Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Tests | Remove hardcoded credentials from ManualTests#3204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged

Conversation

benrr101
Copy link
Contributor

This is a remake of#3090 so that we can get all of the CI to run, original description follows


This PR mops up almost all of the remaining hardcoded credentials, and does three things:

  • Removes references toCertificateUtility.CreateCertificate, which always used a hardcoded certificate.
  • Forces the tests to dynamically generate keys in Azure Key Vault.
  • Removes references toCertificateUtilityWin inCspProviderExt, then the class itself.

Removal of hardcoded credentials

The removal of CertificateUtility.CreateCertificate is pretty uncontroversial. However, theAKVTest.TestRoundTripWithAKVAndCertStoreProvider test tries to round-trip encrypted column data, encrypting it with the hardcoded certificate and decrypting it with the Azure Key Vault key. I've thus treated this key as another static credential and removed it.

It's worth noting that theCoreCryptoTests class loads hardcoded credentials from TCECryptoNativeBaselineRsa.txt. I've not touched this because I don't know what to do with it. It isn't testing any SqlClient-specific functionality, just .NET's ability to decrypt text which is encrypted by native code. I'm not sure whether this is necessary any more though: we already test this implicitly with the end-to-end AE tests. There's no modification required here - just a choice on whether to keep or delete the test entirely.

CspProviderExt tests

One partially-related change was to remove CertificateUtilityWin. This was only ever used by theCspProviderExt tests, which used RSACryptoServiceProvider to generate a key in a specific CSP and encrypt/decrypt data with it. This consisted of three tests:

  1. TestKeysFromCertificatesCreatedWithMultipleCryptoProviders, which looked for all CSPs with a name containing "RSA and AES", then generated a key in that CSP and tested the Always Encrypted provider with it.
  2. TestRoundTripWithCSPAndCertStoreProvider, which generated a certificate and tried to round-trip between the certificate-based AE provider and the CSP-based AE provider. XUnit was already being told to skip this test.
  3. TestEncryptDecryptWithCSP, which did exactly the same thing as test 1, but with a hard-coded CSP of "Microsoft Enhanced RSA and AES Cryptographic Provider".

Tests 1 and 3 are actually identical. "Microsoft Enhanced RSA and AES Cryptographic Provider" is the only CSP which fits the criteria for Test 1. I've thus eliminated test 1, and modified test 3 to run against all matching CSPs.

Of the remaining two tests, TestEncryptDecryptWithCSP would run a PowerShell script to generate a certificate, then extract the private key and use this as the CSP. It didn't need to do this, it could simply instantiate an RSACryptoServiceProvider directly and use that. I've thus eliminated the certificate generation. The round-trip test did need the certificate though, so I've just switched it to use the same certificate generation fixture as the rest of the tests. It still fails if I force it to run, but it fails with the same error as before. Once these changes were done, CertificateUtilityWin was no longer referenced and could be deleted wholesale.

The CspProviderExt/CertificateUtilityWin changes comprise around half of the changes. If it's easier to review, I can split them into a separate PR.

cheenamalhotra reacted with hooray emojiedwardneal reacted with rocket emoji
One test implied that DataTestUtility.AKVUrl would point to an RSA key which aligned with the certificate's private key. Switching this to dynamically generate the key in places.
These were mostly related to generating CSP keys.
* Reorder properties and constructors* Move AEConnectionStringProviderWithCspParameters to its own file* Tweak to the AKV token acquisition
Redundant bracket, alphabetised the ManualTesting csproj
@benrr101benrr101 added the Area\TestsIssues that are targeted to tests or test projects labelMar 6, 2025
@benrr101benrr101 requested a review froma teamMarch 6, 2025 18:40
@benrr101
Copy link
ContributorAuthor

@edwardneal I could use a wee bit of help figuring out the errors - it looks to me that a table doesn't exist, so we can't delete the entries in it before running the test. Since we're not getting any errors creating the tables, I suspect we're dropping the table somewhere between tests. But I can't seem to repro it locally (although that could be an issue with my setup not being the same as test machine).

I've also kicked the failing tests again to see if maybe it's transient. But since it's consistent across all the enclave tests I suspect it isn't transient.

@edwardneal
Copy link
Contributor

Sorry for the delay here@benrr101, I've just been able to get to look at this.

The fixture here isPlatformSpecificTestContext. This instantiates aSQLSetupStrategyCertStoreProvider, which calls the baseSQLSetupStrategy -CreateTables, followed bySetupDatabase.

The effect ofCreateTables which we care about is that it populates theTrustedMasterKeyPathsTestTable and returns it; the caller adds this to thedatabaseObjects field.

SetupDatabase iterates over each of these objects, calling theirCreate method. Then, it callsInsertSampleData, which wipes the table and adds a new record to it.

The net effect is that we create a new table, then immediately insert sample data into it. This fails, so the test fixture can't be instantiated and every test which uses the fixture fails. I'm not able to reproduce it either.

I'd like to compare the logs of a few CI runs - could you retrigger this please?

@benrr101
Copy link
ContributorAuthor

/azp run

@azure-pipelinesAzure Pipelines
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@benrr101
Copy link
ContributorAuthor

@edwardneal Ok, that's mostly what I suspected that it was an issue with the database setup steps causing the fixture to fail to be instantiated. Stuff like that working locally but not on the test machine suggests to me some kind of race condition, but that's just wild speculation. As per your request, I've kicked off another CI run. Let me know if you need more - I appreciate you looking into this :)

@paulmedynskipaulmedynski self-assigned thisMar 21, 2025
benrr101and others added2 commitsMarch 27, 2025 12:19
…/TestFixtures/SQLSetupStrategy.csLet's try@edwardneal's ideaCo-authored-by: Edward Neal <55035479+edwardneal@users.noreply.github.com>
…/TestFixtures/SQLSetupStrategy.csCo-authored-by: Edward Neal <55035479+edwardneal@users.noreply.github.com>
@paulmedynskipaulmedynski added this to the6.1-preview1 milestoneApr 2, 2025
@mdaiglemdaigle self-assigned thisApr 2, 2025
@benrr101
Copy link
ContributorAuthor

@edwardneal Any further thoughts on this one?

