Skip to content

Commit 7af2438

Browse files
arelleguearellegue
authored
Fix | Enhance certificate validation (#2487)
1 parent 808d4c3 commit 7af2438

File tree

18 files changed

+771
-196
lines changed

18 files changed

+771
-196
lines changed

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNICommon.cs‎

Lines changed: 107 additions & 149 deletions
Large diffs are not rendered by default.

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNINpHandle.cs‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ internal sealed class SNINpHandle : SNIPhysicalHandle
2424

2525
private readonly string _targetServer;
2626
private readonly object _sendSync;
27+
private readonly string _hostNameInCertificate;
28+
private readonly string _serverCertificateFilename;
2729
private readonly bool _tlsFirst;
2830
private Stream _stream;
2931
private NamedPipeClientStream _pipeStream;
@@ -38,7 +40,7 @@ internal sealed class SNINpHandle : SNIPhysicalHandle
3840
private int _bufferSize = TdsEnums.DEFAULT_LOGIN_PACKET_SIZE;
3941
private readonly Guid _connectionId = Guid.NewGuid();
4042

41-
public SNINpHandle(string serverName, string pipeName, TimeoutTimer timeout, bool tlsFirst)
43+
public SNINpHandle(string serverName, string pipeName, TimeoutTimer timeout, bool tlsFirst, string hostNameInCertificate, string serverCertificateFilename)
4244
{
4345
using (TrySNIEventScope.Create(nameof(SNINpHandle)))
4446
{
@@ -47,6 +49,8 @@ public SNINpHandle(string serverName, string pipeName, TimeoutTimer timeout, boo
4749
_sendSync = new object();
4850
_targetServer = serverName;
4951
_tlsFirst = tlsFirst;
52+
_hostNameInCertificate = hostNameInCertificate;
53+
_serverCertificateFilename = serverCertificateFilename;
5054
try
5155
{
5256
_pipeStream = new NamedPipeClientStream(
@@ -369,23 +373,23 @@ public override void DisableSsl()
369373
/// Validate server certificate
370374
/// </summary>
371375
/// <param name="sender">Sender object</param>
372-
/// <param name="cert">X.509 certificate</param>
376+
/// <param name="serverCertificate">X.509 certificate</param>
373377
/// <param name="chain">X.509 chain</param>
374378
/// <param name="policyErrors">Policy errors</param>
375379
/// <returns>true if valid</returns>
376-
private bool ValidateServerCertificate(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors policyErrors)
380+
private bool ValidateServerCertificate(object sender, X509Certificate serverCertificate, X509Chain chain, SslPolicyErrors policyErrors)
377381
{
378382
using (TrySNIEventScope.Create(nameof(SNINpHandle)))
379-
{
383+
{
380384
if (!_validateCert)
381385
{
382386
SqlClientEventSource.Log.TrySNITraceEvent(nameof(SNINpHandle), EventType.INFO, "Connection Id {0}, Certificate validation not requested.", args0: ConnectionId);
383387
return true;
384388
}
385389

386390
SqlClientEventSource.Log.TrySNITraceEvent(nameof(SNINpHandle), EventType.INFO, "Connection Id {0}, Proceeding to SSL certificate validation.", args0: ConnectionId);
387-
return SNICommon.ValidateSslServerCertificate(_targetServer, cert, policyErrors);
388-
}
391+
return SNICommon.ValidateSslServerCertificate(_connectionId, _targetServer, _hostNameInCertificate, serverCertificate, _serverCertificateFilename, policyErrors);
392+
}
389393
}
390394

