Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new Attestation Protocol "None" - phase 2 #1425

Merged
merged 38 commits into from
Jan 24, 2022
Merged

Add new Attestation Protocol "None" - phase 2 #1425

merged 38 commits into from
Jan 24, 2022

Conversation

johnnypham
Copy link
Contributor

@johnnypham johnnypham commented Dec 8, 2021

Summary of feature
Currently, VBS enclaves are supported on-prem and SGX enclaves on Azure VMs. VBS support for Azure is in the works but strong attestation is not possible on Azure VMs due to restrictions against accessing the host machine's Trusted Platform Module (TPM).
A new attestation protocol called "None" will be allowed in the connection string, allowing users to forgo enclave attestation when using VBS enclaves: Attestation Protocol = None

Phase 2 changes

  • Attestation Protocol = None can now be added to the connection string. When this is set, the Enclave Attestation Url property is optional (it's required if Attestation Protocol is HGS or AAS).
  • Attestation Protocol = None only works when the server returns an enclave type of VBS. An exception is thrown for any other enclave type.
  • When using Attestation Protocol = None, the NoneAttestationEnclaveProvider will be used to set up an enclave session. This provider does not perform attestation and only derives the shared secret required to set up a secure enclave session.
  • Building the driver with -p:BuildSimulator=true will still work, the driver will simply use NoneAttestationEnclaveProvider. When working with SQL Server in simulator mode, the attestation protocol should now be specified as None and not SIM.
  • Tests: all of the current enclave manual tests will be run with an additional connection string using Attestation Protocol = None. Example run

@DavoudEshtehari
Copy link
Contributor

/azp run

@azure-pipelines
Copy link

You have several pipelines (over 10) configured to build pull requests in this repository. Specify which pipelines you would like to run by using /azp run [pipelines] command. You can specify multiple pipelines using a comma separated list.

@johnnypham
Copy link
Contributor Author

johnnypham commented Jan 5, 2022

The main purpose of having ENCLAVE_SIMULATOR directive comes from SqlConnectionAttestationProtocol.SIM which is now updated with NONE and available as a public API. I believe we can get rid of it.

#if ENCLAVE_SIMULATOR is still needed. SQL Server can run in simulator mode wherein the server will send an enclave type of SIMULATOR. When this happens, we still need the code inside those directives. For example, we still need the simulator if you want to simulate attestation with SGX enclaves, since "None" attestation won't work for SGX.

…st/ExceptionTest.cs

Co-authored-by: DavoudEshtehari <61173489+DavoudEshtehari@users.noreply.github.com>
@johnnypham johnnypham added this to the 4.1.0 milestone Jan 10, 2022
@johnnypham johnnypham added the 🆕 Public API Issues/PRs that introduce new APIs to the driver. label Jan 10, 2022
…ptedTests/ConnectionStringBuilderShould.cs

Co-authored-by: DavoudEshtehari <61173489+DavoudEshtehari@users.noreply.github.com>
@JRahnama JRahnama merged commit 3b945ee into dotnet:main Jan 24, 2022
DavoudEshtehari added a commit to DavoudEshtehari/SqlClient that referenced this pull request Jan 27, 2022
# Conflicts:
#	src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsEnums.cs
DavoudEshtehari added a commit to DavoudEshtehari/SqlClient that referenced this pull request Jan 27, 2022
# Conflicts:
#	src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsEnums.cs
@johnnypham johnnypham deleted the none-attest branch January 27, 2022 18:10
@DavoudEshtehari DavoudEshtehari modified the milestones: 4.1.0, 5.0.0-preview1 Jan 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🆕 Public API Issues/PRs that introduce new APIs to the driver.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants