Fix | Fix certificate validation #2439

arellegue · 2024-04-01T22:44:54Z

This PR fixes issue #2178.

Problem was with Certificate Chain Link error, which is now resolved by comparing the binary raw data of the client certificate against the server certificate. If both certificates match, we allow it to continue. Prior to this, any certificate policy error, we stopped operations and threw an exception.

…l repository.

… CN in certificate.

…, use hostname as CN in certificate instead.

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNICommon.cs

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNINpHandle.cs

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

JRahnama · 2024-04-02T16:11:30Z

@David-Engel Even if two certificates have identical raw data, they will have different digital signatures if they are issued by different entities and also even if two certificates have identical raw data, they may have been issued to different subjects. The question would be is comparing two certificate raw data is enough to determine if they are equal?

I had an internal conversation and it is proven that I am wrong. Ignore my comment here.

DavoudEshtehari

Have you intentionally removed the Address, Circle, Shapes, and Utf8String projects?

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNICommon.cs

JRahnama · 2024-04-18T18:14:19Z

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

  <PropertyGroup>
    <ProjectGuid>{407890AC-9876-4FEF-A6F1-F36A876BAADE}</ProjectGuid>
    <RootNamespace>Microsoft.Data.SqlClient</RootNamespace>
-    <TargetFrameworkVersion>v4.6.2</TargetFrameworkVersion>
+    <TargetFramework>net462</TargetFramework>


why is this change added here? another PR has added that change and it is merged. Try to pull changes from main branch

I'm not sure where that came from but it is already net462

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

JRahnama · 2024-04-18T18:15:26Z

src/Microsoft.Data.SqlClient/src/Microsoft/Data/ProviderBase/DbReferenceCollection.cs

+            }
+        }
+    }
+}


why this change is added here? another PR has merged to address this.

Because I could not get it merged in for some reason and I could not build without it.

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/ConnectionTestParametersData.cs

JRahnama · 2024-04-18T18:37:35Z

...crosoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj

@@ -347,9 +350,18 @@
    <PackageReference Condition="'$(TargetGroup)'!='netfx'" Include="System.ServiceProcess.ServiceController" Version="$(SystemServiceProcessServiceControllerVersion)" />
  </ItemGroup>
  <ItemGroup>
-    <None Condition="'$(TargetGroup)'=='netfx' AND $(ReferenceType)=='Project'" Include="$(BinFolder)$(Configuration).AnyCPU\Microsoft.Data.SqlClient\netfx\**\*SNI*.dll" CopyToOutputDirectory="PreserveNewest" />
+   <ContentWithTargetPath Condition="'$(TargetGroup)'=='netfx' AND $(ReferenceType)=='Project'" Include="$(BinFolder)$(Configuration).AnyCPU\Microsoft.Data.SqlClient\netfx\$(TargetFramework)\*SNI*.dll">


this change is addressed in another PR why is that added here.

JRahnama · 2024-04-19T16:11:12Z

Also, can you address pipeline failures?

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/ConnectionTestParametersData.cs

…ests.

…in Manual Tests.

JRahnama · 2024-04-30T05:38:39Z

src/Microsoft.Data.SqlClient/tests/ManualTests/makepfxcert.ps1

+
+        # Update the certificates store
+        Write-Output "Updating the certificates store..."
+        update-ca-certificates -v


There are couple of things here, generally it is better to use bash on ubuntu, you will have a better control over the commands.

Enabling as system CA certificate is missing here. It could be done by dpkg-reconfigure command

Remember since the server and client are on the same machine you need to configure them for both.

Removing '!' at the beginning of certificate inside ca-certificate is missed. You can test with sudo cat /etc/ca-certificates.conf command to ensure '!' is removed from the certificate name. If '!' shows up Infront of the certificate name it wont be included in update-ca-certificate command.

It is better to provide chmod 755/777 to ensure sql server has access to those files.

JRahnama · 2024-04-30T05:43:12Z

src/Microsoft.Data.SqlClient/tests/ManualTests/makepfxcert.ps1

+          KeyAlgorithm      = "RSA"
+          KeyLength         = 2048
+          HashAlgorithm     = "SHA256"
+          TextExtension     = "2.5.29.37={text}1.3.6.1.5.5.7.3.1", "2.5.29.17={text}DNS=$fqdn&DNS=$localhost&IPAddress=$LoopBackIPV4&DNS=$sqlAliasName&IPAddress=$LoopBackIPV6"


This could be simplified by adding DNSName to paramters.

JRahnama · 2024-04-30T05:44:56Z

src/Microsoft.Data.SqlClient/tests/ManualTests/makepfxcert.ps1

+          Type              = "SSLServerAuthentication"
+          Subject           = "CN=$fqdn"
+          KeyAlgorithm      = "RSA"
+          KeyLength         = 2048


Why on Unix you have chosen 4096 and on windows 2048 for key length?

