
From Gabriel.Montenegro@microsoft.com  Wed Feb  2 08:43:08 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C43353A6D88 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 08:43:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.449
X-Spam-Level: 
X-Spam-Status: No, score=-10.449 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VOzeLIS1M27T for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 08:43:07 -0800 (PST)
Received: from smtp.microsoft.com (mailb.microsoft.com [131.107.115.215]) by core3.amsl.com (Postfix) with ESMTP id E73AB3A6D7B for <hybi@ietf.org>; Wed,  2 Feb 2011 08:43:05 -0800 (PST)
Received: from TK5EX14MLTC103.redmond.corp.microsoft.com (157.54.79.174) by TK5-EXGWY-E802.partners.extranet.microsoft.com (10.251.56.168) with Microsoft SMTP Server (TLS) id 8.2.176.0; Wed, 2 Feb 2011 08:46:25 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14MLTC103.redmond.corp.microsoft.com (157.54.79.174) with Microsoft SMTP Server (TLS) id 14.1.270.2; Wed, 2 Feb 2011 08:46:25 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Wed, 2 Feb 2011 08:46:26 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Julian Reschke <julian.reschke@gmx.de>
Thread-Topic: [hybi] straw-poll on GET vs OPTIONS vs new method
Thread-Index: AQHLuUoQ3oNzz/PaKUq0SFj3SnFkQpPnkhtggACoaYCABkJ88A==
Date: Wed, 2 Feb 2011 16:46:23 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de>
In-Reply-To: <4D43D80B.7010903@gmx.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2011 16:43:08 -0000

Hi Julian,

Sorry for the delay. You say you're "not convinced". Perhaps I can't convin=
ce you as ultimately it might be a matter of taste. I can try to explain wh=
y my distaste for OPTIONS.

The issue with OPTIONS is that it is different in nature than GET. In both =
cases there is processing that must deal with existing code paths and usage=
. However, OPTIONS is meant for querying capabilities of the server. These =
capabilities are ever expanding by adding modules to your server. OPTIONS p=
rocessing is typically farmed out to those modules since they are the only =
ones authoritative about the capabilities available via that particular mod=
ule. So there's significant OPTIONS processing not just at the server, but =
at random modules that happen to be added at that server (which may happen =
even in the presence of a path).  Mixing in what random modules will do as =
part of their processing and how that might or might not affect OPTIONS pro=
cessing, and in what mix of random modules, etc,  is too much randomization=
 into the Upgrade processing. It's also the method to use to find out if th=
e server supports websockets, except it is being proposed also as the metho=
d to use to actually invoke them. It would be best from simplicity point of=
 view to keep  those two roles separate.=20

We've been taking into consideration the enormous variability of infrastruc=
ture and proxies in our decisions so far, I think ignoring the ever expandi=
ng processing of OPTIONS due to random modules or plug-ins at servers, and =
how that will interact with websockets is inconsistent with that concern.

That's why I think it is the worst of all methods being discussed.

Gabriel

> -----Original Message-----
> From: Julian Reschke [mailto:julian.reschke@gmx.de]
> Sent: Saturday, January 29, 2011 1:04 AM
> To: Gabriel Montenegro
> Cc: Salvatore Loreto; hybi@ietf.org; Joe Hildebrand; SM
> Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
>=20
> On 29.01.2011 08:03, Gabriel Montenegro wrote:
> > ...
> > The point that previous uses of OPTIONS can lead to confusion with prev=
ious
> usage was made in reference to its use in CORS (http://www.w3.org/TR/cors=
/).
> There's also WEBDAV (http://tools.ietf.org/html/rfc4918) and others.  Thi=
s point
> argues for WEBSOCKET (a brand new method with no other previous usage)
> over either GET or OPTIONS.
> > ...
>=20
> I don't think there's a problem with OPTIONS and WebDAV. WebDAV uses
> OPTIONS just the way it's designed for, and I'm not aware of any
> potential problems using OPTIONS in other protocol exchanges as well. If
> you do, you need to elaborate.
>=20
> OPTIONS and CORS is a slightly different story because of the stupid
> requirement CORS makes on OPTIONS not to require authentication. That's
> a design flaw in CORS. I'm not sure how it would affect usage of OPTIONS
> over here, though.
>=20
> > +1 WEBSOCKET
> >
> > Even though both GET and OPTIONS have existing usage, they are not equa=
lly
> safe. GET and POST (which are by far the most used) undergo much more
> scrutiny than other lesser-known or completely arbitrary methods. Lesser
> methods can be used to exploit vulnerabilities in faulty ACL checking:
> >
> http://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_(OWA
> SP-CM-008)#Arbitrary_HTTP_Methods
>=20
> Not convinced. The linked text correctly reports that some frameworks do
> only ACL on certain methods, but then fallback to execute unknown
> methods as GET. That's a bug, indeed. Do we have evidence that
> Websockets is going to be deployable on frameworks like these anyway?
> Also, these frameworks are vulnerable already, how does Websockets
> change the situation?
>=20
>  > ...
> > Another point against GET and OPTIONS is that both are supposed to be
> idempotent. This has been misconstrued as a requirement to cause no chang=
es
> at the server. http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics=
-
> 12#section-7.1.2 clarifies:
> >
> >     ...  It is important to
> >     note that idempotence refers only to changes requested by the clien=
t:
> >     a server is free to change its state due to multiple requests for t=
he
> >     purpose of tracking those requests, versioning of results, etc.
> >
> > Since the Upgrade effects a change on the connection, not on the resour=
ce, I
> don't see idempotence as an argument against GET, OPTIONS or any other
> idempotent method.
> > ...
>=20
> That's correct.
>=20
> Best regards, Julian


From julian.reschke@gmx.de  Wed Feb  2 08:57:28 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 787803A6CEC for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 08:57:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.103
X-Spam-Level: 
X-Spam-Status: No, score=-104.103 tagged_above=-999 required=5 tests=[AWL=-1.504, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ioZOp9QGaox6 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 08:57:27 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id 33A123A6C0B for <hybi@ietf.org>; Wed,  2 Feb 2011 08:57:26 -0800 (PST)
Received: (qmail invoked by alias); 02 Feb 2011 17:00:45 -0000
Received: from mail.greenbytes.de (EHLO [192.168.1.134]) [217.91.35.233] by mail.gmx.net (mp053) with SMTP; 02 Feb 2011 18:00:45 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX19lkfdqgCplBde6hGa1euLHKDePHjqvXsZJmPeI2G RN+A0h8PcuvcYy
Message-ID: <4D498DB8.703@gmx.de>
Date: Wed, 02 Feb 2011 18:00:40 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2011 16:57:28 -0000

On 02.02.2011 17:46, Gabriel Montenegro wrote:
> Hi Julian,
>
> Sorry for the delay. You say you're "not convinced". Perhaps I can't convince you as ultimately it might be a matter of taste. I can try to explain why my distaste for OPTIONS.
>
> The issue with OPTIONS is that it is different in nature than GET. In both cases there is processing that must deal with existing code paths and usage. However, OPTIONS is meant for querying capabilities of the server. These capabilities are ever expanding by adding modules to your server. OPTIONS processing is typically farmed out to those modules since they are the only ones authoritative about the capabilities available via that particular module. So there's significant OPTIONS processing not just at the server, but at random modules that happen to be added at that server (which may happen even in the presence of a path).  Mixing in what random modules will do as part of their processing and how that might or might not affect OPTIONS processing, and in what mix of random modules, etc,  is too much randomization into the Upgrade processing. It's also the method to use to find out if the server supports websockets, except it is being proposed also as the method to use to 
actually invoke them. It would be best from simplicity point of view to keep  those two roles separate.
>
> We've been taking into consideration the enormous variability of infrastructure and proxies in our decisions so far, I think ignoring the ever expanding processing of OPTIONS due to random modules or plug-ins at servers, and how that will interact with websockets is inconsistent with that concern.
>
> That's why I think it is the worst of all methods being discussed.
>
> Gabriel

Hi Gabriel,

clarifying: are you talking about "OPTIONS *" or about "OPTIONS /path"?

I agree that the former is a non-starter (because you'd need to collect 
information from many modules), but I'm not sure how the latter is 
different from any other method -- the path identifies a module handling 
the resource, and that module should be able to give a reply about its 
communications options...

BR, Julian

From Gabriel.Montenegro@microsoft.com  Wed Feb  2 11:44:13 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F2F3C3A6D8E for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 11:44:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.499
X-Spam-Level: 
X-Spam-Status: No, score=-10.499 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eR40ltH23Y1N for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 11:44:12 -0800 (PST)
Received: from smtp.microsoft.com (smtp.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id F2A6B3A6C0B for <hybi@ietf.org>; Wed,  2 Feb 2011 11:44:11 -0800 (PST)
Received: from TK5EX14MLTC102.redmond.corp.microsoft.com (157.54.79.180) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Wed, 2 Feb 2011 11:47:32 -0800
Received: from TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com (157.54.71.39) by TK5EX14MLTC102.redmond.corp.microsoft.com (157.54.79.180) with Microsoft SMTP Server (TLS) id 14.1.270.2; Wed, 2 Feb 2011 11:47:32 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.39]) with mapi; Wed, 2 Feb 2011 11:47:31 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: 'Julian Reschke' <julian.reschke@gmx.de>
Thread-Topic: [hybi] straw-poll on GET vs OPTIONS vs new method
Thread-Index: AQHLuUoQ3oNzz/PaKUq0SFj3SnFkQpPnkhtggACoaYCABkJ88IAAi/gA//+YipA=
Date: Wed, 2 Feb 2011 19:47:33 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de>
In-Reply-To: <4D498DB8.703@gmx.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2011 19:44:13 -0000

Because of the extensible nature of OPTIONS, even with a path things may no=
t be as predictable. We don't know for sure that a path will strictly limit=
 processing to a given module. There's too much variability out there in te=
rms of modules, much greater than that inherent in base servers themselves.

For example, "/" may be answered by both the HTTP server or the WebDAV modu=
le (and there may be others). RFC2518 was revised by RFC4918 and that now i=
ncludes some warning about that (section 10.1), but there is existing pract=
ice along these lines:
http://publib.boulder.ibm.com/infocenter/wpzosdoc/v6r1/index.jsp?topic=3D/c=
om.ibm.wp.zos.doc_v615/admin/webdav_http_options.html=20

It would be best to avoid usurping OPTIONS for the websocket handshake (but=
 it should be reusable to query about WS support).

> -----Original Message-----
> From: Julian Reschke [mailto:julian.reschke@gmx.de]
> Sent: Wednesday, February 02, 2011 9:01 AM
> To: Gabriel Montenegro
> Cc: Salvatore Loreto; hybi@ietf.org; Joe Hildebrand; SM
> Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
>=20
> On 02.02.2011 17:46, Gabriel Montenegro wrote:
> > Hi Julian,
> >
> > Sorry for the delay. You say you're "not convinced". Perhaps I can't co=
nvince
> you as ultimately it might be a matter of taste. I can try to explain why=
 my
> distaste for OPTIONS.
> >
> > The issue with OPTIONS is that it is different in nature than GET. In
> > both cases there is processing that must deal with existing code paths
> > and usage. However, OPTIONS is meant for querying capabilities of the
> > server. These capabilities are ever expanding by adding modules to
> > your server. OPTIONS processing is typically farmed out to those
> > modules since they are the only ones authoritative about the
> > capabilities available via that particular module. So there's
> > significant OPTIONS processing not just at the server, but at random
> > modules that happen to be added at that server (which may happen even
> > in the presence of a path).  Mixing in what random modules will do as
> > part of their processing and how that might or might not affect
> > OPTIONS processing, and in what mix of random modules, etc,  is too
> > much randomization into the Upgrade processing. It's also the method
> > to use to find out if the server supports websockets, except it is
> > being proposed also as the method to use to
> actually invoke them. It would be best from simplicity point of view to k=
eep
> those two roles separate.
> >
> > We've been taking into consideration the enormous variability of
> infrastructure and proxies in our decisions so far, I think ignoring the =
ever
> expanding processing of OPTIONS due to random modules or plug-ins at serv=
ers,
> and how that will interact with websockets is inconsistent with that conc=
ern.
> >
> > That's why I think it is the worst of all methods being discussed.
> >
> > Gabriel
>=20
> Hi Gabriel,
>=20
> clarifying: are you talking about "OPTIONS *" or about "OPTIONS /path"?
>=20
> I agree that the former is a non-starter (because you'd need to collect
> information from many modules), but I'm not sure how the latter is differ=
ent
> from any other method -- the path identifies a module handling the resour=
ce,
> and that module should be able to give a reply about its communications
> options...
>=20
> BR, Julian


From julian.reschke@gmx.de  Wed Feb  2 12:07:51 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7134C3A6CDC for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 12:07:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.836
X-Spam-Level: 
X-Spam-Status: No, score=-103.836 tagged_above=-999 required=5 tests=[AWL=-1.237, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oOR5cQbTRQyv for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 12:07:49 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id 2D2F73A6BA9 for <hybi@ietf.org>; Wed,  2 Feb 2011 12:07:48 -0800 (PST)
Received: (qmail invoked by alias); 02 Feb 2011 20:11:07 -0000
Received: from p508FDB5B.dip.t-dialin.net (EHLO [192.168.178.33]) [80.143.219.91] by mail.gmx.net (mp013) with SMTP; 02 Feb 2011 21:11:07 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX19uK+NINr5u728JktODroGPGBTtSLZmd7apTj8awh FoEN77pumOcKHZ
Message-ID: <4D49BA55.3050808@gmx.de>
Date: Wed, 02 Feb 2011 21:11:01 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2011 20:07:51 -0000

On 02.02.2011 20:47, Gabriel Montenegro wrote:
> Because of the extensible nature of OPTIONS, even with a path things may not be as predictable. We don't know for sure that a path will strictly limit processing to a given module. There's too much variability out there in terms of modules, much greater than that inherent in base servers themselves.

OK, but if that is the case, *any* method will have the same problem, 
unless you just define a new one for websockets.

> For example, "/" may be answered by both the HTTP server or the WebDAV module (and there may be others). RFC2518 was revised by RFC4918 and that now includes some warning about that (section 10.1), but there is existing practice along these lines:

Ah, finally somebody reading RFC 4918 :-)

> http://publib.boulder.ibm.com/infocenter/wpzosdoc/v6r1/index.jsp?topic=/com.ibm.wp.zos.doc_v615/admin/webdav_http_options.html

The only client I know that has this problem is the Microsoft WebDAV 
Mini-Redirector. The problem was reported around when it came out (over 
7 years ago), and as far as I know hasn't been fixed. 
(<http://greenbytes.de/tech/webdav/webdav-redirector-list.html#issue-server-discovery>)

So, yes, this is a problem when clients do the wrong thing and aren't 
properly maintained.

(Sorry if this sounds like a cheap shot, but Microsoft's unwillingness 
to fix their WebDAV clients has frustrated me for a long long REALLY 
long time).

> It would be best to avoid usurping OPTIONS for the websocket handshake (but it should be reusable to query about WS support).

Now I'm confused. If you can make OPTIONS respond to a query for WS 
support then why can't you also make it respond to Upgrade for WS?

Best regards, Julian

From ifette@google.com  Wed Feb  2 15:53:21 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0090D3A6CA1 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 15:53:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.457
X-Spam-Level: 
X-Spam-Status: No, score=-105.457 tagged_above=-999 required=5 tests=[AWL=0.219, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 80l-yKewW4BP for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 15:53:19 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 94EB73A6C91 for <hybi@ietf.org>; Wed,  2 Feb 2011 15:53:18 -0800 (PST)
Received: from kpbe14.cbf.corp.google.com (kpbe14.cbf.corp.google.com [172.25.105.78]) by smtp-out.google.com with ESMTP id p12NucQH003641 for <hybi@ietf.org>; Wed, 2 Feb 2011 15:56:39 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1296690999; bh=qto7274qw3U1PTb0BDrkWBnQkj8=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=k97t0wJCMJWxYAoSHSBk+W0AZKv4Or5AqbEg1cm4YeO15NKv16eQxmoV3/RTmLVqj 5nmsnqEwmR/mwriMZJovg==
Received: from iye19 (iye19.prod.google.com [10.241.50.19]) by kpbe14.cbf.corp.google.com with ESMTP id p12NuO7Q031340 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 2 Feb 2011 15:56:37 -0800
Received: by iye19 with SMTP id 19so523787iye.18 for <hybi@ietf.org>; Wed, 02 Feb 2011 15:56:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=TGlkyuJMkmsyMhrqhkYzd/zr35DDnP/I02/JanTdfEM=; b=gVHY+JCGtAnQcbikMLsWJg2dTTgxvlgsp0KEaD/h9twXaheTx6o6IzJHkM1F2BxAWy zss1IzTCfCpsRInjxEoQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=US8xnsAzJm22nvyLWRDR4ZLt4ZRm23f5g85/5UH0KyX2ZQXRSGI9W5jMgfdjewqKuO RaanhJnT+BYOphENQEdA==
MIME-Version: 1.0
Received: by 10.231.14.74 with SMTP id f10mr10820666iba.119.1296690996650; Wed, 02 Feb 2011 15:56:36 -0800 (PST)
Received: by 10.231.13.66 with HTTP; Wed, 2 Feb 2011 15:56:36 -0800 (PST)
In-Reply-To: <4D49BA55.3050808@gmx.de>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de>
Date: Wed, 2 Feb 2011 15:56:36 -0800
Message-ID: <AANLkTin=0D6vNs+FgYCfa8TD26umkG8HEBpgRNR8F=s+@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Julian Reschke <julian.reschke@gmx.de>
Content-Type: multipart/alternative; boundary=00221532cb383d2520049b5566a6
X-System-Of-Record: true
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2011 23:53:21 -0000

--00221532cb383d2520049b5566a6
Content-Type: text/plain; charset=UTF-8

I also prefer OPTIONS + PATH and don't believe there's any significant
confusion that will arise out of this, but more than anything at this point
I would like to get some call from the chairs and move on. I thought this
was supposed to close on the 31st?

On Wed, Feb 2, 2011 at 12:11 PM, Julian Reschke <julian.reschke@gmx.de>wrote:

> On 02.02.2011 20:47, Gabriel Montenegro wrote:
>
>> Because of the extensible nature of OPTIONS, even with a path things may
>> not be as predictable. We don't know for sure that a path will strictly
>> limit processing to a given module. There's too much variability out there
>> in terms of modules, much greater than that inherent in base servers
>> themselves.
>>
>
> OK, but if that is the case, *any* method will have the same problem,
> unless you just define a new one for websockets.
>
>
>  For example, "/" may be answered by both the HTTP server or the WebDAV
>> module (and there may be others). RFC2518 was revised by RFC4918 and that
>> now includes some warning about that (section 10.1), but there is existing
>> practice along these lines:
>>
>
> Ah, finally somebody reading RFC 4918 :-)
>
>
>
>> http://publib.boulder.ibm.com/infocenter/wpzosdoc/v6r1/index.jsp?topic=/com.ibm.wp.zos.doc_v615/admin/webdav_http_options.html
>>
>
> The only client I know that has this problem is the Microsoft WebDAV
> Mini-Redirector. The problem was reported around when it came out (over 7
> years ago), and as far as I know hasn't been fixed. (<
> http://greenbytes.de/tech/webdav/webdav-redirector-list.html#issue-server-discovery
> >)
>
> So, yes, this is a problem when clients do the wrong thing and aren't
> properly maintained.
>
> (Sorry if this sounds like a cheap shot, but Microsoft's unwillingness to
> fix their WebDAV clients has frustrated me for a long long REALLY long
> time).
>
>
>  It would be best to avoid usurping OPTIONS for the websocket handshake
>> (but it should be reusable to query about WS support).
>>
>
> Now I'm confused. If you can make OPTIONS respond to a query for WS support
> then why can't you also make it respond to Upgrade for WS?
>
> Best regards, Julian
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--00221532cb383d2520049b5566a6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I also prefer OPTIONS + PATH and don&#39;t believe there&#39;s any signific=
ant confusion that will arise out of this, but more than anything at this p=
oint I would like to get some call from the chairs and move on. I thought t=
his was supposed to close on the 31st?<br>
<br><div class=3D"gmail_quote">On Wed, Feb 2, 2011 at 12:11 PM, Julian Resc=
hke <span dir=3D"ltr">&lt;<a href=3D"mailto:julian.reschke@gmx.de">julian.r=
eschke@gmx.de</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" st=
yle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">On 02.02.2011 20:47, Gabriel Montenegro wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Because of the extensible nature of OPTIONS, even with a path things may no=
t be as predictable. We don&#39;t know for sure that a path will strictly l=
imit processing to a given module. There&#39;s too much variability out the=
re in terms of modules, much greater than that inherent in base servers the=
mselves.<br>

</blockquote>
<br></div>
OK, but if that is the case, *any* method will have the same problem, unles=
s you just define a new one for websockets.<div class=3D"im"><br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
For example, &quot;/&quot; may be answered by both the HTTP server or the W=
ebDAV module (and there may be others). RFC2518 was revised by RFC4918 and =
that now includes some warning about that (section 10.1), but there is exis=
ting practice along these lines:<br>

</blockquote>
<br></div>
Ah, finally somebody reading RFC 4918 :-)<div class=3D"im"><br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
<a href=3D"http://publib.boulder.ibm.com/infocenter/wpzosdoc/v6r1/index.jsp=
?topic=3D/com.ibm.wp.zos.doc_v615/admin/webdav_http_options.html" target=3D=
"_blank">http://publib.boulder.ibm.com/infocenter/wpzosdoc/v6r1/index.jsp?t=
opic=3D/com.ibm.wp.zos.doc_v615/admin/webdav_http_options.html</a><br>

</blockquote>
<br></div>
The only client I know that has this problem is the Microsoft WebDAV Mini-R=
edirector. The problem was reported around when it came out (over 7 years a=
go), and as far as I know hasn&#39;t been fixed. (&lt;<a href=3D"http://gre=
enbytes.de/tech/webdav/webdav-redirector-list.html#issue-server-discovery" =
target=3D"_blank">http://greenbytes.de/tech/webdav/webdav-redirector-list.h=
tml#issue-server-discovery</a>&gt;)<br>

<br>
So, yes, this is a problem when clients do the wrong thing and aren&#39;t p=
roperly maintained.<br>
<br>
(Sorry if this sounds like a cheap shot, but Microsoft&#39;s unwillingness =
to fix their WebDAV clients has frustrated me for a long long REALLY long t=
ime).<div class=3D"im"><br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
It would be best to avoid usurping OPTIONS for the websocket handshake (but=
 it should be reusable to query about WS support).<br>
</blockquote>
<br></div>
Now I&#39;m confused. If you can make OPTIONS respond to a query for WS sup=
port then why can&#39;t you also make it respond to Upgrade for WS?<br>
<br>
Best regards, Julian<div><div></div><div class=3D"h5"><br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--00221532cb383d2520049b5566a6--

From Gabriel.Montenegro@microsoft.com  Wed Feb  2 16:00:09 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9FCB33A6DB7 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 16:00:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.524
X-Spam-Level: 
X-Spam-Status: No, score=-10.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8m6r7+f84W2j for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 16:00:05 -0800 (PST)
Received: from smtp.microsoft.com (smtp.microsoft.com [131.107.115.215]) by core3.amsl.com (Postfix) with ESMTP id DC2F53A6D79 for <hybi@ietf.org>; Wed,  2 Feb 2011 16:00:04 -0800 (PST)
Received: from TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) by TK5-EXGWY-E802.partners.extranet.microsoft.com (10.251.56.168) with Microsoft SMTP Server (TLS) id 8.2.176.0; Wed, 2 Feb 2011 16:03:24 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) with Microsoft SMTP Server (TLS) id 14.1.270.2; Wed, 2 Feb 2011 16:03:24 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Wed, 2 Feb 2011 16:03:23 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: 'Julian Reschke' <julian.reschke@gmx.de>
Thread-Topic: [hybi] straw-poll on GET vs OPTIONS vs new method
Thread-Index: AQHLuUoQ3oNzz/PaKUq0SFj3SnFkQpPnkhtggACoaYCABkJ88IAAi/gA//+YipCAAJylgP//fWdQ
Date: Thu, 3 Feb 2011 00:03:23 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de>
In-Reply-To: <4D49BA55.3050808@gmx.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 00:00:09 -0000

Hi Julian,

You are reinforcing my point that there are legacy issues with OPTIONS. I h=
ave no comments on your info as to who's at fault for introducing some of t=
hose issues, but the fact is that now we have them. Relying on such a metho=
d for websockets is asking for trouble. These legacy  issues can be avoided=
 by using a new method. I tend to think that the issue is worse for OPTIONS=
 than for GET as I've said, but that is how I worded it: this reuse is bad =
for any existing method (which you also agree to).

Again:

If I had to choose between GET and OPTIONS, I would choose GET. At least wi=
th GET there are some pros, like being able to reuse widely implemented sem=
antics. If you see this as a pro, then you can issue queries as usual, and =
instead of (or in addition to) having the option to respond to them within =
HTTP as usual, we would now have the option to switch into websockets and t=
hen respond. With OPTIONS I only see the cons.=20

If the choice is between WEBSOCKET (a new method) and OPTIONS (perhaps beca=
use the pros on the GET side are actually deemed to be a cons) then I would=
 choose WEBSOCKET to avoid legacy issues and for other advantages as noted =
by others.=20

At this point, it seems like the debate has come down to this choice betwee=
n WEBSOCKET and OPTIONS, so in this case I'll clearly state my preference f=
or WEBSOCKET (a new method).

Either case, I would avoid OPTIONS.

Gabriel

> -----Original Message-----
> From: Julian Reschke [mailto:julian.reschke@gmx.de]
> Sent: 02 February, 2011 12:11
> To: Gabriel Montenegro
> Cc: Salvatore Loreto; hybi@ietf.org; Joe Hildebrand; SM
> Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
>=20
> On 02.02.2011 20:47, Gabriel Montenegro wrote:
> > Because of the extensible nature of OPTIONS, even with a path things ma=
y
> not be as predictable. We don't know for sure that a path will strictly l=
imit
> processing to a given module. There's too much variability out there in t=
erms of
> modules, much greater than that inherent in base servers themselves.
>=20
> OK, but if that is the case, *any* method will have the same problem, unl=
ess
> you just define a new one for websockets.
>=20
> > For example, "/" may be answered by both the HTTP server or the WebDAV
> module (and there may be others). RFC2518 was revised by RFC4918 and that
> now includes some warning about that (section 10.1), but there is existin=
g
> practice along these lines:
>=20
> Ah, finally somebody reading RFC 4918 :-)
>=20
> > http://publib.boulder.ibm.com/infocenter/wpzosdoc/v6r1/index.jsp?topic
> > =3D/com.ibm.wp.zos.doc_v615/admin/webdav_http_options.html
>=20
> The only client I know that has this problem is the Microsoft WebDAV Mini=
-
> Redirector. The problem was reported around when it came out (over
> 7 years ago), and as far as I know hasn't been fixed.
> (<http://greenbytes.de/tech/webdav/webdav-redirector-list.html#issue-serv=
er-
> discovery>)
>=20
> So, yes, this is a problem when clients do the wrong thing and aren't pro=
perly
> maintained.
>=20
> (Sorry if this sounds like a cheap shot, but Microsoft's unwillingness to=
 fix their
> WebDAV clients has frustrated me for a long long REALLY long time).
>=20
> > It would be best to avoid usurping OPTIONS for the websocket handshake =
(but
> it should be reusable to query about WS support).
>=20
> Now I'm confused. If you can make OPTIONS respond to a query for WS suppo=
rt
> then why can't you also make it respond to Upgrade for WS?
>=20
> Best regards, Julian


From derhoermi@gmx.net  Wed Feb  2 16:44:48 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 27B153A6359 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 16:44:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.223
X-Spam-Level: 
X-Spam-Status: No, score=-3.223 tagged_above=-999 required=5 tests=[AWL=-0.624, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yRBqF6+iITac for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 16:44:47 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id A375B3A6405 for <hybi@ietf.org>; Wed,  2 Feb 2011 16:44:46 -0800 (PST)
Received: (qmail invoked by alias); 03 Feb 2011 00:48:05 -0000
Received: from dslb-094-223-191-191.pools.arcor-ip.net (EHLO hive) [94.223.191.191] by mail.gmx.net (mp026) with SMTP; 03 Feb 2011 01:48:05 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+KFdB2qHuK0ZKYAy5wfaWL7BIMMmB41lym+AxSRS ZWHNzYW+MdpfyL
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: ifette@google.com
Date: Thu, 03 Feb 2011 01:48:04 +0100
Message-ID: <pctjk6pn6g3v6top045nrvcg53u3sfu08i@hive.bjoern.hoehrmann.de>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <AANLkTin=0D6vNs+FgYCfa8TD26umkG8HEBpgRNR8F=s+@mail.gmail.com>
In-Reply-To: <AANLkTin=0D6vNs+FgYCfa8TD26umkG8HEBpgRNR8F=s+@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 00:44:48 -0000

* Ian Fette wrote:
>I also prefer OPTIONS + PATH and don't believe there's any significant
>confusion that will arise out of this, but more than anything at this point
>I would like to get some call from the chairs and move on. I thought this
>was supposed to close on the 31st?

It's just a straw poll, and the Working Group does not seem to lean in
any particular direction; that leaves us somewhere between "this does
not seem to matter much" and "more discussion is needed". As far as I
am concerned, I am willing to accept that "GET" has short-term benefits,
while "WEBSOCKET" has long-term benefits. I haven't seen an argument why
"OPTIONS" is better than both of those alternatives. If you, or others,
have a good one, that would make it easier for our chairs to assess what
the rough consensus looks like.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From ifette@google.com  Wed Feb  2 17:12:11 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B2D763A6768 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 17:12:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.742
X-Spam-Level: 
X-Spam-Status: No, score=-103.742 tagged_above=-999 required=5 tests=[AWL=-1.066, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gE5YIDt+4SqL for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 17:12:10 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id AB3463A6403 for <hybi@ietf.org>; Wed,  2 Feb 2011 17:12:09 -0800 (PST)
Received: from wpaz29.hot.corp.google.com (wpaz29.hot.corp.google.com [172.24.198.93]) by smtp-out.google.com with ESMTP id p131FTjE023410 for <hybi@ietf.org>; Wed, 2 Feb 2011 17:15:29 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1296695729; bh=Slcqr7XE4bePbG/Z6iAD/XggJoc=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=jgD13XU/WP/2eze8AHVsHYTzj4op3kLvxetphFKD+x2LWLiPHL7owMWHtUS6l3kFe Y7xESt06n2Mtx0HHnZd2w==
Received: from iyi20 (iyi20.prod.google.com [10.241.51.20]) by wpaz29.hot.corp.google.com with ESMTP id p131FJKx009894 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 2 Feb 2011 17:15:28 -0800
Received: by iyi20 with SMTP id 20so590039iyi.14 for <hybi@ietf.org>; Wed, 02 Feb 2011 17:15:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=tHGdUHS8qqSAECVldgGVzGR8GxSrTtTVfg8jzx7S9ok=; b=SqGwQSLak2EXapvIsWBl59RJtI/hhcFguFqYAFC6WioMGfSwjK/y1SAMKi3pRexzS5 rBq0XlPCwhC0gM/pITVg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=WA+KV2DQmtjHpxltbLoX4ztNJ/ucJa2QBCLhtDqLmgbTi7ItJRByc+fwr4HSCsxU5f uFlIMQR5DPiuaKD8wJsw==
MIME-Version: 1.0
Received: by 10.231.10.76 with SMTP id o12mr10882735ibo.144.1296695727618; Wed, 02 Feb 2011 17:15:27 -0800 (PST)
Received: by 10.231.13.66 with HTTP; Wed, 2 Feb 2011 17:15:27 -0800 (PST)
In-Reply-To: <pctjk6pn6g3v6top045nrvcg53u3sfu08i@hive.bjoern.hoehrmann.de>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <AANLkTin=0D6vNs+FgYCfa8TD26umkG8HEBpgRNR8F=s+@mail.gmail.com> <pctjk6pn6g3v6top045nrvcg53u3sfu08i@hive.bjoern.hoehrmann.de>
Date: Wed, 2 Feb 2011 17:15:27 -0800
Message-ID: <AANLkTimL03uqZ+DPaZpbozJ+aSzv9tvvHqyatWQ3Cn+_@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: multipart/alternative; boundary=0022152d614d39fb6a049b568075
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 01:12:11 -0000

--0022152d614d39fb6a049b568075
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 2, 2011 at 4:48 PM, Bjoern Hoehrmann <derhoermi@gmx.net> wrote:

> * Ian Fette wrote:
> >I also prefer OPTIONS + PATH and don't believe there's any significant
> >confusion that will arise out of this, but more than anything at this
> point
> >I would like to get some call from the chairs and move on. I thought thi=
s
> >was supposed to close on the 31st?
>
> It's just a straw poll, and the Working Group does not seem to lean in
> any particular direction; that leaves us somewhere between "this does
> not seem to matter much" and "more discussion is needed". As far as I
> am concerned, I am willing to accept that "GET" has short-term benefits,
> while "WEBSOCKET" has long-term benefits. I haven't seen an argument why
> "OPTIONS" is better than both of those alternatives. If you, or others,
> have a good one, that would make it easier for our chairs to assess what
> the rough consensus looks like.
>

It's not clear to me why WEBSOCKET actually adds anything over OPTIONS, eve=
n
after this whole thread. If something wants to look for websocket traffic
it's not hard to do so regardless of what is used. OPTIONS has some
advantages as demonstrated in other threads re: reducing the number of
"confused" intermediaries, beyond that I really don't care.

I don't get any of the "query" use cases, as I can't fathom connecting to
some random endpoint without already knowing that it's a ws endpoint...

As for the issue with multiple modules, if there is existing code out there
that would actually be broken by our use of OPTIONS, then I am fine with
WEBSOCKET -- this would be the only compelling argument in my mind. (That
said, if we deployed WEBSOCKET and found that it had a lower connect rate
than OPTIONS, I would want to reserve the right to change my mind...). Some
posts have raised potential issues but it wasn't clear to me whether these
were theoretical possibilities or actual deployments that would have issues=
.



> --
> Bj=C3=B6rn H=C3=B6hrmann =C2=B7 mailto:bjoern@hoehrmann.de =C2=B7 http://=
bjoern.hoehrmann.de
> Am Badedeich 7 =C2=B7 Telefon: +49(0)160/4415681 <tel:+491604415681> =C2=
=B7
> http://www.bjoernsworld.de
> 25899 Dageb=C3=BCll =C2=B7 PGP Pub. KeyID: 0xA4357E78 =C2=B7 http://www.w=
ebsitedev.de/
>

--0022152d614d39fb6a049b568075
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<br><br><div class=3D"gmail_quote">On Wed, Feb 2, 2011 at 4:48 PM, Bjoern H=
oehrmann <span dir=3D"ltr">&lt;<a href=3D"mailto:derhoermi@gmx.net">derhoer=
mi@gmx.net</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">* Ian Fette wrote:<br>
&gt;I also prefer OPTIONS + PATH and don&#39;t believe there&#39;s any sign=
ificant<br>
&gt;confusion that will arise out of this, but more than anything at this p=
oint<br>
&gt;I would like to get some call from the chairs and move on. I thought th=
is<br>
&gt;was supposed to close on the 31st?<br>
<br>
</div>It&#39;s just a straw poll, and the Working Group does not seem to le=
an in<br>
any particular direction; that leaves us somewhere between &quot;this does<=
br>
not seem to matter much&quot; and &quot;more discussion is needed&quot;. As=
 far as I<br>
am concerned, I am willing to accept that &quot;GET&quot; has short-term be=
nefits,<br>
while &quot;WEBSOCKET&quot; has long-term benefits. I haven&#39;t seen an a=
rgument why<br>
&quot;OPTIONS&quot; is better than both of those alternatives. If you, or o=
thers,<br>
have a good one, that would make it easier for our chairs to assess what<br=
>
the rough consensus looks like.<br></blockquote><div><br></div><div>It&#39;=
s not clear to me why WEBSOCKET actually adds anything over OPTIONS, even a=
fter this whole thread. If something wants to look for websocket traffic it=
&#39;s not hard to do so regardless of what is used. OPTIONS has some advan=
tages as demonstrated in other threads re: reducing the number of &quot;con=
fused&quot; intermediaries, beyond that I really don&#39;t care.</div>
<div><br></div><div>I don&#39;t get any of the &quot;query&quot; use cases,=
 as I can&#39;t fathom connecting to some random endpoint without already k=
nowing that it&#39;s a ws endpoint...</div><div><br></div><div>As for the i=
ssue with multiple modules, if there is existing code out there that would =
actually be broken by our use of OPTIONS, then I am fine with WEBSOCKET -- =
this would be the only compelling argument in my mind. (That said, if we de=
ployed WEBSOCKET and found that it had a lower connect rate than OPTIONS, I=
 would want to reserve the right to change my mind...). Some posts have rai=
sed potential issues but it wasn&#39;t clear to me whether these were theor=
etical possibilities or actual deployments that would have issues.</div>
<div><br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"=
margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class=3D"h5">--<br>
Bj=C3=B6rn H=C3=B6hrmann =C2=B7 mailto:<a href=3D"mailto:bjoern@hoehrmann.d=
e">bjoern@hoehrmann.de</a> =C2=B7 <a href=3D"http://bjoern.hoehrmann.de" ta=
rget=3D"_blank">http://bjoern.hoehrmann.de</a><br>
Am Badedeich 7 =C2=B7 Telefon: <a href=3D"tel:+491604415681">+49(0)160/4415=
681</a> =C2=B7 <a href=3D"http://www.bjoernsworld.de" target=3D"_blank">htt=
p://www.bjoernsworld.de</a><br>
25899 Dageb=C3=BCll =C2=B7 PGP Pub. KeyID: 0xA4357E78 =C2=B7 <a href=3D"htt=
p://www.websitedev.de/" target=3D"_blank">http://www.websitedev.de/</a><br>
</div></div></blockquote></div><br>

--0022152d614d39fb6a049b568075--

From gregw@intalio.com  Wed Feb  2 17:55:59 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1FFAC3A679F for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 17:55:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.928
X-Spam-Level: 
X-Spam-Status: No, score=-2.928 tagged_above=-999 required=5 tests=[AWL=0.049,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ECkL7yK0ZPLS for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 17:55:58 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 3EA7E3A659A for <hybi@ietf.org>; Wed,  2 Feb 2011 17:55:58 -0800 (PST)
Received: by vws7 with SMTP id 7so362455vws.31 for <hybi@ietf.org>; Wed, 02 Feb 2011 17:59:17 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.81.5 with SMTP id v5mr2703853vck.74.1296698357071; Wed, 02 Feb 2011 17:59:17 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.98.9 with HTTP; Wed, 2 Feb 2011 17:59:16 -0800 (PST)
In-Reply-To: <pctjk6pn6g3v6top045nrvcg53u3sfu08i@hive.bjoern.hoehrmann.de>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <AANLkTin=0D6vNs+FgYCfa8TD26umkG8HEBpgRNR8F=s+@mail.gmail.com> <pctjk6pn6g3v6top045nrvcg53u3sfu08i@hive.bjoern.hoehrmann.de>
Date: Thu, 3 Feb 2011 12:59:16 +1100
X-Google-Sender-Auth: 7UJR0M73TMdtTK_KydsLwI6_FFo
Message-ID: <AANLkTin6mmC4oTAD6tFYHMzs2Q6u=ZL7rTUzDa-PX1ze@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 01:55:59 -0000

On 3 February 2011 11:48, Bjoern Hoehrmann <derhoermi@gmx.net> wrote:
> * Ian Fette wrote:

> It's just a straw poll, and the Working Group does not seem to lean in
> any particular direction; that leaves us somewhere between "this does
> not seem to matter much" and "more discussion is needed".

Which matches perfectly one of the options:  Make the handshake work
with any method with a note saying the client should expect a non WS
return if the path and/or server does not support WS.

Of course the browsers will still have to make a choice of a method,
but they could experiment with a few methods and then choose the best
one without needing to have the servers and intermediaries re
implemented.

regards

From w@1wt.eu  Wed Feb  2 21:55:19 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CF66E3A6876 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 21:55:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.051
X-Spam-Level: 
X-Spam-Status: No, score=-2.051 tagged_above=-999 required=5 tests=[AWL=-0.008, BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k1-4b5e20se8 for <hybi@core3.amsl.com>; Wed,  2 Feb 2011 21:55:18 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 750AC3A6872 for <hybi@ietf.org>; Wed,  2 Feb 2011 21:55:17 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p135wRWD020408; Thu, 3 Feb 2011 06:58:27 +0100
Date: Thu, 3 Feb 2011 06:58:27 +0100
From: Willy Tarreau <w@1wt.eu>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Message-ID: <20110203055827.GB18511@1wt.eu>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
User-Agent: Mutt/1.4.2.3i
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 05:55:20 -0000

Hi Gabriel,

On Thu, Feb 03, 2011 at 12:03:23AM +0000, Gabriel Montenegro wrote:
> Hi Julian,
> 
> You are reinforcing my point that there are legacy issues with OPTIONS. I have no comments on your info as to who's at fault for introducing some of those issues, but the fact is that now we have them. Relying on such a method for websockets is asking for trouble. These legacy  issues can be avoided by using a new method. I tend to think that the issue is worse for OPTIONS than for GET as I've said, but that is how I worded it: this reuse is bad for any existing method (which you also agree to).
> 
> Again:
> 
> If I had to choose between GET and OPTIONS, I would choose GET. At least with GET there are some pros, like being able to reuse widely implemented semantics. If you see this as a pro, then you can issue queries as usual, and instead of (or in addition to) having the option to respond to them within HTTP as usual, we would now have the option to switch into websockets and then respond. With OPTIONS I only see the cons. 
> 
> If the choice is between WEBSOCKET (a new method) and OPTIONS (perhaps because the pros on the GET side are actually deemed to be a cons) then I would choose WEBSOCKET to avoid legacy issues and for other advantages as noted by others. 
> 
> At this point, it seems like the debate has come down to this choice between WEBSOCKET and OPTIONS, so in this case I'll clearly state my preference for WEBSOCKET (a new method).
> 
> Either case, I would avoid OPTIONS.

As long as we use any method + Upgrade, I don't care much which one we
use, what I don't want to see is a new method without Upgrade which
implies a tunnel as we once expected it.

I don't like much adding new methods, hence the reason why I'm not much
in favor of WEBSOCKET and preferred OPTIONS, but if you say there are
known issues with OPTIONS, even if they're rare, I agree we'd better
avoid them.

I'd still rather avoid GET to get rid of false positives on caches,
though it's not a strong desire.

Also, if we create a new method because we did not find one which matches
our needs, maybe we should be less selfish and not call it WEBSOCKET. After
all, if we're forced to create another new method, it's precisely because
we did not find the perfect one among existing ones. It would be stupid
that another WG in 5 years has the exact same requirement and has to use
WEBSOCKET for another purpose because of its semantics. What we need is
just something that upgrades the connection to a tunnel. We could very
well call it TUNNEL or UPGRADE. At least, the last one clearly implies
what the method is intended for and other projects will be able to use
it too.

Regards,
Willy


From andy@warmcat.com  Thu Feb  3 02:44:21 2011
Return-Path: <andy@warmcat.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 516363A68F7 for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 02:44:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.903
X-Spam-Level: 
X-Spam-Status: No, score=-1.903 tagged_above=-999 required=5 tests=[AWL=-1.649, BAYES_00=-2.599, HOST_EQ_MODEMCABLE=1.368, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RdO3WltOK4CA for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 02:44:20 -0800 (PST)
Received: from warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by core3.amsl.com (Postfix) with ESMTP id 1AFC03A68F0 for <hybi@ietf.org>; Thu,  3 Feb 2011 02:44:20 -0800 (PST)
Received: from warmcat.com (warmcat.com [127.0.0.1]) by warmcat.com (Postfix) with ESMTP id 3C90054A0A3 for <hybi@ietf.org>; Thu,  3 Feb 2011 10:37:46 +0000 (GMT)
Message-ID: <4D4A8576.9060205@warmcat.com>
Date: Thu, 03 Feb 2011 10:37:42 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101209 Fedora/3.1.7-0.35.b3pre.fc14 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [hybi] Testing 04 on a paranoid proxy
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 10:44:21 -0000

Hi -

I am visiting a semiconductor company in France at the moment and their 
guest network uses a quite aggressive proxy, I never had the opportunity 
to be behind such a thing before; maybe it is commonplace for other list 
members but I thought I would see what 04 websockets fared like with it.

Here are the results of being an 04 client behind a "NetCache appliance 
(NetApp/6.0.5)".  In each case the remote server is configured to the 
matching port and mode.


   Port: 7681  Mode: ws or wss  Result:  FAIL (port closed)

   Port: 80    Mode: ws         Result:  FAIL ("BAD GATEWAY") [1]

   Port: 80    Mode wss         Result:  FAIL (SSL HELLO broken) [2]

   Port 443:   Mode ws          Result:  Worked fine

   Port 443:   Mode wss         Result:  Worked fine

I was a bit surprised that ws worked on 443 OK even though this proxy 
has been configured so aggressively as to kill IMAP on 993.  This proxy 
configuration anyway seems to allow websocket funny business so long as 
it is 443.

-Andy


[1]
$ libwebsockets-test-client warmcat.com --port 80
libwebsockets test client
(C) Copyright 2010 Andy Green <andy@warmcat.com> licensed under LGPL2.1
libwebsocket_client_handshake missing required header(s)
HTTP/1.1 502 Bad Gateway
Via: 1.0 BBSM53
Content-Length: 338
Date: Thu, 03 Feb 2011 10:31:05 GMT
Content-Type: text/html
Server: NetCache appliance (NetApp/6.0.5)

<HTML>
<HEAD><TITLE>502 Bad Gateway</TITLE></HEAD>
<BODY>
<H1>Bad Gateway</H1>
<H4>
The following error occurred:<P>
[code=DNS_HOST_NOT_FOUND] The host name was not found during the DNS 
lookup. Contact your system administrator if the problem is not found by 
retrying the URL.
</H4>
<HR>
Please contact the administrator.
</BODY>
</HTML>
libwebsocket dumb connect failed

[2]

$ libwebsockets-test-client warmcat.com --ssl --port 80
libwebsockets test client
(C) Copyright 2010 Andy Green <andy@warmcat.com> licensed under LGPL2.1
SSL connect error error:140770FC:SSL 
routines:SSL23_GET_SERVER_HELLO:unknown protocol
libwebsocket dumb connect failed

From mnot@mnot.net  Thu Feb  3 03:19:38 2011
Return-Path: <mnot@mnot.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7F633A68FE for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 03:19:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.663
X-Spam-Level: 
X-Spam-Status: No, score=-104.663 tagged_above=-999 required=5 tests=[AWL=-2.064, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iWVG16FNudhd for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 03:19:37 -0800 (PST)
Received: from mxout-08.mxes.net (mxout-08.mxes.net [216.86.168.183]) by core3.amsl.com (Postfix) with ESMTP id 9DADD3A68FA for <hybi@ietf.org>; Thu,  3 Feb 2011 03:19:37 -0800 (PST)
Received: from chancetrain-lm.mnot.net (unknown [118.209.1.128]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTPSA id BB553509EB; Thu,  3 Feb 2011 06:22:52 -0500 (EST)
Mime-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset=us-ascii
From: Mark Nottingham <mnot@mnot.net>
In-Reply-To: <4D4A8576.9060205@warmcat.com>
Date: Thu, 3 Feb 2011 22:22:49 +1100
Content-Transfer-Encoding: quoted-printable
Message-Id: <AA2CF46F-BA19-49D6-BA96-E540E1B56F13@mnot.net>
References: <4D4A8576.9060205@warmcat.com>
To: Andy Green <andy@warmcat.com>
X-Mailer: Apple Mail (2.1082)
Cc: hybi@ietf.org
Subject: Re: [hybi] Testing 04 on a paranoid proxy
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 11:19:38 -0000

FYI some background -- That's an old-ish version of netcache, IIRC. It =
was a general proxy/cache solution (and a very very good one) that was =
bought by a security-focused appliance company (BlueCoat) a few years =
back.

It'd be interesting to make the same requests from behind a BC box, but =
I don't have access to any...

Cheers,


On 03/02/2011, at 9:37 PM, Andy Green wrote:

> Hi -
>=20
> I am visiting a semiconductor company in France at the moment and =
their guest network uses a quite aggressive proxy, I never had the =
opportunity to be behind such a thing before; maybe it is commonplace =
for other list members but I thought I would see what 04 websockets =
fared like with it.
>=20
> Here are the results of being an 04 client behind a "NetCache =
appliance (NetApp/6.0.5)".  In each case the remote server is configured =
to the matching port and mode.
>=20
>=20
>  Port: 7681  Mode: ws or wss  Result:  FAIL (port closed)
>=20
>  Port: 80    Mode: ws         Result:  FAIL ("BAD GATEWAY") [1]
>=20
>  Port: 80    Mode wss         Result:  FAIL (SSL HELLO broken) [2]
>=20
>  Port 443:   Mode ws          Result:  Worked fine
>=20
>  Port 443:   Mode wss         Result:  Worked fine
>=20
> I was a bit surprised that ws worked on 443 OK even though this proxy =
has been configured so aggressively as to kill IMAP on 993.  This proxy =
configuration anyway seems to allow websocket funny business so long as =
it is 443.
>=20
> -Andy
>=20
>=20
> [1]
> $ libwebsockets-test-client warmcat.com --port 80
> libwebsockets test client
> (C) Copyright 2010 Andy Green <andy@warmcat.com> licensed under =
LGPL2.1
> libwebsocket_client_handshake missing required header(s)
> HTTP/1.1 502 Bad Gateway
> Via: 1.0 BBSM53
> Content-Length: 338
> Date: Thu, 03 Feb 2011 10:31:05 GMT
> Content-Type: text/html
> Server: NetCache appliance (NetApp/6.0.5)
>=20
> <HTML>
> <HEAD><TITLE>502 Bad Gateway</TITLE></HEAD>
> <BODY>
> <H1>Bad Gateway</H1>
> <H4>
> The following error occurred:<P>
> [code=3DDNS_HOST_NOT_FOUND] The host name was not found during the DNS =
lookup. Contact your system administrator if the problem is not found by =
retrying the URL.
> </H4>
> <HR>
> Please contact the administrator.
> </BODY>
> </HTML>
> =7Flibwebsocket dumb connect failed
>=20
> [2]
>=20
> $ libwebsockets-test-client warmcat.com --ssl --port 80
> libwebsockets test client
> (C) Copyright 2010 Andy Green <andy@warmcat.com> licensed under =
LGPL2.1
> SSL connect error error:140770FC:SSL =
routines:SSL23_GET_SERVER_HELLO:unknown protocol
> libwebsocket dumb connect failed
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--
Mark Nottingham   http://www.mnot.net/




From ferg@caucho.com  Thu Feb  3 11:53:16 2011
Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4FC673A6A4F for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 11:53:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.449
X-Spam-Level: 
X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[AWL=0.150,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4xWTDXIrcuj4 for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 11:53:15 -0800 (PST)
Received: from nm19-vm0.bullet.mail.ne1.yahoo.com (nm19-vm0.bullet.mail.ne1.yahoo.com [98.138.91.59]) by core3.amsl.com (Postfix) with SMTP id DFBB43A6A07 for <hybi@ietf.org>; Thu,  3 Feb 2011 11:53:14 -0800 (PST)
Received: from [98.138.90.56] by nm19.bullet.mail.ne1.yahoo.com with NNFMP; 03 Feb 2011 19:56:35 -0000
Received: from [98.138.89.173] by tm9.bullet.mail.ne1.yahoo.com with NNFMP; 03 Feb 2011 19:56:35 -0000
Received: from [127.0.0.1] by omp1029.mail.ne1.yahoo.com with NNFMP; 03 Feb 2011 19:56:35 -0000
X-Yahoo-Newman-Id: 99889.59577.bm@omp1029.mail.ne1.yahoo.com
Received: (qmail 65671 invoked from network); 3 Feb 2011 19:56:34 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp114.biz.mail.mud.yahoo.com with SMTP; 03 Feb 2011 11:56:34 -0800 PST
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: SiXCQ4oVM1nwq8OiUWxqY.2hTfH4hi.LLKcO1RLOWEgvUfN loXW2QjEBuQ57RgByte3dxA5zi6G_hE2aA39MfImJsX7GwKM147kh06DXGEG OFpwNG81uMRaZdYO0_kqyvoOdokgBEFh0ILAkfcht6ZMlq5cJR71mwnzNExb qyBXUE_uhSDBOOe1o5ClEWnAwkYlK8IR..zaPd9amCrt7lqCJnYmubPdud2v rimAIvYrOK8FU.c7kzZF1CLRZCJwzswXbKdI_eoiROov0Df7rVvoKS7QB0UG E.FbPPGKf8hTReQueBuQfW5gKXvZjYUgMrT2z6KpSw1RumKzxDkSswJmk0YP jbNtjr4N8PWXYjctc.t_MXFoZfS4UQZQTcOnHnA--
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4D4B086B.7000901@caucho.com>
Date: Thu, 03 Feb 2011 11:56:27 -0800
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: Willy Tarreau <w@1wt.eu>
References: <4D394B51.2060105@ericsson.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D43D80B.7010903@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D498DB8.703@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D49BA55.3050808@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu>
In-Reply-To: <20110203055827.GB18511@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 19:53:16 -0000

Willy Tarreau wrote:
> I don't like much adding new methods,...

Method names in HTTP are not expensive. It's not like adding a keyword 
to a programming language, it's just an identifier.

I've never been clear why anyone would think HTTP method names are some 
scarce resource that need to be carefully rationed and overloaded.

> Also, if we create a new method because we did not find one which matches
> our needs, maybe we should be less selfish and not call it WEBSOCKET. After
> all, if we're forced to create another new method, it's precisely because
> we did not find the perfect one among existing ones. It would be stupid
> that another WG in 5 years has the exact same requirement and has to use
> WEBSOCKET for another purpose because of its semantics. What we need is
> just something that upgrades the connection to a tunnel. We could very
> well call it TUNNEL or UPGRADE. At least, the last one clearly implies
> what the method is intended for and other projects will be able to use
> it too.
>   

UPGRADE would be fine, too. As long as it clearly expresses what the 
request is doing, the exact name is less important.

"TUNNEL", for example, would be a poor choice because it's not an 
accurate description of what the protocol is doing (for the endpoints at 
least), but would still be better than "GET" or "OPTIONS", which have 
totally different semantics.

-- Scott

> Regards,
> Willy
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>
>
>   


From w@1wt.eu  Thu Feb  3 13:09:03 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 351523A6AC8 for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 13:09:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.051
X-Spam-Level: 
X-Spam-Status: No, score=-2.051 tagged_above=-999 required=5 tests=[AWL=-0.008, BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ADxmOnCk+ECL for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 13:09:02 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 178FB3A6A53 for <hybi@ietf.org>; Thu,  3 Feb 2011 13:09:00 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p13LC9ww025678; Thu, 3 Feb 2011 22:12:09 +0100
Date: Thu, 3 Feb 2011 22:12:09 +0100
From: Willy Tarreau <w@1wt.eu>
To: Scott Ferguson <ferg@caucho.com>
Message-ID: <20110203211209.GC18511@1wt.eu>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4D4B086B.7000901@caucho.com>
User-Agent: Mutt/1.4.2.3i
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 21:09:03 -0000

On Thu, Feb 03, 2011 at 11:56:27AM -0800, Scott Ferguson wrote:
> Willy Tarreau wrote:
> >I don't like much adding new methods,...
> 
> Method names in HTTP are not expensive. It's not like adding a keyword 
> to a programming language, it's just an identifier.

It's mainly that some products support a finite set of known methods, and
eventhough adding one more is inexpensive in general, it at least requires
a minor upgrade to support the new ones.

Also sometimes the security impacts of crossing new methods with other URLs
and conversely have to be qualified in some complex setups. For instance,
when you know that nothing but GET/HEAD/POST/OPTIONS passes through your
front component and all URLs are known to safely behave in such conditions,
you might have to recheck that when the front component lets a new method
pass.

As I said it's not a big deal, but when not necessary I prefer to avoid it.
Now, Gabriel has explained why we'd better go for a new method. In fact
he's one of the only ones who have brought real arguments instead of just
opinion as we almost all did. For this reason I tend to value his choice
better than mine.

(...)
> UPGRADE would be fine, too. As long as it clearly expresses what the 
> request is doing, the exact name is less important.
> 
> "TUNNEL", for example, would be a poor choice because it's not an 
> accurate description of what the protocol is doing (for the endpoints at 
> least), but would still be better than "GET" or "OPTIONS", which have 
> totally different semantics.

Right.

Regards,
Willy


From jmason@rim.com  Thu Feb  3 14:09:50 2011
Return-Path: <jmason@rim.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 841953A6B1D for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 14:09:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.411
X-Spam-Level: 
X-Spam-Status: No, score=-5.411 tagged_above=-999 required=5 tests=[AWL=-0.208, BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MVdtEIiZVnqA for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 14:09:49 -0800 (PST)
Received: from mhs04ykf.rim.net (mhs04ykf.rim.net [216.9.243.82]) by core3.amsl.com (Postfix) with ESMTP id 8DFDF3A6A00 for <hybi@ietf.org>; Thu,  3 Feb 2011 14:09:49 -0800 (PST)
X-AuditID: 0a666446-b7ba6ae0000051d3-06-4d4b28782c7b
Received: from XHT110CNC.rim.net ( [10.65.22.55]) by mhs04ykf.rim.net (RIM Mail) with SMTP id AB.A7.20947.8782B4D4; Thu,  3 Feb 2011 17:13:12 -0500 (EST)
Received: from XCH117CNC.rim.net ([fe80::b8df:541f:9d85:9909]) by XHT110CNC.rim.net ([fe80::d0e9:e16f:525b:55f5%11]) with mapi; Thu, 3 Feb 2011 17:13:11 -0500
From: Joe Mason <jmason@rim.com>
To: Willy Tarreau <w@1wt.eu>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Date: Thu, 3 Feb 2011 17:13:11 -0500
Thread-Topic: [hybi] straw-poll on GET vs OPTIONS vs new method
Thread-Index: AcvDZ2ubV5NPCPYMSFKA5JjIivIMwgAh/Fqg
Message-ID: <BB31C4AB95A70042A256109D46199126060681F6@XCH117CNC.rim.net>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu>
In-Reply-To: <20110203055827.GB18511@1wt.eu>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
content-transfer-encoding: quoted-printable
MIME-Version: 1.0
X-Brightmail-Tracker: AAAAAgAAAZEXVOHb
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 22:09:50 -0000

> -----Original Message-----
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Willy Tarreau
> 
> Also, if we create a new method because we did not find one which
> matches
> our needs, maybe we should be less selfish and not call it WEBSOCKET.
> After
> all, if we're forced to create another new method, it's precisely
> because
> we did not find the perfect one among existing ones. It would be stupid
> that another WG in 5 years has the exact same requirement and has to
> use
> WEBSOCKET for another purpose because of its semantics. What we need is
> just something that upgrades the connection to a tunnel. We could very
> well call it TUNNEL or UPGRADE. At least, the last one clearly implies
> what the method is intended for and other projects will be able to use
> it too.

+1

Still not convinced on the need or desirability of a new method, but if we d=
o use one it should be descriptive of what the method does, not what protoco=
l it's used in.

Joe


---------------------------------------------------------------------=0A=
This transmission (including any attachments) may contain confidential infor=
mation, privileged material (including material protected by the solicitor-c=
lient or other applicable privileges), or constitute non-public information.=
 Any use of this information by anyone other than the intended recipient is=
 prohibited. If you have received this transmission in error, please immedia=
tely reply to the sender and delete this information from your system. Use,=
 dissemination, distribution, or reproduction of this transmission by uninte=
nded recipients is not authorized and may be unlawful.

From ferg@caucho.com  Thu Feb  3 14:27:40 2011
Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C7A073A6B1D for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 14:27:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.245
X-Spam-Level: 
X-Spam-Status: No, score=-2.245 tagged_above=-999 required=5 tests=[AWL=0.354,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NRmQyYJWCyHz for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 14:27:38 -0800 (PST)
Received: from nm24-vm0.bullet.mail.ac4.yahoo.com (nm24-vm0.bullet.mail.ac4.yahoo.com [98.139.53.222]) by core3.amsl.com (Postfix) with SMTP id 727BC3A687A for <hybi@ietf.org>; Thu,  3 Feb 2011 14:27:37 -0800 (PST)
Received: from [98.139.52.191] by nm24.bullet.mail.ac4.yahoo.com with NNFMP; 03 Feb 2011 22:30:58 -0000
Received: from [98.139.52.155] by tm4.bullet.mail.ac4.yahoo.com with NNFMP; 03 Feb 2011 22:30:58 -0000
Received: from [127.0.0.1] by omp1038.mail.ac4.yahoo.com with NNFMP; 03 Feb 2011 22:30:57 -0000
X-Yahoo-Newman-Id: 989891.40668.bm@omp1038.mail.ac4.yahoo.com
Received: (qmail 57658 invoked from network); 3 Feb 2011 22:30:54 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp114.biz.mail.mud.yahoo.com with SMTP; 03 Feb 2011 14:30:54 -0800 PST
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: E0O25HMVM1lMUM_WZ_o_xglRYe__DsSA29NtB5NdHo0uGZ4 9OxVnDCAfzeh1z2v1NGna0ugxTt0jktJRZ6zPTYngeyUKv9Ww.JgR8WTaKTJ CqDeumFTic9I_yO3P1drfiHpbwJyk_ZiG4X0BE6RV82PlqVfUIrLtA1mAj6B HinGVo4WKRBx_0kyZc7ZUINDs4IP2C_U5K4RLV6DSbCH0o2cNfsgOLP9L_PO jUa0jsR0CUV6cBSGps5H0I2oO__pucHT3aM2V9aYk2bB_kQ81Q8tqkb.Vv.F 1SHaZIVMp7JBdLNz8cfLMWUfLvUSKrRGPIl73QQbCIiv15OpP5rJprdoIF_A oBpUMySWdYBjxCd4H1DDmLuqwi_eLIIKjYnX6RLEa
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4D4B2C9D.2090807@caucho.com>
Date: Thu, 03 Feb 2011 14:30:53 -0800
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: Willy Tarreau <w@1wt.eu>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <20110203211209.GC18511@1wt.eu>
In-Reply-To: <20110203211209.GC18511@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 22:27:41 -0000

Willy Tarreau wrote:
> On Thu, Feb 03, 2011 at 11:56:27AM -0800, Scott Ferguson wrote:
>   
>> Willy Tarreau wrote:
>>     
>>> I don't like much adding new methods,...
>>>       
>> Method names in HTTP are not expensive. It's not like adding a keyword 
>> to a programming language, it's just an identifier.
>>     
>
> It's mainly that some products support a finite set of known methods, and
> eventhough adding one more is inexpensive in general, it at least requires
> a minor upgrade to support the new ones.
>   
But any product that supports websockets needs to be upgraded anyway 
(with the possible exception of passthrough proxies.) Compared to 
supporting the non-HTTP websockets protocol, the work needed to add a 
whitelist string is trivial.

It's not like a servlet filter, for example, will automatically work 
with websockets just because the HTTP method name happens to be "GET".

Not that websockets is all that complicated, but adding one string to a 
whitelist is about as trivial as possible.
> Also sometimes the security impacts of crossing new methods with other URLs
> and conversely have to be qualified in some complex setups. For instance,
> when you know that nothing but GET/HEAD/POST/OPTIONS passes through your
> front component and all URLs are known to safely behave in such conditions,
> you might have to recheck that when the front component lets a new method
> pass.
>   

You'd want to do that with websockets anyway. Having a distinct method 
would reduce confusion, and if nothing else would let you blacklist 
websockets requests until you could upgrade.

-- Scott


> As I said it's not a big deal, but when not necessary I prefer to avoid it.
> Now, Gabriel has explained why we'd better go for a new method. In fact
> he's one of the only ones who have brought real arguments instead of just
> opinion as we almost all did. For this reason I tend to value his choice
> better than mine.
>
> (...)
>   
>> UPGRADE would be fine, too. As long as it clearly expresses what the 
>> request is doing, the exact name is less important.
>>
>> "TUNNEL", for example, would be a poor choice because it's not an 
>> accurate description of what the protocol is doing (for the endpoints at 
>> least), but would still be better than "GET" or "OPTIONS", which have 
>> totally different semantics.
>>     
>
> Right.
>
> Regards,
> Willy
>
>
>
>
>   


From buskanaka@gmail.com  Thu Feb  3 15:06:22 2011
Return-Path: <buskanaka@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5E7BF3A6AC3 for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 15:06:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.976
X-Spam-Level: 
X-Spam-Status: No, score=-2.976 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7udVv8Hs9aGH for <hybi@core3.amsl.com>; Thu,  3 Feb 2011 15:06:21 -0800 (PST)
Received: from mail-ew0-f44.google.com (mail-ew0-f44.google.com [209.85.215.44]) by core3.amsl.com (Postfix) with ESMTP id 46D413A6A17 for <hybi@ietf.org>; Thu,  3 Feb 2011 15:06:21 -0800 (PST)
Received: by ewy8 with SMTP id 8so1099880ewy.31 for <hybi@ietf.org>; Thu, 03 Feb 2011 15:09:44 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:in-reply-to:references:from :date:x-google-sender-auth:message-id:subject:to:content-type; bh=BN9KwLbvmHDTOrWjuB4wYSd84wYjMpdHyXFfvuOOXRs=; b=x44tJ9MyaPANCTMQJlU/WyHb0UHEhCJWgbbVDGfC/yr9xwaND79La0JGMmeEsPKdzE 6Q6rQ8pNsdsHM6WZcZicHPU4pFqrakv1GLSqn3HnijE1eytJM6gVJsx8d7u8sS3G7MuS roC7JW2y2xJt/cTVhdp8GCoq/UZDh2m/QaMQU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:content-type; b=gYHBTGf1N6EM2tTwsP2vIhBINW7u7ZXHtLu2oW8NiEyevikav8SpN1vSRCm5fpSGVh CDVJoYR5UyJiSlmCZk336E8fURUF48Qp15PbiqurOc/pN1AddWJok/Mg+ls7Q4b4F0dQ 84XWwgo7fdWfx8XQqU2BDo58eRKz+YVTldOA8=
Received: by 10.14.11.226 with SMTP id 74mr794404eex.5.1296774583888; Thu, 03 Feb 2011 15:09:43 -0800 (PST)
MIME-Version: 1.0
Sender: buskanaka@gmail.com
Received: by 10.14.119.136 with HTTP; Thu, 3 Feb 2011 15:09:23 -0800 (PST)
In-Reply-To: <4D4B2C9D.2090807@caucho.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <20110203211209.GC18511@1wt.eu> <4D4B2C9D.2090807@caucho.com>
From: Joel Martin <hybi@martintribe.org>
Date: Thu, 3 Feb 2011 17:09:23 -0600
X-Google-Sender-Auth: vW9_pxlr7YKdWKt6pLQrAV2qRBI
Message-ID: <AANLkTimhZ5bo2M6mPiGNEevuDTH_n6v5LZKCX-a-0nq4@mail.gmail.com>
To: "hybi@ietf.org" <hybi@ietf.org>
Content-Type: multipart/alternative; boundary=0016364d1e116d2db6049b68dcf1
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Feb 2011 23:06:22 -0000

--0016364d1e116d2db6049b68dcf1
Content-Type: text/plain; charset=ISO-8859-1

There has already been a suggestion of allowing the client to pick a method
(but still sending Upgrade: websocket). I would like to propose a variation
on that:

1) The client should initially send:

    NEWMETHOD /path HTTP/1.1
    ...
    Upgrade: websocket

where NEWMETHOD is whatever new method is decided on by the working group
whether TUNNEL, UPGRADE, WEBSOCKET or something else.

