ClickHouse / ClickHouse/ClickHouse.EntityFrameworkCore

SkipServerCertificateValidation doesn't seem to work when passing a DbConnection or DbDataSource to UseClickHouse

Offen
#50 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
C#
Sterne
23
Forks
7
Ø Merge
14 T. 3 Std.
Gemergte PRs (30 T.)
1

Beschreibung

## Description

I'm trying to connect to a ClickHouse instance with an untrusted/self-signed cert, and skip validation using `ClickHouseClientSettings.SkipServerCertificateValidation`. Since that setting doesn't exist as a connection string key, I'm building a `ClickHouseClientSettings` object in code and passing it into either a `ClickHouseConnection` or `ClickHouseDataSource`, then handing that to `UseClickHouse` from EntityFrameworkCore.

Both the `DbConnection` overload and the `DbDataSource` overload fail with an untrusted root / SSL error, exactly as if the setting were never set.

To rule out the driver itself, I tested the same settings object directly with `ClickHouseClient` (no EF Core at all) and it works fine, connects and runs a query with no cert error. So the setting itself works, it just doesn't seem to carry through when going through either of these two `UseClickHouse` overloads.

My guess is that somewhere internally it's pulling the connection string back out of the connection/data source and building a new one from that, which would explain why a setting that only exists in code (not in the connection string) gets lost.

## Repro

Works fine, no EF Core:
```csharp
var settings = new ClickHouseClientSettings("Host=;Protocol=https;Port=8443;Username=;Password=")
{
SkipServerCertificateValidation = true
};

using var client = new ClickHouseClient(settings);
await client.ExecuteScalarAsync("SELECT 1"); // succeeds
```

Fails with DbDataSource:
```csharp
var dataSource = new ClickHouseDataSource(settings);

var options = new DbContextOptionsBuilder()
.UseClickHouse(dataSource)
.Options;

await using var ctx = new MyContext(options);
await ctx.Database.CanConnectAsync(); // untrusted root error
```

Fails with DbConnection too:
```csharp
var connection = new ClickHouseConnection(settings);

var options = new DbContextOptionsBuilder()
.UseClickHouse(connection, contextOwnsConnection: true)
.Options;

await using var ctx = new MyContext(options);
await ctx.Database.CanConnectAsync(); // same error
```

## Exception
`System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot at System.Net.Security.SslStream.CompleteHandshake...`

## Environment
- ClickHouse.EntityFrameworkCore: 0.2.0
- ClickHouse.Driver: 1.1.0
- .NET: 10.0

## Question
Is `UseClickHouse(DbConnection)` / `UseClickHouse(DbDataSource)` expected to preserve the actual instance you pass in, including settings that don't have a connection string equivalent? Right now it looks like it's only picking up whatever survives a round trip through the connection string, which silently drops anything like `SkipServerCertificateValidation` that's code-only.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Rechercherichtung

Beginnen Sie mit den Überladungen UseClickHouse(DbConnection) und UseClickHouse(DbDataSource) und vergleichen Sie deren Verhalten mit der direkten ClickHouseClient-Repro. Überprüfen Sie, ob die bereitgestellte Verbindung oder Datenquelle, einschließlich SkipServerCertificateValidation, erhalten bleibt; die Korrektur ist vollständig, wenn beide EF Core-Überladungen ermöglichen, dass CanConnectAsync mit dem selbst signierten Zertifikat erfolgreich ist.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
csharp
Bereich
databases
Issue-Typ
Bug
Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
58/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.