Skip to content

Commit 546c7fb

Browse files
vletouxvletoux
committed
PingCastle 3.0.0.4
1 parent ad432a0 commit 546c7fb

13 files changed

+126
-119
lines changed

‎Data/HealthcheckData.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1170,6 +1170,7 @@ public void SetIntegrity()
11701170
{
11711171
Trace.WriteLine("SetIntegrity called");
11721172
IntegrityRules = ComputeIntegrity();
1173+
IntegrityVerified = true;
11731174
}
11741175

11751176
public void CheckIntegrity()

‎Healthcheck/HealthcheckAnalyzer.cs‎

Lines changed: 34 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -2327,7 +2327,7 @@ private void GenerateADCSEnrollmentServerTests(ADWebService adws, string dnsHost
23272327
byte[] certificate;
23282328
var protocols = new List<string>();
23292329
Trace.WriteLine("[" + DateTime.Now + "] Test for " + dnsHostName + " 1 starts");
2330-
GenerateTLSInfo(uri.Host, uri.Port, protocols, out certificate);
2330+
GenerateTLSInfo(uri.Host, uri.Port, protocols, out certificate, "[" + DateTime.Now + "] ");
23312331
Trace.WriteLine("[" + DateTime.Now + "] Test for " + dnsHostName + " 2 done for TLS");
23322332

23332333
enrollmentServer.SSLProtocol = protocols;
@@ -2340,7 +2340,7 @@ private void GenerateADCSEnrollmentServerTests(ADWebService adws, string dnsHost
23402340
// web enrollment
23412341
// https access
23422342
// channel binding
2343-
var result = ConnectionTester.TestExtendedAuthentication(uri, adws.Credential);
2343+
var result = ConnectionTester.TestExtendedAuthentication(uri, adws.Credential, "[" + DateTime.Now + "] Test for " + dnsHostName + " ");
23442344
Trace.WriteLine("[" + DateTime.Now + "] Test for " + dnsHostName + " 3 done for TestExtendedAuthentication");
23452345
if (result == ConnectionTesterStatus.ChannelBindingDisabled)
23462346
{
@@ -2353,7 +2353,7 @@ private void GenerateADCSEnrollmentServerTests(ADWebService adws, string dnsHost
23532353
}
23542354
// http access
23552355
uri = new Uri("http://" + dnsHostName + "/certsrv/certrqxt.asp");
2356-
result = ConnectionTester.TestConnection(uri, adws.Credential);
2356+
result = ConnectionTester.TestConnection(uri, adws.Credential, "[" + DateTime.Now + "] Test for " + dnsHostName + " ");
23572357
Trace.WriteLine("[" + DateTime.Now + "] Test for " + dnsHostName + " 4 done for TestConnection");
23582358
if (result == ConnectionTesterStatus.AuthenticationSuccessfull)
23592359
{
@@ -2365,7 +2365,7 @@ private void GenerateADCSEnrollmentServerTests(ADWebService adws, string dnsHost
23652365
// channel binding
23662366
uri = new Uri("https://" + dnsHostName + "/" + System.Net.WebUtility.UrlEncode(CAName) + "_CES_Kerberos/service.svc");
23672367

2368-
result = ConnectionTester.TestExtendedAuthentication(uri, adws.Credential);
2368+
result = ConnectionTester.TestExtendedAuthentication(uri, adws.Credential, "[" + DateTime.Now + "] Test for " + dnsHostName + " ");
23692369
Trace.WriteLine("[" + DateTime.Now + "] Test for " + dnsHostName + " 5 done for TestExtendedAuthentication");
23702370
if (result == ConnectionTesterStatus.ChannelBindingDisabled)
23712371
{
@@ -2379,7 +2379,7 @@ private void GenerateADCSEnrollmentServerTests(ADWebService adws, string dnsHost
23792379

23802380
// http access
23812381
uri = new Uri("http://" + dnsHostName + "/" + System.Net.WebUtility.UrlEncode(CAName) + "_CES_Kerberos/service.svc");
2382-
result = ConnectionTester.TestConnection(uri, adws.Credential);
2382+
result = ConnectionTester.TestConnection(uri, adws.Credential, "[" + DateTime.Now + "] Test for " + dnsHostName + " ");
23832383
Trace.WriteLine("[" + DateTime.Now + "] Test for " + dnsHostName + " 6 done for TestConnection");
23842384
if (result == ConnectionTesterStatus.AuthenticationSuccessfull)
23852385
{
@@ -3129,7 +3129,7 @@ private void GenerateWSUSData(ADDomainInfo domainInfo, ADWebService adws)
31293129
{
31303130
byte[] certificate;
31313131
var protocols = new List<string>();
3132-
GenerateTLSInfo(uri.Host, uri.Port, protocols, out certificate);
3132+
GenerateTLSInfo(uri.Host, uri.Port, protocols, out certificate, "[" + DateTime.Now + "] ");
31333133
cache[key] = new KeyValuePair<List<string>, byte[]>(protocols, certificate);
31343134
}
31353135
gpo.WSUSserverSSLProtocol = cache[key].Key;
@@ -3149,7 +3149,7 @@ private void GenerateWSUSData(ADDomainInfo domainInfo, ADWebService adws)
31493149
{
31503150
byte[] certificate;
31513151
var protocols = new List<string>();
3152-
GenerateTLSInfo(uri.Host, uri.Port, protocols, out certificate);
3152+
GenerateTLSInfo(uri.Host, uri.Port, protocols, out certificate, "[" + DateTime.Now + "] ");
31533153
cache[key] = new KeyValuePair<List<string>, byte[]>(protocols, certificate);
31543154
}
31553155
gpo.WSUSserverAlternateSSLProtocol = cache[key].Key;
@@ -4962,12 +4962,12 @@ private void GenerateDomainControllerData(ADDomainInfo domainInfo, ADWebService
49624962
}
49634963
Trace.WriteLine("[" + threadId + "] Working on smb support " + dns);
49644964
SMBSecurityModeEnum securityMode;
4965-
if (SmbScanner.SupportSMB1(dns, out securityMode))
4965+
if (SmbScanner.SupportSMB1(dns, out securityMode, "[" + threadId + "] "))
49664966
{
49674967
DC.SupportSMB1 = true;
49684968
}
49694969
DC.SMB1SecurityMode = securityMode;
4970-
if (SmbScanner.SupportSMB2And3(dns, out securityMode))
4970+
if (SmbScanner.SupportSMB2And3(dns, out securityMode, "[" + threadId + "] "))
49714971
{
49724972
DC.SupportSMB2OrSMB3 = true;
49734973
}
@@ -4979,15 +4979,15 @@ private void GenerateDomainControllerData(ADDomainInfo domainInfo, ADWebService
49794979
}
49804980
if (DC.SMB1SecurityMode != SMBSecurityModeEnum.NotTested && DC.SMB2SecurityMode != SMBSecurityModeEnum.NotTested)
49814981
{
4982-
if (NamedPipeTester.IsRemotePipeAccessible(dns, NamedPipeTester.WebClientPipeName))
4982+
if (NamedPipeTester.IsRemotePipeAccessible(dns, NamedPipeTester.WebClientPipeName, "[" + threadId + "] "))
49834983
{
49844984
DC.WebClientEnabled = true;
49854985
}
49864986
}
49874987
Trace.WriteLine("[" + threadId + "] Working on ldap ssl " + dns);
4988-
GenerateTLSConnectionInfo(dns, DC, adws.Credential);
4988+
GenerateTLSConnectionInfo(dns, DC, adws.Credential, threadId);
49894989
Trace.WriteLine("[" + threadId + "] Working on ldap signing requirements " + dns);
4990-
GenerateLDAPSigningRequirementInfo(dns, DC, adws.Credential);
4990+
GenerateLDAPSigningRequirementInfo(dns, DC, adws.Credential, threadId);
49914991
Trace.WriteLine("[" + threadId + "] Done for " + dns);
49924992
}
49934993
};
@@ -5042,36 +5042,40 @@ private void GenerateDomainControllerData(ADDomainInfo domainInfo, ADWebService
50425042
}
50435043
}
50445044

5045-
private void GenerateTLSConnectionInfo(string dns, HealthcheckDomainController DC, NetworkCredential credentials)
5045+
private void GenerateTLSConnectionInfo(string dns, HealthcheckDomainController DC, NetworkCredential credentials, int threadId)
50465046
{
50475047
DC.LDAPSProtocols = new List<string>();
50485048
byte[] certificate;
5049-
GenerateTLSInfo(dns, 636, DC.LDAPSProtocols, out certificate);
5049+
Trace.WriteLine("[" + threadId + "] GenerateTLSInfo");
5050+
GenerateTLSInfo(dns, 636, DC.LDAPSProtocols, out certificate, "[" + threadId + "] ");
50505051
DC.LDAPCertificate = certificate;
50515052
if (DC.LDAPSProtocols.Count > 0)
50525053
{
50535054
if (DoesComputerMatchDns(dns))
50545055
{
5055-
Trace.WriteLine("Test ignored because tested on the DC itself");
5056+
Trace.WriteLine("[" + threadId + "] Test ignored because tested on the DC itself");
50565057
return;
50575058
}
5058-
5059-
var result = ConnectionTester.TestExtendedAuthentication(new Uri("ldaps://" + dns), credentials);
5059+
Trace.WriteLine("[" + threadId + "] TestExtendedAuthentication");
5060+
var result = ConnectionTester.TestExtendedAuthentication(new Uri("ldaps://" + dns), credentials, "[" + threadId + "] ");
5061+
Trace.WriteLine("[" + threadId + "] Result:" + result);
50605062
if (result == ConnectionTesterStatus.ChannelBindingDisabled)
50615063
{
50625064
DC.ChannelBindingDisabled = true;
50635065
}
50645066
}
50655067
}
50665068

5067-
private void GenerateLDAPSigningRequirementInfo(string dns, HealthcheckDomainController DC, NetworkCredential credentials)
5069+
private void GenerateLDAPSigningRequirementInfo(string dns, HealthcheckDomainController DC, NetworkCredential credentials, int threadId)
50685070
{
50695071
if (DoesComputerMatchDns(dns))
50705072
{
5071-
Trace.WriteLine("Test ignored because tested on the DC itself");
5073+
Trace.WriteLine("[" + threadId + "] Test ignored because tested on the DC itself");
50725074
return;
50735075
}
5074-
var result = ConnectionTester.TestSignatureRequiredEnabled(new Uri("ldap://" + dns), credentials);
5076+
Trace.WriteLine("[" + threadId + "] TestSignatureRequiredEnabled");
5077+
var result = ConnectionTester.TestSignatureRequiredEnabled(new Uri("ldap://" + dns), credentials, "[" + threadId + "] ");
5078+
Trace.WriteLine("[" + threadId + "] Result:" + result);
50755079
if (result == ConnectionTesterStatus.SignatureNotRequired)
50765080
{
50775081
DC.LdapServerSigningRequirementDisabled = true;
@@ -5084,72 +5088,44 @@ bool DoesComputerMatchDns(string Dns)
50845088
return string.Equals(hostName, Dns, StringComparison.OrdinalIgnoreCase);
50855089
}
50865090

