Skip to content

Commit

Permalink
Sync similar elements Enclaves (#887)
Browse files Browse the repository at this point in the history
  • Loading branch information
@Wraith2
Wraith2 authored Mar 18, 2021
1 parent 59d8b70 commit 3943647
Show file tree
Hide file tree
Showing 17 changed files with 529 additions and 1,268 deletions.
31 changes: 25 additions & 6 deletions src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -319,6 +319,12 @@
<Compile Include="..\..\src\Microsoft\Data\SqlClient\AlwaysEncryptedAttestationException.cs">
<Link>Microsoft\Data\SqlClient\AlwaysEncryptedAttestationException.cs</Link>
</Compile>
<Compile Include="..\..\src\Microsoft\Data\SqlClient\AlwaysEncryptedEnclaveProviderUtils.cs">
<Link>Microsoft\Data\SqlClient\AlwaysEncryptedEnclaveProviderUtils.cs</Link>
</Compile>
<Compile Include="..\..\src\Microsoft\Data\SqlClient\AlwaysEncryptedKeyConverter.cs">
<Link>Microsoft\Data\SqlClient\AlwaysEncryptedKeyConverter.cs</Link>
</Compile>
<Compile Include="..\..\src\Microsoft\Data\SqlClient\EnclaveProviderBase.cs">
<Link>Microsoft\Data\SqlClient\EnclaveProviderBase.cs</Link>
</Compile>
Expand All @@ -327,11 +333,12 @@
</Compile>
<Compile Include="Microsoft\Data\SqlClient\SqlColumnEncryptionEnclaveProvider.NetCoreApp.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlEnclaveAttestationParameters.NetCoreApp.cs" />
<Compile Include="Microsoft\Data\SqlClient\EnclaveDelegate.NetCoreApp.cs" />
<Compile Include="Microsoft\Data\SqlClient\EnclaveDelegate.CrossPlatformCrypto.cs" />
<Compile Include="Microsoft\Data\SqlClient\AzureAttestationBasedEnclaveProvider.cs" />
<Compile Include="Microsoft\Data\SqlClient\VirtualSecureModeEnclaveProvider.cs" />
<Compile Include="..\..\src\Microsoft\Data\SqlClient\VirtualSecureModeEnclaveProvider.cs">
<Link>Microsoft\Data\SqlClient\VirtualSecureModeEnclaveProvider.cs</Link>
</Compile>
<Compile Include="Microsoft\Data\SqlClient\VirtualSecureModeEnclaveProviderBase.cs" />
<Compile Include="Microsoft\Data\SqlClient\AlwaysEncryptedEnclaveProviderUtils.cs" />
</ItemGroup>
<!-- netcoreapp 3.1 & netstandard 2.1 and above -->
<ItemGroup Condition="'$(OSGroup)' != 'AnyOS' AND '$(TargetFramework)' != 'netcoreapp2.1' AND '$(TargetFramework)' != 'netstandard2.0'">
Expand Down Expand Up @@ -419,6 +426,12 @@
<Compile Include="Microsoft\Data\ProviderBase\DbConnectionInternal.cs" />
<Compile Include="Microsoft\Data\ProviderBase\DbConnectionPool.cs" />
<Compile Include="Microsoft\Data\ProviderBase\DbConnectionPoolIdentity.cs" />
<Compile Include="..\..\src\Microsoft\Data\SqlClient\EnclaveDelegate.cs">
<Link>Microsoft\Data\SqlClient\EnclaveDelegate.cs</Link>
</Compile>
<Compile Include="..\..\src\Microsoft\Data\SqlClient\EnclavePackage.cs">
<Link>Microsoft\Data\SqlClient\EnclavePackage.cs</Link>
</Compile>
<Compile Include="Microsoft\Data\SqlClient\SqlAuthenticationProviderManager.cs" />
<Compile Include="Microsoft\Data\SqlClient\Server\SqlNorm.cs" />
<Compile Include="Microsoft\Data\SqlClient\Server\SqlSer.cs" />
Expand Down Expand Up @@ -451,6 +464,9 @@
<Compile Include="Microsoft\Data\SqlClient\SqlEnums.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlError.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlErrorCollection.cs" />
<Compile Include="..\..\src\Microsoft\Data\SqlClient\SqlEnclaveSession.cs">
<Link>Microsoft\Data\SqlClient\SqlEnclaveSession.cs</Link>
</Compile>
<Compile Include="Microsoft\Data\SqlClient\SqlException.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlInfoMessageEvent.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlInternalConnection.cs" />
Expand Down Expand Up @@ -506,12 +522,15 @@
<Compile Include="Microsoft\Data\SqlClient\SqlCredential.cs" />
<Compile Include="Microsoft\Data\SqlClient\AlwaysEncryptedHelperClasses.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlSecurityUtility.cs" />
<Compile Include="Microsoft\Data\SqlClient\EnclavePackage.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlEnclaveSession.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlQueryMetadataCache.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlColumnEncryptionEnclaveProvider.cs" />
<Compile Include="Microsoft\Data\SqlClient\SqlEnclaveAttestationParameters.cs" />
<Compile Include="Microsoft\Data\SqlClient\EnclaveDelegate.cs" />
<Compile Include="..\..\src\Microsoft\Data\SqlClient\Reliability\SqlConfigurableRetryLogicManager.cs">
<Link>Microsoft\Data\SqlClient\Reliability\SqlConfigurableRetryLogicManager.cs</Link>
</Compile>
<Compile Include="..\..\src\Microsoft\Data\SqlClient\SqlUtil.cs">
<Link>Microsoft\Data\SqlClient\SqlUtil.cs</Link>
</Compile>
</ItemGroup>
<!-- Windows only -->
<ItemGroup Condition="'$(TargetsWindows)' == 'true'">
Expand Down
21 changes: 10 additions & 11 deletions ...ta.SqlClient/netcore/src/Microsoft/Data/SqlClient/AzureAttestationBasedEnclaveProvider.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@ public AzureAttestationInfo(byte[] attestationInfo)
}
catch (Exception exception)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.FailToParseAttestationInfo, exception.Message));
throw new AlwaysEncryptedAttestationException(string.Format(Strings.FailToParseAttestationInfo, exception.Message));
}
}
}
Expand Down Expand Up @@ -313,7 +313,7 @@ private void VerifyAzureAttestationInfo(string attestationUrl, EnclaveType encla

