MsgBoxViewer 11 – Compatible for BizTalk 2010
Hello
A long time I did not update my blog to announce a new version of my tool ! 🙂
One of the reason is that I just changed of business to become an Escalation Engineer in SharePoint Developement Support; a lot of work and topics to learn in perspective so but I wanted to enlarge my skills set.
I change of business but I still continue to have an eye on BizTalk of course 🙂
I also spent some time these past months with my former BizTalk colleagues to try to identify a process and people responsible for futur MBV updates, and help for quick and easy next updates of MBV.
I had so to change the MBV architecture and redesign completly my tool MBVQueryBuilder to make the query or rules update a task much more easy.
Next MBV updates might be done so mainly by the Biztalk Support team with my contribution.
Finaly I spent time to update MBV to make it compatible for BizTalk 2010 (the Class Settings query reported indeed wrong changes for example) and this is this new version that I put here
This version brings also two major changes :
1) MBV is compiled now to target .NET 2
You can ask yourself why MV was targeting until now only .NET 1.x ?? it is for the simple reason that MBV remained always compatible for BizTalk 2004 and that it should be able to run on BizTalk Server 2004 Servers where only .NET 1.x could be installed
This change means so that it can not run anymore on a BT 2004 box with ONLY .NET 1.X installed, but honestly do we meet frequently such configs now ? 🙂 and anyway you know that you can run MBV on any type of Servers and not only BT ones
2) MBV is not anymore a single .EXE but it is composed now of the following files:
o MYHC.DLL : Implement my custom Health Check engine
o MYHCQUERIES_MBVQUERIES.DLL : Contains the entire MBV repository and custom Query functions to analyze a BizTalk Group
o MSGBOXVIEWER.EXE : GUI MBV Client tool
o MBVCONSOLE.EXE : Console MBV Client tool
Reasons for this split are mainly the following ones:
o Query repository grow too quickly, need so to separate it from the clients .exe
o Health Check engine should be updated w/o the client tools using it
o Need to update easily MBV Repository w/o recompiling the client tools
o As MBV is just a client tool of my generic health Check engine, it can load any type of Query repository (DLL or XML) and not only the BizTalk one
You have the right to prefer the single binary version so in this case I can only suggest you to keep using the old build 🙂 but you will not benefit of additional rules and queries
you can find this new version here :
http://blogs.technet.com/b/jpierauc/archive/2007/12/18/msgboxviewer.aspx
As usual, feel free to report in this blog your feedbacks on the tool, your suggestions for new features or improvements, and any kind of problems you could meet using MBV
and many thanks to all of you who already sent me good feedbacks ! 😉
JP
New Features :
– Compatible for incoming BizTalk 2010
– Add additional query to get retrieve part of Biztalk 2010 Dashboard Settings
– Detect if CU3 is installed on each BT Server
– Get Perfmon counters for ALL BT Servers (and not only the local server)
– Get Perfmon counters for MsgBox Db SQL Servers (SQL General statisitcs, SQL locks, SQL Databases)
– Add order delivery and other port settings in the “Send ports” query
– Add query to get custom settings of each Send Port: Not checked by default
– Add query to get custom settings of each Receive Location: Not checked by default
– Check for small or default value in WCF ReceiveTimeout binding property
– Check for MQS port configured w/o Tx
– Check for WMI prop “ClearAfter” too large value : Error CLSID_PropertBag
– Format better BAM config info report output
– Added Latest new MSDTC /COM+ packages version info
– Get Last X rows from Spool and Instances tables : rows number is configurable as a query property
– Raise a warning in MBV if the CustomSD key is found under HKLM\System\Current Control Set\Services\Eventlog\Application
– Rule to check for KB 980560
– Rule to check for KB 979709
– Rule to check for KB 979095
– Add more info in the “BizTalk Group” category of the SUMMARY REPORT section
– Improved query to get sucessfully all GAC assemblies
– Updated Latest BT Mgmt Pack version check
– Get Pipeline ID in Pipeline Query Report
– Get the Transport Type used in “WCF Custom” port
– Redesigned the DialogBox UI to add custom Rules and be able to raise different type of actions
– Redesigned the main dialogbox of MsgBoxViewer.exe (gui version)
BizTalk Server 2010 Documentation – Beta and Posters
BizTalk Server 2010 Documentation – Beta is available through Microsoft Download Center. Here you will find documents like:
- BizTalkServer2010.exe
- BizTalkServer2010HXS.exe
- Installing BizTalk Server 2010 and BAM in a Multi-Computer Environment.docx
