3

I am trying to deploy a CLR assembly in a SQL Server 2017 DB, following the procedure described at https://sqlquantumleap.com/2017/08/09/sqlclr-vs-sql-server-2017-part-2-clr-strict-security-solution-1/. Basically, for testing purposes I'm just including an assembly with a couple of Regex-based functions:

public class TextUdf
{
    [SqlFunction(Name = "RegexIsMatch", IsDeterministic = true, IsPrecise = true)]
    public static SqlBoolean RegexIsMatch(SqlString text, SqlString pattern,
        SqlInt32 options)
    {
        if (text.IsNull) return SqlBoolean.Null;
        if (pattern.IsNull) pattern = "";

        return Regex.IsMatch((string)text,
            (string)pattern,
            options.IsNull? RegexOptions.None : (RegexOptions)options.Value,
            new TimeSpan(0, 0, 10))
            ? SqlBoolean.True
            : SqlBoolean.False;
    }

    [SqlFunction(Name = "RegexReplace", IsDeterministic = true, IsPrecise = true)]
    public static SqlString RegexReplace(SqlString text, SqlString pattern,
        SqlString replacement, SqlInt32 options)
    {
        if (text.IsNull || pattern.IsNull) return text;

        return Regex.Replace((string)text, (string)pattern,
            (string)replacement,
            options.IsNull ? RegexOptions.None : (RegexOptions)options.Value);
    }
}

I have created a full repro solution at https://github.com/Myrmex/sqlclr. I can follow the whole procedure described there (readme) up to the point where I have to assign the PFX certificate to the CLR assembly to be deployed. At this point, I get this error:

MSB3325: Cannot import the following key file: pfx. The key file may be password protected. To correct this, try to import the certificate again or manually install the certificate to the Strong Name CSP with the following key container name: ...

Following the error message guidance, I then found that I could solve this by installing the PFX with sn, so that I can enter the password manually when prompted (see Cannot import the keyfile 'blah.pfx' - error 'The keyfile may be password protected').

Once done this, I could compile my CLR assembly with the UDF functions. Now, when I try to install it in a test database (just an empty database created for this purpose), via CREATE ASSEMBLY [SqlServerUdf] FROM 0x...binary stuff..., I get this error:

CREATE or ALTER ASSEMBLY for assembly 'SqlServerUdf' with the SAFE or EXTERNAL_ACCESS option failed because the 'clr strict security' option of sp_configure is set to 1. Microsoft recommends that you sign the assembly with a certificate or asymmetric key that has a corresponding login with UNSAFE ASSEMBLY permission. Alternatively, you can trust the assembly using sp_add_trusted_assembly.

which just defeats the purpose of the long procedure I had to follow in order to let SQL Server accept my CLR without dropping strict security.

Clearly I'm missing something, but I'm not sure about many details of the tricky procedure so it would be a hard guesswork. Could anyone suggest we what's wrong with the procedure, so that we can have a quick and dirty step-by-step reference on how to insert a CLR assembly in SQL Server? This simple task seems to have become very hard with the latest version...

Naftis
  • 4,393
  • 7
  • 63
  • 91
  • 1
    Did you create a certificate in SQL Server and make a login that uses it? Ref: https://www.sqlshack.com/impact-clr-strict-security-configuration-setting-sql-server-2017/ (See option 4) This helped me through a similar issue (I was using option 3, though, so I can't speak to how good a solution this is). – Jason Whitish Mar 28 '19 at 14:26
  • @Natfis: just to confirm, you are able to compile / sign the `SqlServerUdf` assembly? AND, you executed the **PreDeploy.sql** script before attempting the deploy, or at least registered the **PreDeploy.sql** script in the `SqlServerUdf` project? I believe I know what the problem is, and will put the rest of the details in an answer. – Solomon Rutzky Mar 28 '19 at 15:04
  • 1
    @JasonWhitish That SQLShack page isn't bad, but doesn't help in creating a self-contained deployment script, nor integrating a solution into a process that works fully with Visual Studio and/or an automated CI process. The options outlined in my posts -- [Asymmetric Key / snk](https://sqlquantumleap.com/2017/08/09/sqlclr-vs-sql-server-2017-part-2-clr-strict-security-solution-1/) or [Certificate-only](https://sqlquantumleap.com/2017/08/16/sqlclr-vs-sql-server-2017-part-3-clr-strict-security-solution-2/) -- are a few more steps, but results in full automation :-D. – Solomon Rutzky Mar 28 '19 at 15:28