5087-
private void GenerateTLSInfo(string dns, int port, List<string> protocols, out byte[] certificate)
5091+
private void GenerateTLSInfo(string dns, int port, List<string> protocols, out byte[] certificate, string logPrefix)
50885092
{
50895093
certificate = null;
50905094
foreach (SslProtocols protocol in Enum.GetValues(typeof(SslProtocols)))
50915095
{
5092-
if (protocol == SslProtocols.None)
5093-
continue;
50945096
if (protocol == SslProtocols.Default)
5095-
{
5096-
try
5097-
{
5098-
byte[] c = null;
5099-
using (TcpClient client = new TcpClient(dns, port))
5100-
{
5101-
client.ReceiveTimeout = 1000;
5102-
client.SendTimeout = 1000;
5103-
using (SslStream sslstream = new SslStream(client.GetStream(), false,
5104-
(object sender, X509Certificate CACert, X509Chain CAChain, SslPolicyErrors sslPolicyErrors)
5105-
=>
5106-
{ c = CACert.GetRawCertData(); return true; }
5107-
, null))
5108-
{
5109-
Trace.WriteLine("normal auth for " + dns);
5110-
sslstream.AuthenticateAsClient(dns, null, protocol, false);
5111-
Trace.WriteLine("normal auth supported for " + dns);
5112-
certificate = c;
5113-
}
5114-
}
5115-
}
5116-
catch (SocketException)
5117-
{
5118-
Trace.WriteLine("SSL not supported for " + dns);
5119-
return;
5120-
}
5121-
catch (Exception)
5122-
{
5123-
}
51245097
continue;
5125-
}
5098+
if (protocol == SslProtocols.None)
5099+
continue;
51265100
try
51275101
{
5102+
byte[] c = null;
51285103
using (TcpClient client = new TcpClient(dns, port))
51295104
{
51305105
client.ReceiveTimeout = 1000;
51315106
client.SendTimeout = 1000;
51325107
using (SslStream sslstream = new SslStream(client.GetStream(), false,
51335108
(object sender, X509Certificate CACert, X509Chain CAChain, SslPolicyErrors sslPolicyErrors)
51345109
=>
5135-
{ return true; }
5110+
{ c = CACert.GetRawCertData(); return true; }
51365111
, null))
51375112
{
5138-
Trace.WriteLine(protocol + " before auth for " + dns);
5113+
Trace.WriteLine(logPrefix + protocol + " before auth for " + dns);
51395114
sslstream.AuthenticateAsClient(dns, null, protocol, false);
5140-
Trace.WriteLine(protocol + " supported for " + dns);
5115+
Trace.WriteLine(logPrefix + protocol + " supported for " + dns);
5116+
certificate = c;
51415117
protocols.Add(protocol.ToString());
51425118
}
51435119
}
51445120
}
51455121
catch (SocketException)
51465122
{
5147-
Trace.WriteLine("SSL not supported for " + dns);
5123+
Trace.WriteLine(logPrefix + "SSL not supported for " + dns);
51485124
return;
51495125
}
51505126
catch (Exception ex)
51515127
{
5152-
Trace.WriteLine(protocol + " not supported for " + dns + ":" + port + " (" + ex.Message + (ex.InnerException == null ? null : " - " + ex.InnerException.Message) + ")");
5128+
Trace.WriteLine(logPrefix + protocol + " not supported for " + dns + ":" + port + " (" + ex.Message + (ex.InnerException == null ? null : " - " + ex.InnerException.Message) + ")");
51535129
}
51545130
}
51555131
}

‎Properties/AssemblyInfo.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,5 +28,5 @@
2828
// Numéro de build
2929
// Révision
3030
//
31-
[assembly: AssemblyVersion("3.0.0.3")]
32-
[assembly: AssemblyFileVersion("3.0.0.3")]
31+
[assembly: AssemblyVersion("3.0.0.4")]
32+
[assembly: AssemblyFileVersion("3.0.0.4")]

‎Report/ReportBase.cs‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -946,14 +946,19 @@ protected void GenerateAccordionDetail(string id, string dataParent, string titl
946946
</div>");
947947
}
948948

949-
private static string GenerateId(string title)
949+
protected static string GenerateId(string title)
950950
{
951951
return "section" + title.Replace(" ", "");
952952
}
953953

