-        private readonly EncryptionOptions _encryptionOption;
+        private readonly EncryptionOptions _encryptionOption = EncryptionOptions.OFF;
+        private bool? _clientOSEncryptionSupport = null;
 
         private SNILoadHandle() : base(IntPtr.Zero, true)
         {
@@ -30,30 +31,41 @@ private SNILoadHandle() : base(IntPtr.Zero, true)
             finally
             {
                 _sniStatus = SNINativeMethodWrapper.SNIInitialize();
-
-                uint value = 0;
-
-                // VSDevDiv 479597: If initialize fails, don't call QueryInfo.
-                if (TdsEnums.SNI_SUCCESS == _sniStatus)
-                {
-                    // Query OS to find out whether encryption is supported.
-                    SNINativeMethodWrapper.SNIQueryInfo(SNINativeMethodWrapper.QTypes.SNI_QUERY_CLIENT_ENCRYPT_POSSIBLE, ref value);
-                }
-
-                _encryptionOption = (value == 0) ? EncryptionOptions.NOT_SUP : EncryptionOptions.OFF;
-
                 base.handle = (IntPtr)1; // Initialize to non-zero dummy variable.
             }
         }
 
-        public override bool IsInvalid
+        /// <summary>
+        /// Verify client encryption possibility.
+        /// </summary>
+        public bool ClientOSEncryptionSupport
         {
             get
             {
-                return (IntPtr.Zero == base.handle);
+                if (_clientOSEncryptionSupport is null)
+                {
+                    // VSDevDiv 479597: If initialize fails, don't call QueryInfo.
+                    if (TdsEnums.SNI_SUCCESS == _sniStatus)
+                    {
+                        try
+                        {
+                            UInt32 value = 0;
+                            // Query OS to find out whether encryption is supported.
+                            SNINativeMethodWrapper.SNIQueryInfo(SNINativeMethodWrapper.QTypes.SNI_QUERY_CLIENT_ENCRYPT_POSSIBLE, ref value);
+                            _clientOSEncryptionSupport = value != 0;
+                        }
+                        catch (Exception e)
+                        {
+                            SqlClientEventSource.Log.TryTraceEvent("<sc.SNILoadHandle.EncryptClientPossible|SEC> Exception occurs during resolving encryption possibility: {0}", e.Message);
+                        }
+                    }
+                }
+                return _clientOSEncryptionSupport.Value;
             }
         }
 
+        public override bool IsInvalid => (IntPtr.Zero == base.handle);
+
         override protected bool ReleaseHandle()
         {
             if (base.handle != IntPtr.Zero)
@@ -69,21 +81,9 @@ override protected bool ReleaseHandle()
             return true;
         }
 
-        public uint Status
-        {
-            get
-            {
-                return _sniStatus;
-            }
-        }
+        public uint Status => _sniStatus;
 
-        public EncryptionOptions Options
-        {
-            get
-            {
-                return _encryptionOption;
-            }
-        }
+        public EncryptionOptions Options => _encryptionOption;
 
         private static void ReadDispatcher(IntPtr key, IntPtr packet, uint error)
         {

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParserStateObjectFactory.Managed.cs

@@ -13,21 +13,14 @@ internal sealed class TdsParserStateObjectFactory
 
         public static readonly TdsParserStateObjectFactory Singleton = new TdsParserStateObjectFactory();
 
-        public EncryptionOptions EncryptionOptions
-        {
-            get
-            {
-                return SNI.SNILoadHandle.SingletonInstance.Options;
-            }
-        }
+        public EncryptionOptions EncryptionOptions => SNI.SNILoadHandle.SingletonInstance.Options;
 
-        public uint SNIStatus
-        {
-            get
-            {
-                return SNI.SNILoadHandle.SingletonInstance.Status;
-            }
-        }
+        public uint SNIStatus => SNI.SNILoadHandle.SingletonInstance.Status;
+
+        /// <summary>
+        /// Verify client encryption possibility.
+        /// </summary>
+        public bool ClientOSEncryptionSupport => SNI.SNILoadHandle.SingletonInstance.ClientOSEncryptionSupport;
 
         public TdsParserStateObject CreateTdsParserStateObject(TdsParser parser)
         {

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParserStateObjectFactory.Windows.cs

@@ -16,24 +16,17 @@ internal sealed class TdsParserStateObjectFactory
         private static bool shouldUseManagedSNI;
 
         // If the appcontext switch is set then Use Managed SNI based on the value. Otherwise Native SNI.dll will be used by default.
-        public static bool UseManagedSNI { get; } =
+        public static bool UseManagedSNI => 
             AppContext.TryGetSwitch(UseManagedNetworkingOnWindows, out shouldUseManagedSNI) ? shouldUseManagedSNI : false;
 
-        public EncryptionOptions EncryptionOptions
-        {
-            get
-            {
-                return UseManagedSNI ? SNI.SNILoadHandle.SingletonInstance.Options : SNILoadHandle.SingletonInstance.Options;
-            }
-        }
+        public EncryptionOptions EncryptionOptions => UseManagedSNI ? SNI.SNILoadHandle.SingletonInstance.Options : SNILoadHandle.SingletonInstance.Options;
 
-        public uint SNIStatus
-        {
-            get
-            {
-                return UseManagedSNI ? SNI.SNILoadHandle.SingletonInstance.Status : SNILoadHandle.SingletonInstance.Status;
-            }
-        }
+        public uint SNIStatus => UseManagedSNI ? SNI.SNILoadHandle.SingletonInstance.Status : SNILoadHandle.SingletonInstance.Status;
+
+        /// <summary>
+        /// Verify client encryption possibility.
+        /// </summary>
+        public bool ClientOSEncryptionSupport => UseManagedSNI ? SNI.SNILoadHandle.SingletonInstance.ClientOSEncryptionSupport : SNILoadHandle.SingletonInstance.ClientOSEncryptionSupport;
 
         public TdsParserStateObject CreateTdsParserStateObject(TdsParser parser)
         {

src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlConnectionString.cs

@@ -31,7 +31,7 @@ internal static class DEFAULT
             internal const bool Context_Connection = false;
             internal const string Current_Language = _emptyString;
             internal const string Data_Source = _emptyString;
-            internal const bool Encrypt = false;
+            internal const bool Encrypt = true;
             internal const bool Enlist = true;
             internal const string FailoverPartner = _emptyString;
             internal const string Initial_Catalog = _emptyString;