Skip to content

Commit 6bbbd11

Browse files
Malcolm-StewartMalcolm-Stewart
committed
Various app updates
SQLNAUI - added "auto" filter Preference SQLNA - added auto filter string mode SQLNA - suppress some false positives in the login failure report SQLCheck - Fit-and-finish improvements SQLCheck - Made the TLS report better
1 parent ec40617 commit 6bbbd11

File tree

24 files changed

+191
-47
lines changed

24 files changed

+191
-47
lines changed

‎SQLCheck/.vs/SQLCheck/v15/Server/sqlite3/storage.ide‎

0 Bytes
Binary file not shown.

‎SQLCheck/.vs/SQLCheck/v15/Server/sqlite3/storage.ide-shm‎

0 Bytes
Binary file not shown.

‎SQLCheck/.vs/SQLCheck/v15/Server/sqlite3/storage.ide-wal‎

0 Bytes
Binary file not shown.

‎SQLCheck/SQLCheck/Collectors.cs‎

Lines changed: 53 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -465,27 +465,67 @@ public static void CollectSecurity(DataSet ds)
465465

466466
public static void CollectTLS(DataSet ds)
467467
{
468+
DataRow Computer = ds.Tables["Computer"].Rows[0];
468469
string[] TLSVersions = new string[] { "SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1", "TLS 1.2" };
469470
string[] ClientServer = new string[] { "Client", "Server" };
470-
string[] ValueNames = new string[] { "DisabledByDefault", "Enabled" }; // DWORD
471471
object temp = null;
472+
string defVal = "", enVal = "", disVal = "", effVal = "";
473+
TLSInfo tlsInfo = TLSInfo.GetTLSInfo(Computer);
472474

473475
foreach (string cs in ClientServer)
474476
{
475477
foreach (string tlsVersion in TLSVersions)
476478
{
477-
foreach (string valueName in ValueNames)
479+
DataRow TLS = ds.Tables["TLS"].NewRow();
480+
ds.Tables["TLS"].Rows.Add(TLS);
481+
defVal = "";
482+
enVal = "";
483+
disVal = "";
484+
effVal = "";
485+
TLS["ClientOrServer"] = cs;
486+
TLS["TLSVersion"] = tlsVersion;
487+
defVal = tlsInfo.GetComputerDefault(tlsVersion);
488+
TLS["Defaultvalue"] = defVal;
489+
temp = Registry.GetValue($@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\{tlsVersion}\{cs}", "Enabled", "");
490+
enVal = temp == null ? "" : ((temp.ToInt() != 0) ? $"True " : "False") + $" (0x{temp.ToInt().ToString("X8")})" + CheckTLS(tlsVersion, "Enabled", temp.ToInt());
491+
TLS["EnabledValue"] = enVal;
492+
temp = Registry.GetValue($@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\{tlsVersion}\{cs}", "DisabledByDefault", "");
493+
disVal = temp == null ? "" : ((temp.ToInt() != 0) ? $"True " : "False") + $" (0x{temp.ToInt().ToString("X8")})" + CheckTLS(tlsVersion, "DisabledByDefault", temp.ToInt());
494+
TLS["DisabledByDefaultValue"] = disVal;
495+
496+
//
497+
// Calculate the effective Value
498+
//
499+
switch (defVal)
478500
{
479-
DataRow TLS = ds.Tables["TLS"].NewRow();
480-
ds.Tables["TLS"].Rows.Add(TLS);
481-
TLS["ClientOrServer"] = cs;
482-
TLS["TLSVersion"] = tlsVersion;
483-
TLS["ValueName"] = valueName;
484-
TLS["Defaultvalue"] = "TODO"; // TODO
485-
temp = Registry.GetValue($@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\{tlsVersion}\{cs}", valueName, "");
486-
TLS["RegistryValue"] = temp == null ? "" : ((temp.ToInt() != 0) ? $"True " : "False") + $" (0x{temp.ToInt().ToString("X8")})" + CheckTLS(tlsVersion, valueName, temp.ToInt());
487-
TLS["PolicyValue"] = "TODO"; // TODO
501+
case "Not Supported":
502+
effVal = "Not Supported";
503+
break;
504+
case "Disabled":
505+
if (enVal == "" || enVal.StartsWith("False"))
506+
{
507+
effVal = "Disabled";
508+
}
509+
else // enVal = true
510+
{
511+
effVal = disVal.StartsWith("False") ? "Enabled" : "Disabled"; // disVal = "" (not specified) -> Disabled
512+
}
513+
break;
514+
case "Enabled":
515+
if (enVal.StartsWith("False"))
516+
{
517+
effVal = "Disabled";
518+
}
519+
else // enVal = True or blank (not specified)
520+
{
521+
effVal = disVal.StartsWith("False") ? "Enabled" : "Disabled"; // disVal = "" (not specified) -> Disabled
522+
}
523+
break;
524+
default:
525+
effVal = "";
526+
break;
488527
}
528+
TLS["EffectiveValue"] = effVal;
489529
}
490530
}
491531
}
@@ -1619,7 +1659,7 @@ public static void CollectSPNAccount(DataSet ds)
16191659
PropertyValueCollection props = entry.Properties["msDS-AllowedToDelegateTo"];
16201660
foreach (object prop in props)
16211661
{
1622-
Console.WriteLine($"Constrained target SPN for {tempAccount}: {prop.ToString()}");
1662+
//Console.WriteLine($"Constrained target SPN for {tempAccount}: {prop.ToString()}"); // debug trace
16231663
// add constrained SPN records here
16241664
DataRow ConstrainedDelegationSPN = ds.Tables["ConstrainedDelegationSPN"].NewRow();
16251665
ds.Tables["ConstrainedDelegationSPN"].Rows.Add(ConstrainedDelegationSPN);
@@ -2047,7 +2087,7 @@ public static void ProcessMSSQLServer(DataSet ds, DataRow SQLInstance, DataRow S
20472087
{
20482088
string msg = "";
20492089
line = SmartString.GetBetween(line, @"[", @"]", false, true); // auto trim the result
2050-
DataRow[] Certificates = ds.Tables["Certificate"].Select($"ThumbPrint='{line}'");
2090+
DataRow[] Certificates = ds.Tables["Certificate"].Select($@"ThumbPrint Like 'Cert Hash(*) ""{line}""'");
20512091
if (Certificates.Length == 0)
20522092
{
20532093
msg = " (no certs match the thumbprint)";