391395
/// <summary>

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNIProxy.cs‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ internal static SNIHandle CreateConnectionHandle(
206206
tlsFirst, hostNameInCertificate, serverCertificateFilename);
207207
break;
208208
case DataSource.Protocol.NP:
209-
sniHandle = CreateNpHandle(details, timeout, parallel, tlsFirst);
209+
sniHandle = CreateNpHandle(details, timeout, parallel, tlsFirst, hostNameInCertificate, serverCertificateFilename);
210210
break;
211211
default:
212212
Debug.Fail($"Unexpected connection protocol: {details._connectionProtocol}");
@@ -362,16 +362,18 @@ private static SNITCPHandle CreateTcpHandle(
362362
/// <param name="timeout">Timer expiration</param>
363363
/// <param name="parallel">Should MultiSubnetFailover be used. Only returns an error for named pipes.</param>
364364
/// <param name="tlsFirst"></param>
365+
/// <param name="hostNameInCertificate">Host name in certificate</param>
366+
/// <param name="serverCertificateFilename">Used for the path to the Server Certificate</param>
365367
/// <returns>SNINpHandle</returns>
366-
private static SNINpHandle CreateNpHandle(DataSource details, TimeoutTimer timeout, bool parallel, bool tlsFirst)
368+
private static SNINpHandle CreateNpHandle(DataSource details, TimeoutTimer timeout, bool parallel, bool tlsFirst, string hostNameInCertificate, string serverCertificateFilename)
367369
{
368370
if (parallel)
369371
{
370372
// Connecting to a SQL Server instance using the MultiSubnetFailover connection option is only supported when using the TCP protocol
371373
SNICommon.ReportSNIError(SNIProviders.NP_PROV, 0, SNICommon.MultiSubnetFailoverWithNonTcpProtocol, Strings.SNI_ERROR_49);
372374
return null;
373375
}
374-
return new SNINpHandle(details.PipeHostName, details.PipeName, timeout, tlsFirst);
376+
return new SNINpHandle(details.PipeHostName, details.PipeName, timeout, tlsFirst, hostNameInCertificate, serverCertificateFilename);
375377
}
376378

377379
/// <summary>
@@ -539,8 +541,10 @@ private void PopulateProtocol()
539541
internal static string GetLocalDBInstance(string dataSource, out bool error)
540542
{
541543
string instanceName = null;
544+
// ReadOnlySpan is not supported in netstandard 2.0, but installing System.Memory solves the issue
542545
ReadOnlySpan<char> input = dataSource.AsSpan().TrimStart();
543546
error = false;
547+
// NetStandard 2.0 does not support passing a string to ReadOnlySpan<char>
544548
int index = input.IndexOf(LocalDbHost.AsSpan().Trim(), StringComparison.InvariantCultureIgnoreCase);
545549
if (input.StartsWith(LocalDbHost_NP.AsSpan().Trim(), StringComparison.InvariantCultureIgnoreCase))
546550
{

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNITcpHandle.cs‎

Lines changed: 1 addition & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -644,7 +644,6 @@ public override uint EnableSsl(uint options)
644644
}
645645
else
646646
{
647-
// TODO: Resolve whether to send _serverNameIndication or _targetServer. _serverNameIndication currently results in error. Why?
648647
_sslStream.AuthenticateAsClient(_targetServer, null, s_supportedProtocols, false);
649648
}
650649
if (_sslOverTdsStream is not null)
@@ -698,33 +697,8 @@ private bool ValidateServerCertificate(object sender, X509Certificate serverCert
698697
return true;
699698
}
700699

701-
string serverNameToValidate;
702-
if (!string.IsNullOrEmpty(_hostNameInCertificate))
703-
{
704-
serverNameToValidate = _hostNameInCertificate;
705-
}
706-
else
707-
{
708-
serverNameToValidate = _targetServer;
709-
}
710-
711-
if (!string.IsNullOrEmpty(_serverCertificateFilename))
712-
{
713-
X509Certificate clientCertificate = null;
714-
try
715-
{
716-
clientCertificate = new X509Certificate(_serverCertificateFilename);
717-
return SNICommon.ValidateSslServerCertificate(clientCertificate, serverCertificate, policyErrors);
718-
}
719-
catch (Exception e)
720-
{
721-
// if this fails, then fall back to the HostNameInCertificate or TargetServer validation.
722-
SqlClientEventSource.Log.TrySNITraceEvent(nameof(SNITCPHandle), EventType.INFO, "Connection Id {0}, IOException occurred: {1}", args0: _connectionId, args1: e.Message);
723-
}
724-
}
725-
726700
SqlClientEventSource.Log.TrySNITraceEvent(nameof(SNITCPHandle), EventType.INFO, "Connection Id {0}, Certificate will be validated for Target Server name", args0: _connectionId);
727-
return SNICommon.ValidateSslServerCertificate(serverNameToValidate, serverCertificate, policyErrors);
701+
return SNICommon.ValidateSslServerCertificate(_connectionId, _targetServer, _hostNameInCertificate, serverCertificate, _serverCertificateFilename, policyErrors);
728702
}
729703

