fix: harden Windows Server 2022 against Sweet32 (CVE-2016-2183)

[timmy-wright]

Summary

Windows Server 2022 (ltsc2022, build 20348) enables TLS_RSA_WITH_3DES_EDE_CBC_SHA by default, making it vulnerable to the Sweet32 birthday attack (CVE-2016-2183 / CVE-2016-6329). WS2022 23H2+ and WS2025+ already exclude 3DES by default and are unaffected.

Changes

• parts/windows/kuberneteswindowssetup.ps1: BasePrep now runs Enable-SecureTls (windowssecuretls.ps1) on ltsc2022 in addition to 1809. This locks the cipher suite order to AES-only ciphers, disables RC4, and disables SSLv2/SSLv3/TLS1.0/1.1 in favor of TLS 1.2. Runs in basePrep since this hardening is static/non-secret and valid for every node.
• e2e/validators.go: added ValidateWindowsSecureTLSEnabled to confirm TLS 1.2 is enabled, TLS 1.0/1.1 are disabled, RC4 is disabled, and the cipher suite order excludes 3DES/RC2/DES.
• e2e/scenario_win_test.go: wired the new validator into Test_Windows2022_AzureNetwork (gen1) and Test_Windows2022Gen2AzureNetwork (gen2).

Testing

• go build ./... and go vet ./... pass in the e2e module.
• make generate produced no snapshot diffs for this change.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[github-actions]

Windows Unit Test Results

  3 files   12 suites   44s ⏱️
384 tests 384 ✅ 0 💤 0 ❌
387 runs  387 ✅ 0 💤 0 ❌

Results for commit 311ade4.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Hardens Windows Server 2022 nodes against Sweet32 (CVE-2016-2183) by enabling the existing Enable-SecureTls hardening on ltsc2022 during Windows CSE BasePrep, and adds e2e validation to ensure the intended TLS/SChannel registry configuration is actually applied.

Changes:

• Run Enable-SecureTls during BasePrep on Windows ltsc2022 (in addition to 1809).
• Add an e2e validator to verify TLS hardening state (protocol enablement/disablement, cipher suite order).
• Wire the new validator into the Windows Server 2022 gen1/gen2 Azure Network e2e scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
parts/windows/kuberneteswindowssetup.ps1	Expands secure TLS hardening execution to include ltsc2022 during BasePrep.
e2e/validators.go	Adds ValidateWindowsSecureTLSEnabled to check TLS/SChannel hardening settings on the VM.
e2e/scenario_win_test.go	Hooks the new TLS validator into Windows Server 2022 scenarios.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

parts/windows/kuberneteswindowssetup.ps1:452

• Enable-SecureTls is now executed on ltsc2022, but the bundled windowssecuretls.ps1 doesn’t reliably disable RC4: DisableRC4 only creates/sets the RC4 cipher subkeys when SCHANNEL\Ciphers has zero subkeys. If the Ciphers key is non-empty on Windows Server 2022, RC4 may remain enabled (and the new e2e validator may also fail by missing the RC4 keys). Consider fixing DisableRC4 to always create/set the four RC4 */128 subkeys to Enabled=0 regardless of other cipher entries, so the hardening guarantee holds on WS2022.

    if ($windowsVersion -eq "1809" -or $windowsVersion -eq "ltsc2022") {
        Logs-To-Event -TaskName "AKS.WindowsCSE.EnableSecureTLS" -TaskMessage "Start to enable secure TLS protocols"
        try {
            . C:\k\windowssecuretls.ps1
            Enable-SecureTls

e2e/validators.go:1497

• The RC4 registry reads use $ErrorActionPreference = 'Stop' and Get-ItemProperty -Name Enabled without -ErrorAction SilentlyContinue. If any of these RC4 keys/values are absent, the PowerShell script exits non-zero before emitting JSON, and the validator fails with an exit-code mismatch instead of a targeted assertion failure. Defaulting missing values to a failing sentinel (e.g., 1) makes the test failure clearer and avoids brittle dependency on key presence.

		"$rc4_128 = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 128/128' -Name Enabled).Enabled",
		"$rc4_64 = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 64/128' -Name Enabled).Enabled",
		"$rc4_56 = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 56/128' -Name Enabled).Enabled",
		"$rc4_40 = (Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 40/128' -Name Enabled).Enabled",

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

parts/windows/kuberneteswindowssetup.ps1:459

• Enable-SecureTls is invoked in BasePrep, but BasePrep is skipped when C:\AzureData\base_prep.complete is present (PIS / VHD-cached nodes). That means Windows Server 2022 nodes created from existing cached VHDs in the 6‑month support window will not receive this Sweet32 hardening at provision time, even if they pick up the updated CSE script. Consider also applying the hardening during NodePrep when BasePrep is skipped, or explicitly confirm that all affected WS2022 VHDs will be republished so the hardening is baked in.

    $windowsVersion = Get-WindowsVersion
    if ($windowsVersion -eq "1809" -or $windowsVersion -eq "ltsc2022") {
        Logs-To-Event -TaskName "AKS.WindowsCSE.EnableSecureTLS" -TaskMessage "Start to enable secure TLS protocols"
        try {
            . C:\k\windowssecuretls.ps1
            Enable-SecureTls
        }
        catch {
            Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ENABLE_SECURE_TLS -ErrorMessage $_
        }
    } else {
        Logs-To-Event -TaskName "AKS.WindowsCSE.EnableSecureTLS" -TaskMessage "Skip secure TLS protocols for Windows version: $windowsVersion"
    }