SHOW:
|
|
- or go back to the newest paste.
| 1 | function Test-TLSRegistrySettings () {
| |
| 2 | ||
| 3 | # constants | |
| 4 | ||
| 5 | # registry paths | |
| 6 | $ZerServerPath = 'HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server' | |
| 7 | $OneClientPath = 'HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client' | |
| 8 | $OneServerPath = 'HKLM:\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server' | |
| 9 | $CipherPath = 'HKLM:\System\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010002' | |
| 10 | ||
| 11 | # we want the various "Enabled" entries to have Data of 0 | |
| 12 | $DesiredEnabled = 0 | |
| 13 | # we want the various "DisabledByDefault" entries to have Data of 1 | |
| 14 | $DesiredDisabled = 1 | |
| 15 | ||
| 16 | # desired value for ...\SSL\00010002\Functions | |
| 17 | $DesiredCiphers = @( | |
| 18 | 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', | |
| 19 | 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', | |
| 20 | 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384', | |
| 21 | 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256', | |
| 22 | 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA', | |
| 23 | 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA', | |
| 24 | 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', | |
| 25 | 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256', | |
| 26 | 'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384', | |
| 27 | 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256', | |
| 28 | 'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA', | |
| 29 | 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA' | |
| 30 | ) | |
| 31 | ||
| 32 | # blindly try to do all the things, then do various tests after | |
| 33 | $ErrorActionPreference = 'SilentlyContinue' | |
| 34 | ||
| 35 | # get PowerShell objects for the registry keys | |
| 36 | $ZerServerKey = Get-Item -Path $ZerServerPath | |
| 37 | $OneClientKey = Get-Item -Path $OneClientPath | |
| 38 | $OneServerKey = Get-Item -Path $OneServerPath | |
| 39 | $CipherKey = Get-Item -Path $CipherKey | |
| 40 | ||
| 41 | # get PowerShell objects for the registry entries | |
| 42 | ||
| 43 | $ZerServerEnabled = $ZerServerKey | Get-ItemProperty -Name 'Enabled' | |
| 44 | ||
| 45 | $OneClientDisabled = $OneClientKey | Get-ItemProperty -Name 'DisabledByDefault' | |
| 46 | $OneClientEnabled = $OneClientKey | Get-ItemProperty -Name 'Enabled' | |
| 47 | ||
| 48 | $OneServerDisabled = $OneServerKey | Get-ItemProperty -Name 'DisabledByDefault' | |
| 49 | $OneServerEnabled = $OneServerKey | Get-ItemProperty -Name 'Enabled' | |
| 50 | ||
| 51 | $CipherFuncs = $CipherKey | Get-ItemProperty -Name 'Functions' | |
| 52 | ||
| 53 | # restore normal error behavior and move on to our tests | |
| 54 | $ErrorActionPreference = 'Continue' | |
| 55 | ||
| 56 | # do the registry key exist at all? | |
| 57 | - | if (-not (Test-Path $ZerServerPath)) { return 'TLS 1.0 Server path missing' }
|
| 57 | + | if (-not (Test-Path $ZerServerPath)) { return $false }
|
| 58 | - | if (-not (Test-Path $OneClientPath)) { return 'TLS 1.1 Client path missing' }
|
| 58 | + | if (-not (Test-Path $OneClientPath)) { return $false }
|
| 59 | - | if (-not (Test-Path $CipherPath )) { return 'TLS cipher suite path missing' }
|
| 59 | + | if (-not (Test-Path $CipherPath )) { return $false }
|
| 60 | ||
| 61 | # did we get objects for the registry keys? | |
| 62 | - | if ($null -eq $ZerServerKey) { return 'TLS 1.0 Server key issue' }
|
| 62 | + | if ($null -eq $ZerServerKey) { return $false }
|
| 63 | - | if ($null -eq $OneClientKey) { return 'TLS 1.1 Client key issue' }
|
| 63 | + | if ($null -eq $OneClientKey) { return $false }
|
| 64 | - | if ($null -eq $OneServerKey) { return 'TLS 1.1 Server key issue' }
|
| 64 | + | if ($null -eq $OneServerKey) { return $false }
|
| 65 | ||
| 66 | # did we get objects for the registry entries? | |
| 67 | - | if ($null -eq $ZerServerEnabled) { return 'TLS 1.0 Server property Enabled issue' }
|
| 67 | + | if ($null -eq $ZerServerEnabled) { return $false }
|
| 68 | - | if ($null -eq $OneClientDisabled) { return 'TLS 1.1 Client property DisabledByDefault issue' }
|
| 68 | + | if ($null -eq $OneClientDisabled) { return $false }
|
| 69 | - | if ($null -eq $OneClientEnabled) { return 'TLS 1.1 Client property Enabled issue' }
|
| 69 | + | if ($null -eq $OneClientEnabled) { return $false }
|
| 70 | - | if ($null -eq $OneServerDisabled) { return 'TLS 1.1 Server property DisabledByDefault issue' }
|
| 70 | + | if ($null -eq $OneServerDisabled) { return $false }
|
| 71 | - | if ($null -eq $OneServerEnabled) { return 'TLS 1.1 Server property Enabled issue' }
|
| 71 | + | if ($null -eq $OneServerEnabled) { return $false }
|
| 72 | - | if ($null -eq $CipherFuncs) { return 'TLS cipher suite property Functions issue' }
|
| 72 | + | if ($null -eq $CipherFuncs) { return $false }
|
| 73 | ||
| 74 | # do the DWORDs have the desired values? | |
| 75 | - | if ($ZerServerEnabled -ne $DesiredEnabled) { return 'TLS 1.0 Server property Enabled does not have desired value' }
|
| 75 | + | if ($ZerServerEnabled -ne $DesiredEnabled) { return $false }
|
| 76 | - | if ($OneClientEnabled -ne $DesiredEnabled) { return 'TLS 1.1 Client property Enabled does not have desired value' }
|
| 76 | + | if ($OneClientEnabled -ne $DesiredEnabled) { return $false }
|
| 77 | - | if ($OneServerEnabled -ne $DesiredEnabled) { return 'TLS 1.1 Server property Enabled does not have desired value' }
|
| 77 | + | if ($OneServerEnabled -ne $DesiredEnabled) { return $false }
|
| 78 | - | if ($OneClientDisabled -ne $DesiredDisabled) { return 'TLS 1.1 Client property DisabledByDefault does not have desired value' }
|
| 78 | + | if ($OneClientDisabled -ne $DesiredDisabled) { return $false }
|
| 79 | - | if ($OneServerDisabled -ne $DesiredDisabled) { return 'TLS 1.1 Server property DisabledByDefault does not have desired value' }
|
| 79 | + | if ($OneServerDisabled -ne $DesiredDisabled) { return $false }
|
| 80 | ||
| 81 | # Compare-Object returns TRUE if params DIFFER | |
| 82 | - | if (Compare-Object $CipherFuncs $DesiredCiphers) { return 'TLS cipher suite Functions property does not have desired value' }
|
| 82 | + | if (Compare-Object $CipherFuncs $DesiredCiphers) { return $false }
|
| 83 | ||
| 84 | # all the checks passed | |
| 85 | return $true | |
| 86 | ||
| 87 | } | |
| 88 |