954954
protected void GenerateTabHeader(string title, string selectedTab, bool defaultIfTabEmpty = false)
955955
{
956956
string id = GenerateId(title);
957+
GenerateTabHeader(title, id, selectedTab, defaultIfTabEmpty);
958+
}
959+
960+
protected void GenerateTabHeader(string title, string id, string selectedTab, bool defaultIfTabEmpty = false)
961+
{
957962
bool isActive = (String.IsNullOrEmpty(selectedTab) ? defaultIfTabEmpty : selectedTab == id);
958963
Add(@"<li class=""nav-item""><a href=""#");
959964
Add(id);
@@ -1393,6 +1398,8 @@ protected void AddLsaSettingsValue(string property, int value)
13931398
case "srvsvcsessioninfo":
13941399
case "enablemodulelogging":
13951400
case "enablescriptblocklogging":
1401+
case "enablecbacandarmor":
1402+
case "cbacandarmorlevel":
13961403
if (value == 0)
13971404
{
13981405
Add(@"<span class=""unticked"">Disabled</span>");

‎Report/ReportHealthCheckConsolidation.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -531,7 +531,7 @@ private void GenerateDCInformation()
531531
AddCellText(dc.OperatingSystem);
532532
AddCellText((dc.CreationDate == DateTime.MinValue ? "Unknown" : dc.CreationDate.ToString("u")));
533533
AddCellText((dc.StartupTime == DateTime.MinValue ? (dc.LastComputerLogonDate.AddDays(60) < DateTime.Now ? "Inactive?" : "Unknown") : (dc.StartupTime.AddMonths(6) < DateTime.Now ? /*"<span class='unticked'>" +*/ dc.StartupTime.ToString("u")/* + "</span>" */: dc.StartupTime.ToString("u"))));
534-
AddCellText((dc.StartupTime == DateTime.MinValue ? "" : (DateTime.Now.Subtract(dc.StartupTime)).Days + " days"));
534+
AddCellText((dc.StartupTime == DateTime.MinValue ? "" : (DateTime.Now.Subtract(dc.StartupTime)).Days.ToString("D3") + " days"));
535535
AddCellText((String.IsNullOrEmpty(dc.OwnerName) ? dc.OwnerSID : dc.OwnerName));
536536
AddCellText((dc.HasNullSession ? "YES" : "NO"), true, !dc.HasNullSession);
537537
AddCellText((dc.SupportSMB1 ? "YES" : "NO"), true, !dc.SupportSMB1);

‎Report/ReportHealthCheckSingle.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1559,7 +1559,7 @@ private void GenerateDCInformation()
15591559
AddCellText(dc.OperatingSystem);
15601560
AddCellText((dc.CreationDate == DateTime.MinValue ? "Unknown" : dc.CreationDate.ToString("u")));
15611561
AddCellText((dc.StartupTime == DateTime.MinValue ? (dc.LastComputerLogonDate.AddDays(60) < DateTime.Now ? "Inactive?" : "Unknown") : (dc.StartupTime.AddMonths(6) < DateTime.Now ? /*"<span class='unticked'>" + */dc.StartupTime.ToString("u")/* + "</span>"*/ : dc.StartupTime.ToString("u"))));
1562-
AddCellText((dc.StartupTime == DateTime.MinValue ? "" : (DateTime.Now.Subtract(dc.StartupTime)).Days + " days"));
1562+
AddCellText((dc.StartupTime == DateTime.MinValue ? "" : (DateTime.Now.Subtract(dc.StartupTime)).Days.ToString("D3") + " days"));
15631563
AddCellText((String.IsNullOrEmpty(dc.OwnerName) ? dc.OwnerSID : dc.OwnerName));
15641564
AddCellText((dc.HasNullSession ? "YES" : "NO"), true, !dc.HasNullSession);
15651565
AddCellText((dc.SupportSMB1 ? "YES" : "NO"), true, !dc.SupportSMB1);

‎Rules/RuleBase.cs‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,14 @@ protected RuleBase()
8383
{
8484
throw new NotImplementedException();
8585
}
86+
ReloadResource();
87+
}
88+
89+
public void ReloadResource()
90+
{
8691
string resourceKey;
8792
resourceKey = RiskId.Replace('-', '_').Replace('$', '_');
88-
93+
8994
Title = ResourceManager.GetString(resourceKey + "_Title");
9095
Description = ResourceManager.GetString(resourceKey + "_Description");
9196
TechnicalExplanation = ResourceManager.GetString(resourceKey + "_TechnicalExplanation");

0 commit comments

Comments
 (0)