2) If server responds with 405 [Method not allowed] then the client may try
again with GET as the method (with new keys/nonces but otherwise the same).
Perhaps other 40X in addition to 405 should trigger a re-request.

The important part is that the "Upgrade: websocket" header is sent in both
cases. The purpose would be to encourage browser and server developers to
use the new method (since there are advantages) but permit fall-back to GET
when something along the path hasn't been updated to support the new method.
Eventually the fall-back could be eliminated once it is no longer deemed
useful.

Regards,
Joel Martin (kanaka)

--0016364d1e116d2db6049b68dcf1
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

There has already been a suggestion of allowing the client to pick a method=
 (but still sending Upgrade: websocket). I would like to propose a variatio=
n on that:<div><br><div>1) The client should initially send:</div><div><br>

</div><div>=A0=A0 =A0NEWMETHOD /path HTTP/1.1</div><div>=A0=A0 =A0...</div>=
<div>=A0=A0 =A0Upgrade: websocket<br><br></div><div><meta http-equiv=3D"con=
tent-type" content=3D"text/html; charset=3Dutf-8">where NEWMETHOD is whatev=
er new method is decided on by the working group whether TUNNEL, UPGRADE, W=
EBSOCKET or something else.</div>

<div><br></div><div>2) If server responds with 405 [Method not allowed] the=
n the client may try again with GET as the method (with new keys/nonces but=
 otherwise the same). Perhaps other 40X in addition to 405 should trigger a=
 re-request.</div>

<div><br></div><div>The important part is that the &quot;Upgrade: websocket=
&quot; header is sent in both cases. The purpose would be to encourage brow=
ser and server developers to use the new method (since there are advantages=
) but permit fall-back to GET when something along the path hasn&#39;t been=
 updated to support the new method. Eventually the fall-back could be elimi=
nated once it is no longer deemed useful.</div>

<div><br></div><div>Regards,</div><div>Joel Martin (kanaka)</div><div><br><=
/div></div>

--0016364d1e116d2db6049b68dcf1--

From julian.reschke@gmx.de  Fri Feb  4 02:17:30 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 86CFB3A68D5 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 02:17:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.81
X-Spam-Level: 
X-Spam-Status: No, score=-103.81 tagged_above=-999 required=5 tests=[AWL=-1.211, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k1jQ7f00BLsB for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 02:17:29 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id A393F3A68CD for <hybi@ietf.org>; Fri,  4 Feb 2011 02:17:28 -0800 (PST)
Received: (qmail invoked by alias); 04 Feb 2011 10:20:51 -0000
Received: from p508FDB1C.dip.t-dialin.net (EHLO [192.168.178.33]) [80.143.219.28] by mail.gmx.net (mp020) with SMTP; 04 Feb 2011 11:20:51 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX18NLVsu/owNhSXn2cWBufMax30n3zKibjc4rKv6yS P89DB/A75E29j0
Message-ID: <4D4BD2FB.7060900@gmx.de>
Date: Fri, 04 Feb 2011 11:20:43 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Scott Ferguson <ferg@caucho.com>
References: <4D394B51.2060105@ericsson.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D43D80B.7010903@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D498DB8.703@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D49BA55.3050808@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com>
In-Reply-To: <4D4B086B.7000901@caucho.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2011 10:17:30 -0000

On 03.02.2011 20:56, Scott Ferguson wrote:
> Willy Tarreau wrote:
>> I don't like much adding new methods,...
>
> Method names in HTTP are not expensive. It's not like adding a keyword
> to a programming language, it's just an identifier.
>
> I've never been clear why anyone would think HTTP method names are some
> scarce resource that need to be carefully rationed and overloaded.
>
>> Also, if we create a new method because we did not find one which matches
>> our needs, maybe we should be less selfish and not call it WEBSOCKET.
>> After
>> all, if we're forced to create another new method, it's precisely because
>> we did not find the perfect one among existing ones. It would be stupid
>> that another WG in 5 years has the exact same requirement and has to use
>> WEBSOCKET for another purpose because of its semantics. What we need is
>> just something that upgrades the connection to a tunnel. We could very
>> well call it TUNNEL or UPGRADE. At least, the last one clearly implies
>> what the method is intended for and other projects will be able to use
>> it too.
>
> UPGRADE would be fine, too. As long as it clearly expresses what the
> request is doing, the exact name is less important.
>
> "TUNNEL", for example, would be a poor choice because it's not an
> accurate description of what the protocol is doing (for the endpoints at
> least), but would still be better than "GET" or "OPTIONS", which have
> totally different semantics.
> ...

I'm not totally convinced that we can't use OPTIONS.

If we *do* define a new method, we should be clear on its semantics 
(independently of Websockets) and other properties (safe, idempotent, 
cacheability).

"UPGRADE" seems to be a poor choice, because what causes the upgrade is 
the header, not the method.

So, if the method really is a No-Op designed just to carry the Upgrade 
header, then maybe it should be called "NOP".

Also note:

"HTTP methods are generic; that is, they are potentially applicable to 
any resource, not just one particular media type, "type" of resource, or 
application. As such, it is preferred that new HTTP methods be 
registered in a document that isn't specific to a single application, so 
that this is clear." -- 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-12.html#rfc.section.2.1.1.p.2>

(note that's an ID only so the HTTPbis WG is looking for feedback on this)

BR, Julian

From tailhook@yandex.ru  Fri Feb  4 02:44:06 2011
Return-Path: <tailhook@yandex.ru>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D138A3A68F4 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 02:44:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.115
X-Spam-Level: 
X-Spam-Status: No, score=0.115 tagged_above=-999 required=5 tests=[AWL=1.225,  BAYES_05=-1.11]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CWos1+gM4caC for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 02:44:05 -0800 (PST)
Received: from forward16.mail.yandex.net (forward16.mail.yandex.net [95.108.253.141]) by core3.amsl.com (Postfix) with ESMTP id 9988D3A68E6 for <hybi@ietf.org>; Fri,  4 Feb 2011 02:44:05 -0800 (PST)
Received: from web25.yandex.ru (web25.yandex.ru [95.108.253.234]) by forward16.mail.yandex.net (Yandex) with ESMTP id 480036C6800D for <hybi@ietf.org>; Fri,  4 Feb 2011 13:47:26 +0300 (MSK)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1296816446; bh=s3wbWjnPLrqPWyaGVAkjAXStGtdumioMTcXUp3ZoBrU=; h=From:To:In-Reply-To:References:Subject:MIME-Version:Message-Id: Date:Content-Transfer-Encoding:Content-Type; b=TAJoGEr5FBeblZMC0xq71QEBao3P7igE1XM8CLRqgGjYV27yZaT0TSzcXkKNV3DW4 moBNpW10uJxLRirCd25u3R91lds8VNaB5HMstsRLtSkw9p8DhErZ3NqGoXMwkJv6/x pQ7RxhRSjrx69+x0+7wZrmS2+vG4osmaks9WtnMA=
Received: from localhost (localhost.localdomain [127.0.0.1]) by web25.yandex.ru (Yandex) with ESMTP id 3D8E36BF0015 for <hybi@ietf.org>; Fri,  4 Feb 2011 13:47:26 +0300 (MSK)
Received: from pptp-dm2008070092.domashka.kiev.ua (pptp-dm2008070092.domashka.kiev.ua [91.203.48.31]) by mail.yandex.ru with HTTP; Fri, 04 Feb 2011 13:47:25 +0300
From: Paul Colomiets <tailhook@yandex.ua>
Envelope-From: tailhook@yandex.ru
To: hybi@ietf.org
In-Reply-To: <4D394B51.2060105@ericsson.com>
References: <4D394B51.2060105@ericsson.com>
MIME-Version: 1.0
Message-Id: <547161296816445@web25.yandex.ru>
Date: Fri, 04 Feb 2011 12:47:25 +0200
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=koi8-r
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2011 10:44:06 -0000

Hi,

I would prefer WEBSOCKET (or maybe other new method), because:
 1. It's easier to reason that it's websocket by first few bytes, it's probably important
    for those serving multiple protocols on single connection, but not real HTTP
 2. It's easier to make that pluggable in some servers. If you want to make plugin
    for OPTIONS, and some other plugin will need to plug into OPTIONS (e.g. WebDAV),
    the plugin system logic would be much more complicated

I world also argue against allowing client to choose method, because probably some
lazy server implementors will implement only one used by most browsers, and we
will be locked to single method anyway.

These points are actually miserable ones, but if most of us thinks method doesn't
matter by important reasons, they could be taken in account.

--
Paul

21.01.2011, 11:01, "Salvatore Loreto" <salvatore.loreto@ericsson.com>:
> Hi there,
>
> after the result of the first straw-poll on GET+Upgrade+Masking,
> there were a discussion about GET not being the only method to "Upgrade"
> the connection;
> other methods such as OPTIONS
> (http://www.ietf.org/mail-archive/web/hybi/current/msg05721.html)
> and perhaps a completely new method could be used (as proposed months ago).
>
> All the possibilities have pro and cons.
>
> The mail thread(s) started to discuss the alternatives,
> convinced Joe and myself, as HyBi wg co-chairs, that it make sense to
> run a straw-poll
> to get as much information as we can šfrom people about technical reason
> (pro and cons)
> for their preference(s).
>
> So please provide your choices (if more then one, please rank them or if
> only one specify
> "I can live only with") among the following
>
> #1 - GET
> #2 - OPTIONS
> #3 - a complete new method (e.g. WEBSOCKET)
>
> This poll will run until January 31st
>
> cheers
> /Sal
>
> --
> Salvatore Loreto
> www.sloreto.com
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--
Paul

From ferg@caucho.com  Fri Feb  4 09:47:57 2011
Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 995323A69FA for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 09:47:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.255
X-Spam-Level: 
X-Spam-Status: No, score=-2.255 tagged_above=-999 required=5 tests=[AWL=0.344,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WFNy3S1GNwpm for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 09:47:56 -0800 (PST)
Received: from nm27.bullet.mail.sp2.yahoo.com (nm27.bullet.mail.sp2.yahoo.com [98.139.91.97]) by core3.amsl.com (Postfix) with SMTP id 193893A69E3 for <hybi@ietf.org>; Fri,  4 Feb 2011 09:47:56 -0800 (PST)
Received: from [98.139.91.64] by nm27.bullet.mail.sp2.yahoo.com with NNFMP; 04 Feb 2011 17:51:19 -0000
Received: from [98.139.91.33] by tm4.bullet.mail.sp2.yahoo.com with NNFMP; 04 Feb 2011 17:51:19 -0000
Received: from [127.0.0.1] by omp1033.mail.sp2.yahoo.com with NNFMP; 04 Feb 2011 17:51:19 -0000
X-Yahoo-Newman-Id: 242883.27334.bm@omp1033.mail.sp2.yahoo.com
Received: (qmail 76463 invoked from network); 4 Feb 2011 17:51:18 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp115.biz.mail.mud.yahoo.com with SMTP; 04 Feb 2011 09:51:18 -0800 PST
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: _cL3PlEVM1loOXv8_dwhKYFmy25EMvwfRIfIV96Bxj6IzCC J0Dhgwsn3rw5f1qnA3h4bxqVIFtF_n6gFPKA1LMbB0jDt1XHTRr7ZisS81HI oRJvBibpH2y9gGW0Ivvm4aLHVNmL2kZOGjpoXW3PfCBheNs8qeoyB4K39Pl9 jZcrzzpe4gzP4oaKfSnJoNRZeGi7GY_DV9KuvoqcKhrZFBWe_dZ7wIRsc7Zr 3xdCHKqQhE364_PBMQZ3c22R.ipIr7nYLICOWVIHvBVmb6DqGNqE9BoVApE2 hU3Hj0.qvxA2cECT3Bodg7p7VvGA9mgg4c2jqdCQRkmNLEnNyJaIeyjws5G_ XOhReApCMad3sSizzx.P3KiZQ8Yutq2k-
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4D4C3C95.2000701@caucho.com>
Date: Fri, 04 Feb 2011 09:51:17 -0800
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: Julian Reschke <julian.reschke@gmx.de>
References: <4D394B51.2060105@ericsson.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D43D80B.7010903@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D498DB8.703@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D49BA55.3050808@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <4D4BD2FB.7060900@gmx.de>
In-Reply-To: <4D4BD2FB.7060900@gmx.de>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2011 17:47:57 -0000

Julian Reschke wrote:
> On 03.02.2011 20:56, Scott Ferguson wrote:
>
> I'm not totally convinced that we can't use OPTIONS.
>
> If we *do* define a new method, we should be clear on its semantics 
> (independently of Websockets) and other properties (safe, idempotent, 
> cacheability).
>
> "UPGRADE" seems to be a poor choice, because what causes the upgrade 
> is the header, not the method.
That's a good point. Paul's point of identifying the protocol by the 
first bytes is good as well.
>
> So, if the method really is a No-Op designed just to carry the Upgrade 
> header, then maybe it should be called "NOP".
>
> Also note:
>
> "HTTP methods are generic; that is, they are potentially applicable to 
> any resource, not just one particular media type, "type" of resource, 
> or application. As such, it is preferred that new HTTP methods be 
> registered in a document that isn't specific to a single application, 
> so that this is clear." -- 
> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-12.html#rfc.section.2.1.1.p.2> 
>

Right, but it's not a media/resource type we're defining. It's an 
entirely different framing protocol:

  GET - unidirectional/cacheable (media-typed) byte array using 
chunked/content-length framing

  POST - request/response pair of (media-typed) byte arrays using 
chunked/content-length framing

  WEBSOCKET - the websocket framing, which is unrelated to either of the 
above.

  OPTIONS - entirely different concept (primarily metadata, not framed 
payload)

To Paul's point, if there was a FooBar protocol with a new framing 
protocol (using upgrade), then it would be logical to have a FOOBAR method.

  UPGRADE - doesn't identify the framing protocol, but does say that 
it's not HTTP framing

  TUNNEL - unframed TCP

(I'm okay with any of the above, just putting out why a WEBSOCKET method 
would make sense.)

-- Scott

>
> (note that's an ID only so the HTTPbis WG is looking for feedback on 
> this)
>
> BR, Julian
>
>
>


From julian.reschke@gmx.de  Fri Feb  4 09:56:27 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CDAD3A6968 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 09:56:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.157
X-Spam-Level: 
X-Spam-Status: No, score=-104.157 tagged_above=-999 required=5 tests=[AWL=-1.558, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AhW7VfRXwaho for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 09:56:27 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id 74FFF3A693C for <hybi@ietf.org>; Fri,  4 Feb 2011 09:56:26 -0800 (PST)
Received: (qmail invoked by alias); 04 Feb 2011 17:59:50 -0000
Received: from mail.greenbytes.de (EHLO [192.168.1.134]) [217.91.35.233] by mail.gmx.net (mp039) with SMTP; 04 Feb 2011 18:59:50 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX18gz8Io7Y8g24P/B7sjI2EwJaYhxiSX5VugJrhilU ImQb35fEjfe04h
Message-ID: <4D4C3E90.9010907@gmx.de>
Date: Fri, 04 Feb 2011 18:59:44 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Paul Colomiets <tailhook@yandex.ua>
References: <4D394B51.2060105@ericsson.com> <547161296816445@web25.yandex.ru>
In-Reply-To: <547161296816445@web25.yandex.ru>
Content-Type: text/plain; charset=KOI8-R; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2011 17:56:27 -0000

On 04.02.2011 11:47, Paul Colomiets wrote:
> Hi,
>
> I would prefer WEBSOCKET (or maybe other new method), because:
>   1. It's easier to reason that it's websocket by first few bytes, it's probably important
>      for those serving multiple protocols on single connection, but not real HTTP

Wait, you still need to be able to parse the request message properly; 
otherwise, how do you get the Upgrade header???

>   2. It's easier to make that pluggable in some servers. If you want to make plugin
>      for OPTIONS, and some other plugin will need to plug into OPTIONS (e.g. WebDAV),
>      the plugin system logic would be much more complicated

On the other hand, by that reasoning, any new protocol we want to 
upgrade to would require a new method. Not convinced.

> ...

Best regards, Julian

From mcmanus@ducksong.com  Fri Feb  4 13:44:43 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7D543A69D4 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 13:44:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.551
X-Spam-Level: 
X-Spam-Status: No, score=-2.551 tagged_above=-999 required=5 tests=[AWL=0.048,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bt1Hx3WWIZR3 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 13:44:42 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id ABE223A67F2 for <hybi@ietf.org>; Fri,  4 Feb 2011 13:44:42 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 1829710305; Fri,  4 Feb 2011 16:48:08 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 350BF101F6 for <hybi@ietf.org>; Fri,  4 Feb 2011 16:48:03 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: "hybi@ietf.org" <hybi@ietf.org>
In-Reply-To: <4D4C3C95.2000701@caucho.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <4D4BD2FB.7060900@gmx.de>  <4D4C3C95.2000701@caucho.com>
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 04 Feb 2011 16:48:01 -0500
Message-ID: <1296856081.2403.23.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Subject: [hybi] websocket methods - both http and procedural
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2011 21:44:43 -0000

Hello All,

We are drifting dangerously close to bike shedding with this method
discussion. Does anyone feel really strongly that this is important for
websockets? I have heard a lot of divergent opinions, but I haven't
heard anyone argue that this is really fundamental. I think we're better
served by moving the process along - I certainly have preferences but
stalemating over this detail is completely not worth effectively
stalling interop for WS longer.

What do WG members think if we try and refocus and have a draft with the
remaining significant undecided issues settled before IETF-80 (probably
mid-March to meet submission deadlines)? That revision would probably
still not be ready for last call - but maybe it could have just one more
editorial iteration to get it there afterwards.

The punchlist of outstanding issues of substance is pretty short - I
encourage the chairs to share their version but I think the point where
the technology was significantly benefiting from lots of discussion and
diverse view points (which it definitely has) has passed us by. Not much
new is entering the arena. Perhaps we can, once we see the list, have
consensus that for expediency resolving the individual items on the list
shouldn't all require consensus themselves due to lack of overall
impact.

-Patrick

-- 
http://www.getfirefox.com/



From Gabriel.Montenegro@microsoft.com  Fri Feb  4 13:52:50 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 906A03A69D3 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 13:52:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.539
X-Spam-Level: 
X-Spam-Status: No, score=-10.539 tagged_above=-999 required=5 tests=[AWL=0.060, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aI61SGzQNUGC for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 13:52:49 -0800 (PST)
Received: from smtp.microsoft.com (smtp.microsoft.com [131.107.115.215]) by core3.amsl.com (Postfix) with ESMTP id 301153A69EE for <hybi@ietf.org>; Fri,  4 Feb 2011 13:52:49 -0800 (PST)
Received: from TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) by TK5-EXGWY-E802.partners.extranet.microsoft.com (10.251.56.168) with Microsoft SMTP Server (TLS) id 8.2.176.0; Fri, 4 Feb 2011 13:56:10 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) with Microsoft SMTP Server (TLS) id 14.1.270.2; Fri, 4 Feb 2011 13:56:10 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Fri, 4 Feb 2011 13:56:09 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>, "hybi@ietf.org" <hybi@ietf.org>
Thread-Topic: [hybi] websocket methods - both http and procedural
Thread-Index: AQHLxLVKPocZ0r+kIEinW+Ago4v2PJPx4Ysg
Date: Fri, 4 Feb 2011 21:56:09 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DF4493@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <4D4BD2FB.7060900@gmx.de>  <4D4C3C95.2000701@caucho.com> <1296856081.2403.23.camel@ds9.ducksong.com>
In-Reply-To: <1296856081.2403.23.camel@ds9.ducksong.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [hybi] websocket methods - both http and procedural
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2011 21:52:50 -0000

+1 !

There are other issues (listed in the issue tracker), but none are earth sh=
attering, and I agree that neither is this one about the choice of method. =
I'd be happy with the status quo of method and moving on.

I was expecting rev 05 much sooner. My impression/hope is that it was going=
 to be available within the next week or so ("early Feb").

Thanks for raising this, Patrick.

> -----Original Message-----
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of P=
at
> McManus @Mozilla
> Sent: Friday, February 04, 2011 13:48
> To: hybi@ietf.org
> Subject: [hybi] websocket methods - both http and procedural
>=20
> Hello All,
>=20
> We are drifting dangerously close to bike shedding with this method discu=
ssion.
> Does anyone feel really strongly that this is important for websockets? I=
 have
> heard a lot of divergent opinions, but I haven't heard anyone argue that =
this is
> really fundamental. I think we're better served by moving the process alo=
ng - I
> certainly have preferences but stalemating over this detail is completely=
 not
> worth effectively stalling interop for WS longer.
>=20
> What do WG members think if we try and refocus and have a draft with the
> remaining significant undecided issues settled before IETF-80 (probably m=
id-
> March to meet submission deadlines)? That revision would probably still n=
ot be
> ready for last call - but maybe it could have just one more editorial ite=
ration to
> get it there afterwards.
>=20
> The punchlist of outstanding issues of substance is pretty short - I enco=
urage the
> chairs to share their version but I think the point where the technology =
was
> significantly benefiting from lots of discussion and diverse view points =
(which it
> definitely has) has passed us by. Not much new is entering the arena. Per=
haps
> we can, once we see the list, have consensus that for expediency resolvin=
g the
> individual items on the list shouldn't all require consensus themselves d=
ue to lack
> of overall impact.
>=20
> -Patrick
>=20
> --
> http://www.getfirefox.com/
>=20
>=20
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi


From buskanaka@gmail.com  Fri Feb  4 16:15:14 2011
Return-Path: <buskanaka@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 16AEB3A6A37 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 16:15:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.976
X-Spam-Level: 
X-Spam-Status: No, score=-2.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n2TcLiQHkS5T for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 16:15:13 -0800 (PST)
Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by core3.amsl.com (Postfix) with ESMTP id 1F2BC3A69F7 for <hybi@ietf.org>; Fri,  4 Feb 2011 16:15:12 -0800 (PST)
Received: by eyd10 with SMTP id 10so1698554eyd.31 for <hybi@ietf.org>; Fri, 04 Feb 2011 16:18:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:in-reply-to:references:from :date:x-google-sender-auth:message-id:subject:to:cc:content-type; bh=pwMTNM9VSFxpWBs/RyaDofcv6eL4hXDyjJqk2vFtZ8o=; b=URpJi6TCtPaijDY538Clrnuz2rRIPMBzCKTx5KCBDgsDwvC2tielk9cK8nc8FJ4VW1 aLgZ2pHcX4Wnh+zuP67V+4xyfza7+8oDyePnSZUsxVJU5UHMhkeauf3IKhQcGhhRsnjq zRuKWZvQkICUxMw/BYmAO+wuZgwqM25YvfLQQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type; b=jYjZrTbBFV1QoTZCcX2ANRitsbfEmx9sGo4AqcXIv75v0eSR3jkXcEuODIbdMLWxAt sJWG+C1UC4YAO7wALLvn38G+gburW956213kFvL5bzA9PkUrt7lG9NAGNoLXmEftBP1O cCWxETtabv1ayiiBllrsRenhv300ZwI+Rc71I=
Received: by 10.14.11.232 with SMTP id 80mr2341641eex.12.1296865118646; Fri, 04 Feb 2011 16:18:38 -0800 (PST)
MIME-Version: 1.0
Sender: buskanaka@gmail.com
Received: by 10.14.119.136 with HTTP; Fri, 4 Feb 2011 16:18:18 -0800 (PST)
In-Reply-To: <4D394B51.2060105@ericsson.com>
References: <4D394B51.2060105@ericsson.com>
From: Joel Martin <hybi@martintribe.org>
Date: Fri, 4 Feb 2011 18:18:18 -0600
X-Google-Sender-Auth: OBpHpCD5oV5rUFQM8PFmPp6Rd5g
Message-ID: <AANLkTi=G9tUnqaT_yxhN2Kn--f+=DQ82Lggi_YDPv1Ek@mail.gmail.com>
To: Salvatore Loreto <salvatore.loreto@ericsson.com>
Content-Type: multipart/alternative; boundary=0016364d20b3b7f333049b7df055
Cc: "hybi@ietf.org" <hybi@ietf.org>, SM <sm+ietf@elandsys.com>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Feb 2011 00:15:14 -0000

--0016364d20b3b7f333049b7df055
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Jan 21, 2011 at 3:01 AM, Salvatore Loreto <
salvatore.loreto@ericsson.com> wrote:

>
> #1 - GET
> #2 - OPTIONS
> #3 - a complete new method (e.g. WEBSOCKET)
>
> This poll will run until January 31st
>

Sal, do we have a count on this since it's officially over? I have feeling
that there wasn't general consensus on this straw poll, although I haven't
been following the counts closely. I do have the general impression that
most people who have expressed an opinion are willing to move forward even
if the choice is not their "favorite" and that this isn't a show-stopper for
anyone.

Joel Martin

--0016364d20b3b7f333049b7df055
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div><div><div class=3D"gmail_quote">On Fri, Jan 21, 2011 at 3:01 AM, Salva=
tore Loreto <span dir=3D"ltr">&lt;<a href=3D"mailto:salvatore.loreto@ericss=
on.com">salvatore.loreto@ericsson.com</a>&gt;</span> wrote:<br><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex;">

<br>
#1 - GET<br>
#2 - OPTIONS<br>
#3 - a complete new method (e.g. WEBSOCKET)<br>
<br>
This poll will run until January 31st<br></blockquote><div><br></div><div>S=
al, do we have a count on this since it&#39;s officially over? I have feeli=
ng that there wasn&#39;t general consensus on this straw poll, although I h=
aven&#39;t been following the counts closely. I do have the general impress=
ion that most people who have expressed an opinion are willing to move forw=
ard even if the choice is not their &quot;favorite&quot; and that this isn&=
#39;t a show-stopper for anyone.</div>

<div><br></div><div>Joel Martin</div></div></div></div>

--0016364d20b3b7f333049b7df055--

From tailhook@yandex.ru  Fri Feb  4 16:27:27 2011
Return-Path: <tailhook@yandex.ru>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 474983A69DC for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 16:27:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.459
X-Spam-Level: 
X-Spam-Status: No, score=0.459 tagged_above=-999 required=5 tests=[AWL=0.608,  BAYES_00=-2.599, MIME_CHARSET_FARAWAY=2.45]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yAEu2-QaGGHI for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 16:27:24 -0800 (PST)
Received: from forward16.mail.yandex.net (forward16.mail.yandex.net [95.108.253.141]) by core3.amsl.com (Postfix) with ESMTP id 5B7F33A67D1 for <hybi@ietf.org>; Fri,  4 Feb 2011 16:27:24 -0800 (PST)
Received: from web16.yandex.ru (web16.yandex.ru [95.108.252.116]) by forward16.mail.yandex.net (Yandex) with ESMTP id 50A0D23A8283 for <hybi@ietf.org>; Sat,  5 Feb 2011 03:30:49 +0300 (MSK)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1296865849; bh=XaABcT8KE0KndVYwnUJbIdVoVKZV6YHi/NU39AqqEAo=; h=From:To:In-Reply-To:References:Subject:MIME-Version:Message-Id: Date:Content-Transfer-Encoding:Content-Type; b=pG2BjEM5QT9J9fPPx1Ns8iHNV3/eNY3nd/KsqWUThq8byKti0C+WvB2M5CQJWZpU8 tjyg0TA6GCpweoDdwhLsRWmFwlbzfQtfFwGFLd3YszvMwpBgKeb6FbVlxI2+LlC5+V C+ZJQz595OfXGdOHR6OgczI1mYU6fxw8n+E7fOBk=
Received: from localhost (localhost.localdomain [127.0.0.1]) by web16.yandex.ru (Yandex) with ESMTP id 09F9E11A8006 for <hybi@ietf.org>; Sat,  5 Feb 2011 03:30:48 +0300 (MSK)
Received: from pptp-dm2008070092.domashka.kiev.ua (pptp-dm2008070092.domashka.kiev.ua [91.203.48.31]) by mail.yandex.ru with HTTP; Sat, 05 Feb 2011 03:30:48 +0300
From: Paul Colomiets <tailhook@yandex.ua>
Envelope-From: tailhook@yandex.ru
To: hybi@ietf.org
In-Reply-To: <4D4C3E90.9010907@gmx.de>
References: <4D394B51.2060105@ericsson.com> <547161296816445@web25.yandex.ru> <4D4C3E90.9010907@gmx.de>
MIME-Version: 1.0
Message-Id: <772991296865848@web16.yandex.ru>
Date: Sat, 05 Feb 2011 02:30:48 +0200
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=koi8-r
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Feb 2011 00:27:27 -0000

04.02.2011, 19:59, "Julian Reschke" <julian.reschke@gmx.de>:
> On 04.02.2011 11:47, Paul Colomiets wrote:
>
>> šHi,
>>
>> šI would prefer WEBSOCKET (or maybe other new method), because:
>> ššš1. It's easier to reason that it's websocket by first few bytes, it's probably important
>> ššššššfor those serving multiple protocols on single connection, but not real HTTP
>
> Wait, you still need to be able to parse the request message properly;
> otherwise, how do you get the Upgrade header???

Yes, but I can switch to the HTTP protocol parser as fast as I see the first few bytes,
and I already know that it's not STOMP or XMLSocket, or XMPP or whatever I should
support. Otherwise I should use HTTP parser as a fallback, which is much less clear
approach.

>
>> ššš2. It's easier to make that pluggable in some servers. If you want to make plugin
>> ššššššfor OPTIONS, and some other plugin will need to plug into OPTIONS (e.g. WebDAV),
>> ššššššthe plugin system logic would be much more complicated
>
> On the other hand, by that reasoning, any new protocol we want to
> upgrade to would require a new method. Not convinced.
Not exactly. If we would upgrade to HTTP/2.0 or Waka or whatever for which method
name matters we should not. Also if we could get some meaningful answer when server
is unable to connect, we should reuse existing method. And all these are not true for
websockets.

--
Paul

From bruce@callenish.com  Fri Feb  4 18:33:17 2011
Return-Path: <bruce@callenish.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A9BD43A6AC2 for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 18:33:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.436
X-Spam-Level: 
X-Spam-Status: No, score=-1.436 tagged_above=-999 required=5 tests=[AWL=-1.137, BAYES_00=-2.599, MANGLED_TOOL=2.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B8g7Sm6-uJlx for <hybi@core3.amsl.com>; Fri,  4 Feb 2011 18:33:16 -0800 (PST)
Received: from biz82.inmotionhosting.com (biz82.inmotionhosting.com [74.124.202.87]) by core3.amsl.com (Postfix) with ESMTP id C257B3A6AC1 for <hybi@ietf.org>; Fri,  4 Feb 2011 18:33:16 -0800 (PST)
Received: from [24.108.133.142] (helo=[192.168.145.101]) by biz82.inmotionhosting.com with esmtpa (Exim 4.69) (envelope-from <bruce@callenish.com>) id 1PlY0v-0003L7-TJ for hybi@ietf.org; Fri, 04 Feb 2011 18:36:42 -0800
Message-ID: <4D4CB7BD.80309@callenish.com>
Date: Fri, 04 Feb 2011 18:36:45 -0800
From: Bruce Atherton <bruce@callenish.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: "hybi@ietf.org" <hybi@ietf.org>
References: <4D394B51.2060105@ericsson.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D43D80B.7010903@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D498DB8.703@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<4D49BA55.3050808@gmx.de>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<20110203055827.GB18511@1wt.eu> <BB31C4AB95A70042A256109D46199126060681F6@XCH117CNC.rim.net>
In-Reply-To: <BB31C4AB95A70042A256109D46199126060681F6@XCH117CNC.rim.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - biz82.inmotionhosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - callenish.com
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Feb 2011 02:33:17 -0000

Should the method be something more like MESSAGE or MESSAGING or 
something similar?

Considering that what we are doing is requesting a messaging channel. 
Purely a bikeshed suggestion, but you have to paint the shed some colour.

On 03/02/2011 2:13 PM, Joe Mason wrote:
>> -----Original Message-----
>> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
>> Willy Tarreau
>>
>> Also, if we create a new method because we did not find one which
>> matches
>> our needs, maybe we should be less selfish and not call it WEBSOCKET.
>> After
>> all, if we're forced to create another new method, it's precisely
>> because
>> we did not find the perfect one among existing ones. It would be stupid
>> that another WG in 5 years has the exact same requirement and has to
>> use
>> WEBSOCKET for another purpose because of its semantics. What we need is
>> just something that upgrades the connection to a tunnel. We could very
>> well call it TUNNEL or UPGRADE. At least, the last one clearly implies
>> what the method is intended for and other projects will be able to use
>> it too.
> +1
>
> Still not convinced on the need or desirability of a new method, but if we do use one it should be descriptive of what the method does, not what protocol it's used in.
>
> Joe
>
>
> ---------------------------------------------------------------------
> This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi


From julian.reschke@gmx.de  Sat Feb  5 02:34:41 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 769BA3A68A8 for <hybi@core3.amsl.com>; Sat,  5 Feb 2011 02:34:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.804
X-Spam-Level: 
X-Spam-Status: No, score=-103.804 tagged_above=-999 required=5 tests=[AWL=-1.205, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1ZXX+BnFZ6Bw for <hybi@core3.amsl.com>; Sat,  5 Feb 2011 02:34:40 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 0E2653A68AD for <hybi@ietf.org>; Sat,  5 Feb 2011 02:34:39 -0800 (PST)
Received: (qmail invoked by alias); 05 Feb 2011 10:38:03 -0000
Received: from p508FC73A.dip.t-dialin.net (EHLO [192.168.178.33]) [80.143.199.58] by mail.gmx.net (mp058) with SMTP; 05 Feb 2011 11:38:03 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX182bGMrJuY2RDwUAeiD3CKDX76hvIHlLKaCyH9Eto NWeP5FlVqxREtj
Message-ID: <4D4D2880.5000607@gmx.de>
Date: Sat, 05 Feb 2011 11:37:52 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Paul Colomiets <tailhook@yandex.ua>
References: <4D394B51.2060105@ericsson.com> <547161296816445@web25.yandex.ru>	<4D4C3E90.9010907@gmx.de> <772991296865848@web16.yandex.ru>
In-Reply-To: <772991296865848@web16.yandex.ru>
Content-Type: text/plain; charset=KOI8-R; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Feb 2011 10:34:41 -0000

On 05.02.2011 01:30, Paul Colomiets wrote:
>
>
> 04.02.2011, 19:59, "Julian Reschke"<julian.reschke@gmx.de>:
>> On 04.02.2011 11:47, Paul Colomiets wrote:
>>
>>>   Hi,
>>>
>>>   I would prefer WEBSOCKET (or maybe other new method), because:
>>>     1. It's easier to reason that it's websocket by first few bytes, it's probably important
>>>        for those serving multiple protocols on single connection, but not real HTTP
>>
>> Wait, you still need to be able to parse the request message properly;
>> otherwise, how do you get the Upgrade header???
>
> Yes, but I can switch to the HTTP protocol parser as fast as I see the first few bytes,
> and I already know that it's not STOMP or XMLSocket, or XMPP or whatever I should
> support. Otherwise I should use HTTP parser as a fallback, which is much less clear
> approach.

