-
Notifications
You must be signed in to change notification settings - Fork 316
Add new Attestation Protocol "None" - phase 2 #1425
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…and to verify out of range for LocaleId
…rator and GetService for netfx and CreateCommandBuilder for both
|
/azp run |
|
You have several pipelines (over 10) configured to build pull requests in this repository. Specify which pipelines you would like to run by using /azp run [pipelines] command. You can specify multiple pipelines using a comma separated list. |
|
…st/ExceptionTest.cs Co-authored-by: DavoudEshtehari <[email protected]>
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/EnclaveDelegate.Crypto.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlCommand.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsParser.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/TdsParser.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/EnclaveDelegate.Crypto.cs
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/EnclaveDelegate.Crypto.cs
Show resolved
Hide resolved
...t.Data.SqlClient/tests/FunctionalTests/AlwaysEncryptedTests/ConnectionStringBuilderShould.cs
Show resolved
Hide resolved
...t.Data.SqlClient/tests/FunctionalTests/AlwaysEncryptedTests/ConnectionStringBuilderShould.cs
Outdated
Show resolved
Hide resolved
...t.Data.SqlClient/tests/FunctionalTests/AlwaysEncryptedTests/ConnectionStringBuilderShould.cs
Outdated
Show resolved
Hide resolved
...t.Data.SqlClient/tests/FunctionalTests/AlwaysEncryptedTests/ConnectionStringBuilderShould.cs
Outdated
Show resolved
Hide resolved
…ptedTests/ConnectionStringBuilderShould.cs Co-authored-by: DavoudEshtehari <[email protected]>
# Conflicts: # src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsEnums.cs
# Conflicts: # src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/TdsEnums.cs
Summary of feature
Currently, VBS enclaves are supported on-prem and SGX enclaves on Azure VMs. VBS support for Azure is in the works but strong attestation is not possible on Azure VMs due to restrictions against accessing the host machine's Trusted Platform Module (TPM).
A new attestation protocol called "None" will be allowed in the connection string, allowing users to forgo enclave attestation when using VBS enclaves:
Attestation Protocol = NonePhase 2 changes
Attestation Protocol = Nonecan now be added to the connection string. When this is set, theEnclave Attestation Urlproperty is optional (it's required ifAttestation ProtocolisHGSorAAS).Attestation Protocol = Noneonly works when the server returns an enclave type ofVBS. An exception is thrown for any other enclave type.Attestation Protocol = None, theNoneAttestationEnclaveProviderwill be used to set up an enclave session. This provider does not perform attestation and only derives the shared secret required to set up a secure enclave session.-p:BuildSimulator=truewill still work, the driver will simply useNoneAttestationEnclaveProvider. When working with SQL Server in simulator mode, the attestation protocol should now be specified asNoneand notSIM.Attestation Protocol = None. Example run