- Installing BizTalk Server 2010 on Windows 7 and Windows Vista.docx
- Installing BizTalk Server 2010 on Windows Server 2008 R2 and 2008.docx
- KWUserGuide.exe
- PartyMigrationTool.exe
- Troubleshooting BizTalk Server 2010 Setup.docx
- Upgrading to BizTalk Server 2010 from BizTalk Server 2009 or 2006 R2.docx
Besides the documentation a new set of posters is available:
- BizTalk Server 2010 BAM Poster
This poster describes BizTalk Server 2010 BAM concepts, processes, and management for both new and experienced users. - BizTalk Server 2010 Runtime Architecture Poster
The poster depicts message flow, data flow, and references that occur at runtime in BizTalk Server 2010. - BizTalk Server 2010 Capabilities Poster
The poster provides a high-level and detailed view of BizTalk Server 2010 features and capabilities. - BizTalk Server 2010 Scale-out Configurations Poster
This poster describes typical scale-out configurations and options for BizTalk Server 2010. - BizTalk Server 2010 ESB Toolkit Architecture Poster
This interactive poster, created in Silverlight, depicts the architecture of the BizTalk Server 2010 ESB Toolkit. It shows the toolkit’s core components, and how these integrate with BizTalk Server. - BizTalk Server 2010 Database Infrastructure Poster
This poster describes BizTalk Server 2010 databases and associated components, jobs, services, UI, and events.
Cheers.
Technorati: biztalk biztalk server 2010
Presenting Azure AppFabric @ TechDays 2010
In case you weren’t aware, we are organizing the TechDays Online Conference on Oct8th. Check out the agenda. You’ll find some well known names and an unknown one in the middle Yep, lil ol’ me speaking on a “Lap Around Azure AppFabric” at 1pm in Track-1. In general the track is supposed to be a […]![]()
Optimising VirtualBox
Another indication on the BizTalk 2010 release date?
You can find a number of rumours and indications on the internet on the RTM date of BizTalk 2010. Today I found another one: Seems like we will have to wait a couple of weeks more . Or maybe it will be available sooner on MSDN subscriptions? Who tells? Tagged: BizTalk, BizTalk 2010![]()
BizTalk Server 2010 released for manufacturing!!!
BizTalk Server 2010 has been released to manufacturing and will be available for purchase starting October 1st, 2010. The evaluation and free Developer editions are now available for download from the BizTalk Server website.
BizTalk Server 2010 is the seventh major release of Microsoft enterprise integration product for connecting systems within and across enterprises. BizTalk Server 2010 has 4 major themes – to help customers to:
· Integrate Enterprise Applications Easily
· Manage and Tune Solutions easily
· Enhance Enterprise Interoperability
Let us look at each of themes in detail.
Theme: Integrate Enterprise Applications Easily
BizTalk Server 2010 helps developers put together applications that integrate various heterogeneous systems in an enterprise easily. There are a number of new features and enhancements to the existing features that enable this easy integration.
Seamless access and mapping to Line-of-Business applications for new users and new scenarios
BizTalk Server 2010 includes out of box activities to connect and map data for AppFabric (.NET) developers. With these activities customers can now connect to LOB systems very easily and also use the award winning BizTalk Mapper and the mapping functionality within AppFabric.
With this feature BizTalk Server 2010 now enables:
· Out of box Line of Business Connectivity
· Includes message data transformation
· Delivered as WF 4.0 activities
· Utilize existing BizTalk engine and tools
· BizTalk LoB Adapters (SAP, Oracle, Siebel, Oracle DB, SQL Server)
· Transformation Engine and Mapper
· Provide LoB connectivity for scenarios that need better performance rather than reliability and control (e.g. Web)
· Enables customers to develop solutions that need higher performance without the durability and reliability constraints.
More posts with detailed information on LOB access and mapper activities in AppFabric are here, here, here, and here.
Better design experience of data transformation (maps)
The Mapper in BizTalk Server 2010 has been redesigned and enhanced to work easily with complex maps.
A few highlights of the new Mapper are:
· Reduce background “noise” using highlight propagation to show only the nodes that are relevant to the user
· Auto-scrolling and coalescing of sibling nodes to help locate the nodes of interest easily
· Search functionality to find the nodes of interest easily especially in large and complex maps
· Improve productivity with Cut/Copy/Paste/Move/Undo functionality
· Predictive match that help create maps faster
More details on the new Mapper are available here.
Built-in components for rapid development of RFID solutions
BizTalk Server 2010 helps developers build RFID solutions faster by providing out of box event handlers for duplicate elimination, TDT based filtering and dwell filtering. It also provides out of box mechanism for .NET apps to subscribe to RFID events, post events to BizTalk Server and also post EPCIS events to a Capture Service.
Theme: Manage and Tune Solutions easily
BizTalk Server 2010 helps IT Pros to easily tune their systems for performance and also manage their systems easily. With the below features in BizTalk Server 2010, it is easier and faster to just get things done.
· Easier to setup and update and migrate
· Efficient performance and tuning and setting of run-time parameters with finer setting granularity and more intuitive and accessible settings
· Better visibility and control of production environment with a new System Center Operations Management Pack
· Enhanced security with Transparent Message Data Encryption
· Compression option to speed up backup tasks
Let us look at the enhancements to settings and SCOM pack in details.
Settings Dashboard:
All the settings related to performance tuning are now consolidated in a single dashboard which is accessible from the Management Console. This settings dashboard provides:
· Dashboard view for all performance related settings consolidated in a single place
· Granular setting level options: group, host and host instance
· For example – MaxReceiveInterval which is used to tune BizTalk solutions for high performance is now available at the host level. It is also split into separate settings – MessagePollingInterval and OrchestrationPollingInterval
· Uniform access to settings through APIs
· Ability to replicate settings between deployments using scriptable Export/Import operations
System Center Operations Manager Pack:
The SCOM pack has been redesigned and remodeled to help IT Professionals to easily monitor BizTalk installations and diagnose any problems. This is enabled with the enhancements below:
· New model with separate application and deployment views
· New alerts and diagnostics
· Single representation of artifacts in a multi machine deployment
Upgrade Support:
The last two versions of BizTalk Server – BizTalk Server 2006 R2 and BizTalk Server 2009 can be upgraded to BizTalk Server 2010 seamlessly in-place.
Theme: Enhance Enterprise Interoperability
BizTalk Server 2010 increases enterprise interoperability with the new, scalable TPM (Trading Partner Management) and new and enhanced Adapters and Accelerators. Now we will look at each of these in detail.
Scalable Trading Partner Management:
The new TPM enables easy on-boarding and lifecycle management of trading partners with the following features:
· New Partner Management model that reflects typical B2B relationships.
· Better and more accessible user interface with
· Agreement templates and business profiles for rapid configuration
· New TPM operator role to manage partner management
Another post with more details on TPM is here.
New and enhanced Adapters:
· New FTPS adapter
· Enhanced FTP Adapter
· Supports files from read-only locations
· Extends atomic write to text files
· Fault tolerance and performance improvements
· Support for new versions of LOB systems
· Oracle EBS 12.1
· SAP 7
· JD Edwards 9.0
· SharePoint 2010
· SQL Server 2008 R2
· Support for new Microsoft platforms
· Windows Server 2008 R2
· SQL Server 2008 R2
· .NET Framework 4.0
· Visual Studio 2010
As we discussed in this blog today, with the focus on making developing, tuning, and managing enterprise integration solutions and managing trading partners faster, simpler and easier, we hope that BizTalk Server 2010 will make it easy for enterprises to build composite solutions that span both on-premise LOB systems and also applications deployed onto the public cloud.
Here is another post that discusses the features of BizTalk Server 2010 along with a video.
Learn BizTalk Server 2010 at your own pace here.
To learn more regarding the BizTalk Server 2010 release and download our new free developer edition, please visit BizTalk Server website. You can learn more about Microsoft’s Application Infrastructure capabilities by exploring on-demand training at www.appinfrastructure.com.
BizTalk Sftp Adapter – New release 1.4 available on CodePlex
I’ve got quite a few request for Proxy support through the years, and eventually someone (no names) got tired of waiting, hired me as a consultant, and forced me to implement it. So I’m happy to say the adapter now comes with support for HTTP Proxy.
Support has also been added to:
- Enable "%UniversalDateTime%" macro on Receive Location (rename)
- "Leave File" on the Receive Location.
- Not throwing 10.000 exception to the eventlog (yes this is a feature)
Thanks to everyone giving feed-back through the codeplex site.
If you like it, please rate the project (If you don’t like it, you should not feel obligated to do so)
You will still need to set the appropriate SSH parameters such as SSH Host, User name and Remote path. These parameters will be sent to the proxy server, which in turn will act as “man-in-the-middle” and connect to the SSH server using the parameters provided by the adapter.
Using the WCF OperationContext from a Receive activity
The WF4 Receive activity shields you from a lot of the WCF pipeline. Normally that is a good thing but there are occasions where you want to know more about the incoming WCF request. Normally you can use the WCF OperationContext.Current to get at this information but with a workflow service this doesn’t work as it is null. The reason is that the workflow executes on a different thread.
So how do you get at the OperationContext?
The trick is to add a class implementing the IReceiveMessageCallback interface to the NativeActivityContext.Properties while the receive is executing and this will have it’s OnReceiveMessage() function executed with the OperationContext passed in. This means creating an activity to wrap the Receive activity like this.
public class GetMessageProperties : NativeActivity
{
public Activity Body { get; set; }
protected override void Execute(NativeActivityContext context)
{
var inspector = new GetMessagePropertiesInspector();
context.Properties.Add(inspector.GetType().FullName, inspector);
context.ScheduleActivity(Body, OnBodyCompleted);
}
private void OnBodyCompleted(NativeActivityContext context, ActivityInstance instance)
{
var inspector = context.Properties.Find(typeof(GetMessagePropertiesInspector).FullName) as GetMessagePropertiesInspector;
if (inspector != null)
{
Console.WriteLine("ClientUri = {0}", inspector.ClientAddress);
}
}
}
The GetMessagePropertiesInspector, which implements the IReceiveMessageCallback, is quite simple. The main thing here is that it can be serialized along with the workflow state so make sure it contains the DataContract attribute.
[DataContract]
public class GetMessagePropertiesInspector : IReceiveMessageCallback
{
[DataMember]
public string ClientAddress { get; set; }
public void OnReceiveMessage(OperationContext operationContext, ExecutionProperties activityExecutionProperties)
{
var properties = operationContext.IncomingMessageProperties;
var endpoint = properties[RemoteEndpointMessageProperty.Name] as RemoteEndpointMessageProperty;
ClientAddress = endpoint.Address;
}
}
Creating and self hosting the workflow in a console app is easy, if you want to use the designer you will need to add an ActivityDesigner as well and you are good to go.
class Program
{
static void Main(string[] args)
{
var workflow = CreateWorkflow();
var host = new WorkflowServiceHost(workflow, new Uri("http://localhost:8080/MyService"));
host.AddDefaultEndpoints();
host.Open();
Console.ReadLine();
host.Close();
}
private static Activity CreateWorkflow()
{
var result = new Sequence();
var receive = new Receive();
receive.OperationName = "GetData";
receive.CanCreateInstance = true;
result.Activities.Add(new GetMessageProperties() { Body = receive });
result.Activities.Add(new SendReply() { Request = receive });
return result;
}
}
If you want to work with the reply message there is also a ISendMessageCallback which does exactly the same for the result message.
Enjoy!
www.TheProblemSolver.nl
Wiki.WindowsWorkflowFoundation.eu
Frequently Asked Questions about the ASP.NET Security Vulnerability
Two days ago I published an important blog post about a security vulnerability in ASP.NET. In it I discussed a workaround that we recommend customers use to help prevent attackers from using the vulnerability against your applications.
Below are answers to some common questions people have asked since then about the vulnerability.
Is Microsoft going to release an update to fix the vulnerability?
Yes. We are working on an update to ASP.NET that we will release via Windows Update once it has been thoroughly tested and is ready for broad distribution.
Until the update is available, we will also publish details on workarounds (like the one described in this post) that can be applied immediately to help protect against the vulnerability. Note that the workarounds are temporary – and will not be required once the update fixes the vulnerability in the underlying products. They are intended to provide steps that you can take immediately until the update is available.
Is this an issue in ASP.NET or is it some cryptographic vulnerability?
This is a vulnerability in how ASP.NET uses cryptography in some circumstances that enables side-channel leaks through error responses. The current ASP.NET use of encryption padding provides information in error responses that can be used by a malicious party. We will be fixing this vulnerability in the security update.
Does this affect both ASP.NET Web Forms and ASP.NET MVC?
Yes – the publicly disclosed exploit can be used against all types of ASP.NET Applications (including both Web Forms and MVC).
Does this affect SharePoint?
Yes – the publicly disclosed exploit can also be used against SharePoint 2010. The SharePoint team recently published a blog post that describes a workaround you can apply until we release the security update.
What would an attack look like on the network or in my logs?
The publicly disclosed exploit would cause the web server to generate thousands (or more likely tens of thousands) of HTTP 500 and 404 error responses to requests from a malicious client.
You can use stateful filters in your firewall or intrusion detection systems on your network to detect such patterns and block such clients. The Dynamic IP Restrictions module supported by IIS 7 can also be used to block these types of attacks.
An attack attempt like this should also generate thousands of warnings in the application event log of your server similar to:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 11/11/1111 11:11:11 AM
Application information:
Application domain: c1db5830-1-129291000036654651
Application Virtual Path: /
Exception information:
Exception type: CryptographicException
Exception message: Padding is invalid and cannot be removed.
Note that there are non-attack reasons to see this error as well (including cases where you have mismatched keys on a web-farm, or a search engine is following links incorrectly, etc), so its presence does not necessarily indicate an attack.
The exception also does not mean that an attack was successful. Implementing the <customErrors> workaround we have provided can protect your application from the public exploit, and ensure that these exceptions do not disclose information that an attacker can use against the application.
What does the <customErrors> workaround do?
A workaround you can use to protect your application from the public exploit is to enable the <customErrors> feature of ASP.NET, and explicitly configure your applications to always return the same error response – regardless of the error encountered on the server. By mapping all error pages to a single error page, you can make it more difficult for an attacker using the public exploit to distinguish between the different types of errors that occur on a server. I covered how to implement the workaround in this blog post.
If you are using .NET Framework version 3.5 SP1 or 4.0, the workaround provides further protection by also helping to mitigate against potential timing analysis attacks. The workaround uses the redirectMode="ResponseRewrite" option in the customErrors feature, and introduces a random delay in the error page. These approaches work together to make it more difficult for an attacker to deduce the type of error that occurred on the server by measuring the time it took to receive the error.
Can I configure a custom 404 error page response and a default redirect for all other errors?
No. By doing this you are still letting an attacker draw distinction between a 404 and other errors. Homogenizing errors is a crucial component to mitigating this attack. Note that this is a workaround until a security patch is available to fix the underlying product vulnerability. This workaround will not be required once we release a security update.
Am I vulnerable if I have my own custom error module?
If the responses that are sent out from your custom logging module do not let the client distinguish between error responses either through its content or time that it takes to serve out, then such a module is an adequate replacement for the customErrors workaround. These responses include both the entire HTTP response and the HTTP error code. If any of the above is not true at all times, then this is not sufficient. Instead you should send out the same error response for all errors until the security update is available to fix the underlying vulnerability.
Should I be concerned about this vulnerability if I don’t store any sensitive information in my viewstate?
Yes you should. There is a combination of attacks that was publicly demonstrated that can leak the contents of your web.config file, including any sensitive, unencrypted, information in the file. You should apply the workaround to block the padding oracle attack in its initial stage of the attack. The security update will fix this vulnerability.
What are best practices to secure my data within the web.config file?
It is always a best practice to encrypt sensitive configuration data within web.config files. That way if your web.config file is ever exposed, attackers can not use its contents maliciously. This MSDN documentation describes how to encrypt web.config file configuration sections: http://msdn.microsoft.com/en-us/library/zhhddkxy(VS.80).aspx. This tutorial also provides more samples of how to encrypt web.config file contents: http://www.4guysfromrolla.com/articles/021506-1.aspx
Why am I getting an error running the vulnerability detection .vbs script?
In my initial blog post I pointed at a .vbs script that you can run against a server to identify any applications within it that need to have their <customErrors> sections updated as a workaround against the publicly disclosed exploit.
On IIS 7, the script requires you to have the IIS 6 management compatibility feature installed to be able to use this script. To enable this, run Add/Remove Programs on workstations and Add Web Server Role Services on server operating systems and select the IIS 6.0 Management Compatibility feature under the “Internet Information Services” feature area. If this feature is already installed, please ensure that you are running the script with Administrator privileges.
Summary
We will post more information as our investigations continue, and we will post security advisory updates if the situation changes. You can learn more about this vulnerability from:
- Microsoft Security Advisory 2416728
- Understanding the ASP.NET Vulnerability
- My Initial Blog Post
- SharePoint Team Blog Post
- Microsoft Security Response Center Blog Post
- Microsoft Security Response Center Update Post
Please post specific questions about the vulnerability in this forum on the www.asp.net web-site.
Thanks,
Scott