So you'd not use the HTTP parser when the method is unknown. Let's say 
it's PATCH. What do you do with it instead?

>>>     2. It's easier to make that pluggable in some servers. If you want to make plugin
>>>        for OPTIONS, and some other plugin will need to plug into OPTIONS (e.g. WebDAV),
>>>        the plugin system logic would be much more complicated
>>
>> On the other hand, by that reasoning, any new protocol we want to
>> upgrade to would require a new method. Not convinced.
> Not exactly. If we would upgrade to HTTP/2.0 or Waka or whatever for which method
> name matters we should not. Also if we could get some meaningful answer when server
> is unable to connect, we should reuse existing method. And all these are not true for
> websockets.

I'm not sure I understand the distinction.

Best regards, Julian

From jamie@shareable.org  Sat Feb  5 02:47:14 2011
Return-Path: <jamie@shareable.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 620BE3A69AE for <hybi@core3.amsl.com>; Sat,  5 Feb 2011 02:47:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.615
X-Spam-Level: 
X-Spam-Status: No, score=-2.615 tagged_above=-999 required=5 tests=[AWL=-0.016, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Qlg5PGvhL6Z for <hybi@core3.amsl.com>; Sat,  5 Feb 2011 02:47:13 -0800 (PST)
Received: from mail2.shareable.org (mail2.shareable.org [80.68.89.115]) by core3.amsl.com (Postfix) with ESMTP id 870313A68A8 for <hybi@ietf.org>; Sat,  5 Feb 2011 02:47:13 -0800 (PST)
Received: from jamie by mail2.shareable.org with local (Exim 4.63) (envelope-from <jamie@shareable.org>) id 1Plfix-0000XG-OV; Sat, 05 Feb 2011 10:50:39 +0000
Date: Sat, 5 Feb 2011 10:50:39 +0000
From: Jamie Lokier <jamie@shareable.org>
To: Greg Wilkins <gregw@webtide.com>
Message-ID: <20110205105039.GA5238@shareable.org>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <AANLkTin=0D6vNs+FgYCfa8TD26umkG8HEBpgRNR8F=s+@mail.gmail.com> <pctjk6pn6g3v6top045nrvcg53u3sfu08i@hive.bjoern.hoehrmann.de> <AANLkTin6mmC4oTAD6tFYHMzs2Q6u=ZL7rTUzDa-PX1ze@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTin6mmC4oTAD6tFYHMzs2Q6u=ZL7rTUzDa-PX1ze@mail.gmail.com>
User-Agent: Mutt/1.5.13 (2006-08-11)
Cc: "hybi@ietf.org" <hybi@ietf.org>, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Feb 2011 10:47:14 -0000

Greg Wilkins wrote:
> On 3 February 2011 11:48, Bjoern Hoehrmann <derhoermi@gmx.net> wrote:
> > * Ian Fette wrote:
> 
> > It's just a straw poll, and the Working Group does not seem to lean in
> > any particular direction; that leaves us somewhere between "this does
> > not seem to matter much" and "more discussion is needed".
> 
> Which matches perfectly one of the options:  Make the handshake work
> with any method with a note saying the client should expect a non WS
> return if the path and/or server does not support WS.
> 
> Of course the browsers will still have to make a choice of a method,
> but they could experiment with a few methods and then choose the best
> one without needing to have the servers and intermediaries re
> implemented.

+1 - I agree.

-- Jamie

From tailhook@yandex.ru  Sat Feb  5 03:37:33 2011
Return-Path: <tailhook@yandex.ru>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C3D063A68E0 for <hybi@core3.amsl.com>; Sat,  5 Feb 2011 03:37:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.398
X-Spam-Level: 
X-Spam-Status: No, score=0.398 tagged_above=-999 required=5 tests=[AWL=0.547,  BAYES_00=-2.599, MIME_CHARSET_FARAWAY=2.45]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c1aM9aoFvd-O for <hybi@core3.amsl.com>; Sat,  5 Feb 2011 03:37:32 -0800 (PST)
Received: from forward2.mail.yandex.net (forward2.mail.yandex.net [77.88.46.7]) by core3.amsl.com (Postfix) with ESMTP id 5A1E63A68A8 for <hybi@ietf.org>; Sat,  5 Feb 2011 03:37:31 -0800 (PST)
Received: from web47.yandex.ru (web47.yandex.ru [77.88.47.186]) by forward2.mail.yandex.net (Yandex) with ESMTP id 17D3AA80066 for <hybi@ietf.org>; Sat,  5 Feb 2011 14:40:58 +0300 (MSK)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1296906058; bh=fH4QQPqoT1WDcc3cU9U+QV832kpfoj9vcMKJiA2vD7E=; h=From:To:In-Reply-To:References:Subject:MIME-Version:Message-Id: Date:Content-Transfer-Encoding:Content-Type; b=jnS6iPF/NkgdFaBRivxpnb7bMOHrA9msDnOkQXPpJzfXP9tpWQw5AcegnBhPErm9B tZqfLNchnnI2DJHOD9uWFJT+T8wqjMRu+agMsXNekiELagG9Ucn1v4N5AIbo2bYG1A wx/0yjLTSBmEw4BlW8jj7TBXpcqWZ2DXCY6ePDto=
Received: from localhost (localhost.localdomain [127.0.0.1]) by web47.yandex.ru (Yandex) with ESMTP id 0C367820059 for <hybi@ietf.org>; Sat,  5 Feb 2011 14:40:58 +0300 (MSK)
Received: from pptp-dm2008070092.domashka.kiev.ua (pptp-dm2008070092.domashka.kiev.ua [91.203.48.31]) by mail.yandex.ru with HTTP; Sat, 05 Feb 2011 14:40:57 +0300
From: Paul Colomiets <tailhook@yandex.ua>
Envelope-From: tailhook@yandex.ru
To: hybi@ietf.org
In-Reply-To: <4D4D2880.5000607@gmx.de>
References: <4D394B51.2060105@ericsson.com> <547161296816445@web25.yandex.ru>	<4D4C3E90.9010907@gmx.de> <772991296865848@web16.yandex.ru> <4D4D2880.5000607@gmx.de>
MIME-Version: 1.0
Message-Id: <296191296906057@web47.yandex.ru>
Date: Sat, 05 Feb 2011 13:40:57 +0200
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=koi8-r
Subject: Re: [hybi] straw-poll on GET vs OPTIONS vs new method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Feb 2011 11:37:33 -0000

05.02.2011, 12:37, "Julian Reschke" <julian.reschke@gmx.de>:
> On 05.02.2011 01:30, Paul Colomiets wrote:
>
>> š04.02.2011, 19:59, "Julian Reschke"<julian.reschke@gmx.de>;:
>>> šOn 04.02.2011 11:47, Paul Colomiets wrote:
>>>> šššHi,
>>>>
>>>> šššI would prefer WEBSOCKET (or maybe other new method), because:
>>>> ššššš1. It's easier to reason that it's websocket by first few bytes, it's probably important
>>>> ššššššššfor those serving multiple protocols on single connection, but not real HTTP
>>> šWait, you still need to be able to parse the request message properly;
>>> šotherwise, how do you get the Upgrade header???
>> šYes, but I can switch to the HTTP protocol parser as fast as I see the first few bytes,
>> šand I already know that it's not STOMP or XMLSocket, or XMPP or whatever I should
>> šsupport. Otherwise I should use HTTP parser as a fallback, which is much less clear
>> šapproach.
>
> So you'd not use the HTTP parser when the method is unknown. Let's say
> it's PATCH. What do you do with it instead?

Close connection, since this imaginary server does not work with HTTP.

>
>>>> ššššš2. It's easier to make that pluggable in some servers. If you want to make plugin
>>>> ššššššššfor OPTIONS, and some other plugin will need to plug into OPTIONS (e.g. WebDAV),
>>>> ššššššššthe plugin system logic would be much more complicated
>>> šOn the other hand, by that reasoning, any new protocol we want to
>>> šupgrade to would require a new method. Not convinced.
>> šNot exactly. If we would upgrade to HTTP/2.0 or Waka or whatever for which method
>> šname matters we should not. Also if we could get some meaningful answer when server
>> šis unable to connect, we should reuse existing method. And all these are not true for
>> šwebsockets.
>
> I'm not sure I understand the distinction.

Consider somebody invented binary http protocol. And your browser understands it.
It issues GET/POST or whatever request in plain-text, requesting upgrade. Then if remote
server does not speak http-binary it will send response to this GET or POST. From
programmer's point of view, probably backend gives frontend server a resource, and it doesn't
matter which protocol frontend will send it to the client, so that backend works on the
same protocol whether client support or imaginary http-binary or not.

So yes, the new methods should be invented for the new pattern of interaction with server.
So probably suggested MESSAGING will be better (UPGRADE or TUNNEL not exacly
match this intention)

--
Paul

From gregw@intalio.com  Sun Feb  6 17:38:17 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9968B3A6B14 for <hybi@core3.amsl.com>; Sun,  6 Feb 2011 17:38:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.563
X-Spam-Level: 
X-Spam-Status: No, score=-0.563 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r8OOwuFn0E9J for <hybi@core3.amsl.com>; Sun,  6 Feb 2011 17:38:16 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 9348F3A6A61 for <hybi@ietf.org>; Sun,  6 Feb 2011 17:38:16 -0800 (PST)
Received: by vws7 with SMTP id 7so2780167vws.31 for <hybi@ietf.org>; Sun, 06 Feb 2011 17:38:19 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.194.1 with SMTP id dw1mr4069240vcb.179.1297042698937; Sun, 06 Feb 2011 17:38:18 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.98.9 with HTTP; Sun, 6 Feb 2011 17:38:18 -0800 (PST)
In-Reply-To: <1296856081.2403.23.camel@ds9.ducksong.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <4D4BD2FB.7060900@gmx.de> <4D4C3C95.2000701@caucho.com> <1296856081.2403.23.camel@ds9.ducksong.com>
Date: Mon, 7 Feb 2011 12:38:18 +1100
X-Google-Sender-Auth: oooYoA71uVwSe_UniQ2ecr-kxmE
Message-ID: <AANLkTikzesYu0LYiS9WJ-jAsLJ+zeki2JS3BKfN+MTmZ@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] websocket methods - both http and procedural
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Feb 2011 01:38:17 -0000

+1

For me the main issues outstanding are:

 1. masked framing
 2. masking as an extension

From ifette@google.com  Sun Feb  6 22:40:47 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2F19B3A6CA1 for <hybi@core3.amsl.com>; Sun,  6 Feb 2011 22:40:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.187
X-Spam-Level: 
X-Spam-Status: No, score=-104.187 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GTO5JRXian0J for <hybi@core3.amsl.com>; Sun,  6 Feb 2011 22:40:20 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 8429F3A6A11 for <hybi@ietf.org>; Sun,  6 Feb 2011 22:40:13 -0800 (PST)
Received: from hpaq1.eem.corp.google.com (hpaq1.eem.corp.google.com [172.25.149.1]) by smtp-out.google.com with ESMTP id p176eFJr024486 for <hybi@ietf.org>; Sun, 6 Feb 2011 22:40:16 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297060816; bh=gFnvpVqjFxAyCX9x1Emr+cw0wO8=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=wwXAH6FKgL66cW2VYtS/r1IN4zdhBUWdShCvqu+zejDuG/g6znprxXtP6mjZ3cwN+ FxJgtDgsoqtPL3dAE3P6Q==
Received: from iwc10 (iwc10.prod.google.com [10.241.65.138]) by hpaq1.eem.corp.google.com with ESMTP id p176djrE016085 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for <hybi@ietf.org>; Sun, 6 Feb 2011 22:40:14 -0800
Received: by iwc10 with SMTP id 10so4464841iwc.17 for <hybi@ietf.org>; Sun, 06 Feb 2011 22:40:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=Zu59jqbfCZnD920guG+KZ31I9fsEh2H09crajHyHWBc=; b=j0VG6qZmyzp2+aK5GzFW1yJEwj8Yvt8TdiZdrWF2X++f/Lcaj7alPSIFTLzTp3vaVC Cxv03hV0m+VN7XdymPCg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=a2Kp4tIimEXln0UND1g/x38FJQ1vdPXjd1DX83divtd9ycMMHKpB3VPcS4EFFxFNr8 ORYI04z9pbTVvkJjrbwQ==
MIME-Version: 1.0
Received: by 10.231.182.5 with SMTP id ca5mr4358866ibb.144.1297060813661; Sun, 06 Feb 2011 22:40:13 -0800 (PST)
Received: by 10.231.13.66 with HTTP; Sun, 6 Feb 2011 22:40:13 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126DF4493@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <4D394B51.2060105@ericsson.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DDF08E@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D43D80B.7010903@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC040@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D498DB8.703@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DEC59B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <4D49BA55.3050808@gmx.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DECA67@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <20110203055827.GB18511@1wt.eu> <4D4B086B.7000901@caucho.com> <4D4BD2FB.7060900@gmx.de> <4D4C3C95.2000701@caucho.com> <1296856081.2403.23.camel@ds9.ducksong.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126DF4493@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
Date: Sun, 6 Feb 2011 22:40:13 -0800
Message-ID: <AANLkTik4W7pCrmAUZa8n-oO57Pzx8e9b2VfC7XAQ6Haj@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: multipart/alternative; boundary=0016367b679a0ce582049bab817c
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] websocket methods - both http and procedural
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Feb 2011 06:40:47 -0000

--0016367b679a0ce582049bab817c
Content-Type: text/plain; charset=UTF-8

I was holding off on -05 until getting the consensus call from the chairs on
the METHOD.

On Fri, Feb 4, 2011 at 1:56 PM, Gabriel Montenegro <
Gabriel.Montenegro@microsoft.com> wrote:

> +1 !
>
> There are other issues (listed in the issue tracker), but none are earth
> shattering, and I agree that neither is this one about the choice of method.
> I'd be happy with the status quo of method and moving on.
>
> I was expecting rev 05 much sooner. My impression/hope is that it was going
> to be available within the next week or so ("early Feb").
>
> Thanks for raising this, Patrick.
>
> > -----Original Message-----
> > From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Pat
> > McManus @Mozilla
> > Sent: Friday, February 04, 2011 13:48
> > To: hybi@ietf.org
> > Subject: [hybi] websocket methods - both http and procedural
> >
> > Hello All,
> >
> > We are drifting dangerously close to bike shedding with this method
> discussion.
> > Does anyone feel really strongly that this is important for websockets? I
> have
> > heard a lot of divergent opinions, but I haven't heard anyone argue that
> this is
> > really fundamental. I think we're better served by moving the process
> along - I
> > certainly have preferences but stalemating over this detail is completely
> not
> > worth effectively stalling interop for WS longer.
> >
> > What do WG members think if we try and refocus and have a draft with the
> > remaining significant undecided issues settled before IETF-80 (probably
> mid-
> > March to meet submission deadlines)? That revision would probably still
> not be
> > ready for last call - but maybe it could have just one more editorial
> iteration to
> > get it there afterwards.
> >
> > The punchlist of outstanding issues of substance is pretty short - I
> encourage the
> > chairs to share their version but I think the point where the technology
> was
> > significantly benefiting from lots of discussion and diverse view points
> (which it
> > definitely has) has passed us by. Not much new is entering the arena.
> Perhaps
> > we can, once we see the list, have consensus that for expediency
> resolving the
> > individual items on the list shouldn't all require consensus themselves
> due to lack
> > of overall impact.
> >
> > -Patrick
> >
> > --
> > http://www.getfirefox.com/
> >
> >
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--0016367b679a0ce582049bab817c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I was holding off on -05 until getting the consensus call from the chairs o=
n the METHOD.=C2=A0<br><br><div class=3D"gmail_quote">On Fri, Feb 4, 2011 a=
t 1:56 PM, Gabriel Montenegro <span dir=3D"ltr">&lt;<a href=3D"mailto:Gabri=
el.Montenegro@microsoft.com">Gabriel.Montenegro@microsoft.com</a>&gt;</span=
> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">+1 !<br>
<br>
There are other issues (listed in the issue tracker), but none are earth sh=
attering, and I agree that neither is this one about the choice of method. =
I&#39;d be happy with the status quo of method and moving on.<br>
<br>
I was expecting rev 05 much sooner. My impression/hope is that it was going=
 to be available within the next week or so (&quot;early Feb&quot;).<br>
<br>
Thanks for raising this, Patrick.<br>
<div><div></div><div class=3D"h5"><br>
&gt; -----Original Message-----<br>
&gt; From: <a href=3D"mailto:hybi-bounces@ietf.org">hybi-bounces@ietf.org</=
a> [mailto:<a href=3D"mailto:hybi-bounces@ietf.org">hybi-bounces@ietf.org</=
a>] On Behalf Of Pat<br>
&gt; McManus @Mozilla<br>
&gt; Sent: Friday, February 04, 2011 13:48<br>
&gt; To: <a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
&gt; Subject: [hybi] websocket methods - both http and procedural<br>
&gt;<br>
&gt; Hello All,<br>
&gt;<br>
&gt; We are drifting dangerously close to bike shedding with this method di=
scussion.<br>
&gt; Does anyone feel really strongly that this is important for websockets=
? I have<br>
&gt; heard a lot of divergent opinions, but I haven&#39;t heard anyone argu=
e that this is<br>
&gt; really fundamental. I think we&#39;re better served by moving the proc=
ess along - I<br>
&gt; certainly have preferences but stalemating over this detail is complet=
ely not<br>
&gt; worth effectively stalling interop for WS longer.<br>
&gt;<br>
&gt; What do WG members think if we try and refocus and have a draft with t=
he<br>
&gt; remaining significant undecided issues settled before IETF-80 (probabl=
y mid-<br>
&gt; March to meet submission deadlines)? That revision would probably stil=
l not be<br>
&gt; ready for last call - but maybe it could have just one more editorial =
iteration to<br>
&gt; get it there afterwards.<br>
&gt;<br>
&gt; The punchlist of outstanding issues of substance is pretty short - I e=
ncourage the<br>
&gt; chairs to share their version but I think the point where the technolo=
gy was<br>
&gt; significantly benefiting from lots of discussion and diverse view poin=
ts (which it<br>
&gt; definitely has) has passed us by. Not much new is entering the arena. =
Perhaps<br>
&gt; we can, once we see the list, have consensus that for expediency resol=
ving the<br>
&gt; individual items on the list shouldn&#39;t all require consensus thems=
elves due to lack<br>
&gt; of overall impact.<br>
&gt;<br>
&gt; -Patrick<br>
&gt;<br>
&gt; --<br>
&gt; <a href=3D"http://www.getfirefox.com/" target=3D"_blank">http://www.ge=
tfirefox.com/</a><br>
&gt;<br>
&gt;<br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; <a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blan=
k">https://www.ietf.org/mailman/listinfo/hybi</a><br>
<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--0016367b679a0ce582049bab817c--

From salvatore.loreto@ericsson.com  Mon Feb  7 02:00:04 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7C3023A6D8B for <hybi@core3.amsl.com>; Mon,  7 Feb 2011 02:00:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level: 
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Rrhnk0tSDsO for <hybi@core3.amsl.com>; Mon,  7 Feb 2011 02:00:03 -0800 (PST)
Received: from mailgw10.se.ericsson.net (mailgw10.se.ericsson.net [193.180.251.61]) by core3.amsl.com (Postfix) with ESMTP id 3EDF13A6D87 for <hybi@ietf.org>; Mon,  7 Feb 2011 02:00:03 -0800 (PST)
X-AuditID: c1b4fb3d-b7b89ae0000036a3-e8-4d4fc2a68f94
Received: from esessmw0184.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw10.se.ericsson.net (Symantec Mail Security) with SMTP id 36.66.13987.6A2CF4D4; Mon,  7 Feb 2011 11:00:06 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0184.eemea.ericsson.se (153.88.115.82) with Microsoft SMTP Server id 8.2.234.1; Mon, 7 Feb 2011 11:00:05 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id 91F5B2A6F; Mon,  7 Feb 2011 12:00:05 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 5C51B5072D; Mon,  7 Feb 2011 12:00:05 +0200 (EET)
Received: from Salvatore-Loretos-MacBook-Pro.local (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id AFB8350679; Mon,  7 Feb 2011 12:00:04 +0200 (EET)
Message-ID: <4D4FC2A4.6090204@ericsson.com>
Date: Mon, 7 Feb 2011 11:00:04 +0100
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: "hybi@ietf.org" <hybi@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, SM <sm+ietf@elandsys.com>
Subject: [hybi] considerations on strawpoll GET vs OPTIONS vs new Method
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Feb 2011 10:00:04 -0000

Hi there,

Joe and I, as chairs, haven't seen emerging any significant consensus 
from this straw-poll;
so we suggest to move forward with no change of method for the upcoming 
05 version,
keeping GET as method for the handshake,
as its behavior in the WebSocket handshake has been largely tested in 
the field
and it is now well know for better and worse.

However we want make clear that the choice of method can change, in a 
next version,
once we have a more clear evidence of the fact that a different method
(e.g. OPTIONS or a brand new one) has a better success rate and less 
side effect that GET

Folks interested to promote a different method are invited to work (in 
parallel) on experimenting
and collecting data to share within the HyBi community.
At moment we don't have any real data to evaluate the success rate of 
OPTIONS as well as
its actual behavior as method for the handshake while interacting with 
the deployed intermediaries;
moreover the discussion triggered by the strawpoll has let emerge some 
side effects that folks
had not thought before.

With respect to defining a completely new method (e.g. WEBSOCKET),
including all of the implied semantics, we would need to coordinate with
(or delegate to) HTTPbis for the necessary expertise, particularly 
considering the
potential for unexpected behavior from the intermediaries that are 
having problems
with the existing methods.

Those interested in working in parallel on defining a new method are 
invited to produce
new I-Ds to describe their ideas;
those I-Ds should provide analysis of how the method is likely to deploy 
in the wild.

cheers
Sal

-- 
Salvatore Loreto
www.sloreto.com


From trac@tools.ietf.org  Tue Feb  8 08:56:03 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 24D1D3A67D7 for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 08:56:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.6
X-Spam-Level: 
X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i403bsHSwl1G for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 08:56:02 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 692193A679F for <hybi@ietf.org>; Tue,  8 Feb 2011 08:56:02 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PmqrE-0003Nf-JJ; Tue, 08 Feb 2011 08:56:04 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: g_e_montenegro@yahoo.com, ifette@google.com
X-Trac-Project: hybi
Date: Tue, 08 Feb 2011 16:56:04 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: https://wiki.tools.ietf.org/wg/hybi/trac/ticket/34#comment:2
Message-ID: <072.cae4b5fa90b8568ea20d51061e9a87ee@tools.ietf.org>
References: <063.9dad946fb744931897763f85a2d66a89@tools.ietf.org>
X-Trac-Ticket-ID: 34
In-Reply-To: <063.9dad946fb744931897763f85a2d66a89@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: g_e_montenegro@yahoo.com, ifette@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #34 (closed): Clarify Close processing
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Feb 2011 16:56:03 -0000

#34: Clarify Close processing

Changes (by ifette@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 I have addressed this in r55 of the protocol in svn, which will be
 included in -05.

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |        Owner:        
     Type:  defect                    |       Status:  closed
 Priority:  major                     |    Milestone:        
Component:  thewebsocketprotocol      |      Version:        
 Severity:  -                         |   Resolution:  fixed 
 Keywords:                            |  
--------------------------------------+-------------------------------------

Ticket URL: <https://wiki.tools.ietf.org/wg/hybi/trac/ticket/34#comment:2>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Tue Feb  8 09:24:24 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E52C3A681A for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 09:24:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.6
X-Spam-Level: 
X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pBRmzS9LS1L8 for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 09:24:23 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 747B03A6818 for <hybi@ietf.org>; Tue,  8 Feb 2011 09:24:23 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PmrIi-0002KK-8g; Tue, 08 Feb 2011 09:24:28 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: g_e_montenegro@yahoo.com, ifette@google.com
X-Trac-Project: hybi
Date: Tue, 08 Feb 2011 17:24:28 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: https://wiki.tools.ietf.org/wg/hybi/trac/ticket/32#comment:2
Message-ID: <072.80e443af066d25046cba634c7f0f596c@tools.ietf.org>
References: <063.20025886c0bcb5ccbc9f7e7f1c6e494a@tools.ietf.org>
X-Trac-Ticket-ID: 32
In-Reply-To: <063.20025886c0bcb5ccbc9f7e7f1c6e494a@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: g_e_montenegro@yahoo.com, ifette@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #32 (closed): Clarify use of Origin header
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Feb 2011 17:24:24 -0000

#32: Clarify use of Origin header

Changes (by ifette@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 Addressed in r56 in svn, will be included in -5.

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |        Owner:        
     Type:  defect                    |       Status:  closed
 Priority:  major                     |    Milestone:        
Component:  thewebsocketprotocol      |      Version:        
 Severity:  -                         |   Resolution:  fixed 
 Keywords:                            |  
--------------------------------------+-------------------------------------

Ticket URL: <https://wiki.tools.ietf.org/wg/hybi/trac/ticket/32#comment:2>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Tue Feb  8 11:29:14 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C5A203A680A for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 11:29:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.6
X-Spam-Level: 
X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id afSFvlM1dDSR for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 11:29:14 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 0BD3D3A67D6 for <hybi@ietf.org>; Tue,  8 Feb 2011 11:29:14 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PmtFZ-0006bf-AC; Tue, 08 Feb 2011 11:29:21 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: ifette@google.com
X-Trac-Project: hybi
Date: Tue, 08 Feb 2011 19:29:21 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/39#comment:1
Message-ID: <077.d634d5b0cd4d9b5b8c98ab033ec56a2b@tools.ietf.org>
References: <068.36490524d935945394c51f239c8e5ca3@tools.ietf.org>
X-Trac-Ticket-ID: 39
In-Reply-To: <068.36490524d935945394c51f239c8e5ca3@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: ifette@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #39 (closed): multiple extensions selection in the server side handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Feb 2011 19:29:14 -0000

#39: multiple extensions selection in the  server side handshake

Changes (by ifette@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Old description:

> the fact that the server can select more then one extension, among the
> ones that client has offered, is not clear in the current version (04).
>
> in order to clarify that,
> the following minor change to the text has been proposed by Alexander:
>
> 1 /extensions/
> 2   A (possibly empty) list representing the protocol-level
> 3   extensions the server is ready to use.  If the server supports
> 4   multiple extensions, then the value of each extension should be
> 5   derived from the client's handshake and match exactly one of the
> 6   values in the "Sec-WebSocket-Extensions" field.  The absence
> 7   of such a field is equivalent to the null value.  The empty
> 8    string is not the same as the null value for these purposes.
>
> The changes are in lines 4 and 5.
>
> see: http://www.ietf.org/mail-archive/web/hybi/current/msg05851.html

New description:

 the fact that the server can select more then one extension, among the
 ones that client has offered, is not clear in the current version (04).

 in order to clarify that,
 the following minor change to the text has been proposed by Alexander:

 1 /extensions/
 2   A (possibly empty) list representing the protocol-level
 3   extensions the server is ready to use.  If the server supports
 4   multiple extensions, then the value of each extension should be
 5   derived from the client's handshake and match exactly one of the
 6   values in the "Sec-WebSocket-Extensions" field.  The absence
 7   of such a field is equivalent to the null value.  The empty
 8    string is not the same as the null value for these purposes.

 The changes are in lines 4 and 5.

 see: http://www.ietf.org/mail-archive/web/hybi/current/msg05851.html

--

Comment:

 Resolved in r58 in svn. will be included in -05

-- 
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@â€¦             |        Owner:        
     Type:  enhancement                    |       Status:  closed
 Priority:  minor                          |    Milestone:        
Component:  thewebsocketprotocol           |      Version:        
 Severity:  -                              |   Resolution:  fixed 
 Keywords:                                 |  
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/39#comment:1>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Tue Feb  8 11:31:30 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE52E3A683F for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 11:31:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.6
X-Spam-Level: 
X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 65EbLEhufEvb for <hybi@core3.amsl.com>; Tue,  8 Feb 2011 11:31:29 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 4FFFF3A680A for <hybi@ietf.org>; Tue,  8 Feb 2011 11:31:29 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PmtHh-0000T7-AD; Tue, 08 Feb 2011 11:31:33 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: g_e_montenegro@yahoo.com, ifette@google.com
X-Trac-Project: hybi
Date: Tue, 08 Feb 2011 19:31:33 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/35#comment:2
Message-ID: <072.5deef7fb505f6b1d50f0d0e8e391388b@tools.ietf.org>
References: <063.1eec032ca0db73dba1b467c65224b70a@tools.ietf.org>
X-Trac-Ticket-ID: 35
In-Reply-To: <063.1eec032ca0db73dba1b467c65224b70a@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: g_e_montenegro@yahoo.com, ifette@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #35 (new): Clarify Ping/Pong processing
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Feb 2011 19:31:30 -0000

#35: Clarify Ping/Pong processing


Comment(by ifette@â€¦):

 Resolved in r59 in svn, will be included in -05

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |       Owner:     
     Type:  defect                    |      Status:  new
 Priority:  major                     |   Milestone:     
Component:  thewebsocketprotocol      |     Version:     
 Severity:  -                         |    Keywords:     
--------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/35#comment:2>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From Internet-Drafts@ietf.org  Tue Feb  8 15:15:03 2011
Return-Path: <Internet-Drafts@ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 114383A68BD; Tue,  8 Feb 2011 15:15:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.599
X-Spam-Level: 
X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QpcfbbBNPfZz; Tue,  8 Feb 2011 15:15:02 -0800 (PST)
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F95D3A6857; Tue,  8 Feb 2011 15:15:02 -0800 (PST)
MIME-Version: 1.0
Content-Type: Multipart/Mixed; Boundary="NextPart"
From: Internet-Drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 3.12
Message-ID: <20110208231502.31262.8249.idtracker@localhost>
Date: Tue, 08 Feb 2011 15:15:02 -0800
Cc: hybi@ietf.org
Subject: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Feb 2011 23:15:03 -0000

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the BiDirectional or Server-Initiated HTTP Working Group of the IETF.


	Title           : The WebSocket protocol
	Author(s)       : I. Fette
	Filename        : draft-ietf-hybi-thewebsocketprotocol-05.txt
	Pages           : 51
	Date            : 2011-02-08

The WebSocket protocol enables two-way communication between a user
agent running untrusted code running in a controlled environment to a
remote host that has opted-in to communications from that code.  The
security model used for this is the Origin-based security model
commonly used by Web browsers.  The protocol consists of an initial
handshake followed by basic message framing, layered over TCP.  The
goal of this technology is to provide a mechanism for browser-based
applications that need two-way communication with servers that does
not rely on opening multiple HTTP connections (e.g. using
XMLHttpRequest or <iframe>s and long polling).

Please send feedback to the hybi@ietf.org mailing list.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-hybi-thewebsocketprotocol-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Message/External-body;
	name="draft-ietf-hybi-thewebsocketprotocol-05.txt";
	site="ftp.ietf.org"; access-type="anon-ftp";
	directory="internet-drafts"

Content-Type: text/plain
Content-ID: <2011-02-08150531.I-D@ietf.org>


--NextPart--

From andy.warmcat.com@googlemail.com  Wed Feb  9 01:03:46 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 96C5E3A6959 for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 01:03:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VcrXXLEX-Iv5 for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 01:03:45 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 183853A6957 for <hybi@ietf.org>; Wed,  9 Feb 2011 01:03:44 -0800 (PST)
Received: by wwa36 with SMTP id 36so7210232wwa.13 for <hybi@ietf.org>; Wed, 09 Feb 2011 01:03:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=tajCps9ltTg8rrS892iXTyPX6ytN0b9KI4XkK3rd2SM=; b=ltZXK95jVCnKwuGKkSOlG7kjtIcb/bE8YziuendfIhskFYZ0Gsx+WMloiLI87dQiQ9 oGlKHfPwfUCqn9AYnNdSpZeTnFZI/Ok0KWroPqKoe7u+gqkoI+6q3G/INWOakXrZnmEN XVcb/Kt16qDho0u+CVkPDuqG4WM3wqtdddafU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; b=qY+Ln7s+FqggPVQXP58OgM4sfQG62yW0s/9IQrIwQrpIRESIco6z03ldCkpzplwcFv Z/65dp+4mZevOxJCcscOUPu/CJYtSxmIHHhSfjw0Ocu67eVI8lyK7mRoPjUM/hTR4weh B/HoLuZ2TZxI3p/k/v5GpDz9LF0mfK65f4ddc=
Received: by 10.227.156.15 with SMTP id u15mr4934977wbw.220.1297242187714; Wed, 09 Feb 2011 01:03:07 -0800 (PST)
Received: from [192.168.1.4] (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id u9sm83819wbg.0.2011.02.09.01.03.06 (version=SSLv3 cipher=RC4-MD5); Wed, 09 Feb 2011 01:03:06 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D52584A.4070000@warmcat.com>
Date: Wed, 09 Feb 2011 09:03:06 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Hybi <hybi@ietf.org>
References: <20110208231502.31262.8249.idtracker@localhost>
In-Reply-To: <20110208231502.31262.8249.idtracker@localhost>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [hybi] I-D Action:draft-ietf-hyb / libwebsockets updated to 05 framing
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Feb 2011 09:03:46 -0000

On 02/08/11 23:15, Somebody in the thread at some point said:

> http://www.ietf.org/internet-drafts/draft-ietf-hybi-thewebsocketprotocol-05.txt

Nice, the per-frame SHA-1 is gone and no AES junk; syntax for extension 
specification in the client header is defined.  If you want to (in 
violation though) as a client you can compatibly set the frame nonce to 
00000000 and skip munging altogether.

