Skip to content

Commit 3b945ee

Browse files
author
Johnny Pham
authored
Add new Attestation Protocol "None" - phase 2 (#1425)
1 parent c9d59d8 commit 3b945ee

File tree

21 files changed

+181
-181
lines changed

21 files changed

+181
-181
lines changed

‎doc/snippets/Microsoft.Data.SqlClient/SqlConnection.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -527,7 +527,7 @@ End Module
527527
|Application Intent<br /><br /> -or-<br /><br />ApplicationIntent|ReadWrite|Declares the application workload type when connecting to a server. Possible values are `ReadOnly` and `ReadWrite`. For example:<br /><br /> `ApplicationIntent=ReadOnly`<br /><br /> For more information about SqlClient support for Always On Availability Groups, see [SqlClient Support for High Availability, Disaster Recovery](/sql/connect/ado-net/sql/sqlclient-support-high-availability-disaster-recovery).|
528528
|Application Name|N/A|The name of the application. If no application name is provided, 'Framework Microsoft SqlClient Data Provider' when running on .NET Framework and 'Core Microsoft SqlClient Data Provider' otherwise.<br /><br /> An application name can be 128 characters or less.|
529529
|AttachDBFilename<br /><br /> -or-<br /><br /> Extended Properties<br /><br /> -or-<br /><br /> Initial File Name|N/A|The name of the primary database file, including the full path name of an attachable database. AttachDBFilename is only supported for primary data files with an .mdf extension.<br /><br /> If the value of the AttachDBFileName key is specified in the connection string, the database is attached and becomes the default database for the connection.<br /><br /> If this key is not specified and if the database was previously attached, the database will not be reattached. The previously attached database will be used as the default database for the connection.<br /><br /> If this key is specified together with the AttachDBFileName key, the value of this key will be used as the alias. However, if the name is already used in another attached database, the connection will fail.<br /><br /> The path may be absolute or relative by using the DataDirectory substitution string. If DataDirectory is used, the database file must exist within a subdirectory of the directory pointed to by the substitution string. **Note:** Remote server, HTTP, and UNC path names are not supported. <br /><br /> The database name must be specified with the keyword 'database' (or one of its aliases) as in the following:<br /><br /> <code>"AttachDbFileName=&#124;DataDirectory&#124;\data\YourDB.mdf;integrated security=true;database=YourDatabase"</code><br /><br /> An error will be generated if a log file exists in the same directory as the data file and the 'database' keyword is used when attaching the primary data file. In this case, remove the log file. Once the database is attached, a new log file will be automatically generated based on the physical path.|
530-
|Attestation Protocol|N/A|Gets or sets the value of Attestation Protocol.<br /><br />Valid values are:<br />`AAS`<br />`HGS`|
530+
|Attestation Protocol|N/A|Gets or sets the value of Attestation Protocol.<br /><br />Valid values are:<br />`AAS`<br />`HGS`<br />`None`|
531531
|Authentication|N/A|The authentication method used for [Connecting to SQL Database By Using Azure Active Directory Authentication](https://azure.microsoft.com/documentation/articles/sql-database-aad-authentication/#7-connect-to-your-database-by-using-azure-active-directory-identities).<br /><br /> Valid values are:<br /><br /> `Active Directory Integrated`, `Active Directory Interactive`, `Active Directory Password`, `Active Directory Service Principal`, `Active Directory Device Code Flow`, `Active Directory Managed Identity`, `Active Directory MSI`, `Active Directory Default`, `Sql Password`.|
532532
|Column Encryption Setting|disabled|Enables or disables [Always Encrypted](/sql/relational-databases/security/encryption/always-encrypted-database-engine) functionality for the connection. Supported values are: `enabled` and `disabled`|
533533
|Command Timeout|30|The default wait time (in seconds) before terminating the attempt to execute a command and generating an error.<br /><br /> Valid values are greater than or equal to 0 and less than or equal to 2147483647.|

‎doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@
1313
<summary>Attestation portocol for Azure Attestation Service</summary>
1414
<value>1</value>
1515
</AAS>
16-
<SIM>
17-
<summary>Attestation protocol for Simulator</summary>
16+
<None>
17+
<summary>Attestation protocol for no attestation. Only compatible with Virtualization-based security (VBS) enclaves. An Enclave Attestation Url is not required when using this protocol.</summary>
1818
<value>2</value>
19-
</SIM>
19+
</None>
2020
<HGS>
2121
<summary>Attestation protocol for Host Guardian Service</summary>
2222
<value>3</value>

‎src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -472,10 +472,8 @@ public enum SqlConnectionAttestationProtocol
472472
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/AAS/*' />
473473
AAS = 1,
474474

475-
#if ENCLAVE_SIMULATOR
476-
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/SIM/*' />
477-
SIM = 2,
478-
#endif
475+
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/None/*' />
476+
None = 2,
479477

480478
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/HGS/*' />
481479
HGS = 3

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SqlCommand.cs‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -204,10 +204,9 @@ internal bool IsColumnEncryptionEnabled
204204
}
205205
}
206206

207-
internal bool ShouldUseEnclaveBasedWorkflow
208-
{
209-
get { return !string.IsNullOrWhiteSpace(_activeConnection.EnclaveAttestationUrl) && IsColumnEncryptionEnabled; }
210-
}
207+
internal bool ShouldUseEnclaveBasedWorkflow =>
208+
(!string.IsNullOrWhiteSpace(_activeConnection.EnclaveAttestationUrl) || Connection.AttestationProtocol == SqlConnectionAttestationProtocol.None) &&
209+
IsColumnEncryptionEnabled;
211210

212211
/// <summary>
213212
/// Per-command custom providers. It can be provided by the user and can be set more than once.
@@ -4211,7 +4210,7 @@ private void ReadDescribeEncryptionParameterResults(SqlDataReader ds, ReadOnlyDi
42114210

42124211
if (isRequestedByEnclave)
42134212
{
4214-
if (string.IsNullOrWhiteSpace(this.Connection.EnclaveAttestationUrl))
4213+
if (string.IsNullOrWhiteSpace(this.Connection.EnclaveAttestationUrl) && Connection.AttestationProtocol != SqlConnectionAttestationProtocol.None)
42154214
{
42164215
throw SQL.NoAttestationUrlSpecifiedForEnclaveBasedQuerySpDescribe(this._activeConnection.Parser.EnclaveType);
42174216
}
@@ -4636,8 +4635,11 @@ private void GenerateEnclavePackage()
46364635
return;
46374636
}
46384637

4639-
if (string.IsNullOrWhiteSpace(this._activeConnection.EnclaveAttestationUrl))
4638+
if (string.IsNullOrWhiteSpace(this._activeConnection.EnclaveAttestationUrl) &&
4639+
Connection.AttestationProtocol != SqlConnectionAttestationProtocol.None)
4640+
{
46404641
throw SQL.NoAttestationUrlSpecifiedForEnclaveBasedQueryGeneratingEnclavePackage(this._activeConnection.Parser.EnclaveType);
4642+
}
46414643

46424644
string enclaveType = this._activeConnection.Parser.EnclaveType;
46434645
if (string.IsNullOrWhiteSpace(enclaveType))

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsEnums.cs‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1070,10 +1070,8 @@ public enum SqlConnectionAttestationProtocol
10701070
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/AAS/*' />
10711071
AAS = 1,
10721072

1073-
#if ENCLAVE_SIMULATOR
1074-
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/SIM/*' />
1075-
SIM = 2,
1076-
#endif
1073+
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/None/*' />
1074+
None = 2,
10771075

10781076
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/HGS/*' />
10791077
HGS = 3