‎SQLCheck/SQLCheck/Properties/AssemblyInfo.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,5 @@
3232
// You can specify all the values or you can default the Build and Revision Numbers
3333
// by using the '*' as shown below:
3434
// [assembly: AssemblyVersion("1.0.*")]
35-
[assembly: AssemblyVersion("1.0.0.1088")]
36-
[assembly: AssemblyFileVersion("1.0.0.1088")]
35+
[assembly: AssemblyVersion("1.0.0.1095")]
36+
[assembly: AssemblyFileVersion("1.0.0.1095")]

‎SQLCheck/SQLCheck/SQLCheck.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@
7070
<Compile Include="SmartString.cs" />
7171
<Compile Include="Storage.cs" />
7272
<Compile Include="TextReport.cs" />
73+
<Compile Include="TLSInfo.cs" />
7374
<Compile Include="Utility.cs" />
7475
<EmbeddedResource Include="SQLCheck.resx">
7576
<DependentUpon>SQLCheck.cs</DependentUpon>

‎SQLCheck/SQLCheck/Storage.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,12 +130,12 @@ public static DataSet CreateDataSet(String ComputerName)
130130
dt.AddColumn("ID", "Integer");
131131
dt.Columns["ID"].AutoIncrement = true;
132132
dt.AddColumn("ParentID", "Integer");
133-
dt.AddColumn("TLSVersion", "String"); // SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2
134-
dt.AddColumn("ClientOrServer", "String"); // Client or Server
135-
dt.AddColumn("ValueName", "String"); // DisabledByDefault or Enabled
136-
dt.AddColumn("DefaultValue", "String"); // got from OS version mapping table, any non-zero setting is "True", preserve blanks for missing entries
137-
dt.AddColumn("RegistryValue", "String"); // under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
138-
dt.AddColumn("PolicyValue", "String"); // under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies ... somewhere - none on my system
133+
dt.AddColumn("TLSVersion", "String"); // SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2
134+
dt.AddColumn("ClientOrServer", "String"); // Client or Server
135+
dt.AddColumn("DefaultValue", "String"); // got from OS version mapping table: Not Supported, Disabled, Enabled
136+
dt.AddColumn("EnabledValue", "String"); // under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
137+
dt.AddColumn("DisabledByDefaultValue", "String"); // under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
138+
dt.AddColumn("EffectiveValue", "String"); //
139139
ds.Tables.Add(dt);
140140

