Visual Studio 2005 SP1 - ADS "Zone.Identifer" stroke again

Today, in order to get a new virtual machine up and running with Windows 2003 ready for .NET development I installed the free trial version of Visual Studio 2005. Usually I have got a CD with me and this time they were away (I left them back in Paris). So, I have downloaded a version from the web (Visual Studio 2005 SP1).

First issue: Error 1305 (MSI)

I tried to installed and got the 1305 error preventing the MSI to run properly ("Verify that the file exists and that you can access it").

I was again a victim of "the blocked file" (see my other blog entry IIS WEB issue ). Because, I downloaded the file from the web directly into my virtual machine (instead of using my CD/DVD) the file had an extra information "Zone.Identifier" attached top it (new use of ADS as part of the security improvement on Windows 2003 SP1). I checked the properties using Windows Explorer and I "unblocked" the file.
I shut downed the machine and rebooted it 3 times before I understood what was going on.

Before the installation kicks-off, some files need to be extracted from the MSI. When the files were extracted from the MSI into a temporary folder, they were added some extra information such as "Zone.Identifier" (I am assuming this was due to the fact that the main file setup/cab/msi files had that extra ADS information to them).
This was preventing the extraction to go further. I had to delete the temporary folder.

Second Issue: "SAFER" checks

That permitted the process to go a bit further, but it raised another issue (Error 1718):


Before the installation kicks-off, some files need to be extracted from the MSI and some "SAFER" checks are applied to them. This is documented on Heath Stewart's Blog and Microsoft web site. This was preventing the checking steps to go further. I had to install the hotfix "KB925336":


The installation was then able to finish without any further issue.

In Summary

So, here are the tips when downloading files from Internet (or other network resource) in order to install software on Windows 2003 SP1 (or above, or Windows XP SP2. I do not know about Vista, but usually Security improves and 'usability' has to give up ;)):

• Do not forget to unblock the file (e.g. using Windows Explorer). Obviously, you have to trust the source of the file, that is your responsability.
  
• If you have already run the setup file, make sure to remove all temporarily files created (they should be deleted when an installation is aborted or finished, but it is not always the case).
• Where are the temporarily files?
• Well look at your environment variables (using a command line window and the "set" command). Look for the variables "TEMP" and "TMP". Be careful, those settings are set at the user level, so check them for the user account you are using to do the installation.

I have installed VS 2005 SP1, so I think I will soon develop a quick tool that scan for ADS information on the files.

Security Measures to take into account when designing web sites

• Always create at least two network boundaries:
1. A DMZ (i.e. Front-end machine area)
• Web servers mainly, but it could have other machines used for communication, as long as:
• No customer data should be hold in this network boundary
• Machines in this boundary can only talk to machine on the next level down if that machine does not hold any confidential data (e.g. Customer Data, Partners data, Employees data, etc..)
2. A Back-end machine area
• Application servers
• Database servers containing confidential data migh be here (or a third boundary network could host them)
• Intranet web servers
• dqw
• A firewall must exits:
• In front of the DMZ
• Between the DMZ and the back-end area
• Machines in the F-E can trust machines in the B-E
• Machines in the B-E cannot trust machines/identities from the F-E
• If an Employee or Partner Web site must be available from the Internet area, it must be in a different DMZ (if possible).
• It is always a good thing to have two URLs for a web site:
1. http://www.mysite.com/ for normal browsing (port 80)
2. https://secure.mysite.com/ for secure browsing (port 443)
• This enables HTTPS to be handled by hardware
• The Encryption traffic will happen between the client’s browser and the public firewall in front of the DMZ
• In the DMZ, the HTTP request can be handled by the normal HTTP port (80). The application can still check whether this is a secure HTTP request by looking at the domain (http://www.mysite.com/ or secure.mysite.com).

HTTP Request issues – "Expect: 100-continue" and "Connection: Keep-Alive" headers

I have been working on a little .NET application (1.1) tool to send other HTTP the content from an XML file.

As I was intercepting the HTTP requests/responses going on between my machine and the server, I found out that my .NET application was always sending as part of the headers:

• "Expect: 100-continue"
• "Connection: Keep-Alive"

My application will always send a HTTP request in one go, get the response and exit. So, I need to get rid of those two HTTP headers (or at least disable them).

Here a sample from “TCPTrace”:
# The HTTP request

POST /HTTPFlowerServer/Cancellation.aspx HTTP/1.1
Content-Type: text/xml
Content-Length: 89
Expect: 100-continue
Connection: Keep-Alive
Host: localhost:8080

<?xml version='1.0' encoding='utf-8'?>
<MyRequest><Cancellation Id="27" /></MyRequest>

# The HTTP response

HTTP/1.1 100 Continue

HTTP/1.1 200 OK
Date: Mon, 15 Jan 2007 18:23:03 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=sq2f2p55jqjluojh3mr4qh3o; path=/
Cache-Control: private
Content-Type: text/xml; charset=utf-8
Content-Length: 74

<MyResponse><Acknowledgement OrderId="27"></Acknowledgement></MyResponse>

In order to not keep the connection alive, you need change the “KeepAlive” property of your HttpWebRequest.

In order to remove the “Expect: 100-continue”, you need to change the settings on the ServicePoint used by your request.

Here is what you need to do:

HttpWebRequest myRequest = (HttpWebRequest)System.Net.WebRequest.CreateDefault(targetURI);
myRequest.Method = "POST";
myRequest.KeepAlive = false;
myRequest.ServicePoint.Expect100Continue = false;

I found the latter solution from a blog at http://haacked.com/archive/2004/05/15/449.aspx. Look for the entry made by Mirronelli.

Here a sample of the HTTP headers after the changes:

# The HTTP request

POST /HTTPFlowerServer/Cancellation.aspx HTTP/1.1
Content-Type: text/xml
Content-Length: 89
Connection: Close
Host: localhost:8080

<?xml version='1.0' encoding='utf-8'?> <MyRequest><Cancellation Id="27" /></MyRequest>

# The HTTP response

HTTP/1.1 200 OK
Connection: close
Date: Mon, 15 Jan 2007 19:00:53 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Set-Cookie: ASP.NET_SessionId=npxysrbhbz4rsi455x5qhe45; path=/
Cache-Control: private
Content-Type: text/xml; charset=utf-8
Content-Length: 74

<MyResponse><Acknowledgement OrderId="27"></Acknowledgement></MyResponse>

Robert Scoble is leaving Microsoft / PodTech

(From Reuters news - http://go.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=12494144&src=eDialog/GetContent)

The world's most famous corporate blogger, Robert Scoble, credited with helping to break down a siege mentality at his employer, Microsoft Corp., confirmed on Sunday he is leaving to join a recently formed Silicon Valley Internet media start-up (http://scobleizer.wordpress.com/).

Scoble's offers succinct advice to other corporate bloggers who wish to keep their day jobs: "Understand your company's culture before you start mouthing off. When you start breaking the rules, you better know you are breaking the rules."