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParser.cs‎

Lines changed: 8 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3174,22 +3174,22 @@ private bool TryProcessFeatureExtAck(TdsParserStateObject stateObj)
31743174
if (TceVersionSupported < TdsEnums.MIN_TCE_VERSION_WITH_ENCLAVE_SUPPORT)
31753175
{
31763176
// Check if enclave attestation url was specified and server does not support enclave computations and we aren't going to be routed to another server.
3177-
if (!string.IsNullOrWhiteSpace(_connHandler.ConnectionOptions.EnclaveAttestationUrl) && SqlConnectionAttestationProtocol.NotSpecified != attestationProtocol)
3177+
if (!string.IsNullOrWhiteSpace(_connHandler.ConnectionOptions.EnclaveAttestationUrl) && attestationProtocol != SqlConnectionAttestationProtocol.NotSpecified)
31783178
{
31793179
throw SQL.EnclaveComputationsNotSupported();
31803180
}
31813181
else if (!string.IsNullOrWhiteSpace(_connHandler.ConnectionOptions.EnclaveAttestationUrl))
31823182
{
31833183
throw SQL.AttestationURLNotSupported();
31843184
}
3185-
else if (SqlConnectionAttestationProtocol.NotSpecified != _connHandler.ConnectionOptions.AttestationProtocol)
3185+
else if (_connHandler.ConnectionOptions.AttestationProtocol != SqlConnectionAttestationProtocol.NotSpecified)
31863186
{
31873187
throw SQL.AttestationProtocolNotSupported();
31883188
}
31893189
}
31903190

31913191
// Check if enclave attestation url was specified and server does not return an enclave type and we aren't going to be routed to another server.
3192-
if (!string.IsNullOrWhiteSpace(_connHandler.ConnectionOptions.EnclaveAttestationUrl))
3192+
if (!string.IsNullOrWhiteSpace(_connHandler.ConnectionOptions.EnclaveAttestationUrl) || attestationProtocol == SqlConnectionAttestationProtocol.None)
31933193
{
31943194
if (string.IsNullOrWhiteSpace(EnclaveType))
31953195
{
@@ -3200,7 +3200,7 @@ private bool TryProcessFeatureExtAck(TdsParserStateObject stateObj)
32003200
// Check if the attestation protocol is specified and supports the enclave type.
32013201
if (SqlConnectionAttestationProtocol.NotSpecified != attestationProtocol && !IsValidAttestationProtocol(attestationProtocol, EnclaveType))
32023202
{
3203-
throw SQL.AttestationProtocolNotSupportEnclaveType(ConvertAttestationProtocolToString(attestationProtocol), EnclaveType);
3203+
throw SQL.AttestationProtocolNotSupportEnclaveType(attestationProtocol.ToString(), EnclaveType);
32043204
}
32053205
}
32063206
}
@@ -3215,10 +3215,8 @@ private bool IsValidAttestationProtocol(SqlConnectionAttestationProtocol attesta
32153215
{
32163216
case TdsEnums.ENCLAVE_TYPE_VBS:
32173217
if (attestationProtocol != SqlConnectionAttestationProtocol.AAS
3218-
#if ENCLAVE_SIMULATOR
3219-
&& attestationProtocol != SqlConnectionAttestationProtocol.SIM
3220-
#endif
3221-
&& attestationProtocol != SqlConnectionAttestationProtocol.HGS)
3218+
&& attestationProtocol != SqlConnectionAttestationProtocol.HGS
3219+
&& attestationProtocol != SqlConnectionAttestationProtocol.None)
32223220
{
32233221
return false;
32243222
}
@@ -3227,7 +3225,7 @@ private bool IsValidAttestationProtocol(SqlConnectionAttestationProtocol attesta
32273225
case TdsEnums.ENCLAVE_TYPE_SGX:
32283226
#if ENCLAVE_SIMULATOR
32293227
if (attestationProtocol != SqlConnectionAttestationProtocol.AAS
3230-
&& attestationProtocol != SqlConnectionAttestationProtocol.SIM)
3228+
&& attestationProtocol != SqlConnectionAttestationProtocol.None)
32313229
#else
32323230
if (attestationProtocol != SqlConnectionAttestationProtocol.AAS)
32333231
#endif
@@ -3238,7 +3236,7 @@ private bool IsValidAttestationProtocol(SqlConnectionAttestationProtocol attesta
32383236

32393237
#if ENCLAVE_SIMULATOR
32403238
case TdsEnums.ENCLAVE_TYPE_SIMULATOR:
3241-
if (attestationProtocol != SqlConnectionAttestationProtocol.SIM)
3239+
if (attestationProtocol != SqlConnectionAttestationProtocol.None)
32423240
{
32433241
return false;
32443242
}
@@ -3252,26 +3250,6 @@ private bool IsValidAttestationProtocol(SqlConnectionAttestationProtocol attesta
32523250
return true;
32533251
}
32543252