I added in 05 framing support for client and server in libwebsockets, 
the support is:

  Server: 76/00, 04 and 05 selected dynamically per-client
  Client: 04 or 05 selectable

There's a -v switch on the test client and ping applets to set spec 
version to use, eg, -v4

Extension header should be recognized and rejected since it doesn't 
support any.

Ran out of time to do the new close stuff before "real work" must start 
but otherwise it's probably a useful sparring partner for other client 
or server implementations.

http://git.warmcat.com/cgi-bin/cgit/libwebsockets/

-Andy

From tyoshino@google.com  Wed Feb  9 16:05:27 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C3973A67AD for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:05:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.676
X-Spam-Level: 
X-Spam-Status: No, score=-103.676 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MANGLED_TOOL=2.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Y0eDM2j8KXY for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:05:26 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id E10193A67AC for <hybi@ietf.org>; Wed,  9 Feb 2011 16:05:25 -0800 (PST)
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13]) by smtp-out.google.com with ESMTP id p1A05ZIl010546 for <hybi@ietf.org>; Wed, 9 Feb 2011 16:05:35 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297296336; bh=kmhUtCRytUrgcHnJl2cPNVjPX8U=; h=MIME-Version:From:Date:Message-ID:Subject:To:Content-Type; b=ufXMt7xBl2wJAJyYvINHLs5SejMIv59fKJdmSNBdGF89QC5Re2GbGERpS3rIPB7Dg fRWRVmMKKyyDLj8IUE72A==
Received: from iwn2 (iwn2.prod.google.com [10.241.68.66]) by hpaq13.eem.corp.google.com with ESMTP id p1A057GL004403 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 9 Feb 2011 16:05:34 -0800
Received: by iwn2 with SMTP id 2so802378iwn.21 for <hybi@ietf.org>; Wed, 09 Feb 2011 16:05:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:from:date:message-id:subject:to :content-type; bh=YSiw4iS3a9moH3mX6X8/rC0rOK0WZJowlK7vxzhY6O8=; b=NOsRXhByyT58bnWxszxHdRAjzjvrF4ojLKYLr6TqxNCOxGJoCZIbKfirv/BV6BqOVV wR3vwxlzWAUprW72N/mg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:from:date:message-id:subject:to:content-type; b=FZV3NZpgZ7WILrefHuntvW3w7mXfljgqfLJluextQ6y2eIu7M8xBXRUbbvEodGI/9E nHGIwPHtFF0Gp1QCKFmw==
Received: by 10.42.178.134 with SMTP id bm6mr2051195icb.523.1297296333993; Wed, 09 Feb 2011 16:05:33 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Wed, 9 Feb 2011 16:05:13 -0800 (PST)
From: Takeshi Yoshino <tyoshino@google.com>
Date: Wed, 9 Feb 2011 16:05:13 -0800
Message-ID: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=90e6ba6e8d9c27f604049be257af
X-System-Of-Record: true
Subject: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 00:05:27 -0000

--90e6ba6e8d9c27f604049be257af
Content-Type: text/plain; charset=ISO-8859-1

Long time has passed since there was active discussion on closing handshake
design. Closing handshake detail has been gradually changed in -01 and -05
adopting suggestions from tickets and posts on the list, and now there is
some inconsistency between sections. I think now it's good time to discuss
again what closing handshake should realize, how it should be done, and what
_cleanly_ means.

== What closing handshake should realize ==
Now it seems closing handshake in -05 is designed to realize two things.
a) peer B assume that no more data is coming from peer A when B receives
closing initiation from A
b) peer A assume that all the data sent out has been successfully received
by peer B when A receives closing acknowledgement from B

Section 1.4 in -05 states only a), but I thought that b) is also closing
handshake's objective. e.g. this old post
http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html by Hixie
says so.

How many people on this list are supportive for having feature-b) realized
by closing handshake? When I was talking with people offlist, some were
doubtful about the usefulness of this feature. It think most apps would
build their own shutdown protocol and doesn't rely on WebSocket closing
handshake.

== How it should be done for each option ==
1) If we need only a), a) can be simply realized by closing frame without
body.

2) If we need both a) and b), we have to distinguish closing initiation and
acknowledgement since it's possible that both sides initiate closing at the
same time.

Some sentences ("A received close message is deemed to be ..." in Section
4.5.1) were added to -01 to ask each peer to check the body of closing frame
to distinguish if it's acknowledgement or not". This was incomplete as
Gabriel pointed out in http://trac.tools.ietf.org/wg/hybi/trac/ticket/34,
but it's now almost addressed in -05. I think we need to make one more tiny
fix on 4.5.1, but then, I think it's perfect.

== What does _cleanly_ means? ==
By the word _cleanly_ all the information about closing handshake is passed
to the WebSocket API.

If we take 1), _cleanly_ means the user agent has received all data from the
server.

If we take 2),... in -05, _cleanly_ has different meaning depending on
whether client initiated close or server initiated close. If client
initiated close, _cleanly_ means the user agent has received all data from
the server and all the data sent to the server has been received by the
server. If server initiated close, _cleanly_ only means the user agent has
received all data from the server. Since we're going to assure b), the user
agent should initiate closure before sending back acknowledgement (we need
some change in 4.5.1). Then, _cleanly_ means the same for both cases.

====

Let's make decision here to clean-up closing handshake stuff in the spec.

1) keep feature-b)
- Change Section 1.4 to mention that closing handshake is designed to
realize feature-b)
- Fix 4.5.1 so that a peer wait until receiving acknowledgement if it has
initiated closing handshake
2) drop feature-b)
- Drop body comparison procedure added in -01
- Avoid using a word "acknowledgement". It's confusing IMO.

--90e6ba6e8d9c27f604049be257af
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Long time has passed since there was active discussion on closing hand=
shake design. Closing handshake detail has been gradually changed in -01 an=
d -05 adopting suggestions from tickets and posts on the list, and now ther=
e is some inconsistency between sections. I think now it&#39;s good time to=
 discuss again what closing handshake should realize, how it should be done=
, and what _cleanly_ means.</div>

<div><div><br></div></div><div>=3D=3D What closing handshake should realize=
 =3D=3D</div><div>Now it seems closing handshake in -05 is designed to real=
ize two things.</div><div><div>a) peer B assume that no more data is coming=
 from peer A=A0when B receives closing initiation from A</div>

<div>b) peer A assume that all the data sent out has been successfully rece=
ived by peer B when A receives closing acknowledgement from B</div><div><br=
></div></div><div>Section 1.4 in -05 states only a), but=A0I thought that b=
) is also closing handshake&#39;s objective. e.g. this old post=A0<a href=
=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html">http:/=
/www.ietf.org/mail-archive/web/hybi/current/msg01526.html</a>=A0by Hixie sa=
ys so.</div>

<div><br></div><div>How many people on this list are supportive for having =
feature-b) realized by closing handshake? When I was talking with people of=
flist, some were doubtful about the usefulness of this feature. It think mo=
st apps would build their own shutdown protocol and doesn&#39;t rely on Web=
Socket closing handshake.</div>

<div><br></div><div>=3D=3D How it should be done for each option =3D=3D</di=
v><div>1) If we need only a), a) can be simply realized by closing frame wi=
thout body.</div><div><br></div><div>2) If we need both a) and b), we have =
to distinguish closing initiation and acknowledgement since it&#39;s possib=
le that both sides initiate closing at the same time.</div>

<div><br></div><div>Some sentences (&quot;A received close message is deeme=
d to be ...&quot; in Section 4.5.1) were added to -01 to ask each peer to c=
heck the body of closing frame to distinguish if it&#39;s acknowledgement o=
r not&quot;. This was incomplete as Gabriel pointed out in=A0<a href=3D"htt=
p://trac.tools.ietf.org/wg/hybi/trac/ticket/34">http://trac.tools.ietf.org/=
wg/hybi/trac/ticket/34</a>, but it&#39;s now almost addressed in -05. I thi=
nk we need to make one more tiny fix on 4.5.1, but then, I think it&#39;s p=
erfect.</div>

<div><br></div><div>=3D=3D What does _cleanly_ means? =3D=3D</div><div>By t=
he word _cleanly_ all the information about closing handshake is passed to =
the WebSocket API.</div><div><br></div><div>If we take 1), _cleanly_ means =
the user agent has received all data from the server.</div>

<div><br></div><div>If we take 2),... in -05, _cleanly_ has different meani=
ng depending on whether client initiated close or server initiated close. I=
f client initiated close, _cleanly_ means the user agent has received all d=
ata from the server and all the data sent to the server has been received b=
y the server. If server initiated close,=A0_cleanly_ only means the user ag=
ent has received all data from the server. Since we&#39;re going to assure =
b), the user agent should initiate closure before sending back acknowledgem=
ent (we need some change in 4.5.1). Then, _cleanly_ means the same for both=
 cases.</div>

<div><br></div><div>=3D=3D=3D=3D</div><div><br></div><div>Let&#39;s make de=
cision here to clean-up closing handshake stuff in the spec.</div><div><br>=
</div><div>1) keep feature-b)</div><div>- Change Section 1.4 to mention tha=
t closing handshake is designed to realize feature-b)</div>

<div>- Fix 4.5.1 so that a peer wait until receiving acknowledgement if it =
has initiated closing handshake</div><div>2) drop feature-b)</div><div>- Dr=
op body comparison procedure added in -01</div><div>- Avoid using a word &q=
uot;acknowledgement&quot;. It&#39;s confusing IMO.</div>

<div><br></div>

--90e6ba6e8d9c27f604049be257af--

From Gabriel.Montenegro@microsoft.com  Wed Feb  9 16:21:52 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1862F3A67FA for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:21:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.298
X-Spam-Level: 
X-Spam-Status: No, score=-8.298 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, MANGLED_TOOL=2.3, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9B5SmPFGHkIX for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:21:50 -0800 (PST)
Received: from smtp.microsoft.com (maila.microsoft.com [131.107.115.212]) by core3.amsl.com (Postfix) with ESMTP id 4E7333A682D for <hybi@ietf.org>; Wed,  9 Feb 2011 16:21:46 -0800 (PST)
Received: from TK5EX14MLTC102.redmond.corp.microsoft.com (157.54.79.180) by TK5-EXGWY-E801.partners.extranet.microsoft.com (10.251.56.50) with Microsoft SMTP Server (TLS) id 8.2.176.0; Wed, 9 Feb 2011 16:21:56 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14MLTC102.redmond.corp.microsoft.com (157.54.79.180) with Microsoft SMTP Server (TLS) id 14.1.270.2; Wed, 9 Feb 2011 16:21:56 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Wed, 9 Feb 2011 16:21:55 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Takeshi Yoshino <tyoshino@google.com>, "hybi@ietf.org" <hybi@ietf.org>
Thread-Topic: [hybi] Clarify the role of closing handshake
Thread-Index: AQHLyLZQD4/LNEvRdUK4csWEI+DaLJP53n3g
Date: Thu, 10 Feb 2011 00:21:55 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FE@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com>
In-Reply-To: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FETK5EX14MBXW605w_"
MIME-Version: 1.0
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 00:21:52 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FETK5EX14MBXW605w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

+1 on Dropping feature B (data draining) and only keeping the simple semant=
ics of feature A as you say below:

a) peer B assume that no more data is coming from peer A when B receives cl=
osing initiation from A

Either side has to be ready for the other side going away without warning (=
a user just yanking the page in the browser). Any value for data draining i=
s suspect and better handled at the application. There may be value in havi=
ng it as a signal to intermediaries so they can claim state earlier than th=
ey might have otherwise (they also have to have timeouts as they cannot rel=
y on the Close message being cleanly sent), but then the simplest form is e=
nough.

My suggestion on Close is to simplify it along these lines:


*         Using simple close semantics (whoever sends it, closes the entire=
 session).

*         No half-close semantics as in TCP

*         Assuming that any data draining must be taken care of by the app,=
 so no need for acking a close.

*         Assuming that the primary purpose of a Close is to inform interme=
diaries that the session is now terminated.

Proposed text is:

4.5.1.  Close

   The Close message contains an opcode of 0x01 and no body.

   The websocket is considered fully closed when an endpoint has either sen=
t or received a Close message.
   Accordingly, upon sending or receiving a Close message, no more data or =
control messages can be sent on  the websocket.

Comments?

Gabriel



From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of Tak=
eshi Yoshino
Sent: Wednesday, February 09, 2011 16:05
To: hybi@ietf.org
Subject: [hybi] Clarify the role of closing handshake

Long time has passed since there was active discussion on closing handshake=
 design. Closing handshake detail has been gradually changed in -01 and -05=
 adopting suggestions from tickets and posts on the list, and now there is =
some inconsistency between sections. I think now it's good time to discuss =
again what closing handshake should realize, how it should be done, and wha=
t _cleanly_ means.

=3D=3D What closing handshake should realize =3D=3D
Now it seems closing handshake in -05 is designed to realize two things.
a) peer B assume that no more data is coming from peer A when B receives cl=
osing initiation from A
b) peer A assume that all the data sent out has been successfully received =
by peer B when A receives closing acknowledgement from B

Section 1.4 in -05 states only a), but I thought that b) is also closing ha=
ndshake's objective. e.g. this old post http://www.ietf.org/mail-archive/we=
b/hybi/current/msg01526.html by Hixie says so.

How many people on this list are supportive for having feature-b) realized =
by closing handshake? When I was talking with people offlist, some were dou=
btful about the usefulness of this feature. It think most apps would build =
their own shutdown protocol and doesn't rely on WebSocket closing handshake=
.

=3D=3D How it should be done for each option =3D=3D
1) If we need only a), a) can be simply realized by closing frame without b=
ody.

2) If we need both a) and b), we have to distinguish closing initiation and=
 acknowledgement since it's possible that both sides initiate closing at th=
e same time.

Some sentences ("A received close message is deemed to be ..." in Section 4=
.5.1) were added to -01 to ask each peer to check the body of closing frame=
 to distinguish if it's acknowledgement or not". This was incomplete as Gab=
riel pointed out in http://trac.tools.ietf.org/wg/hybi/trac/ticket/34, but =
it's now almost addressed in -05. I think we need to make one more tiny fix=
 on 4.5.1, but then, I think it's perfect.

=3D=3D What does _cleanly_ means? =3D=3D
By the word _cleanly_ all the information about closing handshake is passed=
 to the WebSocket API.

If we take 1), _cleanly_ means the user agent has received all data from th=
e server.

If we take 2),... in -05, _cleanly_ has different meaning depending on whet=
her client initiated close or server initiated close. If client initiated c=
lose, _cleanly_ means the user agent has received all data from the server =
and all the data sent to the server has been received by the server. If ser=
ver initiated close, _cleanly_ only means the user agent has received all d=
ata from the server. Since we're going to assure b), the user agent should =
initiate closure before sending back acknowledgement (we need some change i=
n 4.5.1). Then, _cleanly_ means the same for both cases.

=3D=3D=3D=3D

Let's make decision here to clean-up closing handshake stuff in the spec.

1) keep feature-b)
- Change Section 1.4 to mention that closing handshake is designed to reali=
ze feature-b)
- Fix 4.5.1 so that a peer wait until receiving acknowledgement if it has i=
nitiated closing handshake
2) drop feature-b)
- Drop body comparison procedure added in -01
- Avoid using a word "acknowledgement". It's confusing IMO.


--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FETK5EX14MBXW605w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV=3D"Content-Type" CONTENT=
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros=
oft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0in;
	margin-right:0in;
	margin-bottom:0in;
	margin-left:.5in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.EmailStyle17
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:2037272670;
	mso-list-type:hybrid;
	mso-list-template-ids:840435840 -241777842 67698691 67698693 67698689 6769=
8691 67698693 67698689 67698691 67698693;}
@list l0:level1
	{mso-level-start-at:0;
	mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:.75in;
	text-indent:-.25in;
	font-family:Symbol;
	mso-fareast-font-family:"MS Mincho";
	mso-bidi-font-family:"Times New Roman";}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:1.25in;
	text-indent:-.25in;
	font-family:"Courier New";}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:1.75in;
	text-indent:-.25in;
	font-family:Wingdings;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:2.25in;
	text-indent:-.25in;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:2.75in;
	text-indent:-.25in;
	font-family:"Courier New";}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:3.25in;
	text-indent:-.25in;
	font-family:Wingdings;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:3.75in;
	text-indent:-.25in;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:4.25in;
	text-indent:-.25in;
	font-family:"Courier New";}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	margin-left:4.75in;
	text-indent:-.25in;
	font-family:Wingdings;}
ol
	{margin-bottom:0in;}
ul
	{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue vli=
nk=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span style=3D'f=
ont-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>+1 on Dro=
pping feature B (data draining) and only keeping the simple semantics of fe=
ature A as you say below:<o:p></o:p></span></p><p class=3DMsoNormal><span s=
tyle=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>=
<o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal>a) peer B assume that no m=
ore data is coming from peer A&nbsp;when B receives closing initiation from=
 A<o:p></o:p></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-=
family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p=
 class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","s=
ans-serif";color:#1F497D'>Either side has to be ready for the other side go=
ing away without warning (a user just yanking the page in the browser). Any=
 value for data draining is suspect and better handled at the application. =
There may be value in having it as a signal to intermediaries so they can c=
laim state earlier than they might have otherwise (they also have to have t=
imeouts as they cannot rely on the Close message being cleanly sent), but t=
hen the simplest form is enough.<o:p></o:p></span></p><p class=3DMsoNormal>=
<span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1=
F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span style=3D'font=
-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>My suggestio=
n on Close is to simplify it along these lines:<o:p></o:p></span></p><p cla=
ss=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-=
serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoListParagra=
ph style=3D'margin-left:.75in;text-indent:-.25in;mso-list:l0 level1 lfo1'><=
![if !supportLists]><span style=3D'font-size:11.0pt;font-family:Symbol;colo=
r:#1F497D'><span style=3D'mso-list:Ignore'>&middot;<span style=3D'font:7.0p=
t "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </spa=
n></span></span><![endif]><span style=3D'font-size:11.0pt;font-family:"Cali=
bri","sans-serif";color:#1F497D'>Using simple close semantics (whoever send=
s it, closes the entire session).<o:p></o:p></span></p><p class=3DMsoListPa=
ragraph style=3D'margin-left:.75in;text-indent:-.25in;mso-list:l0 level1 lf=
o1'><![if !supportLists]><span style=3D'font-size:11.0pt;font-family:Symbol=
;color:#1F497D'><span style=3D'mso-list:Ignore'>&middot;<span style=3D'font=
:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
</span></span></span><![endif]><span style=3D'font-size:11.0pt;font-family:=
"Calibri","sans-serif";color:#1F497D'>No half-close semantics as in TCP<o:p=
></o:p></span></p><p class=3DMsoListParagraph style=3D'margin-left:.75in;te=
xt-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style=
=3D'font-size:11.0pt;font-family:Symbol;color:#1F497D'><span style=3D'mso-l=
ist:Ignore'>&middot;<span style=3D'font:7.0pt "Times New Roman"'>&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span></span><![endif]><span=
 style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D=
'>Assuming that any data draining must be taken care of by the app, so no n=
eed for acking a close.<o:p></o:p></span></p><p class=3DMsoListParagraph st=
yle=3D'margin-left:.75in;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if =
!supportLists]><span style=3D'font-size:11.0pt;font-family:Symbol;color:#1F=
497D'><span style=3D'mso-list:Ignore'>&middot;<span style=3D'font:7.0pt "Ti=
mes New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></s=
pan></span><![endif]><span style=3D'font-size:11.0pt;font-family:"Calibri",=
"sans-serif";color:#1F497D'>Assuming that the primary purpose of a Close is=
 to inform intermediaries that the session is now terminated.<o:p></o:p></s=
pan></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"C=
alibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3D=
MsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif=
";color:#1F497D'>Proposed text is:<o:p></o:p></span></p><p class=3DMsoNorma=
l><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:=
#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal>4.5.1. &nbsp;Clos=
e<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNor=
mal>&nbsp;&nbsp; The Close message contains an opcode of 0x01 and no body.<=
o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNorma=
l>&nbsp;&nbsp; The websocket is considered fully closed when an endpoint ha=
s either sent or received a Close message.<o:p></o:p></p><p class=3DMsoNorm=
al>&nbsp;&nbsp; Accordingly, upon sending or receiving a Close message, no =
more data or control messages can be sent on &nbsp;the websocket.<o:p></o:p=
></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Cali=
bri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMso=
Normal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";c=
olor:#1F497D'>Comments?<o:p></o:p></span></p><p class=3DMsoNormal><span sty=
le=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o=
:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11.=
0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Gabriel<o:p></o:p></s=
pan></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"C=
alibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3D=
MsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif=
";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span sty=
le=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o=
:p>&nbsp;</o:p></span></p><div style=3D'border:none;border-left:solid blue =
1.5pt;padding:0in 0in 0in 4.0pt'><div><div style=3D'border:none;border-top:=
solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=3DMsoNormal><b><spa=
n style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> hyb=
i-bounces@ietf.org [mailto:hybi-bounces@ietf.org] <b>On Behalf Of </b>Takes=
hi Yoshino<br><b>Sent:</b> Wednesday, February 09, 2011 16:05<br><b>To:</b>=
 hybi@ietf.org<br><b>Subject:</b> [hybi] Clarify the role of closing handsh=
ake<o:p></o:p></span></p></div></div><p class=3DMsoNormal><o:p>&nbsp;</o:p>=
</p><div><p class=3DMsoNormal>Long time has passed since there was active d=
iscussion on closing handshake design. Closing handshake detail has been gr=
adually changed in -01 and -05 adopting suggestions from tickets and posts =
on the list, and now there is some inconsistency between sections. I think =
now it's good time to discuss again what closing handshake should realize, =
how it should be done, and what _cleanly_ means.<o:p></o:p></p></div><div><=
div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div></div><div><p class=3DM=
soNormal>=3D=3D What closing handshake should realize =3D=3D<o:p></o:p></p>=
</div><div><p class=3DMsoNormal>Now it seems closing handshake in -05 is de=
signed to realize two things.<o:p></o:p></p></div><div><div><p class=3DMsoN=
ormal>a) peer B assume that no more data is coming from peer A&nbsp;when B =
receives closing initiation from A<o:p></o:p></p></div><div><p class=3DMsoN=
ormal>b) peer A assume that all the data sent out has been successfully rec=
eived by peer B when A receives closing acknowledgement from B<o:p></o:p></=
p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div></div><div><p =
class=3DMsoNormal>Section 1.4 in -05 states only a), but&nbsp;I thought tha=
t b) is also closing handshake's objective. e.g. this old post&nbsp;<a href=
=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html">http:/=
/www.ietf.org/mail-archive/web/hybi/current/msg01526.html</a>&nbsp;by Hixie=
 says so.<o:p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></=
p></div><div><p class=3DMsoNormal>How many people on this list are supporti=
ve for having feature-b) realized by closing handshake? When I was talking =
with people offlist, some were doubtful about the usefulness of this featur=
e. It think most apps would build their own shutdown protocol and doesn't r=
ely on WebSocket closing handshake.<o:p></o:p></p></div><div><p class=3DMso=
Normal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>=3D=3D How it s=
hould be done for each option =3D=3D<o:p></o:p></p></div><div><p class=3DMs=
oNormal>1) If we need only a), a) can be simply realized by closing frame w=
ithout body.<o:p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p=
></p></div><div><p class=3DMsoNormal>2) If we need both a) and b), we have =
to distinguish closing initiation and acknowledgement since it's possible t=
hat both sides initiate closing at the same time.<o:p></o:p></p></div><div>=
<p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>S=
ome sentences (&quot;A received close message is deemed to be ...&quot; in =
Section 4.5.1) were added to -01 to ask each peer to check the body of clos=
ing frame to distinguish if it's acknowledgement or not&quot;. This was inc=
omplete as Gabriel pointed out in&nbsp;<a href=3D"http://trac.tools.ietf.or=
g/wg/hybi/trac/ticket/34">http://trac.tools.ietf.org/wg/hybi/trac/ticket/34=
</a>, but it's now almost addressed in -05. I think we need to make one mor=
e tiny fix on 4.5.1, but then, I think it's perfect.<o:p></o:p></p></div><d=
iv><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNorma=
l>=3D=3D What does _cleanly_ means? =3D=3D<o:p></o:p></p></div><div><p clas=
s=3DMsoNormal>By the word _cleanly_ all the information about closing hands=
hake is passed to the WebSocket API.<o:p></o:p></p></div><div><p class=3DMs=
oNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>If we take 1),=
 _cleanly_ means the user agent has received all data from the server.<o:p>=
</o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><=
p class=3DMsoNormal>If we take 2),... in -05, _cleanly_ has different meani=
ng depending on whether client initiated close or server initiated close. I=
f client initiated close, _cleanly_ means the user agent has received all d=
ata from the server and all the data sent to the server has been received b=
y the server. If server initiated close,&nbsp;_cleanly_ only means the user=
 agent has received all data from the server. Since we're going to assure b=
), the user agent should initiate closure before sending back acknowledgeme=
nt (we need some change in 4.5.1). Then, _cleanly_ means the same for both =
cases.<o:p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><=
/div><div><p class=3DMsoNormal>=3D=3D=3D=3D<o:p></o:p></p></div><div><p cla=
ss=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Let's m=
ake decision here to clean-up closing handshake stuff in the spec.<o:p></o:=
p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p cl=
ass=3DMsoNormal>1) keep feature-b)<o:p></o:p></p></div><div><p class=3DMsoN=
ormal>- Change Section 1.4 to mention that closing handshake is designed to=
 realize feature-b)<o:p></o:p></p></div><div><p class=3DMsoNormal>- Fix 4.5=
.1 so that a peer wait until receiving acknowledgement if it has initiated =
closing handshake<o:p></o:p></p></div><div><p class=3DMsoNormal>2) drop fea=
ture-b)<o:p></o:p></p></div><div><p class=3DMsoNormal>- Drop body compariso=
n procedure added in -01<o:p></o:p></p></div><div><p class=3DMsoNormal>- Av=
oid using a word &quot;acknowledgement&quot;. It's confusing IMO.<o:p></o:p=
></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div></div></div=
></body></html>=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FETK5EX14MBXW605w_--

From trac@tools.ietf.org  Wed Feb  9 16:32:09 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6AE4D3A672F for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:32:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.524
X-Spam-Level: 
X-Spam-Status: No, score=-102.524 tagged_above=-999 required=5 tests=[AWL=-0.076, BAYES_00=-2.599, NO_RELAYS=-0.001, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z6oDwMzD9Ody for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:32:08 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id CBE733A682D for <hybi@ietf.org>; Wed,  9 Feb 2011 16:32:07 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PnKSH-00030o-Km; Wed, 09 Feb 2011 16:32:17 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: g_e_montenegro@yahoo.com
X-Trac-Project: hybi
Date: Thu, 10 Feb 2011 00:32:17 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://wiki.tools.ietf.org/wg/hybi/trac/ticket/40
Message-ID: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
X-Trac-Ticket-ID: 40
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: g_e_montenegro@yahoo.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 00:32:09 -0000

#40: Clarify binary/utf-8 mixed handling

 It can be confusing to mix binary and utf-8 frames in one tcp-like stream.
 For example, what will the current text-only JS Websocket API do if
 suddenly binary starts appearing?
 Additionally, when only partial frames may be available, it is expensive
 to verify that this is indeed a valid UTF-8 stream (protocol
 implementation needs to take into account multi-byte characters and end of
 current data payload).  If binary has been negotiated for this session,
 processing can be optimized accordingly.

 Proposal: allow negotiation to clarify if a stream will not mix binary and
 text in order to enable optimizing for the binary-only case.

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |       Owner:     
     Type:  defect                    |      Status:  new
 Priority:  major                     |   Milestone:     
Component:  thewebsocketprotocol      |     Version:     
 Severity:  -                         |    Keywords:     
--------------------------------------+-------------------------------------

Ticket URL: <http://wiki.tools.ietf.org/wg/hybi/trac/ticket/40>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Wed Feb  9 16:44:18 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4BA863A6826 for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:44:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.521
X-Spam-Level: 
X-Spam-Status: No, score=-102.521 tagged_above=-999 required=5 tests=[AWL=-0.073, BAYES_00=-2.599, NO_RELAYS=-0.001, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id InOfxQC31hml for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:44:17 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 5F9563A672F for <hybi@ietf.org>; Wed,  9 Feb 2011 16:44:17 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PnKe3-0006tK-EO; Wed, 09 Feb 2011 16:44:27 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: jat@google.com
X-Trac-Project: hybi
Date: Thu, 10 Feb 2011 00:44:27 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/40#comment:1
Message-ID: <072.675a3ef818509cf3962a42f126f405cd@tools.ietf.org>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
X-Trac-Ticket-ID: 40
In-Reply-To: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: jat@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 00:44:18 -0000

#40: Clarify binary/utf-8 mixed handling


Comment(by jat@â€¦):

 I would assume a user agent with no binary support would fail the
 connection on receiving a binary frame and deliver an appropriate event to
 the JS client.

 Since the JS API provides no streaming API, you can't deliver partial text
 results anyway, so there is no need to validate the UTF8 until you have
 all of it.  If you are processing it as you go, such as converting it to
 UTF16, then you validate it whenever you get a complete character, and
 your state machine maintains where you are.

 I don't see why adding negotiation for the type of frames which may appear
 is useful -- you already have to maintain state about how many bytes are
 left in the current frame in progress and what type it is, and surely you
 can take appropriate actions based on that state as easily as you could
 some flag negotiated during the handshake.

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |       Owner:     
     Type:  defect                    |      Status:  new
 Priority:  major                     |   Milestone:     
Component:  thewebsocketprotocol      |     Version:     
 Severity:  -                         |    Keywords:     
--------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/40#comment:1>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From jat@google.com  Wed Feb  9 16:46:22 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7640C3A6827 for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:46:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.976
X-Spam-Level: 
X-Spam-Status: No, score=-102.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0+VpnM7zygIx for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:46:21 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 040FA3A6826 for <hybi@ietf.org>; Wed,  9 Feb 2011 16:46:20 -0800 (PST)
Received: from kpbe18.cbf.corp.google.com (kpbe18.cbf.corp.google.com [172.25.105.82]) by smtp-out.google.com with ESMTP id p1A0kUoR001878 for <hybi@ietf.org>; Wed, 9 Feb 2011 16:46:30 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297298791; bh=CQLjXbXtVB/rwD7MSl05JdOBW9k=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=bDWuLtFtBLTAX8fmmg86jAs4XRJFoR9I6gMksd6JwZoE2693d4SLcAHv84nQhC09V mge6Sk8+lVaYHfIKgRpcA==
Received: from yxd30 (yxd30.prod.google.com [10.190.1.222]) by kpbe18.cbf.corp.google.com with ESMTP id p1A0kSaD018411 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 9 Feb 2011 16:46:29 -0800
Received: by yxd30 with SMTP id 30so371411yxd.11 for <hybi@ietf.org>; Wed, 09 Feb 2011 16:46:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=QzF+/TvhAuGDF35GR5C8Wwmnl8bMg7GP9xmozIJPZy0=; b=PW55rNQqfmvnEUBN/C1uAyPRxAPY3fVdqKqnnBZm38BZjrSSYgNx1ismPDUMSHC4qm 6DnbgaUh02LpXTJqFCPA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=C4/4vFdyREHtoM+P16beh9DE2/KikJHDvoAeeNBFfWKyGmolBVvl1yqSyOH9n04lqh Cdr5rcVrbZJqaaYu6pgg==
Received: by 10.150.49.17 with SMTP id w17mr2378399ybw.377.1297298788392; Wed, 09 Feb 2011 16:46:28 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Wed, 9 Feb 2011 16:46:07 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FE@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E042FE@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
From: John Tamplin <jat@google.com>
Date: Wed, 9 Feb 2011 19:46:07 -0500
Message-ID: <AANLkTikaJGknY8-urat9Vopi1TqZdzCJ9ZzGXy85Qk-p@mail.gmail.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: multipart/alternative; boundary=000e0cd6aeb4732064049be2e96a
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 00:46:22 -0000

--000e0cd6aeb4732064049be2e96a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 9, 2011 at 7:21 PM, Gabriel Montenegro <
Gabriel.Montenegro@microsoft.com> wrote:

> +1 on Dropping feature B (data draining) and only keeping the simple
> semantics of feature A as you say below:
>
>
>
> a) peer B assume that no more data is coming from peer A when B receives
> closing initiation from A
>
>
>
> Either side has to be ready for the other side going away without warning
> (a user just yanking the page in the browser). Any value for data drainin=
g
> is suspect and better handled at the application. There may be value in
> having it as a signal to intermediaries so they can claim state earlier t=
han
> they might have otherwise (they also have to have timeouts as they cannot
> rely on the Close message being cleanly sent), but then the simplest form=
 is
> enough.
>
>
>
> My suggestion on Close is to simplify it along these lines:
>
>
>
> =C2=B7         Using simple close semantics (whoever sends it, closes the
> entire session).
>
> =C2=B7         No half-close semantics as in TCP
>
> =C2=B7         Assuming that any data draining must be taken care of by t=
he
> app, so no need for acking a close.
>
> =C2=B7         Assuming that the primary purpose of a Close is to inform
> intermediaries that the session is now terminated.
>
>
>
> Proposed text is:
>
>
>
> 4.5.1.  Close
>
>
>
>    The Close message contains an opcode of 0x01 and no body.
>
>
>
>    The websocket is considered fully closed when an endpoint has either
> sent or received a Close message.
>
>    Accordingly, upon sending or receiving a Close message, no more data o=
r
> control messages can be sent on  the websocket.
>
>
>
> Comments?
>

I would say it is fully closed when both sent and received a Close message,
or when the underlying channel is closed.