730704
/// <summary>

‎src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs‎

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Microsoft.Data.SqlClient/src/Resources/Strings.resx‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4737,4 +4737,7 @@
47374737
<data name="SQL_RemoteCertificateNotAvailable" xml:space="preserve">
47384738
<value>Certificate not available while validating the certificate.</value>
47394739
</data>
4740+
<data name="SQL_RemoteCertificateDoesNotMatchServerCertificate" xml:space="preserve">
4741+
<value>The certificate provided by the server does not match the certificate provided by the ServerCertificate option.</value>
4742+
</data>
47404743
</root>

‎src/Microsoft.Data.SqlClient/tests/FunctionalTests/SqlConnectionBasicTests.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
using System.Security;
1313
using System.Threading;
1414
using System.Threading.Tasks;
15+
using Microsoft.SqlServer.TDS.PreLogin;
1516
using Microsoft.SqlServer.TDS.Servers;
1617
using Xunit;
1718

‎src/Microsoft.Data.SqlClient/tests/FunctionalTests/TestTdsServer.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,5 @@ public static TestTdsServer StartTestServer(bool enableFedAuth = false, bool ena
6565
public void Dispose() => _endpoint?.Stop();
6666

6767
public string ConnectionString { get; private set; }
68-
6968
}
7069
}

‎src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/ConnectionTestParameters.cs‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Licensed to the .NET Foundation under one or more agreements.
2+
// The .NET Foundation licenses this file to you under the MIT license.
3+
// See the LICENSE file in the project root for more information.
4+
5+
using System;
6+
using System.Collections.Generic;
7+
using System.Linq;
8+
using System.Text;
9+
using System.Threading.Tasks;
10+
using Microsoft.SqlServer.TDS.PreLogin;
11+
12+
namespace Microsoft.Data.SqlClient.ManualTesting.Tests.DataCommon
13+
{
14+
public class ConnectionTestParameters
15+
{
16+
private SqlConnectionEncryptOption _encryptionOption;
17+
private TDSPreLoginTokenEncryptionType _encryptionType;
18+
private string _hnic;
19+
private string _cert;
20+
private bool _result;
21+
private bool _trustServerCert;
22+
23+
public SqlConnectionEncryptOption Encrypt => _encryptionOption;
24+
public bool TrustServerCertificate => _trustServerCert;
25+
public string Certificate => _cert;
26+
public string HostNameInCertificate => _hnic;
27+
public bool TestResult => _result;
28+
public TDSPreLoginTokenEncryptionType TdsEncryptionType => _encryptionType;
29+
30+
public ConnectionTestParameters(TDSPreLoginTokenEncryptionType tdsEncryptionType, SqlConnectionEncryptOption encryptOption, bool trustServerCert, string cert, string hnic, bool result)
31+
{
32+
_encryptionOption = encryptOption;
33+
_trustServerCert = trustServerCert;
34+
_cert = cert;
35+
_hnic = hnic;
36+
_result = result;
37+
_encryptionType = tdsEncryptionType;
38+
}
39+
}
40+
}