Enable Linux certificate as CA certificate.

… certificate for negative test.

David-Engel · 2024-05-02T23:55:49Z

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionTestWithSSLCert/CertificateTest.cs

@@ -106,13 +106,15 @@ public void OpenningConnectionWithGoodCertificateTest()

            // Test with Mandatory encryption
            builder.Encrypt = SqlConnectionEncryptOption.Mandatory;
+            builder.TrustServerCertificate = true;


Wouldn't this just mask if the test doesn't set up the server certificate correctly? (Same for line 117.)

This was addressed in PR #2487.

David-Engel · 2024-05-03T00:14:07Z

...ta.SqlClient/tests/ManualTests/SQL/ConnectionTestWithSSLCert/CertificateTestWithTdsServer.cs

+            string userId = string.Empty;
+            string password = string.Empty;
+            SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);
+            userId = builder.UserID;
+            password = builder.Password;
+
+            using TestTdsServer server = TestTdsServer.StartTestServer(enableFedAuth: false, enableLog: false, connectionTimeout: 15,
+                methodName: "", new X509Certificate2(s_fullPathToPfx, "nopassword", X509KeyStorageFlags.UserKeySet),
+                encryptionType: connectionTestParameters.TdsEncryptionType);
+
+            if (userId != string.Empty)
+            {
+                builder = new(server.ConnectionString)
+                {
+                    UserID = userId,
+                    Password = password,
+                    TrustServerCertificate = connectionTestParameters.TrustServerCertificate,
+                    Encrypt = connectionTestParameters.Encrypt,
+                };
+            }
+            else
+            {
+                builder = new(server.ConnectionString)
+                {
+                    IntegratedSecurity = true,
+                    TrustServerCertificate = connectionTestParameters.TrustServerCertificate,
+                    Encrypt = connectionTestParameters.Encrypt,
+                };
+            }
+
+            if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows) && userId == string.Empty)
+            {
+                builder.IntegratedSecurity = false;
+                builder.UserID = "user";
+                builder.Password = "password";
+            }


This seems strange. Why do we switch between integrated and un/pw here? And why use the un/pw from the config? Doesn't the auth not matter since TestTdsServer doesn't care about auth here? Seems like this could be simplified to just a few lines... No?

Suggested change

string userId = string.Empty;

string password = string.Empty;

SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);

userId = builder.UserID;

password = builder.Password;

using TestTdsServer server = TestTdsServer.StartTestServer(enableFedAuth: false, enableLog: false, connectionTimeout: 15,

methodName: "", new X509Certificate2(s_fullPathToPfx, "nopassword", X509KeyStorageFlags.UserKeySet),

encryptionType: connectionTestParameters.TdsEncryptionType);

if (userId != string.Empty)

{

builder = new(server.ConnectionString)

{

UserID = userId,

Password = password,

TrustServerCertificate = connectionTestParameters.TrustServerCertificate,

Encrypt = connectionTestParameters.Encrypt,

};

}

else

{

builder = new(server.ConnectionString)

{

IntegratedSecurity = true,

TrustServerCertificate = connectionTestParameters.TrustServerCertificate,

Encrypt = connectionTestParameters.Encrypt,

};

}

if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows) && userId == string.Empty)

{

builder.IntegratedSecurity = false;

builder.UserID = "user";

builder.Password = "password";

}

using TestTdsServer server = TestTdsServer.StartTestServer(enableFedAuth: false, enableLog: false, connectionTimeout: 15,

methodName: "", new X509Certificate2(s_fullPathToPfx, "nopassword", X509KeyStorageFlags.UserKeySet),

encryptionType: connectionTestParameters.TdsEncryptionType);

SqlConnectionStringBuilder builder = new(server.ConnectionString)

{

TrustServerCertificate = connectionTestParameters.TrustServerCertificate,

Encrypt = connectionTestParameters.Encrypt,

};

This was addressed in PR #2487.

arellegue added 21 commits February 5, 2024 13:44

Initial merge from certValidation and certTest branch from David-Enge…

95c67b1

…l repository.

Initial merge from certValidation and certTest branch from David-Enge…

ed691c5

…l repository.

Merge branch 'main' into FixCertificateValidation

5452a9c

Added unit test in Manual Tests.

fa54829

Merged latest project files from upstream.

e8d3e54

Merge branch 'main' into FixCertificateValidation

67f2091

Fixed project files.

cf5739c

Fix script for linux to install openssl first.

267acdd

Add force installation of openssl from PSGallery.

af9a1ff

Removed OpenSsl installation.

3c682cc

Add 1 second delay for the certificate to be created.

45ad5f8

Add debug to display certificate location.

3522200

Add print working directory to script.

78f75e4

Add cat to display content of result.txt.

9d417da

Add parameter for the location of certificate.

60768f0

Fix script parameters.

7136a33

Fix script so that if FQDN is over 64 characters then don't use it as…

d7423ed

… CN in certificate.

Without specifiying CN, the openssl command becomes interactive. Thus…

07a2332

…, use hostname as CN in certificate instead.

Fix string length test to -gt 64.

aa13fb1

Add the installation of openssl for linux.

4369b9e

Clean-up unwanted comments from scripts and unit test.

1c39823

arellegue requested review from David-Engel, JRahnama and DavoudEshtehari April 1, 2024 22:44

Removed unnecessary using.

aa0dfc2

David-Engel reviewed Apr 2, 2024

View reviewed changes

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNICommon.cs Outdated Show resolved Hide resolved

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNICommon.cs Outdated Show resolved Hide resolved

JRahnama reviewed Apr 2, 2024

View reviewed changes

src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNINpHandle.cs Show resolved Hide resolved

JRahnama reviewed Apr 2, 2024

View reviewed changes

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj Outdated Show resolved Hide resolved

DavoudEshtehari reviewed Apr 2, 2024

View reviewed changes

JRahnama reviewed Apr 18, 2024

View reviewed changes

arellegue added 3 commits April 18, 2024 12:06

Applied suggested change in the comment at line 141 of SNICommon.cs.

dfbc847

Added extra line as suggested.

9d8c7d9

Merged from upstream main.

9095e71

arellegue added 2 commits April 19, 2024 09:22

Applied suggested changes.

f301515

No change just trigerring pipeline run for this PR.

e413d9c

JRahnama reviewed Apr 19, 2024

View reviewed changes

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/ConnectionTestParametersData.cs Show resolved Hide resolved

arellegue requested review from JRahnama and DavoudEshtehari April 24, 2024 15:46

arellegue added 8 commits April 24, 2024 08:56

Revert Nuget.config changes.

db6656d

Merge branch 'main' into FixCertificateValidation

8821999

Merge branch 'main' into FixCertificateValidation

804473f

Change default Tds Server encryption to not supported in Functional T…

3341d76

…ests.

Restore original TestTdsServer.cs in Functional Test.

5e8bd99

Changed TdsServer default encryption to None in Manual Tests.

7ee63c2

Actually, make the test TdsServer default Encryption to NotSupported …

b5539d1

…in Manual Tests.

Removed blank line from TestTdsServer.cs.

2dd6fb1

JRahnama reviewed Apr 30, 2024

View reviewed changes

arellegue added 7 commits April 30, 2024 08:57

Make Windows and Linux certificate key length to be 4096.

b6770d3

Enable Linux certificate as CA certificate.

Commenbt out dpkg-reconfigure in the certificate maker script.

43b940b

Update script that creates certificate.

df87444

Merge branch 'main' into FixCertificateValidation

e485ce4

Added unit test wrapper for Windows and Unix. MaxOS will be excluded.

81b5a09

Updated script so that the dpkg-reconfigure is noninteractive.

faf2b14

Add comment that possible value for certificate includes a mismatched…

e9adb82

… certificate for negative test.

David-Engel reviewed May 3, 2024

View reviewed changes

arellegue removed the request for review from DavoudEshtehari May 3, 2024 15:32

arellegue marked this pull request as draft May 3, 2024 15:35

arellegue mentioned this pull request May 7, 2024

Fix | Enhance certificate validation #2487

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix | Fix certificate validation #2439

Fix | Fix certificate validation #2439

arellegue commented Apr 1, 2024 •

edited

JRahnama commented Apr 2, 2024 •

edited

DavoudEshtehari left a comment

JRahnama Apr 18, 2024

arellegue Apr 18, 2024

JRahnama Apr 18, 2024

arellegue Apr 18, 2024 •

edited

JRahnama Apr 18, 2024

arellegue Apr 19, 2024

JRahnama commented Apr 19, 2024

JRahnama Apr 30, 2024

JRahnama Apr 30, 2024

JRahnama Apr 30, 2024

David-Engel May 2, 2024

arellegue May 7, 2024

David-Engel May 3, 2024

arellegue May 7, 2024

Fix | Fix certificate validation #2439

Are you sure you want to change the base?

Fix | Fix certificate validation #2439

Conversation

arellegue commented Apr 1, 2024 • edited

JRahnama commented Apr 2, 2024 • edited

DavoudEshtehari left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

arellegue Apr 18, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JRahnama commented Apr 19, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

arellegue commented Apr 1, 2024 •

edited

JRahnama commented Apr 2, 2024 •

edited

arellegue Apr 18, 2024 •

edited