--=20
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6aeb4732064049be2e96a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 9, 2011 at 7:21 PM, Gabriel Monteneg=
ro <span dir=3D"ltr">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.com=
">Gabriel.Montenegro@microsoft.com</a>&gt;</span> wrote:<br><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex;">

<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple"><div><p class=3D"MsoNorm=
al"><span style=3D"font-size:11.0pt;color:#1F497D">+1 on Dropping feature B=
 (data draining) and only keeping the simple semantics of feature A as you =
say below:</span></p>

<div class=3D"im"><p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;co=
lor:#1F497D">=C2=A0</span></p><p class=3D"MsoNormal">a) peer B assume that =
no more data is coming from peer A=C2=A0when B receives closing initiation =
from A</p><p class=3D"MsoNormal">

<span style=3D"font-size:11.0pt;color:#1F497D">=C2=A0</span></p></div><p cl=
ass=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">Either sid=
e has to be ready for the other side going away without warning (a user jus=
t yanking the page in the browser). Any value for data draining is suspect =
and better handled at the application. There may be value in having it as a=
 signal to intermediaries so they can claim state earlier than they might h=
ave otherwise (they also have to have timeouts as they cannot rely on the C=
lose message being cleanly sent), but then the simplest form is enough.</sp=
an></p>

<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">=C2=
=A0</span></p><p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:=
#1F497D">My suggestion on Close is to simplify it along these lines:</span>=
</p><p class=3D"MsoNormal">

<span style=3D"font-size:11.0pt;color:#1F497D">=C2=A0</span></p><p style=3D=
"margin-left:.75in"><span style=3D"font-size:11.0pt;font-family:Symbol;colo=
r:#1F497D"><span>=C2=B7<span style=3D"font:7.0pt &quot;Times New Roman&quot=
;">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 </span></span></span><s=
pan style=3D"font-size:11.0pt;color:#1F497D">Using simple close semantics (=
whoever sends it, closes the entire session).</span></p>

<p style=3D"margin-left:.75in"><span style=3D"font-size:11.0pt;font-family:=
Symbol;color:#1F497D"><span>=C2=B7<span style=3D"font:7.0pt &quot;Times New=
 Roman&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 </span></spa=
n></span><span style=3D"font-size:11.0pt;color:#1F497D">No half-close seman=
tics as in TCP</span></p>

<p style=3D"margin-left:.75in"><span style=3D"font-size:11.0pt;font-family:=
Symbol;color:#1F497D"><span>=C2=B7<span style=3D"font:7.0pt &quot;Times New=
 Roman&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 </span></spa=
n></span><span style=3D"font-size:11.0pt;color:#1F497D">Assuming that any d=
ata draining must be taken care of by the app, so no need for acking a clos=
e.</span></p>

<p style=3D"margin-left:.75in"><span style=3D"font-size:11.0pt;font-family:=
Symbol;color:#1F497D"><span>=C2=B7<span style=3D"font:7.0pt &quot;Times New=
 Roman&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 </span></spa=
n></span><span style=3D"font-size:11.0pt;color:#1F497D">Assuming that the p=
rimary purpose of a Close is to inform intermediaries that the session is n=
ow terminated.</span></p>

<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">=C2=
=A0</span></p><p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:=
#1F497D">Proposed text is:</span></p><p class=3D"MsoNormal"><span style=3D"=
font-size:11.0pt;color:#1F497D">=C2=A0</span></p>

<p class=3D"MsoNormal">4.5.1. =C2=A0Close</p><p class=3D"MsoNormal">=C2=A0<=
/p><p class=3D"MsoNormal">=C2=A0=C2=A0 The Close message contains an opcode=
 of 0x01 and no body.</p><p class=3D"MsoNormal">=C2=A0</p><p class=3D"MsoNo=
rmal">=C2=A0=C2=A0 The websocket is considered fully closed when an endpoin=
t has either sent or received a Close message.</p>

<p class=3D"MsoNormal">=C2=A0=C2=A0 Accordingly, upon sending or receiving =
a Close message, no more data or control messages can be sent on =C2=A0the =
websocket.</p><p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:=
#1F497D">=C2=A0</span></p>

<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">Comme=
nts?</span></p></div></div></blockquote><div><br></div><div>I would say it =
is fully closed when both sent and received a Close message, or when the un=
derlying channel is closed.=C2=A0</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd6aeb4732064049be2e96a--

From derhoermi@gmx.net  Wed Feb  9 16:59:59 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 66B313A684D for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:59:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.847
X-Spam-Level: 
X-Spam-Status: No, score=-1.847 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_55=0.6, SARE_SUB_ENC_UTF8=0.152]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ocWYG9AGZSxN for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 16:59:58 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 093293A67FA for <hybi@ietf.org>; Wed,  9 Feb 2011 16:59:57 -0800 (PST)
Received: (qmail invoked by alias); 10 Feb 2011 01:00:06 -0000
Received: from dslb-094-223-223-041.pools.arcor-ip.net (EHLO HIVE) [94.223.223.41] by mail.gmx.net (mp032) with SMTP; 10 Feb 2011 02:00:06 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+n0Qcb7VGnEb8Ci6oqWqnvqQyV+/jsgK2yzqVtvU XEry6Oea/SED4l
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: g_e_montenegro@yahoo.com
Date: Thu, 10 Feb 2011 02:00:07 +0100
Message-ID: <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
In-Reply-To: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 00:59:59 -0000

* hybi issue tracker wrote:
> Additionally, when only partial frames may be available, it is expensive
> to verify that this is indeed a valid UTF-8 stream (protocol
> implementation needs to take into account multi-byte characters and end of
> current data payload).  If binary has been negotiated for this session,
> processing can be optimized accordingly.

If you do accept UTF-8 encoded data then you have to validate it, other-
wise you get strange and possibly dangerous failures if you receive mal-
formed data, for instance, you can't trust that the length has been cal-
culated correctly. Anyway, you would seem to have this problem due to
fragmentation anyway if you accept text frames, and if you don't mean to
accept text frames then you just don't, there would seem to be no need
to negotiate for "binary-only". I also note that validating UTF-8 is not
really expensive, it's just a matter of `state = table[state + byte]`
for each byte. Work, sure, but not very "expensive". It's easy too if
you use my http://bjoern.hoehrmann.de/utf-8/decoder/dfa/ decoder for it.

> Proposal: allow negotiation to clarify if a stream will not mix binary and
> text in order to enable optimizing for the binary-only case.

I do agree the protocol specification needs to discuss mixing frame
types, like, what if you have a fragmented text message but one of the
frames is not a text frame, but allowing to negotiate this complexity
away will most likely lead to interoperability and security problems, as
people will take shortcuts like not validating the frame type. We've
in fact seen that already on this list. Essentially negotiation binary-
only would be subsetting and fragmenting the protocol, and I don't think
the benefit here warrants that.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From gregw@intalio.com  Wed Feb  9 17:04:03 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6BBC53A682D for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 17:04:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.77
X-Spam-Level: 
X-Spam-Status: No, score=-1.77 tagged_above=-999 required=5 tests=[AWL=1.207,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J0Mkf0eDi67G for <hybi@core3.amsl.com>; Wed,  9 Feb 2011 17:04:02 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 7FDA13A684D for <hybi@ietf.org>; Wed,  9 Feb 2011 17:04:02 -0800 (PST)
Received: by vws7 with SMTP id 7so540470vws.31 for <hybi@ietf.org>; Wed, 09 Feb 2011 17:04:13 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.190.197 with SMTP id dj5mr3300239vcb.4.1297299852954; Wed, 09 Feb 2011 17:04:12 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.77.205 with HTTP; Wed, 9 Feb 2011 17:04:12 -0800 (PST)
In-Reply-To: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com>
Date: Thu, 10 Feb 2011 12:04:12 +1100
X-Google-Sender-Auth: 4BAC3XGF-vA13XR5MXGNz_s3Nfo
Message-ID: <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Takeshi Yoshino <tyoshino@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 01:04:03 -0000

One of the other aims of the closing handshake was to better identify
error condition, so as to prevent a client repeating unacceptable
operations.

For example, if a client sends a frame that is too large for the
server to handle, the server needs to indicate that an error condition
has occurred.  If the connection is closed (orderly or otherwise) ,
then the client might assume that it was an idle shutdown or transient
condition on the server and thus open a new connection and continue to
send over large frames.


Currently -05 says:

7.1.2.  Server-initiated closure
   Certain algorithms require or recommend that the server *abort the
   WebSocket connection* during the opening handshake.  To do so, the
   server must simply close the WebSocket connection.


the problem with this is that for a client such a close of the
websocket connection cannot be distinguished from a
network/intermediary failure.   I think that typically an aborted
connection should not be retried, but a network/intermediary failure
should be - so it would be good to be able to signal to the client the
difference.

Thus I'd like to suggest that the close handshake carry a single byte
of reason for the close.
I think it would be sufficient to define just:

  0x00 Normal close
  0x01 Abnormal close

But I could see an argument for something a little richer:

 0x00 Idle close
 0x01 close
 0x02 abnormal close

but I concede that the danger here is trying to define too many close states

From Gabriel.Montenegro@microsoft.com  Thu Feb 10 00:50:04 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE7DD3A69F4 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 00:50:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.448
X-Spam-Level: 
X-Spam-Status: No, score=-9.448 tagged_above=-999 required=5 tests=[AWL=1.150,  BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TIicuofgDFTS for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 00:50:02 -0800 (PST)
Received: from smtp.microsoft.com (mailc.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id E0FD13A6933 for <hybi@ietf.org>; Thu, 10 Feb 2011 00:50:02 -0800 (PST)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Thu, 10 Feb 2011 00:50:14 -0800
Received: from TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com (157.54.71.39) by TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) with Microsoft SMTP Server (TLS) id 14.1.270.2; Thu, 10 Feb 2011 00:50:14 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.39]) with mapi; Thu, 10 Feb 2011 00:50:13 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: "hybi@ietf.org" <hybi@ietf.org>
Thread-Topic: fyi: Websockets prototype updated
Thread-Index: AcvI/4dn5mdHes0fR0C3JJKbpFEjxQ==
Date: Thu, 10 Feb 2011 08:50:12 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04DBF@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E04DBFTK5EX14MBXW605w_"
MIME-Version: 1.0
Subject: [hybi] fyi: Websockets prototype updated
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 08:50:04 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E04DBFTK5EX14MBXW605w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

FYI, the prototype available at HTML5 Labs was recently updated to rev 04 o=
f the draft. We expect to continue updating the prototype to 05 and beyond:
http://blogs.msdn.com/b/interoperability/archive/2011/02/09/the-updated-web=
sockets-prototype.aspx

One more demo was added (now 3). For further info, downloads, etc:
http://html5labs.interoperabilitybridges.com/prototypes/available-for-downl=
oad/websockets

Gabriel



--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E04DBFTK5EX14MBXW605w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40"><head><meta http-equiv=3DContent-Type content=
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros=
oft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue vli=
nk=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal>FYI, the prototy=
pe available at HTML5 Labs was recently updated to rev 04 of the draft. We =
expect to continue updating the prototype to 05 and beyond:<o:p></o:p></p><=
p class=3DMsoNormal><a href=3D"http://blogs.msdn.com/b/interoperability/arc=
hive/2011/02/09/the-updated-websockets-prototype.aspx">http://blogs.msdn.co=
m/b/interoperability/archive/2011/02/09/the-updated-websockets-prototype.as=
px</a> <o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3D=
MsoNormal>One more demo was added (now 3). For further info, downloads, etc=
:<o:p></o:p></p><p class=3DMsoNormal><a href=3D"http://html5labs.interopera=
bilitybridges.com/prototypes/available-for-download/websockets">http://html=
5labs.interoperabilitybridges.com/prototypes/available-for-download/websock=
ets</a><o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3D=
MsoNormal>Gabriel<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><=
p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div></body></html>=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E04DBFTK5EX14MBXW605w_--

From Gabriel.Montenegro@microsoft.com  Thu Feb 10 01:25:42 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B0B223A6951 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:25:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.024
X-Spam-Level: 
X-Spam-Status: No, score=-10.024 tagged_above=-999 required=5 tests=[AWL=0.575, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vjp62E9vedap for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:25:41 -0800 (PST)
Received: from smtp.microsoft.com (maila.microsoft.com [131.107.115.212]) by core3.amsl.com (Postfix) with ESMTP id 7462A3A6885 for <hybi@ietf.org>; Thu, 10 Feb 2011 01:25:40 -0800 (PST)
Received: from TK5EX14HUBC101.redmond.corp.microsoft.com (157.54.7.153) by TK5-EXGWY-E801.partners.extranet.microsoft.com (10.251.56.50) with Microsoft SMTP Server (TLS) id 8.2.176.0; Thu, 10 Feb 2011 01:25:52 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14HUBC101.redmond.corp.microsoft.com (157.54.7.153) with Microsoft SMTP Server (TLS) id 14.1.270.2; Thu, 10 Feb 2011 01:25:51 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Thu, 10 Feb 2011 01:25:51 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Greg Wilkins <gregw@webtide.com>, Takeshi Yoshino <tyoshino@google.com>
Thread-Topic: [hybi] Clarify the role of closing handshake
Thread-Index: AQHLyLZQD4/LNEvRdUK4csWEI+DaLJP6cYsAgAABlOA=
Date: Thu, 10 Feb 2011 09:25:50 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com>
In-Reply-To: <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 09:25:42 -0000

I think your simple reason would be enough (either normal or abnormal close=
 for now).

To be clear: you're not arguing against the simplified semantics of conside=
ring the websocket closed (no further data or control) upon either sending =
or receiving a Close message, correct?

> -----Original Message-----
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of G=
reg
> Wilkins
> Sent: Wednesday, February 09, 2011 17:04
> To: Takeshi Yoshino
> Cc: hybi@ietf.org
> Subject: Re: [hybi] Clarify the role of closing handshake
>=20
> One of the other aims of the closing handshake was to better identify err=
or
> condition, so as to prevent a client repeating unacceptable operations.
>=20
> For example, if a client sends a frame that is too large for the server t=
o handle,
> the server needs to indicate that an error condition has occurred.  If th=
e
> connection is closed (orderly or otherwise) , then the client might assum=
e that it
> was an idle shutdown or transient condition on the server and thus open a=
 new
> connection and continue to send over large frames.
>=20
>=20
> Currently -05 says:
>=20
> 7.1.2.  Server-initiated closure
>    Certain algorithms require or recommend that the server *abort the
>    WebSocket connection* during the opening handshake.  To do so, the
>    server must simply close the WebSocket connection.
>=20
>=20
> the problem with this is that for a client such a close of the websocket
> connection cannot be distinguished from a
> network/intermediary failure.   I think that typically an aborted
> connection should not be retried, but a network/intermediary failure shou=
ld be -
> so it would be good to be able to signal to the client the difference.
>=20
> Thus I'd like to suggest that the close handshake carry a single byte of =
reason for
> the close.
> I think it would be sufficient to define just:
>=20
>   0x00 Normal close
>   0x01 Abnormal close
>=20
> But I could see an argument for something a little richer:
>=20
>  0x00 Idle close
>  0x01 close
>  0x02 abnormal close
>=20
> but I concede that the danger here is trying to define too many close sta=
tes
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi


From gregw@intalio.com  Thu Feb 10 01:43:54 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9A20F3A69F4 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:43:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.374
X-Spam-Level: 
X-Spam-Status: No, score=-2.374 tagged_above=-999 required=5 tests=[AWL=0.603,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KH7gls3HLgHi for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:43:53 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 5A0D23A6961 for <hybi@ietf.org>; Thu, 10 Feb 2011 01:43:53 -0800 (PST)
Received: by vws7 with SMTP id 7so743177vws.31 for <hybi@ietf.org>; Thu, 10 Feb 2011 01:44:04 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.194.1 with SMTP id dw1mr5488922vcb.179.1297331043847; Thu, 10 Feb 2011 01:44:03 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.77.205 with HTTP; Thu, 10 Feb 2011 01:44:03 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
Date: Thu, 10 Feb 2011 20:44:03 +1100
X-Google-Sender-Auth: NsE9hIfhzlCmmNQMvpN--tZMiPI
Message-ID: <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 09:43:54 -0000

On 10 February 2011 20:25, Gabriel Montenegro
<Gabriel.Montenegro@microsoft.com> wrote:
> I think your simple reason would be enough (either normal or abnormal clo=
se for now).

cool

> To be clear: you're not arguing against the simplified semantics of consi=
dering the websocket closed (no further data or control) upon either sendin=
g or receiving a Close message, correct?

I'm not arguing either way.  I can see the benefits of half close and
flush through, but also the complexities, so I'm happy to follow herd
on this one.

cheers


>> -----Original Message-----
>> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of =
Greg
>> Wilkins
>> Sent: Wednesday, February 09, 2011 17:04
>> To: Takeshi Yoshino
>> Cc: hybi@ietf.org
>> Subject: Re: [hybi] Clarify the role of closing handshake
>>
>> One of the other aims of the closing handshake was to better identify er=
ror
>> condition, so as to prevent a client repeating unacceptable operations.
>>
>> For example, if a client sends a frame that is too large for the server =
to handle,
>> the server needs to indicate that an error condition has occurred. =A0If=
 the
>> connection is closed (orderly or otherwise) , then the client might assu=
me that it
>> was an idle shutdown or transient condition on the server and thus open =
a new
>> connection and continue to send over large frames.
>>
>>
>> Currently -05 says:
>>
>> 7.1.2. =A0Server-initiated closure
>> =A0 =A0Certain algorithms require or recommend that the server *abort th=
e
>> =A0 =A0WebSocket connection* during the opening handshake. =A0To do so, =
the
>> =A0 =A0server must simply close the WebSocket connection.
>>
>>
>> the problem with this is that for a client such a close of the websocket
>> connection cannot be distinguished from a
>> network/intermediary failure. =A0 I think that typically an aborted
>> connection should not be retried, but a network/intermediary failure sho=
uld be -
>> so it would be good to be able to signal to the client the difference.
>>
>> Thus I'd like to suggest that the close handshake carry a single byte of=
 reason for
>> the close.
>> I think it would be sufficient to define just:
>>
>> =A0 0x00 Normal close
>> =A0 0x01 Abnormal close
>>
>> But I could see an argument for something a little richer:
>>
>> =A00x00 Idle close
>> =A00x01 close
>> =A00x02 abnormal close
>>
>> but I concede that the danger here is trying to define too many close st=
ates
>> _______________________________________________
>> hybi mailing list
>> hybi@ietf.org
>> https://www.ietf.org/mailman/listinfo/hybi
>
>

From Gabriel.Montenegro@microsoft.com  Thu Feb 10 01:47:14 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 732083A6940 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:47:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.839
X-Spam-Level: 
X-Spam-Status: No, score=-9.839 tagged_above=-999 required=5 tests=[AWL=0.008,  BAYES_00=-2.599, J_CHICKENPOX_55=0.6, RCVD_IN_DNSWL_HI=-8, SARE_SUB_ENC_UTF8=0.152]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RvhLIz9VfdRz for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:47:13 -0800 (PST)
Received: from smtp.microsoft.com (mailb.microsoft.com [131.107.115.215]) by core3.amsl.com (Postfix) with ESMTP id 3E3953A6933 for <hybi@ietf.org>; Thu, 10 Feb 2011 01:47:13 -0800 (PST)
Received: from TK5EX14HUBC101.redmond.corp.microsoft.com (157.54.7.153) by TK5-EXGWY-E802.partners.extranet.microsoft.com (10.251.56.168) with Microsoft SMTP Server (TLS) id 8.2.176.0; Thu, 10 Feb 2011 01:47:24 -0800
Received: from TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com (157.54.71.39) by TK5EX14HUBC101.redmond.corp.microsoft.com (157.54.7.153) with Microsoft SMTP Server (TLS) id 14.1.270.2; Thu, 10 Feb 2011 01:47:24 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.39]) with mapi; Thu, 10 Feb 2011 01:47:24 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>, "g_e_montenegro@yahoo.com" <g_e_montenegro@yahoo.com>
Thread-Topic: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
Thread-Index: AQHLyL3zrxOYNTkuIkOg6Nb3OoxxI5P6fJmA
Date: Thu, 10 Feb 2011 09:47:22 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org> <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de>
In-Reply-To: <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8	mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 09:47:14 -0000

Yes, if one accepts UTF-8, that must be validated, no question about it. Th=
e point is not to disallow UTF-8, but to be able to optimize on those webso=
cket connections that use binary only, so this is not a fragmenting of the =
protocol any more than any other per-session negotiable feature is.

>From the comments, folks seem to be thinking about Javascript Websockets AP=
I, and how it does not allow binary nor support streaming. That's true, but=
 as we've emphasized before: we're designing the websockets protocol to be =
usable with the JS Websockets API, but is not limited to it. Other APIs may=
 offer both binary and streaming.

> -----Original Message-----
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Bjoern Hoehrmann
> Sent: Wednesday, February 09, 2011 17:00
> To: g_e_montenegro@yahoo.com
> Cc: hybi@ietf.org
> Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 =
mixed
> handling
>=20
> * hybi issue tracker wrote:
> > Additionally, when only partial frames may be available, it is
> > expensive to verify that this is indeed a valid UTF-8 stream (protocol
> > implementation needs to take into account multi-byte characters and
> > end of current data payload).  If binary has been negotiated for this
> > session, processing can be optimized accordingly.
>=20
> If you do accept UTF-8 encoded data then you have to validate it, other- =
wise
> you get strange and possibly dangerous failures if you receive mal- forme=
d data,
> for instance, you can't trust that the length has been cal- culated corre=
ctly.
> Anyway, you would seem to have this problem due to fragmentation anyway i=
f
> you accept text frames, and if you don't mean to accept text frames then =
you
> just don't, there would seem to be no need to negotiate for "binary-only"=
. I also
> note that validating UTF-8 is not really expensive, it's just a matter of=
 `state =3D
> table[state + byte]` for each byte. Work, sure, but not very "expensive".=
 It's easy
> too if you use my http://bjoern.hoehrmann.de/utf-8/decoder/dfa/ decoder f=
or
> it.
>=20
> > Proposal: allow negotiation to clarify if a stream will not mix binary
> > and text in order to enable optimizing for the binary-only case.
>=20
> I do agree the protocol specification needs to discuss mixing frame types=
, like,
> what if you have a fragmented text message but one of the frames is not a=
 text
> frame, but allowing to negotiate this complexity away will most likely le=
ad to
> interoperability and security problems, as people will take shortcuts lik=
e not
> validating the frame type. We've in fact seen that already on this list. =
Essentially
> negotiation binary- only would be subsetting and fragmenting the protocol=
, and
> I don't think the benefit here warrants that.
> --
> Bj=F6rn H=F6hrmann =B7 mailto:bjoern@hoehrmann.de =B7 http://bjoern.hoehr=
mann.de
> Am Badedeich 7 =B7 Telefon: +49(0)160/4415681 =B7 http://www.bjoernsworld=
.de
> 25899 Dageb=FCll =B7 PGP Pub. KeyID: 0xA4357E78 =B7 http://www.websitedev=
.de/
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi


From andy.warmcat.com@googlemail.com  Thu Feb 10 01:49:01 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 985653A6929 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:49:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eEGJCpCTIv28 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 01:49:00 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 4DDE93A6885 for <hybi@ietf.org>; Thu, 10 Feb 2011 01:49:00 -0800 (PST)
Received: by wwa36 with SMTP id 36so1167622wwa.13 for <hybi@ietf.org>; Thu, 10 Feb 2011 01:49:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=LAx0Ujh3qS7737bc3+pRoyavQ2Yg5KKwQkpAhPe6IeI=; b=v8iti7Sh23XgWnO3gk7tdkhwKQU3s+qHLD+NuNY1G7eb0Q3I3fsmvCF00V54dof7oI lNs6iCrEo34Dlxq95GrdDFfAa38vqtg7pXQyuS/LQcuw+sS6sBu6EaeSZCp3ohaT8Kkv qKkeQzs8fLlwww9dSVY8oBjYj3j6xj4CkGIVo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; b=JM7dTTkQKMJrd/7zy88AU7bn5L/gQ1Q9ehcCcPbEUu8fUTrVPSCLf6zHEJtKG22y9l 9QBpC2CxU3JuKojUXYsYYxdSEAt43UwbLlsOvBsnFP8cimuF3Gf6Qc5uvx+MHJBYVQrK cjM6fdqvCYYvd3+XtiKCW6WXFOZnvo8TGUOHw=
Received: by 10.227.201.5 with SMTP id ey5mr3317747wbb.182.1297331350945; Thu, 10 Feb 2011 01:49:10 -0800 (PST)
Received: from [192.168.1.4] (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id w25sm1085532wbd.11.2011.02.10.01.49.09 (version=SSLv3 cipher=RC4-MD5); Thu, 10 Feb 2011 01:49:09 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D53B495.8050608@warmcat.com>
Date: Thu, 10 Feb 2011 09:49:09 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Hybi <hybi@ietf.org>
References: <20110208231502.31262.8249.idtracker@localhost> <4D52584A.4070000@warmcat.com>
In-Reply-To: <4D52584A.4070000@warmcat.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [hybi] I-D Action:draft-ietf-hyb / libwebsockets updated to 05 framing
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 09:49:01 -0000

On 02/09/11 09:03, Somebody in the thread at some point said:

> Ran out of time to do the new close stuff before "real work" must start
> but otherwise it's probably a useful sparring partner for other client
> or server implementations.
>
> http://git.warmcat.com/cgi-bin/cgit/libwebsockets/

The 05 CLOSE stuff on client and server is added earlier thismorning so 
it should be a reasonably complete 05 implementation now.

-Andy

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 10 02:59:37 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E1B943A696E for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 02:59:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.264
X-Spam-Level: 
X-Spam-Status: No, score=-6.264 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pUhUgyZRAzpm for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 02:59:36 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 9D26C3A6974 for <hybi@ietf.org>; Thu, 10 Feb 2011 02:59:36 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021002594236-410380 ; Thu, 10 Feb 2011 02:59:42 -0800 
In-Reply-To: <20110208231502.31262.8249.idtracker@localhost>
To: hybi@ietf.org
MIME-Version: 1.0
X-KeepSent: 44DCAB38:CFF4042C-88257833:0030697C; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 10 Feb 2011 02:59:12 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/10/2011 02:59:42 AM, Serialize complete at 02/10/2011 02:59:42 AM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 02:59:42 AM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 02:59:49 AM, Serialize complete at 02/10/2011 02:59:49 AM
Content-Type: multipart/alternative; boundary="=_alternative 003C5A3B88257833_="
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 10:59:38 -0000

This is a multipart message in MIME format.
--=_alternative 003C5A3B88257833_=
Content-Type: text/plain; charset="US-ASCII"

Hi,

I have just started studying details of ws protocol on my new given task. 
I read -05  and 
I would like to give you some of my thoughts as feedback, with a few 
questions about the 
protocol. I would assume some of my questions have already been 
discussed/resolved. 
In such case, if you could kindly  refer me to relevant discussions made 
in the past, 
that would be great.


o Section 1.3 - discrepancy in SHA1 hash value:

My python says:
>>> h = hashlib.sha1()
>>> h.update('dGhlIHNhbXBsZSBub25jZQ==258EAFA5-E914-47DA-95CA- 
C5AB0DC85B11')
>>> h.hexdigest()
'1b334d8e1b8d57c1c7a214517c106abc434282b8'

which is different from what the example says in -05. Am I missing 
something?


o Section 1.9 - subprotocols

It would be better if the document describes expected behavior of server 
and client
when Sec-Websocket-Protocol header is not present.


o Section 2.1 - typo?

What is IRI? You mean, "URL"?


o Section 4.3 - Opcodes
In the description of 'Opcode', I thought it would be better to have a 
list of currently defined
opcodes with a brief description. (It's trivial though it helps for a 
reader like myself.)

e.g.)
    0x0: continuation frame
    0x1: connection close (A control frame)
    0x2: ping (A control frame)
    0x3: pong (A control frame)
    0x4: text frame
    0x5: binary frame
    0x6-F: reserved


o  Section 4.3 - Continuation frame (opcode=%x0)

It is not clear to me in the document how this frame (opcode=0) is used 
while there's
FIN bit for fragmentation/defragmentation.

Section 4.4 says, 
"..., and terminated by a single frame with the FIN bit set and an opcode 
of 0"

Considering a case where there are text and binary frames that are both 
fragmented
and alternating over the wire, how can application tell which frame (text 
or binary) the
last frame with FIN=1 set belongs to?

For example:
[op=txt, fin=0] [op=bin, fin=0] [op=0, fin=1] <== is this for txt or bin?

Is this kind of multiplexing support intended in the protocol design? If 
the doc explains
why and how fragmentation is used.


o Section 4.5.1 - the term "body"

For consistency, it should be replaced with Application Data, or "body" be 
defined explicitly in the document.


o Section 4.5.1 - Close handshake

It is no clear to me what 0x43 and 0x53 are trying to achieve. In TCP, 
there is FIN with no 
details of why/who is closing for graceful shutdown.


o Section 4.5.2 and 4.5.3

It would be better if there is some description for why we have ping and 
pong frames, 
especially for implementers. For example, ping/pong can be used to keep 
TCP 
connection alive at application level which can be transparent to 
application. But it can 
also be used for app to detect 'presence' of a client for the use in the 
app.
(# I myself can not tell what the original intention is by just reading 
-05.)


o Section 7.2 - _cleanly_

Very very trivial, but why not use "gracefully" which is widely used in 
TCP land.


o Overall

As I was reading though, it took some time to find out which feature is 
for which entities
role as in protocol layering. Ping/pong protocol for example, I am still 
not sure if
this is done by WebSocket protocol internally or exposed to application. 
Another 
examples would be the extension data filed - who is going to parse it?

Most of this ambiguity may be clear in the use of JS under WebSocket API. 
But I am
coming from non-browser perspectives and I would probably need to figure 
out
how to implement *protocol API* for non-application developers for 
example.

If there's a layer structure with interfaces defined in the document, that 
would be a
great help - something like:

===== WebSocket API ======
+------------------------+
|  WS-JS Bridge (if any) |
+------------------------+
+--------++--------------+
|        ||              |
|  HTTP  |+--+---+ Web   |                      -- peer -- 
|        |   ^   | Socket|
|        |  (HS) |       | <== WS protocol ==> [WS entity]
|        |   v   |       |
|        +---+--+|       |
|               |<========== HTTP ===========> [HTTP entity]
+---------------++-------+
+------------------------+
|         TCP/IP         |
+------------------------+

I wish I could help constructing more specific proposal rather than just 
giving you
comments, but I am still trying to catch up with the current status, to be 
honest. I hope
above would be of a little help at least for the WG.