3255-
private string ConvertAttestationProtocolToString(SqlConnectionAttestationProtocol attestationProtocol)
3256-
{
3257-
switch (attestationProtocol)
3258-
{
3259-
case SqlConnectionAttestationProtocol.AAS:
3260-
return "AAS";
3261-
3262-
case SqlConnectionAttestationProtocol.HGS:
3263-
return "HGS";
3264-
3265-
#if ENCLAVE_SIMULATOR
3266-
case SqlConnectionAttestationProtocol.SIM:
3267-
return "SIM";
3268-
#endif
3269-
3270-
default:
3271-
return "NotSpecified";
3272-
}
3273-
}
3274-
32753253
private bool TryReadByteString(TdsParserStateObject stateObj, out string value)
32763254
{
32773255
value = string.Empty;

‎src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -889,10 +889,8 @@ public enum SqlConnectionAttestationProtocol
889889
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/AAS/*' />
890890
AAS = 1,
891891

892-
#if ENCLAVE_SIMULATOR
893-
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/SIM/*' />
894-
SIM = 2,
895-
#endif
892+
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/None/*' />
893+
None = 2,
896894

897895
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/HGS/*' />
898896
HGS = 3

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlCommand.cs‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -160,10 +160,9 @@ internal bool IsColumnEncryptionEnabled
160160
}
161161
}
162162

163-
internal bool ShouldUseEnclaveBasedWorkflow
164-
{
165-
get { return !string.IsNullOrWhiteSpace(_activeConnection.EnclaveAttestationUrl) && IsColumnEncryptionEnabled; }
166-
}
163+
internal bool ShouldUseEnclaveBasedWorkflow =>
164+
(!string.IsNullOrWhiteSpace(_activeConnection.EnclaveAttestationUrl) || Connection.AttestationProtocol == SqlConnectionAttestationProtocol.None) &&
165+
IsColumnEncryptionEnabled;
167166

168167
internal ConcurrentDictionary<int, SqlTceCipherInfoEntry> keysToBeSentToEnclave;
169168
internal bool requiresEnclaveComputations = false;
@@ -4780,7 +4779,7 @@ private void ReadDescribeEncryptionParameterResults(SqlDataReader ds, ReadOnlyDi
47804779

47814780
if (isRequestedByEnclave)
47824781
{
4783-
if (string.IsNullOrWhiteSpace(this.Connection.EnclaveAttestationUrl))
4782+
if (string.IsNullOrWhiteSpace(this.Connection.EnclaveAttestationUrl) && Connection.AttestationProtocol != SqlConnectionAttestationProtocol.None)
47844783
{
47854784
throw SQL.NoAttestationUrlSpecifiedForEnclaveBasedQuerySpDescribe(this._activeConnection.Parser.EnclaveType);
47864785
}
@@ -5244,8 +5243,11 @@ private void GenerateEnclavePackage()
52445243
return;
52455244
}
52465245

5247-
if (string.IsNullOrWhiteSpace(this._activeConnection.EnclaveAttestationUrl))
5246+
if (string.IsNullOrWhiteSpace(this._activeConnection.EnclaveAttestationUrl) &&
5247+
Connection.AttestationProtocol != SqlConnectionAttestationProtocol.None)
5248+
{
52485249
throw SQL.NoAttestationUrlSpecifiedForEnclaveBasedQueryGeneratingEnclavePackage(this._activeConnection.Parser.EnclaveType);
5250+
}
52495251

52505252
string enclaveType = this._activeConnection.Parser.EnclaveType;
52515253
if (string.IsNullOrWhiteSpace(enclaveType))

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsEnums.cs‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1069,10 +1069,8 @@ public enum SqlConnectionAttestationProtocol
10691069
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/AAS/*' />
10701070
AAS = 1,
10711071

1072-
#if ENCLAVE_SIMULATOR
1073-
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/SIM/*' />
1074-
SIM = 2,
1075-
#endif
1072+
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/None/*' />
1073+
None = 2,
10761074

10771075
/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionAttestationProtocol.xml' path='docs/members[@name="SqlConnectionAttestationProtocol"]/HGS/*' />
10781076
HGS = 3

0 commit comments

Comments
 (0)