Add CA Certificate validation by caleblloyd · Pull Request #280 · mysql-net/MySqlConnector

caleblloyd · 2017-06-22T13:33:28Z

Fixes Specify Acceptable Server CA / Expose SslStream? #278
Please review for technical issues. I took most of the implementation from the two SO answers here. If there is a better way to validate certificate chains, comment away.
I've hand tested; need to write Unit tests for this before it is ready to be merged

bgrainger

Revert the MySqlConnectionStringBuilder API changes.

The certificate checking looks OK, but I've never used those APIs before so it's hard to know if I'm overlooking anything.

bgrainger · 2017-06-22T13:57:26Z

 			set => MySqlConnectionStringOption.SslMode.SetValue(this, value);
 		}

-		public string CertificateFile


Even though the old names are bad and confusing, we should keep them for compatibility with Connector/Net.

Oh yea, forgot this class was Public. I'll change it back.

bgrainger · 2017-06-22T13:58:24Z

-			AddOption(CertificateFile = new MySqlConnectionStringOption<string>(
-				keys: new[] { "CertificateFile", "Certificate File" },
+			AddOption(ClientCertificate = new MySqlConnectionStringOption<string>(
+				keys: new[] { "ClientCertificate", "Client Certificate", "CertificateFile", "Certificate File" },


Although it's not a breaking change to add ClientCertificate as an alias, I'm not sure there's real value in doing so. Since we need to keep CertificateFile as the C# property name, might as well just be consistent with that.

We've got 2 things named Certificate now, a Client Certificate and a CA Certificate. I think an alias could help users qualify which one they're dealing with.

bgrainger · 2017-06-22T13:59:29Z

-		public string CertificatePassword { get; }
+		public string ClientCertificate { get; }
+		public string ClientCertificatePassword { get; }
+		public string CACertificate { get; }


I'm OK with renaming the properties here (on our internal class) to make it clear what each one stores.

Although I wonder if ClientCertificateFilePath would be better for clarity.

Yes, adding FilePath makes sense

bgrainger · 2017-06-22T14:04:37Z

+					if (cs.SslMode == MySqlSslMode.Preferred || cs.SslMode == MySqlSslMode.Required)
+						return true;
+
+					if ((rcbPolicyErrors & SslPolicyErrors.RemoteCertificateChainErrors) > 0 && cs.CACertificate != null)


Nitpick: I would write != 0 for testing a bitflag. (> 0 first made me think it was a count of errors, not testing a flag.)

bgrainger · 2017-06-22T14:06:40Z

+							if (!File.Exists(cs.CACertificate))
+								throw new MySqlException("Cannot find CA Certificate File", ex);
+							throw new MySqlException("The CA Certificate File is invalid", ex);
+						}


I wonder if constructing caCertificate should be done outside the callback. I also wonder if any MySqlException that is thrown gets passed through, or would it end up being wrapped by, say, a CryptographicException? (I haven't tested to see.)

It probably should. There's an extremely rare case where the CA was already validated and this construction gets skipped completely, but in that case they wouldn't need to supply a CA certificate at all. I'll move it out.

caleblloyd · 2017-06-22T17:06:36Z

I reverted all of the naming changes and am simply calling the new option CACertificateFile. I think it should be clear enough that CertificateFile means "client certificate", so on second thought no need for an alias, which could create more confusion.

bgrainger · 2017-06-22T21:39:02Z

 		private async Task InitSslAsync(ProtocolCapabilities serverCapabilities, ConnectionSettings cs, IOBehavior ioBehavior, CancellationToken cancellationToken)
 		{
-			X509CertificateCollection clientCertificates = null;
+			X509CertificateCollection CertificateFiles = null;


This still only contains (a single) client certificate, correct? If so, I think the old name of clientCertificates is clearer.

Dang find/replace got me here

bgrainger · 2017-06-22T21:43:26Z

+					if (cs.CertificatePassword == null)
+						certificate = new X509Certificate2(cs.CertificateFile);
+					else
+						certificate = new X509Certificate2(cs.CertificateFile, cs.CertificatePassword);


Is this if/else necessary? It looks like the old code worked to pass a potentially-null cs.CertificatePassword as the second argument to the constructor, and I don't see any indication in the documentation that it can't be null. In corefx, the single-argument constructor just seems to pass null when it delegates to an overload.