Best regards,
--
Yutaka Takeda

--=_alternative 003C5A3B88257833_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Hi,</font>
<br>
<br><font size=2 face="sans-serif">I have just started studying details
of ws protocol on my new given task. I read -05 &nbsp;and </font>
<br><font size=2 face="sans-serif">I would like to give you some of my
thoughts as feedback, with a few questions about the </font>
<br><font size=2 face="sans-serif">protocol. I would assume some of my
questions have already been discussed/resolved. </font>
<br><font size=2 face="sans-serif">In such case, if you could kindly &nbsp;refer
me to relevant discussions made in the past, </font>
<br><font size=2 face="sans-serif">that would be great.</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 1.3 - discrepancy in SHA1
hash value:</font>
<br>
<br><font size=2 face="sans-serif">My python says:</font>
<br><font size=2 face="sans-serif">&gt;&gt;&gt; h = hashlib.sha1()</font>
<br><font size=2 face="sans-serif">&gt;&gt;&gt; h.update('dGhlIHNhbXBsZSBub25jZQ==258EAFA5-E914-47DA-95CA-
C5AB0DC85B11')</font>
<br><font size=2 face="sans-serif">&gt;&gt;&gt; h.hexdigest()</font>
<br><font size=2 face="sans-serif">'1b334d8e1b8d57c1c7a214517c106abc434282b8'</font>
<br>
<br><font size=2 face="sans-serif">which is different from what the example
says in -05. Am I missing something?</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 1.9 - subprotocols</font>
<br>
<br><font size=2 face="sans-serif">It would be better if the document describes
expected behavior of server and client</font>
<br><font size=2 face="sans-serif">when Sec-Websocket-Protocol header is
not present.</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 2.1 - typo?</font>
<br>
<br><font size=2 face="sans-serif">What is IRI? You mean, &quot;URL&quot;?</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 4.3 - Opcodes</font>
<br><font size=2 face="sans-serif">In the description of 'Opcode', I thought
it would be better to have a list of currently defined</font>
<br><font size=2 face="sans-serif">opcodes with a brief description. (It's
trivial though it helps for a reader like myself.)</font>
<br>
<br><font size=2 face="sans-serif">e.g.)</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x0: continuation frame</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x1: connection close
(A control frame)</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x2: ping (A control frame)</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x3: pong (A control frame)</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x4: text frame</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x5: binary frame</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; 0x6-F: reserved</font>
<br>
<br>
<br><font size=2 face="sans-serif">o &nbsp;Section 4.3 - Continuation frame
(opcode=%x0)</font>
<br>
<br><font size=2 face="sans-serif">It is not clear to me in the document
how this frame (opcode=0) is used while there's</font>
<br><font size=2 face="sans-serif">FIN bit for fragmentation/defragmentation.</font>
<br>
<br><font size=2 face="sans-serif">Section 4.4 says, </font>
<br><font size=2 face="sans-serif">&quot;..., and terminated by a single
frame with the FIN bit set and an opcode of 0&quot;</font>
<br>
<br><font size=2 face="sans-serif">Considering a case where there are text
and binary frames that are both fragmented</font>
<br><font size=2 face="sans-serif">and alternating over the wire, how can
application tell which frame (text or binary) the</font>
<br><font size=2 face="sans-serif">last frame with FIN=1 set belongs to?</font>
<br>
<br><font size=2 face="sans-serif">For example:</font>
<br><font size=2 face="sans-serif">[op=txt, fin=0] [op=bin, fin=0] [op=0,
fin=1] &lt;== is this for txt or bin?</font>
<br>
<br><font size=2 face="sans-serif">Is this kind of multiplexing support
intended in the protocol design? If the doc explains</font>
<br><font size=2 face="sans-serif">why and how fragmentation is used.</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 4.5.1 - the term &quot;body&quot;</font>
<br>
<br><font size=2 face="sans-serif">For consistency, it should be replaced
with Application Data, or &quot;body&quot; be defined explicitly in the
document.</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 4.5.1 - Close handshake</font>
<br>
<br><font size=2 face="sans-serif">It is no clear to me what 0x43 and 0x53
are trying to achieve. In TCP, there is FIN with no </font>
<br><font size=2 face="sans-serif">details of why/who is closing for graceful
shutdown.</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 4.5.2 and 4.5.3</font>
<br>
<br><font size=2 face="sans-serif">It would be better if there is some
description for why we have ping and pong frames, </font>
<br><font size=2 face="sans-serif">especially for implementers. For example,
ping/pong can be used to keep TCP </font>
<br><font size=2 face="sans-serif">connection alive at application level
which can be transparent to application. But it can </font>
<br><font size=2 face="sans-serif">also be used for app to detect 'presence'
of a client for the use in the app.</font>
<br><font size=2 face="sans-serif">(# I myself can not tell what the original
intention is by just reading -05.)</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Section 7.2 - _cleanly_</font>
<br>
<br><font size=2 face="sans-serif">Very very trivial, but why not use &quot;gracefully&quot;
which is widely used in TCP land.</font>
<br>
<br>
<br><font size=2 face="sans-serif">o Overall</font>
<br>
<br><font size=2 face="sans-serif">As I was reading though, it took some
time to find out which feature is for which entities</font>
<br><font size=2 face="sans-serif">role as in protocol layering. Ping/pong
protocol for example, I am still not sure if</font>
<br><font size=2 face="sans-serif">this is done by WebSocket protocol internally
or exposed to application. Another </font>
<br><font size=2 face="sans-serif">examples would be the extension data
filed - who is going to parse it?</font>
<br>
<br><font size=2 face="sans-serif">Most of this ambiguity may be clear
in the use of JS under WebSocket API. But I am</font>
<br><font size=2 face="sans-serif">coming from non-browser perspectives
and I would probably need to figure out</font>
<br><font size=2 face="sans-serif">how to implement *protocol API* for
non-application developers for example.</font>
<br>
<br><font size=2 face="sans-serif">If there's a layer structure with interfaces
defined in the document, that would be a</font>
<br><font size=2 face="sans-serif">great help - something like:</font>
<br>
<br><font size=2 face="Fixedsys">===== WebSocket API ======</font>
<br><font size=2 face="Fixedsys">+------------------------+</font>
<br><font size=2 face="Fixedsys">| &nbsp;WS-JS Bridge (if any) |</font>
<br><font size=2 face="Fixedsys">+------------------------+</font>
<br><font size=2 face="Fixedsys">+--------++--------------+</font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp;|| &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|</font>
<br><font size=2 face="Fixedsys">| &nbsp;HTTP &nbsp;|+--+---+ Web &nbsp;
| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp;-- peer -- </font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;
^ &nbsp; | Socket|</font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;(HS)
| &nbsp; &nbsp; &nbsp; | &lt;== WS protocol ==&gt; [WS entity]</font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;
v &nbsp; | &nbsp; &nbsp; &nbsp; |</font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp;+---+--+|
&nbsp; &nbsp; &nbsp; |</font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; |&lt;========== HTTP ===========&gt; [HTTP entity]</font>
<br><font size=2 face="Fixedsys">+---------------++-------+</font>
<br><font size=2 face="Fixedsys">+------------------------+</font>
<br><font size=2 face="Fixedsys">| &nbsp; &nbsp; &nbsp; &nbsp; TCP/IP &nbsp;
&nbsp; &nbsp; &nbsp; |</font>
<br><font size=2 face="Fixedsys">+------------------------+</font>
<br>
<br><font size=2 face="sans-serif">I wish I could help constructing more
specific proposal rather than just giving you</font>
<br><font size=2 face="sans-serif">comments, but I am still trying to catch
up with the current status, to be honest. I hope</font>
<br><font size=2 face="sans-serif">above would be of a little help at least
for the WG.</font>
<br>
<br><font size=2 face="sans-serif">Best regards,</font>
<br><font size=2 face="sans-serif">--<br>
Yutaka Takeda</font>
<br>
--=_alternative 003C5A3B88257833_=--

From julian.reschke@gmx.de  Thu Feb 10 03:26:58 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1CC3B3A6970 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 03:26:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.599
X-Spam-Level: 
X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fMGCfWyk8DLf for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 03:26:57 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id E81FE3A6965 for <hybi@ietf.org>; Thu, 10 Feb 2011 03:26:56 -0800 (PST)
Received: (qmail invoked by alias); 10 Feb 2011 11:27:07 -0000
Received: from p508FA0C5.dip.t-dialin.net (EHLO [192.168.178.33]) [80.143.160.197] by mail.gmx.net (mp062) with SMTP; 10 Feb 2011 12:27:07 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX1+ci05TJiWcv+I6TVd+MmwG6dPfhj7wOkXd6pfai2 8Iu89Q8CYVvWNE
Message-ID: <4D53CB85.6070408@gmx.de>
Date: Thu, 10 Feb 2011 12:27:01 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Yutaka_Takeda@PlayStation.Sony.Com
References: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
In-Reply-To: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: [hybi] Terminology, was:  I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 11:26:58 -0000

On 10.02.2011 11:59, Yutaka_Takeda@PlayStation.Sony.Com wrote:
> ...
> o Section 2.1 - typo?
>
> What is IRI? You mean, "URL"?
> ...

I see

>    The term "URL" is used in this section in a manner consistent with
>    the terminology used in HTML, namely, to denote a string that might
>    or might not be a valid URI or IRI and to which certain error
>    handling behaviors will be applied when the string is parsed.  [HTML]

This needs to be fixed to be either "URI" or "IRI" (depending on what we 
actually want, I *suspect* URI); and of course the bogus HTML reference 
needs to go.

Best regards, Julian

From andy.warmcat.com@googlemail.com  Thu Feb 10 03:35:20 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 792C73A697B for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 03:35:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AQ4lE0TnCm5I for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 03:35:19 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id AEC9D3A698E for <hybi@ietf.org>; Thu, 10 Feb 2011 03:35:18 -0800 (PST)
Received: by wyf23 with SMTP id 23so1292918wyf.31 for <hybi@ietf.org>; Thu, 10 Feb 2011 03:35:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=rEFuh/gwW3vjvFMhBKPSQ18jxyuPnAz7M9aqFJ+hpJ0=; b=k0kkHc2M8kMq1mtuVXQjwcRMkiMveb1TmvjuaHLJ3mH22oEeqNLyLGiq3QOiqYVaGT /DG5AnkALsyeEbeAvXSf92YHRWucSFTy0d3z7aivixoBqsXfw3iKYxUGnggX0y4xEFdI Q93ftOPuMRdn1TF9/oZwoLrjQLwi2pTZ0mA1E=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=D6HBAmmzbL5vm9yJCbeySS8/lawXEUur/vKt5D1XmUxa4SgQtn65qYbj/BO92Tu3RQ nEn1+ZTUD+Y6K/gLyy5rRfs6DHMezQr6QLdu0UzFYQrGqVY8ZrHKg1LXyAmNRyCHSMN9 9WyoztSBQiAaIKWgcqqwn9JKzgnrt4YMWefCw=
Received: by 10.227.133.11 with SMTP id d11mr7452941wbt.193.1297337729114; Thu, 10 Feb 2011 03:35:29 -0800 (PST)
Received: from [192.168.1.4] (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id f27sm1151501wbf.19.2011.02.10.03.35.27 (version=SSLv3 cipher=RC4-MD5); Thu, 10 Feb 2011 03:35:28 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D53CD80.5040708@warmcat.com>
Date: Thu, 10 Feb 2011 11:35:28 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Yutaka_Takeda@PlayStation.Sony.Com
References: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
In-Reply-To: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Cc: hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 11:35:20 -0000

On 02/10/11 10:59, Somebody in the thread at some point said:

ã�“ã‚“ã�°ã‚“ã‚�ã€�ã‚†ã�Ÿã�‹ã�•ã‚“

> It would be better if the document describes expected behavior of server
> and client
> when Sec-Websocket-Protocol header is not present.

I guess it's just the degenerate case that the server only supports one 
protocol.

> o Section 2.1 - typo?
>
> What is IRI? You mean, "URL"?

It's "internationalized"

http://www.w3.org/International/O-URL-and-ident.html

> e.g.)
> 0x0: continuation frame
> 0x1: connection close (A control frame)
> 0x2: ping (A control frame)
> 0x3: pong (A control frame)
> 0x4: text frame
> 0x5: binary frame
> 0x6-F: reserved

Yes it's a nice idea.

> o Section 4.3 - Continuation frame (opcode=%x0)
>
> It is not clear to me in the document how this frame (opcode=0) is used
> while there's
> FIN bit for fragmentation/defragmentation.

Right it wasn't clear to me either.

> For example:
> [op=txt, fin=0] [op=bin, fin=0] [op=0, fin=1] <== is this for txt or bin?
>
> Is this kind of multiplexing support intended in the protocol design? If
> the doc explains
> why and how fragmentation is used.

It's not defined yet that muxing is allowed, it'll be an extension it 
seems.  When muxing is allowed, there will be a stream index in each 
fragment to allow deterministic reassembly.

> It is no clear to me what 0x43 and 0x53 are trying to achieve. In TCP,
> there is FIN with no
> details of why/who is closing for graceful shutdown.

I guess it at least is documentation if you are looking in tcpdump.

> It would be better if there is some description for why we have ping and
> pong frames,
> especially for implementers. For example, ping/pong can be used to keep TCP
> connection alive at application level which can be transparent to
> application. But it can
> also be used for app to detect 'presence' of a client for the use in the
> app.
> (# I myself can not tell what the original intention is by just reading
> -05.)

Yeah.

> As I was reading though, it took some time to find out which feature is
> for which entities
> role as in protocol layering. Ping/pong protocol for example, I am still
> not sure if
> this is done by WebSocket protocol internally or exposed to application.

In libwesockets

http://git.warmcat.com/cgi-bin/cgit/libwebsockets/

the library takes care of all control frames.  It passes a message to 
the user callback to notify PONG receipt but it just returns by default. 
  The actual CONTINUATION, CLOSE, PING, PONG service is done in the 
library without bothering user code.

BTW libwebsockets is C, LGPL2, maybe it can help you.

> Another
> examples would be the extension data filed - who is going to parse it?

For extensions that are transparent, like gzip or mux, then the 
websocket library can hide it from the user.  Anything more complicated 
will have to be a co-operation between library and user handling.

> Most of this ambiguity may be clear in the use of JS under WebSocket
> API. But I am
> coming from non-browser perspectives and I would probably need to figure
> out
> how to implement *protocol API* for non-application developers for example.

Yeah that is my situation too.

> If there's a layer structure with interfaces defined in the document,
> that would be a
> great help - something like:

I think that is probably out of scope, the protocol stands alone and 
it's best to restrict what it tries to define to what goes on the wire.

-Andy

From jat@google.com  Thu Feb 10 07:58:21 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D6AB83A69C8 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 07:58:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.976
X-Spam-Level: 
X-Spam-Status: No, score=-102.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fGeKhGtFvPeu for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 07:58:20 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 502893A69FB for <hybi@ietf.org>; Thu, 10 Feb 2011 07:58:20 -0800 (PST)
Received: from kpbe19.cbf.corp.google.com (kpbe19.cbf.corp.google.com [172.25.105.83]) by smtp-out.google.com with ESMTP id p1AFwVl3020426 for <hybi@ietf.org>; Thu, 10 Feb 2011 07:58:31 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297353512; bh=x0cKcXnd1vDNv5LPWSgQLMcjFsE=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=b2mST7INko6vCVvu0Jpf7Zy7yh2jpvT07dTSi2VrBSudSneOpGP4aT603PZ06he9T qfEUNDnuG3+4MufZQsVlg==
Received: from gwj15 (gwj15.prod.google.com [10.200.10.15]) by kpbe19.cbf.corp.google.com with ESMTP id p1AFwTuE027571 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 10 Feb 2011 07:58:29 -0800
Received: by gwj15 with SMTP id 15so820145gwj.7 for <hybi@ietf.org>; Thu, 10 Feb 2011 07:58:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=YSOQVA4HUO51mziMIRplc4NHZdkoQApZA1G6MVcBdjk=; b=OptjG07bBVrlYdpztRAOvRQTHHUVadw7/vMl8K9Flr6+FQ+rrmVjznH3xk02bm973e 0FoV2Piu9a1s6ZKIeITA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=MhPThiHtH5ESsCevS8Q081lqUtToCXdm7aba1FGXH60ZIui0d+cT6oaR9SxKFFD/n/ 7mu9BFAgQaeQuXY3ujzA==
Received: by 10.150.186.14 with SMTP id j14mr3347672ybf.149.1297353461221; Thu, 10 Feb 2011 07:57:41 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Thu, 10 Feb 2011 07:57:20 -0800 (PST)
In-Reply-To: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
References: <20110208231502.31262.8249.idtracker@localhost> <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
From: John Tamplin <jat@google.com>
Date: Thu, 10 Feb 2011 10:57:20 -0500
Message-ID: <AANLkTimdy0tQrdMHdN7bX7ty=A47qr9oag+nAcx3RtqR@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=000e0cd51b5439a251049befa4c3
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 15:58:21 -0000

--000e0cd51b5439a251049befa4c3
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 10, 2011 at 5:59 AM, <Yutaka_Takeda@playstation.sony.com> wrote:

> o  Section 4.3 - Continuation frame (opcode=%x0)
>
> It is not clear to me in the document how this frame (opcode=0) is used
> while there's
> FIN bit for fragmentation/defragmentation.
>

The reasonable options are:
 1) define a different frame format for continuation frames that doesn't
have opcodes
 2) use the same opcode as the original frame
 3) use a new opcode

#1 adds complexity and wastes bits for little benefit.  #3 has the benefit
of allowing you to detect the four states of a frame (single-frame message,
initial frame of fragmented message, middle frame of fragmented message,
final frame of fragmented message) if you care, and also provides
opportunity for more error checking.


> Section 4.4 says,
> "..., and terminated by a single frame with the FIN bit set and an opcode
> of 0"
>
> Considering a case where there are text and binary frames that are both
> fragmented
> and alternating over the wire, how can application tell which frame (text
> or binary) the
> last frame with FIN=1 set belongs to?
>
> For example:
> [op=txt, fin=0] [op=bin, fin=0] [op=0, fin=1] <== is this for txt or bin?
>
> Is this kind of multiplexing support intended in the protocol design? If
> the doc explains
> why and how fragmentation is used.
>

No, see 4.4.  Only control frames can be sent in the middle of a fragmented
message (I believe the "open question" line is out of date -- I think the
consensus was that control frames can be injected in the middle of a
fragmented message, otherwise the latency of responding to ping, for
example, would be very long if behind a large message), and control frames
cannot be fragmented.  Multiplexing will be defined as an extension and will
include logical channels.  Even in #2, you would have to maintain the frame
type from the original frame to avoid attacks like [BINARY "invalid UTF8"]
[TEXT/FIN "UTF8"] which could exploit bugs in UTF8 decoders.

o Overall


> As I was reading though, it took some time to find out which feature is for
> which entities
> role as in protocol layering. Ping/pong protocol for example, I am still
> not sure if
> this is done by WebSocket protocol internally or exposed to application.
> Another
> examples would be the extension data filed - who is going to parse it?


The WebSocket implementation will be the one to at least extract the
extension data from the frame, but the interpretation of that data will be
defined by the extension.  It may be processed by the WebSocket layer or the
application depending on the extension.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd51b5439a251049befa4c3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 10, 2011 at 5:59 AM,  <span dir=3D"l=
tr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Takeda=
@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;">

<font size=3D"2" face=3D"sans-serif">o =C2=A0Section 4.3 - Continuation fra=
me
(opcode=3D%x0)</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">It is not clear to me in the docum=
ent
how this frame (opcode=3D0) is used while there&#39;s</font>
<br><font size=3D"2" face=3D"sans-serif">FIN bit for fragmentation/defragme=
ntation.</font>
<br></blockquote><div><br></div><div>The reasonable options are:</div><div>=
=C2=A01) define a different frame format for continuation frames that doesn=
&#39;t have opcodes</div><div>=C2=A02) use the same opcode as the original =
frame</div>

<div>=C2=A03) use a new opcode</div><div><br></div><div>#1 adds complexity =
and wastes bits for little benefit. =C2=A0#3 has the benefit of allowing yo=
u to detect the four states of a frame (single-frame message, initial frame=
 of fragmented message, middle frame of fragmented message, final frame of =
fragmented message) if you care, and also provides opportunity for more err=
or checking.</div>

<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;"><font size=3D"2" face=3D"s=
ans-serif">Section 4.4 says, </font>
<br><font size=3D"2" face=3D"sans-serif">&quot;..., and terminated by a sin=
gle
frame with the FIN bit set and an opcode of 0&quot;</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Considering a case where there are=
 text
and binary frames that are both fragmented</font>
<br><font size=3D"2" face=3D"sans-serif">and alternating over the wire, how=
 can
application tell which frame (text or binary) the</font>
<br><font size=3D"2" face=3D"sans-serif">last frame with FIN=3D1 set belong=
s to?</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">For example:</font>
<br><font size=3D"2" face=3D"sans-serif">[op=3Dtxt, fin=3D0] [op=3Dbin, fin=
=3D0] [op=3D0,
fin=3D1] &lt;=3D=3D is this for txt or bin?</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Is this kind of multiplexing suppo=
rt
intended in the protocol design? If the doc explains</font>
<br><font size=3D"2" face=3D"sans-serif">why and how fragmentation is used.=
</font>
<br></blockquote><div><br></div><div>No, see 4.4. =C2=A0Only control frames=
 can be sent in the middle of a fragmented message (I believe the &quot;ope=
n question&quot; line is out of date -- I think the consensus was that cont=
rol frames can be injected in the middle of a fragmented message, otherwise=
 the latency of responding to ping, for example, would be very long if behi=
nd a large message), and control frames cannot be fragmented. =C2=A0Multipl=
exing will be defined as an extension and will include logical channels. =
=C2=A0Even in #2, you would have to maintain the frame type from the origin=
al frame to avoid attacks like [BINARY &quot;invalid UTF8&quot;] [TEXT/FIN =
&quot;UTF8&quot;] which could exploit bugs in UTF8 decoders.</div>

<div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex=
;border-left:1px #ccc solid;padding-left:1ex;"><font size=3D"2" face=3D"san=
s-serif">o Overall</font>
</blockquote><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;b=
order-left:1px #ccc solid;padding-left:1ex;">
<br><font size=3D"2" face=3D"sans-serif">As I was reading though, it took s=
ome
time to find out which feature is for which entities</font>
<br><font size=3D"2" face=3D"sans-serif">role as in protocol layering. Ping=
/pong
protocol for example, I am still not sure if</font>
<br><font size=3D"2" face=3D"sans-serif">this is done by WebSocket protocol=
 internally
or exposed to application. Another </font>
<br><font size=3D"2" face=3D"sans-serif">examples would be the extension da=
ta
filed - who is going to parse it?</font></blockquote><div><br></div><div>Th=
e WebSocket implementation will be the one to at least extract the extensio=
n data from the frame, but the interpretation of that data will be defined =
by the extension. =C2=A0It may be processed by the WebSocket layer or the a=
pplication depending on the extension.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd51b5439a251049befa4c3--

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 10 10:48:48 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B579C3A6987 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 10:48:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.264
X-Spam-Level: 
X-Spam-Status: No, score=-6.264 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mjINaJ4EI4-q for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 10:48:47 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id D1DF63A6981 for <hybi@ietf.org>; Thu, 10 Feb 2011 10:48:47 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021010485422-423892 ; Thu, 10 Feb 2011 10:48:54 -0800 
In-Reply-To: <4D53CD80.5040708@warmcat.com>
To: Andy Green <andy@warmcat.com>
MIME-Version: 1.0
X-KeepSent: 06E2DB91:88D9689D-88257833:0066F681; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF06E2DB91.88D9689D-ON88257833.0066F681-88257833.00676ADF@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 10 Feb 2011 10:49:35 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/10/2011 10:48:53 AM, Serialize complete at 02/10/2011 10:48:53 AM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 10:48:54 AM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 10:49:01 AM, Serialize complete at 02/10/2011 10:49:01 AM
Content-Type: multipart/alternative; boundary="=_alternative 00676ADD88257833_="
Cc: hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 18:48:48 -0000

This is a multipart message in MIME format.
--=_alternative 00676ADD88257833_=
Content-Type: text/plain; charset="ISO-2022-JP"

> $B$3$s$P$s$o!"$f$?$+$5$s(B
$B%3%a%s%H$"$j$,$H$&!"%"%s%G%#$5$s(B

> > What is IRI? You mean, "URL"?
> It's "internationalized"

I did not know it until now... - thanks!

> > It is no clear to me what 0x43 and 0x53 are trying to achieve. In TCP,
> > there is FIN with no
> > details of why/who is closing for graceful shutdown.
> 
> I guess it at least is documentation if you are looking in tcpdump.

I would prefer not to reveal any details over the wire for security reason 

if there's not much gain with the details, and also it is always clear 
who initiated Close with tcpdump anyway.

> BTW libwebsockets is C, LGPL2, maybe it can help you.

Wow, that would be helpful as a reference for validation of implementation
and protocol itself. I will look into it, when I get ready for it. Good 
job!

> > If there's a layer structure with interfaces defined in the document,
> > that would be a great help - something like:
> 
> I think that is probably out of scope, the protocol stands alone and 
> it's best to restrict what it tries to define to what goes on the wire.

I see. I still think that a layered block diagram will help defining 
more clearly the scope of this document for readers to understand 
relationship between this protocol spec and other entities, IMHO.

Best,
- Yutaka

--=_alternative 00676ADD88257833_=
Content-Type: text/html; charset="ISO-2022-JP"


<br><tt><font size=2>&gt; $B$3$s$P$s$o!"$f$?$+$5$s(B</font></tt>
<br><tt><font size=2>$B%3%a%s%H$"$j$,$H$&!"%"%s%G%#$5$s(B</font></tt>
<br><tt><font size=2><br>
&gt; &gt; What is IRI? You mean, &quot;URL&quot;?<br>
&gt; It's &quot;internationalized&quot;<br>
</font></tt>
<br><tt><font size=2>I did not know it until now... - thanks!</font></tt>
<br>
<br><tt><font size=2>&gt; &gt; It is no clear to me what 0x43 and 0x53
are trying to achieve. In TCP,<br>
&gt; &gt; there is FIN with no<br>
&gt; &gt; details of why/who is closing for graceful shutdown.<br>
&gt; <br>
&gt; I guess it at least is documentation if you are looking in tcpdump.<br>
</font></tt>
<br><tt><font size=2>I would prefer not to reveal any details over the
wire for security reason </font></tt>
<br><tt><font size=2>if there's not much gain with the details, and also
it is always clear </font></tt>
<br><tt><font size=2>who initiated Close with tcpdump anyway.</font></tt>
<br>
<br><tt><font size=2>&gt; BTW libwebsockets is C, LGPL2, maybe it can help
you.<br>
</font></tt>
<br><tt><font size=2>Wow, that would be helpful as a reference for validation
of implementation</font></tt>
<br><tt><font size=2>and protocol itself. I will look into it, when I get
ready for it. Good job!</font></tt>
<br>
<br><tt><font size=2>&gt; &gt; If there's a layer structure with interfaces
defined in the document,<br>
&gt; &gt; that would be a great help - something like:<br>
&gt; <br>
&gt; I think that is probably out of scope, the protocol stands alone and
<br>
&gt; it's best to restrict what it tries to define to what goes on the
wire.<br>
</font></tt>
<br><tt><font size=2>I see. I still think that a layered block diagram
will help defining </font></tt>
<br><tt><font size=2>more clearly the scope of this document for readers
to understand </font></tt>
<br><tt><font size=2>relationship between this protocol spec and other
entities, IMHO.</font></tt>
<br>
<br><tt><font size=2>Best,</font></tt>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
--=_alternative 00676ADD88257833_=--

From tyoshino@google.com  Thu Feb 10 11:18:21 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DF1293A69EA for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 11:18:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.976
X-Spam-Level: 
X-Spam-Status: No, score=-102.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tGUT9D6jPLh8 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 11:18:20 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id D46BF3A69E5 for <hybi@ietf.org>; Thu, 10 Feb 2011 11:18:19 -0800 (PST)
Received: from kpbe16.cbf.corp.google.com (kpbe16.cbf.corp.google.com [172.25.105.80]) by smtp-out.google.com with ESMTP id p1AJIUY1023067 for <hybi@ietf.org>; Thu, 10 Feb 2011 11:18:30 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297365511; bh=bkrZzaScHM6lhx5vBphvGhM1S0I=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=DtPSEiWJB8GYcGzVF6fDOaK6xDXMXdIgwOpBlRHU8kmqqmjWw7G6cQ2ORe1LIhin+ DS9j1AQ/mVE8gblFPxpyw==
Received: from yib17 (yib17.prod.google.com [10.243.65.81]) by kpbe16.cbf.corp.google.com with ESMTP id p1AJISe1010491 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 10 Feb 2011 11:18:28 -0800
Received: by yib17 with SMTP id 17so996094yib.40 for <hybi@ietf.org>; Thu, 10 Feb 2011 11:18:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=6iLUa9Yjy4m2RYi4AX/2AZg/QF/O6gtOKz1MKcFjwVc=; b=pc6wLA629COBPPVqF39kS3jGLzACvyhL9QrloeOompoa38i+TUSUgpYpmXWMkuCqE8 ciq1kyOzDF43CTRySWmg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=cw6jCHcfgTBLDchrXT7oCw5PwqCfBWeOpwPgFkC8rR7ABLzIyRgsfYncpc9U6A06u1 J50znNTFY5N1TuVsZhLg==
Received: by 10.151.62.18 with SMTP id p18mr3687296ybk.390.1297365506263; Thu, 10 Feb 2011 11:18:26 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.91.16 with HTTP; Thu, 10 Feb 2011 11:18:06 -0800 (PST)
In-Reply-To: <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 11 Feb 2011 04:18:06 +0900
Message-ID: <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: multipart/alternative; boundary=000e0cdf1486250d2a049bf272dc
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 19:18:22 -0000

--000e0cdf1486250d2a049bf272dc
Content-Type: text/plain; charset=ISO-8859-1

Gabriel's idea is even simple. I don't object to that. I see the benefit of
Greg's idea, too.

A while back, Yuta listed error cases can happen during frame processing,
and suggested we define how we handle them. Maybe we would use abnormal
close frame for them.
http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html

I think abnormal close frame should indicate only protocol level error
(frame parsing error, too large message, etc.). Any error inside application
can be exchanged on application level. So we don't have to extend close()
interface.

CloseEvent interface should be changed. _cleanly_ must be re-defined. We
would define three type of close, _normal close_, _abnormal close_,
_underlying channel terminated_, and replace "wasClean" with, say, "reason"
or something. I'm not sure if we should invoke error event, too. I
personally think it's redundant.

Then,
- close() called on WebSocket object -> send normal close frame -> "normal"
close event regardless of whatever happen
- any protocol level error happened on client side and sent abnormal close
frame -> "abnormal" close event
- received normal close frame -> "normal" close event
- received abnormal close frame -> "abnormal" close event
- underlying channel is closed without receiving close frame -> "underlying
channel terminated" close event

I think this modification on CloseEvent doesn't violate the security model
we now have to prevent WebSocket from being abused for port scanner.
Abnormal close is just a new variant of closure information explicitly sent
from the server. Thoughts?

So, by putting them together, like this?

----

4.5.1.  Close

The Close message contains an opcode of 0x01.

The Close message contains a body that is a single byte in length.  This
byte carrys the reason for the close.  For normal close, the body MUST be a
0x00. For abnormal close, the body MUST be a 0x01.

The websocket is considered fully closed when an endpoint has either sent or
received a Close message, or when the underlying channel is closed.

The application MUST NOT send any more data messages after sent or received
a Close message.

7.1.1.  Client-initiated closure

<I'm not sure how much it's useful to have client send normal/abnormal.
Server cannot retry by itself so, it's not the case Greg explained. But
maybe we can just add it as well as server.>

7.1.2.  Server-initiated closure

<No change on *abort WebSocket connection* during opening handshake>

Certain algorithms require or recommend that the server *abort2
the WebSocket connection* after WebSocket connection is established.  To do
so, the server must send a Close message with a single byte body 0x01
meaning abnormal closure and close the WebSocket connection.

<We need some verb to replace abort2>

7.2.  Normal closure of connections

To *close the WebSocket connection*, the user agent MUST send a Close
control frame with a single byte body 0x00 meaning normal closure, as
described in Section 4.5.1.  Once an endpoint has sent or received an Close
control frame, that endpoint must close the TCP ...  If the connection was
closed after the client sent or received normal close frame, then it's
called _normal close_. If the connection was closed after the client send or
received abnormal close frame, then it's called _abnormal close_. Otherwise,
it's called _underlying connection terminated_.

The user agent can distinguish protocol failure notified by abnormal close
frame from disconnection caused by network or intermediary to allow the
application to determine if it should retry connection or not.

...