‎src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/ConnectionTestParametersData.cs‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
// Licensed to the .NET Foundation under one or more agreements.
2+
// The .NET Foundation licenses this file to you under the MIT license.
3+
// See the LICENSE file in the project root for more information.
4+
5+
using System.Collections.Generic;
6+
using System.IO;
7+
using Microsoft.SqlServer.TDS.PreLogin;
8+
9+
namespace Microsoft.Data.SqlClient.ManualTesting.Tests.DataCommon
10+
{
11+
public class ConnectionTestParametersData
12+
{
13+
private const int CASES = 30;
14+
private string _empty = string.Empty;
15+
// It was advised to store the client certificate in its own folder.
16+
private static readonly string s_fullPathToCer = Path.Combine(Directory.GetCurrentDirectory(), "clientcert", "localhostcert.cer");
17+
private static readonly string s_mismatchedcert = Path.Combine(Directory.GetCurrentDirectory(), "clientcert", "mismatchedcert.cer");
18+
19+
private static readonly string s_hostName = System.Net.Dns.GetHostName();
20+
public static ConnectionTestParametersData Data { get; } = new ConnectionTestParametersData();
21+
public List<ConnectionTestParameters> ConnectionTestParametersList { get; set; }
22+
23+
public static IEnumerable<object[]> GetConnectionTestParameters()
24+
{
25+
for (int i = 0; i < CASES; i++)
26+
{
27+
yield return new object[] { Data.ConnectionTestParametersList[i] };
28+
}
29+
}
30+
31+
public ConnectionTestParametersData()
32+
{
33+
// Test cases possible field values for connection parameters:
34+
// These combinations are based on the possible values of Encrypt, TrustServerCertificate, Certificate, HostNameInCertificate
35+
/*
36+
* TDSEncryption | Encrypt | TrustServerCertificate | Certificate | HNIC | TestResults
37+
* ----------------------------------------------------------------------------------------------
38+
* Off | Optional | true | valid | valid name | true
39+
* On | Mandatory | false | mismatched | empty | false
40+
* Required | | x | ChainError? | wrong name? |
41+
*/
42+
ConnectionTestParametersList = new List<ConnectionTestParameters>
43+
{
44+
// TDSPreLoginTokenEncryptionType.Off
45+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Optional, false, _empty, _empty, true),
46+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, false, _empty, _empty, false),
47+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Optional, true, _empty, _empty, true),
48+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, true, _empty, _empty, true),
49+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, false, s_fullPathToCer, _empty, true),
50+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, true, s_fullPathToCer, _empty, true),
51+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, false, _empty, s_hostName, false),
52+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, true, _empty, s_hostName, true),
53+
54+
// TDSPreLoginTokenEncryptionType.On
55+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Optional, false, _empty, _empty, false),
56+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, false, _empty, _empty, false),
57+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Optional, true, _empty, _empty, true),
58+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, true, _empty, _empty, true),
59+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, false, s_fullPathToCer, _empty, true),
60+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, true, s_fullPathToCer, _empty, true),
61+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, false, _empty, s_hostName, false),
62+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, true, _empty, s_hostName, true),
63+
64+
// TDSPreLoginTokenEncryptionType.Required
65+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Optional, false, _empty, _empty, false),
66+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, false, _empty, _empty, false),
67+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Optional, true, _empty, _empty, true),
68+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, true, _empty, _empty, true),
69+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, false, s_fullPathToCer, _empty, true),
70+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, true, s_fullPathToCer, _empty, true),
71+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, false, _empty, s_hostName, false),
72+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, true, _empty, s_hostName, true),
73+
74+
// Mismatched certificate test
75+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, false, s_mismatchedcert, _empty, false),
76+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, true, s_mismatchedcert, _empty, false),
77+
new(TDSPreLoginTokenEncryptionType.Off, SqlConnectionEncryptOption.Mandatory, true, s_mismatchedcert, _empty, true),
78+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, false, s_mismatchedcert, _empty, false),
79+
new(TDSPreLoginTokenEncryptionType.On, SqlConnectionEncryptOption.Mandatory, true, s_mismatchedcert, _empty, true),
80+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, false, s_mismatchedcert, _empty, false),
81+
new(TDSPreLoginTokenEncryptionType.Required, SqlConnectionEncryptOption.Mandatory, true, s_mismatchedcert, _empty, true),
82+
};
83+
}
84+
}
85+
}

0 commit comments

Comments
 (0)