if (!isSignatureValid)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.AttestationTokenSignatureValidationFailed, exceptionMessage));
throw new AlwaysEncryptedAttestationException(string.Format(Strings.AttestationTokenSignatureValidationFailed, exceptionMessage));
}

// Validate claims in the token
Expand Down Expand Up @@ -349,7 +349,7 @@ private OpenIdConnectConfiguration GetOpenIdConfigForSigningKeys(string url, boo
}
catch (Exception exception)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.GetAttestationTokenSigningKeysFailed, GetInnerMostExceptionMessage(exception)), exception);
throw new AlwaysEncryptedAttestationException(string.Format(Strings.GetAttestationTokenSigningKeysFailed, GetInnerMostExceptionMessage(exception)), exception);
}

OpenIdConnectConfigurationCache.Add(url, openIdConnectConfig, DateTime.UtcNow.AddDays(1));
Expand Down Expand Up @@ -381,7 +381,7 @@ private static ICollection<string> GenerateListOfIssuers(string tokenIssuerUrl)

if (isDefaultPort)
{
issuerUrls.Add(String.Concat(issuerUrl, ":", port.ToString()));
issuerUrls.Add(string.Concat(issuerUrl, ":", port.ToString()));
}

return issuerUrls;
Expand Down Expand Up @@ -428,7 +428,7 @@ private bool VerifyTokenSignature(string attestationToken, string tokenIssuerUrl
}
catch (Exception exception)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.InvalidAttestationToken, GetInnerMostExceptionMessage(exception)));
throw new AlwaysEncryptedAttestationException(string.Format(Strings.InvalidAttestationToken, GetInnerMostExceptionMessage(exception)));
}

return isSignatureValid;
Expand Down Expand Up @@ -456,15 +456,15 @@ private byte[] ComputeSHA256(byte[] data)
private void ValidateAttestationClaims(EnclaveType enclaveType, string attestationToken, EnclavePublicKey enclavePublicKey, byte[] nonce)
{
// Read the json token
JsonWebToken token = null;
JsonWebToken token;
try
{
JsonWebTokenHandler tokenHandler = new JsonWebTokenHandler();
token = tokenHandler.ReadJsonWebToken(attestationToken);
}
catch (ArgumentException argumentException)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.FailToParseAttestationToken, argumentException.Message));
throw new AlwaysEncryptedAttestationException(string.Format(Strings.FailToParseAttestationToken, argumentException.Message));
}

// Get all the claims from the token
Expand Down Expand Up @@ -492,7 +492,7 @@ private void ValidateClaim(Dictionary<string, string> claims, string claimName,
bool hasClaim = claims.TryGetValue(claimName, out claimData);
if (!hasClaim)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.MissingClaimInAttestationToken, claimName));
throw new AlwaysEncryptedAttestationException(string.Format(Strings.MissingClaimInAttestationToken, claimName));
}

// Get the Base64Url of the actual data and compare it with claim
Expand All @@ -506,14 +506,13 @@ private void ValidateClaim(Dictionary<string, string> claims, string claimName,
throw new AlwaysEncryptedAttestationException(Strings.InvalidArgumentToBase64UrlDecoder);
}

bool hasValidClaim = String.Equals(encodedActualData, claimData, StringComparison.Ordinal);
bool hasValidClaim = string.Equals(encodedActualData, claimData, StringComparison.Ordinal);
if (!hasValidClaim)
{
throw new AlwaysEncryptedAttestationException(String.Format(Strings.InvalidClaimInAttestationToken, claimName, claimData));
throw new AlwaysEncryptedAttestationException(string.Format(Strings.InvalidClaimInAttestationToken, claimName, claimData));
}
}

// Derives the shared secret between the client and enclave.
private byte[] GetSharedSecret(EnclavePublicKey enclavePublicKey, byte[] nonce, EnclaveType enclaveType, EnclaveDiffieHellmanInfo enclaveDHInfo, ECDiffieHellman clientDHKey)
{
byte[] enclaveRsaPublicKey = enclavePublicKey.PublicKey;
Expand Down
Loading

0 comments on commit 3943647

Please sign in to comment.