141141
//

‎SQLCheck/SQLCheck/TLSInfo.cs‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
using System;
2+
using System.Data;
3+
4+
namespace SQLCheck
5+
{
6+
class TLSInfo
7+
{
8+
public string SSL20 = "";
9+
public string SSL30 = "";
10+
public string TLS10 = "";
11+
public string TLS11 = "";
12+
public string TLS12 = "";
13+
public string TLS13 = "";
14+
15+
public TLSInfo(string ssl20, string ssl30, string tls10, string tls11, string tls12, string tls13)
16+
{
17+
SSL20 = ssl20;
18+
SSL30 = ssl30;
19+
TLS10 = tls10;
20+
TLS11 = tls11;
21+
TLS12 = tls12;
22+
TLS13 = tls13;
23+
}
24+
25+
public string GetComputerDefault(string TLSVersion)
26+
{
27+
switch (TLSVersion)
28+
{
29+
case "SSL 2.0": return SSL20;
30+
case "SSL 3.0": return SSL30;
31+
case "TLS 1.0": return TLS10;
32+
case "TLS 1.1": return TLS11;
33+
case "TLS 1.2": return TLS12;
34+
case "TLS 1.3": return TLS13;
35+
default: return $"Unknown TLS version: {TLSVersion}.";
36+
}
37+
}
38+
39+
public static TLSInfo GetTLSInfo(DataRow Computer)
40+
{
41+
string WindowsVersion = Computer.GetString("WindowsVersion");
42+
string WindowsReleaseID = Computer.GetString("WindowsReleaseID");
43+
string WindowsBuild = Computer.GetString("WindowsBuild");
44+
string WindowsName = Computer.GetString("WindowsName");
45+
46+
if (Utility.CompareVersion(WindowsVersion, "10.0") == "=" && WindowsReleaseID.StartsWith("22")) // Windows 22
47+
{
48+
return new TLSInfo("Enabled", "Enabled", "Enabled", "Enabled", "Enabled", "Enabled");
49+
}
50+
else if (Utility.CompareVersion(WindowsVersion, "10.0") == "=" || // Windows 10 and Windows 2016 and Windows 2019
51+
WindowsVersion.Contains("NT 6.2.") || // Windows 8 and Windows Server 2012
52+
WindowsVersion.Contains("NT 6.3.")) // Windows 8.1 and Windows Server 2012 R2
53+
{
54+
return new TLSInfo("Enabled", "Enabled", "Enabled", "Enabled", "Enabled", "Not Supported");
55+
}
56+
else if (WindowsVersion.Contains("NT 6.1.") || // Windows 7 and Windows 2008 R2
57+
(WindowsVersion.Contains("NT 6.0.") && WindowsBuild == "6002" && WindowsName.Contains("Server"))) // Windows Server 2008 SP2 (not Vista SP2)
58+
{
59+
// if version = Windows 2008 SP2, Windows 2008 R2, Windows 7
60+
return new TLSInfo("Enabled", "Disabled", "Disabled", "Disabled", "Disabled", "Not Supported");
61+
}
62+
else // anything older
63+
{
64+
return new TLSInfo("Enabled", "Not Supported", "Not Supported", "Not Supported", "Not Supported", "Not Supported");
65+
}
66+
}
67+
}
68+
}

‎SQLCheck/SQLCheck/TextReport.cs‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -285,15 +285,15 @@ static void ReportSecurity(DataSet ds, TextWriter s) // outputs computer and do
285285
DataTable dtTLS = ds.Tables["TLS"];
286286
ReportFormatter rf = new ReportFormatter();
287287
// rf.SetColumnNames("Client/Server:L", "TLS Version:L", "Setting:L", "Default:L", "Registry:L", "Policy:L"); // we don't collect all these columns, yet
288-
rf.SetColumnNames("Client/Server:L", "TLS Version:L", "Setting:L", "Registry:L");
288+
rf.SetColumnNames("Client/Server:L", "TLS Version:L", "Default:L", "Enabled in Reg:L", "Disabled By Default:L", "Effective Value:L");
289289
foreach (DataRow TLS in dtTLS.Rows)
290290
{
291291
rf.SetcolumnData(TLS["ClientOrServer"].ToString(),
292292
TLS["TLSVersion"].ToString(),
293-
TLS["ValueName"].ToString(),
294-
// TLS["DefaultValue"].ToString(),
295-
TLS["RegistryValue"].ToString());
296-
// TLS["PolicyValue"].ToString());
293+
TLS.GetString("DefaultValue"),
294+
TLS.GetString("EnabledValue"),
295+
TLS.GetString("DisabledByDefaultValue"),
296+
TLS.GetString("EffectiveValue"));
297297
}
298298
s.WriteLine(rf.GetHeaderText());
299299
s.WriteLine(rf.GetSeparatorText());

‎SQL_Network_Analyzer/.vs/SQLNetworkAnalyzer/v15/.suo‎

0 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)