So it feels like this could be simplified back to the old code.

Thanks for the CoreFX link. I wanted to make sure importing PEM encoded certs would work too and usually those aren't password protected. I'll change it back though since it runs through the same codepath.

bgrainger · 2017-06-22T21:44:02Z


-			Func<object, string, X509CertificateCollection, X509Certificate, string[], X509Certificate> localCertificateCb =
-				(lcbSender, lcbTargetHost, lcbLocalCertificates, lcbRemoteCertificate, lcbAcceptableIssuers) => lcbLocalCertificates[0];
+			X509Certificate LocalCertificateCb(object lcbSender, string lcbTargetHost, X509CertificateCollection lcbLocalCertificates, X509Certificate lcbRemoteCertificate, string[] lcbAcceptableIssuers) => lcbLocalCertificates[0];


Local function 👍

bgrainger · 2017-06-22T21:44:57Z


 			SslStream sslStream;
-			if (clientCertificates == null)
+			if (CertificateFiles == null || CertificateFiles.Count == 0)


I'm not sure how CertificateFiles.Count == 0 would happen.

This always-false condition should be removed, or line 641 should be updated with equivalent logic if it can happen (I lean towards the former).

Right, shouldn't happen. It just doesn't feel right referring to the element [0] without checking the count, but it has worked fine without this check so far. I'll take it out.

bgrainger

New code LGTM. As noted, I think there are some unnecessary changes from the current code that could be reverted before this is merged.

caleblloyd · 2017-06-23T00:47:40Z

I'll fix the things highlighted, thanks. I also need to add a handful of unit tests to test the CA validation and also check operation with PEM encoded certs.

caleblloyd · 2017-06-26T13:25:15Z

@bgrainger I've made the changes and added tests. This should be ready.

caleblloyd · 2017-06-26T13:26:40Z

Also I ran the SSL tests from Windows to a SSL Enabled MySQL server (since Appveyor doesn't have SSL enabled). They all passed, both our tests and the BASELINE tests.

bgrainger · 2017-06-29T15:34:17Z

Shipped in 0.22.0.

caleblloyd added the do not merge label Jun 22, 2017

caleblloyd force-pushed the f_ssl_ca branch from 45d133b to 6a4d2e8 Compare June 22, 2017 13:35

bgrainger requested changes Jun 22, 2017

View reviewed changes

caleblloyd force-pushed the f_ssl_ca branch from 6a4d2e8 to 0f2a18b Compare June 22, 2017 17:04

caleblloyd force-pushed the f_ssl_ca branch from 0f2a18b to 0721552 Compare June 22, 2017 17:19

bgrainger reviewed Jun 22, 2017

View reviewed changes

add CA Certificate validation

d7a6d8d

caleblloyd force-pushed the f_ssl_ca branch 3 times, most recently from b2e3bb0 to 1c4c534 Compare June 26, 2017 12:49

ssl tests and CACertificateFile docs

acead3a

caleblloyd force-pushed the f_ssl_ca branch from 1c4c534 to acead3a Compare June 26, 2017 13:03

caleblloyd removed the do not merge label Jun 26, 2017

bgrainger approved these changes Jun 26, 2017

View reviewed changes

bgrainger merged commit 9b22a2d into mysql-net:master Jun 26, 2017

caleblloyd deleted the f_ssl_ca branch August 12, 2017 13:49

Conversation

caleblloyd commented Jun 22, 2017

Uh oh!

bgrainger left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

caleblloyd commented Jun 22, 2017

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bgrainger left a comment

Choose a reason for hiding this comment

Uh oh!

caleblloyd commented Jun 23, 2017

Uh oh!

caleblloyd commented Jun 26, 2017

Uh oh!

caleblloyd commented Jun 26, 2017

Uh oh!

bgrainger commented Jun 29, 2017

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants