Slashdot Log In
Vista's TCP/IP Promises and Perils
Posted by
kdawson
on Wed Dec 13, 2006 08:42 AM
from the packet-to-go dept.
from the packet-to-go dept.
boyko.at.netqos tips us to a new writeup on Vista's TCP/IP stack, which is called Compound TCP/IP (CTCP). From the article: "...security policy will come from a centralized source. When you get your DHCP lease, your computer will report to the stack what OS you're using, what version level, what patches, what anti-virus software that's active — all that kind of stuff. It will have the ability to restrict your network access if you have a down-level machine... We could see a lot of our customers with much higher WAN network utilization because of this new TCP/IP stack... CTCP can be enabled/disabled from the command prompt but there has been no mention of tuning parameters which leads us to ask the question: How are you supposed to configure this setting in Vista?... What worries us... is that Microsoft is basing this on packet round trip time. The round-trip time from the client-side will have the server processing time in it; but the clients aren't likely going to be the running the CTCP at first. If you have a server-to-server backup running, for example, CTCP may think its part of the round-trip time and it'll throw the delay window through the roof..."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Sure, ask the client (Score:5, Insightful)
So my trojan will be reporting values honored by the DHCP servers. This system is still relying on the information sent by the (possibly infected) machine, so it is not secure in any way.
Re: (Score:2)
I think the idea here is to cut off net access for an unpatched machine so it doesn't get infected in the first place. Obviously this is useless against a machine that has already been compromised.
Re:Sure, ask the client (Score:5, Insightful)
So, assuming you are not a huge corporate customer, how exactly *do* you get updates at this point?
Parent
Why build it into the stack? (Score:5, Informative)
The goal here seems to just be a way to allow corporate networks like WANs to restrict access based on the version of Windows that's running and the security software being implemented on the client. Setting aside how a rootkit would just fake the responses (and I don't believe for a second that there won't be rootkits for Vista once it gets mainstream), why does this have to be in the network stack? It could be easily implemented as part of the higher-level networking services like WINS or Active Directory, as a requirement before the user is allowed access to particular network resources.
This whole concept seems rather flawed, unless there's some large part of it that I'm missing, and it just seems like it's going to require other OSes to rewrite their perfectly good TCP/IP stacks in order to inter-operate with Windows networks. Maybe that's the whole point?
Parent
Re:Why build it into the stack? (Score:5, Insightful)
The first time the CEO can't get his email because his laptop wasn't patched to the right level all hell will break loose and this will be turned off.
It's also insecure as hell, someone could write a virus that does nothing but shut off this checking and then erases itself. Then you got a lot of time spent by the Help Desk and/or Techs trying to figure out why no one can connect! And unless the techs are ultra sharp about how the "new" TCP/IP stack operates they are going to be really puzzled and frustrated.
Parent
Re: (Score:3, Insightful)
Exactly. This strategy has been advocated in Microsoft internal documents dating from years back. Eric S. Raymond quotes a Microsoft confidential Linux strategy report [catb.org] as saying:
I know I've been waiting since then for this particular shoe to drop. As for the rest of you, especiall
Re: (Score:3, Informative)
Not if:
1) This code is in the kernel,
2) You are running a version of Vista which forbids patching of the kernel (i.e. modification of the kernel that is running) - that's any 64-bit installation
Also not if:
1) The setting requires a UAC prompt,
2) The company has gone to the bother
Re:Why build it into the stack? (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
To set up what seems to be called "CTCP", all you'd do are have appended DHCP flags already allowed by the standard, with one last extra flag as "SIGNATURE" flag, signed by the private key. All data would be in clear-text, and easily read AND changeable, BUT the signature guarantees unmodification. The MS DHCP server could verify the sig, and grant/refuse an IP address.
Of course, there'd
It's called embrace and extend (Score:3, Insightful)
Re: (Score:3, Insightful)
They also claim that CTCP has been designed for "TCP fairness" to allow CTCP and regular TCP traffic to play nicely when sharing the same link - Microsoft's data shows that CTCP doesn't induce enough loss to wreak havoc with regular TCP allowing then to both maximize their throughput.
Incase you missed Networking 101, it is beneficial from a networking point of view to have only one protocol running on a network. But hell, if you want to... you can run a bunch of pro
Re: (Score:3, Informative)
As CTCP is a protocol carried in IP, there should be no impact within the network, as practically nothing does deep introspection of packets other than firewalls (for policy) and end systems (for multiplexing and demultiplexing). Intermediate systems (i.e., IP routers) simply won't care or necessarily even notice that the IP da
Re: (Score:3, Insightful)
Well, I guess smart IT shops will just put such servers outside the CDHCP servers....
Nice try, mshaft. Take your bat and ball and go home. Try again another day...
Re: (Score:3, Informative)
Re: (Score:3, Informative)
The buzzword "quarantine network" has been tossed around for at least the last six months. The theory behind the technology is that a client that fails to meet the policy requirements will be directed to a completely seperate subnet (think DMZ) where it will have access to a server that will push down the necessary patches and AV upgrades to bring the client into compliance. In otherwords, if your network is on 10.1.1.x the
Because residential ISPs might implement it (Score:3, Insightful)
Here is what I think is funny. Everyone bitches about this feature when MS implements it. How it could be an app or service of some sort. But when Cisco does it with CSA http://www.cisco.com/en/US/products/sw/secursw/ps5 057/index.html [cisco.com] It is the best idea ever.
There's a specific difference. Residential ISPs are more likely to require something that is available as part of the Windows base install than something that requires proprietary software from Cisco. In addition, something from Microsoft is more likely to be used to deny Linux users the ability to connect or to require them to move up to the next tier of service at twice the monthly rate.
client? (Score:2, Insightful)
I don't think anyone on
Article summary (Score:5, Informative)
We haven't used Vista.
We haven't tested the features we're talking about.
We think they're actually probably very good.
We don't know (and nor does anyone) because we haven't tested them.
They could be bad.
They could do nasty stuff to your networks.
But we don't know because we haven't tested anything.
Sounds good in theory though.
And all the MS guys that have ever wrote about it say it works.
We don't think it'll work perfectly first time.
But we don't know because we haven't tested anything at all in any way.
We advise others to test before they make any decision.
Good article. (That was sarcasm. At least I think it was but I haven't tested it myself yet).
Re:Article summary (Score:4, Interesting)
Altogether these are some very interesting concepts, and I hope that they pan out in practice. (I too haven't tested any of this myself).
Parent
Re: (Score:2)
Whilst this might work for a simple network it coul
Promising... (Score:5, Funny)
Re: (Score:2)
Don't kid yourself, Vista is the evil nibble.
10 LET M$ = "Microsoft" (Score:3, Interesting)
AC: Which items of Paul Rogers' laundry list did twitter's comment violate? If the M$ one was the most significant, consider that M$ is a valid name for a string variable in (at least early dialects of) BASIC; a lot of people thus use M$ to imply that the world might have been a better place had Microsoft kept making languages and office software instead of branching off into operating systems.
the whole point... (Score:2, Insightful)
Re: (Score:2)
Re:the whole point...could happen (Score:4, Interesting)
Parent
Re:Bingo! (Score:3, Interesting)
The bigger picture is locking everything out.
1. Reaching into the networking peripherals market to extract a tax for the privilege of connecting to a Vista PC. Give Microsoft a few cents for every device sold and no consumer will care. Microsoft can then tighten the DRM noose and increase revenue simultaneou
Re: (Score:3, Interesting)
I love ... (Score:2)
Many thanks to the big brains in Redmond!
What the load of misinformation (Score:5, Informative)
Compound TCP is not a TCP/IP stack! It's congestion avoidance/recovery algorithm for TCP streams. It's one of many (Vega, Reno, BIC, CUBIC etc. etc.). It's also available for Linux (but was removed from standard kernel some time ago).
Other things mentioned are parts of Network Access Control, which is already deployed in many companies. There are many software and hardware solutions available, Vista isn't special. It becoming must-have in corporate environment, praising Vista for having it is like claiming that DHCP client in OS is innovation.
Re:What the load of misinformation (Score:5, Informative)
I was commenting blurb, not article itself.
2. What does the design of the tcp/ip stack in any other OS have anything to do with this?
Compund TCP is not stack design. It's one of congestion algorithms for TCP.
Parent
It will have the ability to restrict your network (Score:5, Insightful)
Ehm... and who decides what is a down-level machine?
Re:It will have the ability to restrict your netwo (Score:5, Insightful)
Or you could go with the paranoid conspiracy theory and assume that MS will shoot themselves in the foot by trying to close out competing OSes at the network level; that would be the slashdot way, after all.
Parent
Yes, M$ is evil and M$TCP is stupid. (Score:3, Insightful)
Allowing sysadmins to keep unpatched Windows boxes off their networks is obviously nothing but pure evil. It's Microsoft, so it must be evil, right?
Keeping windows boxes off a network would be nice, but it would be better to simply cut off machines that misbehave. Every machine on the botnet is going to know exactly what to tell the silly C(luster fuck)DHCP server for maximum access. Brands of OS M$ does not like will not. DHCP is already slow, adding this overhead won't rid your network of infection
Microsoft security man... (Score:2, Troll)
Yeah, trust a blind man to invent a new pencil...
Stream of conciousness babblling? (Score:2)
Re: (Score:2)
You must be new here. J/K. Yeah, the article was all about technical and short on explanation. From the tone, I gather that the Vista stack is doing things in the name of security that really isn't very secure. Also there are implications to other OSs that are running on the same network that use a more standard TCP/IP stack. That's what I could gather.
Key phrase: "restrict your network access" (Score:4, Insightful)
Translation: "You WILL upgrade all of your machines to Vista, or Microsoft will artificially degrade their performance." It's called "market development."
Those M$ asshats are actually going to try to sell this as a NAC feature, when it's nothing but another license fee grab. Piss on them: I'm still running several totally stable, bullet-proof web servers on NT4 with 128Mb (albeit behind a good firewall), and I have neither the need nor the intention to "upgrade" them anytime soon (or ever, for that matter).
obligatory abbreviation joke (Score:2)
CTCP is also a portion of the core IRC protocol, which was a goofy way to extend command set.
I can see a niche for a benign rootkit here... (Score:4, Insightful)
Specifically, something to tell the CTCP stack that you're running the very latest version of everything, so that you don't get penalized by other nodes.
Of course, that would be bad news for everyone else on the network, if in fact your old, unpatched OS (which you are reporting as new and patched to avoid having to upgrade to Vista 2.5.9.396) _is_ infected. But then, that's part of the problem with including features that work AGAINST the person buying/using them.
To sum up: malicious/hijacked computers will report that everything's OK. Computers controlled by savvy users who don't want hassle will report that everything's OK. Computers that really have nothing interesting about them will report that everything's OK. There'll be a thin band of computers that really do have old OS versions but that nobody cares about enough to doctor -- these will report that everything's not OK, until they become an issue and are considered a painful extra cost of MS-based networks. The remaining 90% of all computers will have this feature disabled, thus saving all the bother at a very very low cost in security.
It's not that this feature is evil, it just comes from the wrong mindset. I think MS's misconception that it's good to start from the question 'how can we restrict or coerce customers', rather than 'how can we empower and help customers', is likely to prove permanent.
Trojan'd Box? What about hacked DHCP Server? (Score:4, Insightful)
Raises questions (Score:2)
That raises some questions. Does this mean that the stack itself on the system in question will place some kind of access restriction? Are they trying to wedge this into layer 4? Have they devised some kind of MS client-server extension to DHCP that sends a data structure to a server which in turn pushes a policy out to the stack? Or is this intended to be part of an 802.1x based scheme?
Re: (Score:3, Informative)
It's just more vendor-specific fields in the DHCP request and response, plus some ioctl() hooks into the network stack. Basically a CTCP client brings up a normal unrestricted TCP stack and sends it's info in fields in the DHCP request. The DHCP server sees the fields, analyzes them and sends back configuration info in the DHCP response. The client then interprets the configuration info and uses the CTCP API to tell the network stack to impose the rules the server sent.
Of course, you can see several gaping
less than half the story (Score:2)
One big problem is that few of these gateways are MS-Windows machines. Most are Criscos that get fried up by the heavy traffic :) I doubt an x86 box could service a full-speed OC-3 if the table look-ups get extensive.
TCP/IP stack embrace and extend? (Score:4, Insightful)
I have to admit, it's been a while since I've read the TCP/IP protocol specs, but I don't remember there being any provisions for communicating things like OS type, version, or patch lists over the TCP/IP headers.
This brings up a major compatibility question as to how this is going to work with routers, linux servers, printers, and other devices on a network who either don't know about CTCP or don't give a shit about CTCP. This scheme also seems to be extremely vunerable to spoofing.
If M$ would spend half as much effort in securing their OS as they do coming up with these hare-brained schemes, then we wouldn't need such contrived solutions to security.
Asking the Google for more info... (Score:5, Informative)
White paper here: http://download.microsoft.com/download/d/0/8/d08d
Interesting chat transcript here: http://www.microsoft.com/technet/community/chats/
From the transcript:
Q: NAP seems to fulfill the pre-admission health/integrity check very well. Can customers use the same NAP infrastructure to support post-admission NAC? e.g. with NAP today I can check a desktop PC is healthy when it joins, but what about 24 hours later?
A: Post-admission enforcement depends on the enforcement mechanism you're using. For instance, health will be re-evaluated when a client attempts to renew their IP address when using DHCP as the enforcement mechanism. For IPSec, it will happen when health certs expire. For 802.1x, it will happen when re-authentication occurs. For VPN, it will happen when clients reconnect. Any health change on the client will trigger re-evaluation of the health state, too.
Q: What is the likelihood of a NAP agent for Windows 2000 clients in the network?
A: We are not planning to implement a Windows 2000 NAP client. However, we are licensing our protocols to 3rd party companies so that they can offer NAP clients on Windows 2000 (and other OS's like Mac, Linux, etc.)
Enjoy,
Not all patches are for security (Score:4, Insightful)
MS and the next-gen DVD consortium for that matter treat the customer as a potential criminal and require the ability to disable functionality in whole or in part. In other words, "security" to these people, including Microsoft, means keeping things secured against the user.
As a real security scheme it looks quite weak and vulnerable. But engineering a way to get user's machines to spy on them and report not only compliance with security policies but also use of arbitrary applications seems quite useful both for pushing OS upgrades and conversions to Windows down people's throats and for providing ammo to content liscensing organizations. Vista will be able to tell centralized servers who you are, whether you comply with some policy, and whether you can withstand an arbitrary network attack. Doesn't sound too secure to me. Wonder how SuSE will "interoperate" with this.
Easy fix (Score:4, Funny)
So then no worries, right? The first virus I get will surely disable CTCP for me, no sweat...
People might prefer that. (Score:2)
A significant percentage of users only want a 'content delivery box' for their computer. That's what they use it for; that and as a game machine. Most people don't really use their computer for anything that wouldn't be provid
Re: (Score:3, Interesting)
Unless things drastically change, the ISPs aren't going to give two shits about what you do on their network.
Things are likely to drastically change [slashdot.org].
It would be great if ISPs started holding computer users accountable for not spreading malicious code or attaching infected machines to the network, but the fact of that matter is that day might very well never come.
Unless the only high-speed ISP in town is "with MSN Premium". Or unless ISP A makes ISP B's implementation of "trusted" TCP a condition of peering arrangements (otherwise prepare to pay extra for transit to ISP A's customers and/or have packets deprioritized) or e-mail delivery arrangements (otherwise prepare to have e-mail from ISP B routed to ISP A customers' junk mail folders).