fix: verify SQL Server TLS certificates

.pre-commit-config.yaml

@@ -61,7 +61,7 @@ repos:
         exclude: "README.md"
   # Central hooks
   - repo: https://github.com/phantomcyber/dev-cicd-tools
-    rev: v2.1.4
+    rev: v2.2.4
     hooks:
       - id: build-docs
         language: python

NOTICE

@@ -64,6 +64,7 @@ that what they have is not the original version, so that the original
 author's reputation will not be affected by problems that might be
 introduced by others.
 
+
   Finally, software patents pose a constant threat to the existence of
 any free program.  We wish to make sure that a company cannot
 effectively restrict the users of a free program by obtaining a
@@ -120,6 +121,7 @@ modification follow.  Pay close attention to the difference between a
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
 
+
 		  GNU LESSER GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
@@ -167,6 +169,7 @@ Library.
 and you may at your option offer warranty protection in exchange for a
 fee.
 
+
   2. You may modify your copy or copies of the Library or any portion
 of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
@@ -225,6 +228,7 @@ ordinary GNU General Public License has appeared, then you can specify
 that version instead if you wish.)  Do not make any other change in
 these notices.
 
+
   Once this change is made in a given copy, it is irreversible for
 that copy, so the ordinary GNU General Public License applies to all
 subsequent copies and derivative works made from that copy.
@@ -276,6 +280,7 @@ distribute the object code for the work under the terms of Section 6.
 Any executables containing that work also fall under Section 6,
 whether or not they are linked directly with the Library itself.
 
+
   6. As an exception to the Sections above, you may also combine or
 link a "work that uses the Library" with the Library to produce a
 work containing portions of the Library, and distribute that work
@@ -338,6 +343,7 @@ accompany the operating system.  Such a contradiction means you cannot
 use both them and the Library together in an executable that you
 distribute.
 
+
   7. You may place library facilities that are a work based on the
 Library side-by-side in a single library together with other library
 facilities not covered by this License, and distribute such a combined
@@ -379,6 +385,7 @@ restrictions on the recipients' exercise of the rights granted herein.
 You are not responsible for enforcing compliance by third parties with
 this License.
 
+
   11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
@@ -431,6 +438,7 @@ the Free Software Foundation.  If the Library does not specify a
 license version number, you may choose any version ever published by
 the Free Software Foundation.
 
+
   14. If you wish to incorporate parts of the Library into other free
 programs whose distribution conditions are incompatible with these,
 write to the author to ask for permission.  For software which is
@@ -465,6 +473,7 @@ DAMAGES.
 
 		     END OF TERMS AND CONDITIONS
 
+
            How to Apply These Terms to Your New Libraries
 
   If you develop a new library, and you want it to be of the greatest
@@ -571,6 +580,7 @@ that what they have is not the original version, so that the original
 author's reputation will not be affected by problems that might be
 introduced by others.
 
+
   Finally, software patents pose a constant threat to the existence of
 any free program.  We wish to make sure that a company cannot
 effectively restrict the users of a free program by obtaining a
@@ -627,6 +637,7 @@ modification follow.  Pay close attention to the difference between a
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
 
+
 		  GNU LESSER GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
@@ -674,6 +685,7 @@ Library.
 and you may at your option offer warranty protection in exchange for a
 fee.
 
+
   2. You may modify your copy or copies of the Library or any portion
 of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
@@ -732,6 +744,7 @@ ordinary GNU General Public License has appeared, then you can specify
 that version instead if you wish.)  Do not make any other change in
 these notices.
 
+
   Once this change is made in a given copy, it is irreversible for
 that copy, so the ordinary GNU General Public License applies to all
 subsequent copies and derivative works made from that copy.
@@ -783,6 +796,7 @@ distribute the object code for the work under the terms of Section 6.
 Any executables containing that work also fall under Section 6,
 whether or not they are linked directly with the Library itself.
 
+
   6. As an exception to the Sections above, you may also combine or
 link a "work that uses the Library" with the Library to produce a
 work containing portions of the Library, and distribute that work
@@ -845,6 +859,7 @@ accompany the operating system.  Such a contradiction means you cannot
 use both them and the Library together in an executable that you
 distribute.
 
+
   7. You may place library facilities that are a work based on the
 Library side-by-side in a single library together with other library
 facilities not covered by this License, and distribute such a combined
@@ -886,6 +901,7 @@ restrictions on the recipients' exercise of the rights granted herein.
 You are not responsible for enforcing compliance by third parties with
 this License.
 
+
   11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
@@ -938,6 +954,7 @@ the Free Software Foundation.  If the Library does not specify a
 license version number, you may choose any version ever published by
 the Free Software Foundation.
 
+
   14. If you wish to incorporate parts of the Library into other free
 programs whose distribution conditions are incompatible with these,
 write to the author to ask for permission.  For software which is
@@ -972,6 +989,7 @@ DAMAGES.
 
 		     END OF TERMS AND CONDITIONS
 
+
            How to Apply These Terms to Your New Libraries
 
   If you develop a new library, and you want it to be of the greatest
@@ -1015,4 +1033,3 @@ necessary.  Here is a sample; alter the names:
   Ty Coon, President of Vice
 
 That's all there is to it!
-

README.md

@@ -17,6 +17,17 @@ Below are the default ports used by Microsoft-SQL-Server.
 |          **Microsoft-SQL-Server (ms-sql-s)** | 1433 | tcp |
 |          **Microsoft-SQL-Server (ms-sql-s)** | 1433 | udp |
 
+## TLS certificate verification
+
+The connector requires TLS and verifies the SQL Server certificate and configured hostname by
+default. Set **CA file** to a PEM bundle when the server uses a private certificate authority. The
+default value, `system`, uses the operating system trust store.
+
+Disabling **Verify server certificate** is an explicit compatibility opt-out. It keeps the database
+traffic encrypted when **Encryption** is `require`, but it does not authenticate the remote server
+and can expose credentials and data to a man-in-the-middle attacker. Setting **Encryption** to `off`
+also disables transport encryption.
+
 ## LGPL
 
 This app uses the pymssql module, which is licensed under the Free Software Foundation (FSF).
@@ -38,7 +49,9 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION
 **username** | required | string | Username |
 **password** | required | password | Password |
 **port** | optional | numeric | Database Service Port |
-**encryption** | optional | string | TLS encryption mode for the database connection |
+**encryption** | optional | string | TLS negotiation mode. This controls encryption availability, not peer authentication. |
+**verify_server_cert** | optional | boolean | Verify the database server certificate and configured hostname |
+**ca_file** | optional | string | Optional CA bundle path for privately signed database certificates. Uses the system trust store by default. |
 
 ### Supported Actions
 

manual_readme_content.md

@@ -7,6 +7,17 @@ Below are the default ports used by Microsoft-SQL-Server.
 |          **Microsoft-SQL-Server (ms-sql-s)** | 1433 | tcp |
 |          **Microsoft-SQL-Server (ms-sql-s)** | 1433 | udp |
 
+## TLS certificate verification
+
+The connector requires TLS and verifies the SQL Server certificate and configured hostname by
+default. Set **CA file** to a PEM bundle when the server uses a private certificate authority. The
+default value, `system`, uses the operating system trust store.
+
+Disabling **Verify server certificate** is an explicit compatibility opt-out. It keeps the database
+traffic encrypted when **Encryption** is `require`, but it does not authenticate the remote server
+and can expose credentials and data to a man-in-the-middle attacker. Setting **Encryption** to `off`
+also disables transport encryption.
+
 ## LGPL
 
 This app uses the pymssql module, which is licensed under the Free Software Foundation (FSF).

microsoftsqlserver.json

@@ -53,15 +53,28 @@
             "order": 4
         },
         "encryption": {
-            "description": "TLS encryption mode for the database connection",
+            "description": "TLS negotiation mode. This controls encryption availability, not peer authentication.",
             "data_type": "string",
             "value_list": [
                 "off",
                 "request",
                 "require"
             ],
-            "default": "request",
+            "default": "require",
             "order": 5
+        },
+        "verify_server_cert": {
+            "description": "Verify the database server certificate and configured hostname",
+            "data_type": "boolean",
+            "default": true,
+            "order": 6
+        },
+        "ca_file": {
+            "description": "Optional CA bundle path for privately signed database certificates. Uses the system trust store by default.",
+            "data_type": "string",
+            "default": "system",
+            "required": false,
+            "order": 7
         }
     },
     "actions": [

microsoftsqlserver_connector.py

@@ -253,7 +253,7 @@ def _handle_test_connectivity(self, param):
         self.save_progress("Test Connectivity Passed")
         return action_result.set_status(phantom.APP_SUCCESS)
 
-    def _configure_freetds(self, encryption):
+    def _configure_freetds(self, encryption, verify_server_cert, ca_file):
         # Workaround for https://github.com/pymssql/pymssql/issues/924:
         # The `encryption` parameter passed to pymssql.connect() is silently ignored due to a
         # known bug in pymssql. As a workaround, we write a temporary FreeTDS config file with
@@ -267,6 +267,18 @@ def _configure_freetds(self, encryption):
             "[global]",
             f"encryption = {encryption}",
         ]
+        if verify_server_cert:
+            ca_file = (ca_file or MSSQLSERVER_CA_FILE_DEFAULT).strip()
+            if not ca_file or any(character in ca_file for character in "\r\n\x00"):
+                raise ValueError("Invalid CA file path")
+            lines.extend(
+                [
+                    f"ca file = {ca_file}",
+                    "check certificate hostname = yes",
+                ]
+            )
+        else:
+            self.debug_print("WARNING: TLS server certificate verification is disabled for this asset.")
 
         temp_conf = tempfile.NamedTemporaryFile(mode="w", prefix="mssql_freetds_", suffix=".conf", delete=False)
         self._freetds_conf_path = temp_conf.name
@@ -441,6 +453,8 @@ def _connect_sql(self, param):
         password = config["password"]
         port = config.get("port", 1433)
         encryption = config.get("encryption", MSSQLSERVER_ENCRYPTION_DEFAULT)
+        verify_server_cert = config.get("verify_server_cert", MSSQLSERVER_VERIFY_SERVER_CERT_DEFAULT)
+        ca_file = config.get("ca_file", MSSQLSERVER_CA_FILE_DEFAULT)
         host = param.get("host", config["host"])
         database = param.get("database", config["database"])
         param["host"] = host
@@ -455,7 +469,7 @@ def _connect_sql(self, param):
         try:
             # `encryption` is passed via the FreeTDS config rather than as a pymssql.connect() argument
             # see _configure_freetds() for details.
-            self._configure_freetds(encryption)
+            self._configure_freetds(encryption, verify_server_cert, ca_file)
             self._connection = pymssql.connect(host, username, password, database, port=port)  # pylint: disable=no-member
             self._cursor = self._connection.cursor()
         except Exception as ex:

microsoftsqlserver_consts.py

@@ -19,5 +19,7 @@
 DEFAULT_TIMEOUT = 30
 
 # encryption config
-MSSQLSERVER_ENCRYPTION_DEFAULT = "request"
+MSSQLSERVER_ENCRYPTION_DEFAULT = "require"
 MSSQLSERVER_ENCRYPTION_VALID_VALUES = {"off", "request", "require"}
+MSSQLSERVER_VERIFY_SERVER_CERT_DEFAULT = True
+MSSQLSERVER_CA_FILE_DEFAULT = "system"

release_notes/unreleased.md

@@ -1 +1,3 @@
 **Unreleased**
+
+* Required TLS and enabled SQL Server certificate and hostname verification by default, with custom CA and explicit opt-out support.