@benrr101benrr101 removed this from the6.1-preview1 milestoneApr 29, 2025
@benrr101benrr101 added this to the6.1-preview2 milestoneApr 29, 2025
@benrr101
Copy link
ContributorAuthor

@edwardneal thanks again for looking into the failures and dealing with the annoying back-n-forth of trying to resolve the issues. Let's see what this round does.

@paulmedynski,@mdaigle do you have anything to add regarding the net8/net9 test behavior? I'm kinda wondering if we need to make sure that the test projects are defined to target the same frameworks as the projects themselves.

@saurabh500
Copy link
Contributor

/azp run

@azure-pipelinesAzure Pipelines
Copy link

Azure Pipelines successfully started running 2 pipeline(s).

@edwardneal
Copy link
Contributor

CI has timed out again, but I was able to see the cause in the realtime logs a few hours ago. It looks like we're not receiving any response from 10.0.0.4 and 10.0.0.5 prior to running the tests. Is the AE Enclave test environment healthy?

@saurabh500
Copy link
Contributor

@cheenamalhotra does this have to do with the VM decommissioning?

@edwardneal there are test infrastructure issues we are trying to iron out.

edwardneal and cheenamalhotra reacted with thumbs up emoji

@David-Engel
Copy link
Contributor

10.0.0.5 is the one that was deallocated due to Azure capacity pressure, yes. It let me start it back up so I've re-run failed jobs for this PR.

cheenamalhotra reacted with thumbs up emoji

@edwardneal
Copy link
Contributor

Thanks - I can see that most of these tests are passing now (with the exception of Azure Key Vault - I'll try to reproduce that locally.)

…/TestFixtures/SQLSetupStrategyAzureKeyVault.csCo-authored-by: Edward Neal <55035479+edwardneal@users.noreply.github.com>
Copy link
Contributor

@paulmedynskipaulmedynski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This is a large review, and I've only skimmed it so far. I will need a subject-matter expert to walk me through most of it.

edwardneal reacted with thumbs up emoji
…/TestFixtures/SQLSetupStrategyAzureKeyVault.csCo-authored-by: Edward Neal <55035479+edwardneal@users.noreply.github.com>
@codecovCodecov
Copy link

codecovbot commentedMay 20, 2025
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 65.28%. Comparing base(cc23e04) to head(02470f2).
Report is 8 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@##             main    #3204      +/-   ##==========================================- Coverage   67.16%   65.28%   -1.89%==========================================  Files         300      300                Lines       65640    65640              ==========================================- Hits        44087    42851    -1236- Misses      21553    22789    +1236
FlagCoverage Δ
addons92.58% <ø> (ø)
netcore68.50% <ø> (-3.80%)⬇️
netfx66.68% <ø> (+1.28%)⬆️

Flags with carried forward coverage won't be shown.Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report?Share it here.

🚀 New features to boost your workflow:
  • ❄️Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
edwardneal reacted with hooray emoji

Copy link
Contributor

@paulmedynskipaulmedynski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Clearing my 'Request changes' review, but not approving. In the interest of getting this merged, other team members with a better understanding of the changes should review for approval.

edwardneal reacted with thumbs up emoji
@paulmedynskipaulmedynski dismissed theirstale reviewMay 29, 2025 11:11

No changes necessary after discussion.

@paulmedynskipaulmedynski removed their assignmentMay 29, 2025
@benrr101
Copy link
ContributorAuthor

@paulmedynski - I can't review this on myself, so that means we've only got you,@mdaigle,@samsharma2700, and@cheenamalhotra who can review it.

cheenamalhotra
cheenamalhotra previously approved these changesMay 30, 2025
Copy link
Contributor

@paulmedynskipaulmedynski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

It all makes sense to me, with a few comments.

…the test arguments* Move test arguments into property (the class was only used in a single location)* Cleanup test code* Tweak default provider discovery code to handle edge cases a bit better
@benrr101
Copy link
ContributorAuthor

@paulmedynski I addressed most of the comments you added, some a bit more heavily-handed (heavy-handidly?) than others. I also merged main into it b/c I couldn't build without a fix we added a looong time ago.

edwardneal reacted with hooray emoji

@benrr101benrr101 merged commit55095ef intomainJun 5, 2025
251 checks passed
@benrr101benrr101 deleted the dev/russellben/en-manual-tests-certificate-gen branchJune 5, 2025 22:02
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@edwardnealedwardnealedwardneal left review comments

@mdaiglemdaiglemdaigle approved these changes

@paulmedynskipaulmedynskipaulmedynski approved these changes

@cheenamalhotracheenamalhotracheenamalhotra left review comments

Assignees

@mdaiglemdaigle

Labels
Area\TestsIssues that are targeted to tests or test projects
Projects
None yet
Milestone
6.1-preview2
Development

Successfully merging this pull request may close these issues.

7 participants
@benrr101@edwardneal@paulmedynski@saurabh500@David-Engel@mdaigle@cheenamalhotra

[8]ページ先頭

©2009-2025 Movatter.jp