1 Answers1

2

Based on what I see in the GitHub repository, there seems to be some steps that you skipped:

  1. You did not set a password on the original SQL2017_KeyAsm project. That's why it's still an .snk file (i.e. SQL2017_KeyAsm.snk) instead of a .pfx file (i.e. SQL2017_KeyAsm.pfx). I am guessing that you unchecked the "Protect my key file with a password" checkbox (I think it is checked by default), because you should not have an .snk at all. Also, in your SQL2017_KeyAsm.sqlproj file, you currently have:

    <AssemblyOriginatorKeyFile>SQL2017_KeyAsm.snk</AssemblyOriginatorKeyFile>

    When you should have the following:

    <AssemblyOriginatorKeyFile>SQL2017_KeyAsm.pfx</AssemblyOriginatorKeyFile>

    Although, your instructions in the readme are correct, as you have stated there: "enter in a password". Still, this probably explains the password error you got, since there is no password protecting the private key. Either that, or the password error is due to using the wrong pfx file (see below). I guess try fixing the below items first as it might be possible to get away with a password-less SNK, I've just never tried it.

  2. At the end of the One-Time Procedures section, in the last two steps just after the paragraph starting with, "Finally, the following steps...", step 2 is using the wrong .pfx file. I am guessing that this is a direct result of not having a .pfx file in the previous step (due to not setting a password), so you grabbed the only .pfx file that was there. This is why you are getting the error when attempting to load the SqlServerUdf assembly: you signed the assembly with the certificate, but that certificate was only used as a mechanism to load the KeyAsm assembly into [master] so that the Asymmetric Key could be extracted from it. After that the certificate is dropped. The Asymmetric Key is the public key of the .snk file that was created when you told Visual Studio that you wanted the SQL2017_KeyAsm project signed. And so that .snk file (or .pfx if you protect it with a password) is what you need to select when you are telling Visual Studio to sign the SqlServerUdf project. Doing this will use the same private key to sign both projects / assemblies.

So, first thing to do is change the private key used to sign the SqlServerUdf assembly. It should not be the certificate .pfx file. It needs to be the same key used to sign the KeyAsm file. In your case, this would be SQL2017_KeyAsm.snk.

Try making that one change and see if everything works. If not, then go back and add a password to the snk file (via Visual Studio). You shouldn't need to re-generate the Certificate or its .pfx file because the public key should be staying the same, and that's all that gets loaded into [master] anyway. But, do let me know if this still doesn't work. In the mean time, I will update that post to be more explicit about the password, and about which pfx file to use when.

Solomon Rutzky
  • 46,688
  • 9
  • 128
  • 171
  • Thanks, this is all very useful and I'll also have to check your link above. Meanwhile, maybe it's just me, but I cannot find any "Protect my key file with a password" checkbox in the VS UI (currently using VS2019 RC4). In SQL CLR options I just find a Signing button, and when I click it I get a dialog with a Sign the assembly checkbox, a Choose a strong name key file dropdown with a Change Password button, and a Delay sign only checkbox. – Naftis Mar 28 '19 at 19:24
  • I haven't tried VS 2019. Maybe I should? But the checkbox I am referring to is on the window that pops up when you select "New..." from that drop-down... – Solomon Rutzky Mar 28 '19 at 19:29
  • Thank you, I had to repeat the whole procedure but it did work. I have updated the GIT repo for reference to all the mortals of us :). – Naftis Mar 28 '19 at 20:18
  • Awesome! And sorry that wasn't clearer. I should have my post updated later tonight with several clarifications. Please also vote for [Allow Asymmetric Key to be created from binary hex bytes string just like CREATE CERTIFICATE](https://feedback.azure.com/forums/908035-sql-server/suggestions/32896978-allow-asymmetric-key-to-be-created-from-binary-hex) as it would eliminate 90% (or more) of this hassle! – Solomon Rutzky Mar 28 '19 at 20:35