On Thu, Feb 10, 2011 at 18:44, Greg Wilkins <gregw@webtide.com> wrote:

> On 10 February 2011 20:25, Gabriel Montenegro
> <Gabriel.Montenegro@microsoft.com> wrote:
> > I think your simple reason would be enough (either normal or abnormal
> close for now).
>
> cool
>
> > To be clear: you're not arguing against the simplified semantics of
> considering the websocket closed (no further data or control) upon either
> sending or receiving a Close message, correct?
>
> I'm not arguing either way.  I can see the benefits of half close and
> flush through, but also the complexities, so I'm happy to follow herd
> on this one.
>
> cheers
>
>
> >> -----Original Message-----
> >> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Greg
> >> Wilkins
> >> Sent: Wednesday, February 09, 2011 17:04
> >> To: Takeshi Yoshino
> >> Cc: hybi@ietf.org
> >> Subject: Re: [hybi] Clarify the role of closing handshake
> >>
> >> One of the other aims of the closing handshake was to better identify
> error
> >> condition, so as to prevent a client repeating unacceptable operations.
> >>
> >> For example, if a client sends a frame that is too large for the server
> to handle,
> >> the server needs to indicate that an error condition has occurred.  If
> the
> >> connection is closed (orderly or otherwise) , then the client might
> assume that it
> >> was an idle shutdown or transient condition on the server and thus open
> a new
> >> connection and continue to send over large frames.
> >>
> >>
> >> Currently -05 says:
> >>
> >> 7.1.2.  Server-initiated closure
> >>    Certain algorithms require or recommend that the server *abort the
> >>    WebSocket connection* during the opening handshake.  To do so, the
> >>    server must simply close the WebSocket connection.
> >>
> >>
> >> the problem with this is that for a client such a close of the websocket
> >> connection cannot be distinguished from a
> >> network/intermediary failure.   I think that typically an aborted
> >> connection should not be retried, but a network/intermediary failure
> should be -
> >> so it would be good to be able to signal to the client the difference.
> >>
> >> Thus I'd like to suggest that the close handshake carry a single byte of
> reason for
> >> the close.
> >> I think it would be sufficient to define just:
> >>
> >>   0x00 Normal close
> >>   0x01 Abnormal close
> >>
> >> But I could see an argument for something a little richer:
> >>
> >>  0x00 Idle close
> >>  0x01 close
> >>  0x02 abnormal close
> >>
> >> but I concede that the danger here is trying to define too many close
> states
> >> _______________________________________________
> >> hybi mailing list
> >> hybi@ietf.org
> >> https://www.ietf.org/mailman/listinfo/hybi
> >
> >
>

--000e0cdf1486250d2a049bf272dc
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Gabriel&#39;s idea is even simple. I don&#39;t object to that.=A0I see=
 the benefit of Greg&#39;s idea, too.</div><div><div><div><br></div><div><d=
iv><div>A while back, Yuta listed error cases can happen during frame proce=
ssing, and suggested we define how we handle them. Maybe we would use abnor=
mal close frame for them.</div>

<div><a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg05131.=
html">http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html</a></=
div><div><br></div></div><div><div>I think abnormal close frame should indi=
cate only protocol level error (frame parsing error, too large message, etc=
.). Any error inside application can be exchanged on application level. So =
we don&#39;t have to extend close() interface.</div>

<div><br></div><div><div>CloseEvent interface should be changed. _cleanly_ =
must be re-defined. We would define three type of close, _normal close_, _a=
bnormal close_, _underlying channel terminated_, and replace &quot;wasClean=
&quot; with, say, &quot;reason&quot; or something. I&#39;m not sure if we s=
hould invoke error event, too. I personally think it&#39;s redundant.</div>

<div><br></div><div>Then,</div><div>- close() called on WebSocket object -&=
gt; send normal close frame -&gt; &quot;normal&quot; close event regardless=
 of whatever happen</div><div>- any protocol level error happened on client=
 side and sent abnormal close frame -&gt; &quot;abnormal&quot; close event<=
/div>

<div>- received normal close frame -&gt; &quot;normal&quot; close event</di=
v><div>- received abnormal close frame -&gt; &quot;abnormal&quot; close eve=
nt</div><div>- underlying channel is closed without receiving close frame -=
&gt; &quot;underlying channel terminated&quot; close event</div>

</div></div></div><div><br></div><div>I think this modification on CloseEve=
nt doesn&#39;t violate the security model we now have to prevent WebSocket =
from being abused for port scanner. Abnormal close is just a new variant of=
 closure information explicitly sent from the server. Thoughts?</div>

<div><br></div><div><div><div>So, by putting them together, like this?</div=
><div></div></div></div><div><br></div><div>----</div><div><br></div><div><=
div>4.5.1. =A0Close</div><div><br></div><div>The Close message contains an =
opcode of 0x01.</div>

<div><br></div><div>The Close message contains a body that is a single byte=
 in length. =A0This byte carrys the reason for the close. =A0For normal clo=
se, the body MUST be a 0x00. For abnormal close, the body MUST be a 0x01.</=
div>

<div>=A0</div><div>The websocket is considered fully closed when an endpoin=
t has either sent or received a Close message, or when the underlying chann=
el is closed.</div><div><br></div><div><div>The application MUST NOT send a=
ny more data messages after sent or received a=A0Close message.</div>

</div><div><br></div><div><div>7.1.1. =A0Client-initiated closure</div></di=
v><div><br></div><div>&lt;I&#39;m not sure how much it&#39;s useful to have=
 client send normal/abnormal. Server cannot retry by itself so, it&#39;s no=
t the case Greg explained. But maybe we can just add it as well as server.&=
gt;</div>

<div><br></div><div>7.1.2. =A0Server-initiated closure</div><div><br></div>=
<div>&lt;No change on *abort WebSocket connection* during opening handshake=
&gt;</div><div><br></div><div>Certain algorithms require or recommend that =
the server *abort2 the=A0WebSocket connection* after WebSocket connection i=
s established. =A0To do so, the=A0server must send a Close message with a s=
ingle byte body 0x01 meaning=A0abnormal closure and close the WebSocket con=
nection.</div>

<div><br></div><div>&lt;We need some verb to replace abort2&gt;</div><div><=
br></div><div>7.2. =A0Normal closure of connections</div><div><br></div><di=
v>To *close the WebSocket connection*, the user agent MUST send a=A0Close c=
ontrol frame with a single byte body 0x00 meaning normal closure, as descri=
bed in Section 4.5.1. =A0Once an endpoint has sent or received an Close con=
trol frame, that endpoint must close the TCP ...=A0=A0If the connection was=
 closed after the client sent or received normal=A0close frame, then it&#39=
;s called _normal close_. If the connection was closed after the client sen=
d or received abnormal close frame, then it&#39;s called _abnormal close_. =
Otherwise, it&#39;s called _underlying connection terminated_.</div>

<div><br></div><div><div>The user agent can distinguish protocol failure no=
tified by abnormal close frame from disconnection caused by=A0network or in=
termediary to allow the application to determine if it should retry connect=
ion or not.</div>

</div><div><br></div><div>...</div></div><div><br></div></div></div><div cl=
ass=3D"gmail_quote">On Thu, Feb 10, 2011 at 18:44, Greg Wilkins <span dir=
=3D"ltr">&lt;<a href=3D"mailto:gregw@webtide.com">gregw@webtide.com</a>&gt;=
</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">On 10 February 2011 20:25, Gabriel Monteneg=
ro<br>
<div class=3D"im">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.com">G=
abriel.Montenegro@microsoft.com</a>&gt; wrote:<br>
</div><div class=3D"im">&gt; I think your simple reason would be enough (ei=
ther normal or abnormal close for now).<br>
<br>
</div>cool<br>
<div class=3D"im"><br>
&gt; To be clear: you&#39;re not arguing against the simplified semantics o=
f considering the websocket closed (no further data or control) upon either=
 sending or receiving a Close message, correct?<br>
<br>
</div>I&#39;m not arguing either way. =A0I can see the benefits of half clo=
se and<br>
flush through, but also the complexities, so I&#39;m happy to follow herd<b=
r>
on this one.<br>
<br>
cheers<br>
<div><div></div><div class=3D"h5"><br>
<br>
&gt;&gt; -----Original Message-----<br>
&gt;&gt; From: <a href=3D"mailto:hybi-bounces@ietf.org">hybi-bounces@ietf.o=
rg</a> [mailto:<a href=3D"mailto:hybi-bounces@ietf.org">hybi-bounces@ietf.o=
rg</a>] On Behalf Of Greg<br>
&gt;&gt; Wilkins<br>
&gt;&gt; Sent: Wednesday, February 09, 2011 17:04<br>
&gt;&gt; To: Takeshi Yoshino<br>
&gt;&gt; Cc: <a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
&gt;&gt; Subject: Re: [hybi] Clarify the role of closing handshake<br>
&gt;&gt;<br>
&gt;&gt; One of the other aims of the closing handshake was to better ident=
ify error<br>
&gt;&gt; condition, so as to prevent a client repeating unacceptable operat=
ions.<br>
&gt;&gt;<br>
&gt;&gt; For example, if a client sends a frame that is too large for the s=
erver to handle,<br>
&gt;&gt; the server needs to indicate that an error condition has occurred.=
 =A0If the<br>
&gt;&gt; connection is closed (orderly or otherwise) , then the client migh=
t assume that it<br>
&gt;&gt; was an idle shutdown or transient condition on the server and thus=
 open a new<br>
&gt;&gt; connection and continue to send over large frames.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; Currently -05 says:<br>
&gt;&gt;<br>
&gt;&gt; 7.1.2. =A0Server-initiated closure<br>
&gt;&gt; =A0 =A0Certain algorithms require or recommend that the server *ab=
ort the<br>
&gt;&gt; =A0 =A0WebSocket connection* during the opening handshake. =A0To d=
o so, the<br>
&gt;&gt; =A0 =A0server must simply close the WebSocket connection.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; the problem with this is that for a client such a close of the web=
socket<br>
&gt;&gt; connection cannot be distinguished from a<br>
&gt;&gt; network/intermediary failure. =A0 I think that typically an aborte=
d<br>
&gt;&gt; connection should not be retried, but a network/intermediary failu=
re should be -<br>
&gt;&gt; so it would be good to be able to signal to the client the differe=
nce.<br>
&gt;&gt;<br>
&gt;&gt; Thus I&#39;d like to suggest that the close handshake carry a sing=
le byte of reason for<br>
&gt;&gt; the close.<br>
&gt;&gt; I think it would be sufficient to define just:<br>
&gt;&gt;<br>
&gt;&gt; =A0 0x00 Normal close<br>
&gt;&gt; =A0 0x01 Abnormal close<br>
&gt;&gt;<br>
&gt;&gt; But I could see an argument for something a little richer:<br>
&gt;&gt;<br>
&gt;&gt; =A00x00 Idle close<br>
&gt;&gt; =A00x01 close<br>
&gt;&gt; =A00x02 abnormal close<br>
&gt;&gt;<br>
&gt;&gt; but I concede that the danger here is trying to define too many cl=
ose states<br>
&gt;&gt; _______________________________________________<br>
&gt;&gt; hybi mailing list<br>
&gt;&gt; <a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
&gt;&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_=
blank">https://www.ietf.org/mailman/listinfo/hybi</a><br>
&gt;<br>
&gt;<br>
</div></div></blockquote></div><br>

--000e0cdf1486250d2a049bf272dc--

From derhoermi@gmx.net  Thu Feb 10 11:47:31 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67BAD3A6A5F for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 11:47:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.147
X-Spam-Level: 
X-Spam-Status: No, score=-2.147 tagged_above=-999 required=5 tests=[AWL=0.300,  BAYES_00=-2.599, SARE_SUB_ENC_UTF8=0.152]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sVluu+D2FaYh for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 11:47:30 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id C4E263A67B3 for <hybi@ietf.org>; Thu, 10 Feb 2011 11:47:29 -0800 (PST)
Received: (qmail invoked by alias); 10 Feb 2011 19:47:40 -0000
Received: from dslb-094-223-223-041.pools.arcor-ip.net (EHLO HIVE) [94.223.223.41] by mail.gmx.net (mp072) with SMTP; 10 Feb 2011 20:47:40 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+jnqZsa5Oj3tWXr3F/BxKQrGFDehsiH0wcoml+bT beo+w4K2iTptsY
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Date: Thu, 10 Feb 2011 20:47:42 +0100
Message-ID: <fqe8l699oqaju9hbjg8de0c23bvqrc32vh@hive.bjoern.hoehrmann.de>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org> <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8	mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 19:47:31 -0000

* Gabriel Montenegro wrote:
>Yes, if one accepts UTF-8, that must be validated, no question about it.
>The point is not to disallow UTF-8, but to be able to optimize on those
>websocket connections that use binary only, so this is not a fragmenting
>of the protocol any more than any other per-session negotiable feature
>is.

Well, I don't see what optimization you can do by knowing promises have
been made that no text frames will be transmitted, and if there are op-
timizations possible, I don't see why this needs to be communicated in-
side the protocol, and if it does, why the existing mechanisms are not
sufficient or otherwise unsuitable. In other words, I do not see why it
is a matter of conformance with respect to the core specification.

What I do not want is a situation where I tell somebody "Your Websocket
implementation is broken" and they respond "Oh, no, it's okay because
we've negotiated binary-only" for some value of "it". So how would your
proposal affect conformance or, if it does not, why would it matter that
we adopt some negotiation mechanism for this?
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 10 12:04:56 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A62073A6A5C; Thu, 10 Feb 2011 12:04:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.964
X-Spam-Level: 
X-Spam-Status: No, score=-5.964 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4XVuLKUv275z; Thu, 10 Feb 2011 12:04:55 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 77AEB3A69E4; Thu, 10 Feb 2011 12:04:55 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021012045970-427772 ; Thu, 10 Feb 2011 12:04:59 -0800 
In-Reply-To: <AANLkTimdy0tQrdMHdN7bX7ty=A47qr9oag+nAcx3RtqR@mail.gmail.com>
To: John Tamplin <jat@google.com>
MIME-Version: 1.0
X-KeepSent: A8382492:154772F5-88257833:00691B5C; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFA8382492.154772F5-ON88257833.00691B5C-88257833.006E74A1@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 10 Feb 2011 12:06:27 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/10/2011 12:04:59 PM, Serialize complete at 02/10/2011 12:04:59 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 12:04:59 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 12:05:09 PM, Serialize complete at 02/10/2011 12:05:09 PM
Content-Type: multipart/alternative; boundary="=_alternative 006E74A088257833_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 20:04:56 -0000

This is a multipart message in MIME format.
--=_alternative 006E74A088257833_=
Content-Type: text/plain; charset="US-ASCII"

Hello John,

Thanks for your comments.
My comments inline..


> On Thu, Feb 10, 2011 at 5:59 AM, <Yutaka_Takeda@playstation.sony.com> 
wrote:
> o  Section 4.3 - Continuation frame (opcode=%x0) 
> 
> It is not clear to me in the document how this frame (opcode=0) is 
> used while there's 
> FIN bit for fragmentation/defragmentation. 
> 
> The reasonable options are:
>  1) define a different frame format for continuation frames that 
> doesn't have opcodes
>  2) use the same opcode as the original frame
>  3) use a new opcode
> 
> #1 adds complexity and wastes bits for little benefit.  #3 has the 
> benefit of allowing you to detect the four states of a frame 
> (single-frame message, initial frame of fragmented message, middle 
> frame of fragmented message, final frame of fragmented message) if 
> you care, and also provides opportunity for more error checking.

It's on TCP - the order is guaranteed, therefore only 1-bit of 
information is necessary, IMO. {Just continuation or final.
'first or middle' is redundant over the steamed protocol)

Single frame: [fin=1]
Fragmented  : [fin=0]...[fin=1]

It works even in the case where different frames are multiplexed.
(I understand, it occurs only with Control frames in the current spec.)

>From the net: [op=txt, fin=0] [op=bin, fin=0] [op=txt, fin=1]
Text buffer : [op=txt, fin=0]                 [op=txt, fin=1]
Bin. buffer :                 [op=bin, fin=0] (waiting for opt=bin, fin=0 
or 1)

# any thoughts?


> For example: 
> [op=txt, fin=0] [op=bin, fin=0] [op=0, fin=1] <== is this for txt or 
bin? 
> 
> Is this kind of multiplexing support intended in the protocol 
> design? If the doc explains 
> why and how fragmentation is used. 
> 
> No, see 4.4.  Only control frames can be sent in the middle of a 
> fragmented message (I believe the "open question" line is out of 

Ah, I see. When I read 4.4 - second paragraph seems to imply that
other adjacent fragments share the same opcode... But with third
bullet, I was lost on it. As you pointed out, this section needs to 
be updated/fixed.

> date -- I think the consensus was that control frames can be 
> injected in the middle of a fragmented message, otherwise the 
> latency of responding to ping, for example, would be very long if 
> behind a large message), and control frames cannot be fragmented.

I see. Good to know the purpose of the fragmentation. (please add
in the document)

I have not read [WSAPI] yet, though, I would assume the ping/pong
will be done at WS protocol level. How can you inject "ping" when
the first portion of long text frame has just been transmitted? 
The payload length is already sent. You would need to implement 
some scheduler for ping with a large buffer to avoid that. If the 
ping is initiated by the app, then it would be another story...

The heart of the problem I can think of is the fact that the 
current protocol does not define maximum size of the frame for
text and binary. I mean, one solution would be to set up such 
maximum frame size (or MFS - which corresponds in a way to TCP's 
MSS) to a reasonable amount to allow multiplexed frames to flow 
all the time with a reasonable delay.
 
>  Multiplexing will be defined as an extension and will include 
> logical channels.  Even in #2, you would have to maintain the frame 
> type from the original frame to avoid attacks like [BINARY "invalid 
> UTF8"] [TEXT/FIN "UTF8"] which could exploit bugs in UTF8 decoders.

I have to admit that I could not decipher you point. Sorry. I 
will look for information about the UTF8 bug exploit, or could you
please point me to a related discussion?

> The WebSocket implementation will be the one to at least extract the
> extension data from the frame, but the interpretation of that data 
> will be defined by the extension.  It may be processed by the 
> WebSocket layer or the application depending on the extension.

It sounds good to me - thank you.

- Yutaka

--=_alternative 006E74A088257833_=
Content-Type: text/html; charset="US-ASCII"


<br><tt><font size=2>Hello John,</font></tt>
<br>
<br><tt><font size=2>Thanks for your comments.</font></tt>
<br><tt><font size=2>My comments inline..</font></tt>
<br>
<br><tt><font size=2><br>
&gt; On Thu, Feb 10, 2011 at 5:59 AM, &lt;Yutaka_Takeda@playstation.sony.com&gt;
wrote:</font></tt>
<br><tt><font size=2>&gt; o &nbsp;Section 4.3 - Continuation frame (opcode=%x0)
<br>
&gt; <br>
&gt; It is not clear to me in the document how this frame (opcode=0) is
<br>
&gt; used while there's <br>
&gt; FIN bit for fragmentation/defragmentation. </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; The reasonable options are:</font></tt>
<br><tt><font size=2>&gt; &nbsp;1) define a different frame format for
continuation frames that <br>
&gt; doesn't have opcodes</font></tt>
<br><tt><font size=2>&gt; &nbsp;2) use the same opcode as the original
frame</font></tt>
<br><tt><font size=2>&gt; &nbsp;3) use a new opcode</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; #1 adds complexity and wastes bits for little benefit. &nbsp;#3 has
the <br>
&gt; benefit of allowing you to detect the four states of a frame <br>
&gt; (single-frame message, initial frame of fragmented message, middle
<br>
&gt; frame of fragmented message, final frame of fragmented message) if
<br>
&gt; you care, and also provides opportunity for more error checking.</font></tt>
<br>
<br><tt><font size=2>It's on TCP - the order is guaranteed, therefore only
1-bit of </font></tt>
<br><tt><font size=2>information is necessary, IMO. {Just continuation
or final.</font></tt>
<br><tt><font size=2>'first or middle' is redundant over the steamed protocol)</font></tt>
<br>
<br><tt><font size=2>Single frame: [fin=1]</font></tt>
<br><tt><font size=2>Fragmented &nbsp;: [fin=0]...[fin=1]</font></tt>
<br>
<br><tt><font size=2>It works even in the case where different frames are
multiplexed.</font></tt>
<br><tt><font size=2>(I understand, it occurs only with Control frames
in the current spec.)</font></tt>
<br>
<br><tt><font size=2>From the net: [op=txt, fin=0] [op=bin, fin=0] [op=txt,
fin=1]</font></tt>
<br><tt><font size=2>Text buffer : [op=txt, fin=0] &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [op=txt, fin=1]</font></tt>
<br><tt><font size=2>Bin. buffer : &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; [op=bin, fin=0] (waiting for opt=bin, fin=0 or 1)</font></tt>
<br>
<br><tt><font size=2># any thoughts?</font></tt>
<br>
<br>
<br><tt><font size=2>&gt; For example: <br>
&gt; [op=txt, fin=0] [op=bin, fin=0] [op=0, fin=1] &lt;== is this for txt
or bin? <br>
&gt; <br>
&gt; Is this kind of multiplexing support intended in the protocol <br>
&gt; design? If the doc explains <br>
&gt; why and how fragmentation is used. </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; No, see 4.4. &nbsp;Only control frames can be sent in the middle of
a <br>
&gt; fragmented message (I believe the &quot;open question&quot; line is
out of </font></tt>
<br>
<br><tt><font size=2>Ah, I see. When I read 4.4 - second paragraph seems
to imply that</font></tt>
<br><tt><font size=2>other adjacent fragments share the same opcode...
But with third</font></tt>
<br><tt><font size=2>bullet, I was lost on it. As you pointed out, this
section needs to </font></tt>
<br><tt><font size=2>be updated/fixed.</font></tt>
<br><tt><font size=2><br>
&gt; date -- I think the consensus was that control frames can be <br>
&gt; injected in the middle of a fragmented message, otherwise the <br>
&gt; latency of responding to ping, for example, would be very long if
<br>
&gt; behind a large message), and control frames cannot be fragmented.</font></tt>
<br>
<br><tt><font size=2>I see. Good to know the purpose of the fragmentation.
(please add</font></tt>
<br><tt><font size=2>in the document)</font></tt>
<br>
<br><tt><font size=2>I have not read [WSAPI] yet, though, I would assume
the ping/pong</font></tt>
<br><tt><font size=2>will be done at WS protocol level. How can you inject
&quot;ping&quot; when</font></tt>
<br><tt><font size=2>the first portion of long text frame has just been
transmitted? </font></tt>
<br><tt><font size=2>The payload length is already sent. You would need
to implement </font></tt>
<br><tt><font size=2>some scheduler for ping with a large buffer to avoid
that. If the </font></tt>
<br><tt><font size=2>ping is initiated by the app, then it would be another
story...</font></tt>
<br>
<br><tt><font size=2>The heart of the problem I can think of is the fact
that the </font></tt>
<br><tt><font size=2>current protocol does not define maximum size of the
frame for</font></tt>
<br><tt><font size=2>text and binary. I mean, one solution would be to
set up such </font></tt>
<br><tt><font size=2>maximum frame size (or MFS - which corresponds in
a way to TCP's </font></tt>
<br><tt><font size=2>MSS) to a reasonable amount to allow multiplexed frames
to flow </font></tt>
<br><tt><font size=2>all the time with a reasonable delay.</font></tt>
<br><tt><font size=2>&nbsp;<br>
&gt; &nbsp;Multiplexing will be defined as an extension and will include
<br>
&gt; logical channels. &nbsp;Even in #2, you would have to maintain the
frame <br>
&gt; type from the original frame to avoid attacks like [BINARY &quot;invalid
<br>
&gt; UTF8&quot;] [TEXT/FIN &quot;UTF8&quot;] which could exploit bugs in
UTF8 decoders.</font></tt>
<br>
<br><tt><font size=2>I have to admit that I could not decipher you point.
Sorry. I </font></tt>
<br><tt><font size=2>will look for information about the UTF8 bug exploit,
or could you</font></tt>
<br><tt><font size=2>please point me to a related discussion?</font></tt>
<br>
<br><tt><font size=2>&gt; The WebSocket implementation will be the one
to at least extract the<br>
&gt; extension data from the frame, but the interpretation of that data
<br>
&gt; will be defined by the extension. &nbsp;It may be processed by the
<br>
&gt; WebSocket layer or the application depending on the extension.</font></tt>
<br>
<br><tt><font size=2>It sounds good to me - thank you.</font></tt>
<br>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
--=_alternative 006E74A088257833_=--

From jat@google.com  Thu Feb 10 12:26:25 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 193CB3A6838 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 12:26:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.376
X-Spam-Level: 
X-Spam-Status: No, score=-105.376 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lkFpvuv75oal for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 12:26:23 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 8408C3A67D1 for <hybi@ietf.org>; Thu, 10 Feb 2011 12:26:23 -0800 (PST)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p1AKQZxg030421 for <hybi@ietf.org>; Thu, 10 Feb 2011 12:26:35 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297369595; bh=CJAfckfJIq5zsDBTqY7OKuowzdQ=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=PfBAyb3lEL35zb77jSwzA4fnXKgmXzrRT5GwNGUV9j9vMk3+dpSWZpFPwH57I7+d+ bf13OF7hse4QsYuAYUDPA==
Received: from ywl2 (ywl2.prod.google.com [10.192.12.2]) by wpaz37.hot.corp.google.com with ESMTP id p1AKQYxL028340 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 10 Feb 2011 12:26:35 -0800
Received: by ywl2 with SMTP id 2so791667ywl.13 for <hybi@ietf.org>; Thu, 10 Feb 2011 12:26:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=+nJyjCTSp2kmFUI4PblfJt857xH4AJuFSyfuxU44KoI=; b=ReeNGV3FXobsSJHM3KeGch4Z1DjfLELmonLR6qW1m1vr5B1m6qK57HMdJOARVQ6ipv l+eRQGziMOwqJwWtungQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=NU0gjr2lQovub17AeNyhjCE3qJSIzcJb0ru72HrFwFYVqiJMWibH/Ak7DIheQuUqjW V7tsSedHHdxhFKxd7xzg==
Received: by 10.150.49.17 with SMTP id w17mr3721518ybw.377.1297369594629; Thu, 10 Feb 2011 12:26:34 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Thu, 10 Feb 2011 12:26:14 -0800 (PST)
In-Reply-To: <OFA8382492.154772F5-ON88257833.00691B5C-88257833.006E74A1@playstation.sony.com>
References: <AANLkTimdy0tQrdMHdN7bX7ty=A47qr9oag+nAcx3RtqR@mail.gmail.com> <OFA8382492.154772F5-ON88257833.00691B5C-88257833.006E74A1@playstation.sony.com>
From: John Tamplin <jat@google.com>
Date: Thu, 10 Feb 2011 15:26:14 -0500
Message-ID: <AANLkTinYrCzkOrWBc6on6ue1-Y7o=cFAAj1WD_Ya5_gA@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=000e0cd6aeb4d4902a049bf36590
X-System-Of-Record: true
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 20:26:25 -0000

--000e0cd6aeb4d4902a049bf36590
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 10, 2011 at 3:06 PM, <Yutaka_Takeda@playstation.sony.com> wrote:

> It's on TCP - the order is guaranteed, therefore only 1-bit of
> information is necessary, IMO. {Just continuation or final.
> 'first or middle' is redundant over the steamed protocol)



Single frame: [fin=1]
> Fragmented  : [fin=0]...[fin=1]
>
> It works even in the case where different frames are multiplexed.
> (I understand, it occurs only with Control frames in the current spec.)
>
> From the net: [op=txt, fin=0] [op=bin, fin=0] [op=txt, fin=1]
> Text buffer : [op=txt, fin=0]                 [op=txt, fin=1]
> Bin. buffer :                 [op=bin, fin=0] (waiting for opt=bin, fin=0
> or 1)
>
> # any thoughts?


That would let you interleave different types of frames, but not the same
type of frames.  Since the initial uses are all going to be text frames,
that doesn't buy you anything.  A complete multiplexing solution also needs
to address flow control issues, so I don't see that the limited ability to
interleave frames with different opcodes is useful.


> I see. Good to know the purpose of the fragmentation. (please add
> in the document)
>

The primary purpose of fragmentation is to allow sending a message that is
of unknown size when it is started without having to buffer it.  If messages
couldn't be fragmented, then you would have to buffer the entire message so
you could count its length before you could send the first byte.  With
fragmentation, you choose a reasonable size buffer and when the buffer is
full you write a fragment to the network.

A secondary use-case for fragmentation is for mulitplexing, where you don't
want want a large message on one logical channel to monopolize the output
channel, so the MUX needs to be free to split the message into smaller
fragments to better share the output channel.


> I have not read [WSAPI] yet, though, I would assume the ping/pong
> will be done at WS protocol level. How can you inject "ping" when
> the first portion of long text frame has just been transmitted?
> The payload length is already sent. You would need to implement
> some scheduler for ping with a large buffer to avoid that. If the
> ping is initiated by the app, then it would be another story...
>
> The heart of the problem I can think of is the fact that the
> current protocol does not define maximum size of the frame for
> text and binary. I mean, one solution would be to set up such
> maximum frame size (or MFS - which corresponds in a way to TCP's
> MSS) to a reasonable amount to allow multiplexed frames to flow
> all the time with a reasonable delay.
>

Read the archives -- the current solution is a hard-won compromise between
those who wanted simplicity of being able to write a large message in a
single operation (and making use of things like sendfile to do it in the OS)
and those who wanted fragmentation.


> >  Multiplexing will be defined as an extension and will include
> > logical channels.  Even in #2, you would have to maintain the frame
> > type from the original frame to avoid attacks like [BINARY "invalid
> > UTF8"] [TEXT/FIN "UTF8"] which could exploit bugs in UTF8 decoders.
>
> I have to admit that I could not decipher you point. Sorry. I
> will look for information about the UTF8 bug exploit, or could you
> please point me to a related discussion?


Imagine we copied the opcode into every frame, and there was an
implementation that decided it would avoid having to remember what opcode it
was processing since every frame includes the opcode.  Now, it receives a
fragment with a BINARY opcode, including non-UTF8 data.  The next fragment
is TEXT/FINAL, and so the receiving software verifies that the bytes sent is
valid UTF8 data, appends it to the current message buffer, and then delivers
it to the application as UTF8 data.  However, the first part of the buffer
was never validated to be UTF8 since it was received as type BINARY.  Thus,
you might exploit a bug in UTF8 handling in the application that didn't
expect to deal with invalid UTF8 sequences in a text message.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6aeb4d4902a049bf36590
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 10, 2011 at 3:06 PM,  <span dir=3D"l=
tr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Takeda=
@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;">

<tt><font size=3D"2">It&#39;s on TCP - the order is guaranteed, therefore o=
nly
1-bit of </font></tt>
<br><tt><font size=3D"2">information is necessary, IMO. {Just continuation
or final.</font></tt>
<br><tt><font size=3D"2">&#39;first or middle&#39; is redundant over the st=
eamed protocol)</font></tt>=C2=A0=C2=A0</blockquote><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex;">=C2=A0</blockquote>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;"><tt><font size=3D"2">Single frame: [fin=3D1=
]</font></tt>
<br><tt><font size=3D"2">Fragmented =C2=A0: [fin=3D0]...[fin=3D1]</font></t=
t>
<br>
<br><tt><font size=3D"2">It works even in the case where different frames a=
re
multiplexed.</font></tt>
<br><tt><font size=3D"2">(I understand, it occurs only with Control frames
in the current spec.)</font></tt>
<br>
<br><tt><font size=3D"2">From the net: [op=3Dtxt, fin=3D0] [op=3Dbin, fin=
=3D0] [op=3Dtxt,
fin=3D1]</font></tt>
<br><tt><font size=3D"2">Text buffer : [op=3Dtxt, fin=3D0] =C2=A0 =C2=A0 =
=C2=A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 [op=3Dtxt, fin=3D1]</font></tt>
<br><tt><font size=3D"2">Bin. buffer : =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0
=C2=A0 =C2=A0 [op=3Dbin, fin=3D0] (waiting for opt=3Dbin, fin=3D0 or 1)</fo=
nt></tt>
<br>
<br><tt><font size=3D"2"># any thoughts?</font></tt>=C2=A0</blockquote><div=
><br></div><div>That would let you interleave different types of frames, bu=
t not the same type of frames. =C2=A0Since the initial uses are all going t=
o be text frames, that doesn&#39;t buy you anything. =C2=A0A complete multi=
plexing solution also needs to address flow control issues, so I don&#39;t =
see that the limited ability to interleave frames with different opcodes is=
 useful.</div>

<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;"><div class=3D"im"><tt><fon=
t size=3D"2">I see. Good to know the purpose of the fragmentation.
(please add</font></tt>
</div><tt><font size=3D"2">in the document)</font></tt>
<br></blockquote><div><br></div><div>The primary purpose of fragmentation i=
s to allow sending a message that is of unknown size when it is started wit=
hout having to buffer it. =C2=A0If messages couldn&#39;t be fragmented, the=
n you would have to buffer the entire message so you could count its length=
 before you could send the first byte. =C2=A0With fragmentation, you choose=
 a reasonable size buffer and when the buffer is full you write a fragment =
to the network.</div>

<div><br></div><div>A secondary use-case for fragmentation is for mulitplex=
ing, where you don&#39;t want want a large message on one logical channel t=
o monopolize the output channel, so the MUX needs to be free to split the m=
essage into smaller fragments to better share the output channel.</div>

<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;"><tt><font size=3D"2">I hav=
e not read [WSAPI] yet, though, I would assume
the ping/pong</font></tt>
<br><tt><font size=3D"2">will be done at WS protocol level. How can you inj=
ect
&quot;ping&quot; when</font></tt>
<br><tt><font size=3D"2">the first portion of long text frame has just been
transmitted? </font></tt>
<br><tt><font size=3D"2">The payload length is already sent. You would need
to implement </font></tt>
<br><tt><font size=3D"2">some scheduler for ping with a large buffer to avo=
id
that. If the </font></tt>
<br><tt><font size=3D"2">ping is initiated by the app, then it would be ano=
ther
story...</font></tt>
<br>
<br><tt><font size=3D"2">The heart of the problem I can think of is the fac=
t
that the </font></tt>
<br><tt><font size=3D"2">current protocol does not define maximum size of t=
he
frame for</font></tt>
<br><tt><font size=3D"2">text and binary. I mean, one solution would be to
set up such </font></tt>
<br><tt><font size=3D"2">maximum frame size (or MFS - which corresponds in
a way to TCP&#39;s </font></tt>
<br><tt><font size=3D"2">MSS) to a reasonable amount to allow multiplexed f=
rames
to flow </font></tt>
<br><tt><font size=3D"2">all the time with a reasonable delay.</font></tt>
<br><div class=3D"im"><tt><font size=3D"2"></font></tt></div></blockquote><=
div><br></div><div>Read the archives -- the current solution is a hard-won =
compromise between those who wanted simplicity of being able to write a lar=
ge message in a single operation (and making use of things like sendfile to=
 do it in the OS) and those who wanted fragmentation.</div>

<div>=C2=A0<span class=3D"Apple-style-span" style=3D"font-family: monospace=
; ">=C2=A0</span></div><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class=3D"im"><t=
t><font size=3D"2">
&gt; =C2=A0Multiplexing will be defined as an extension and will include
<br>
&gt; logical channels. =C2=A0Even in #2, you would have to maintain the
frame <br>
&gt; type from the original frame to avoid attacks like [BINARY &quot;inval=
id
<br>
&gt; UTF8&quot;] [TEXT/FIN &quot;UTF8&quot;] which could exploit bugs in
UTF8 decoders.</font></tt>
<br>
<br></div><tt><font size=3D"2">I have to admit that I could not decipher yo=
u point.
Sorry. I </font></tt>
<br><tt><font size=3D"2">will look for information about the UTF8 bug explo=
it,
or could you</font></tt>
<br><tt><font size=3D"2">please point me to a related discussion?</font></t=
t>=C2=A0</blockquote><div><br></div><div>Imagine we copied the opcode into =
every frame, and there was an implementation that decided it would avoid ha=
ving to remember what opcode it was processing since every frame includes t=
he opcode. =C2=A0Now, it receives a fragment with a BINARY opcode, includin=
g non-UTF8 data. =C2=A0The next fragment is TEXT/FINAL, and so the receivin=
g software verifies that the bytes sent is valid UTF8 data, appends it to t=
he current message buffer, and then delivers it to the application as UTF8 =
data. =C2=A0However, the first part of the buffer was never validated to be=
 UTF8 since it was received as type BINARY. =C2=A0Thus, you might exploit a=
 bug in UTF8 handling in the application that didn&#39;t expect to deal wit=
h invalid UTF8 sequences in a text message.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd6aeb4d4902a049bf36590--

From jat@google.com  Thu Feb 10 12:29:12 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DEF963A6838 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 12:29:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.9
X-Spam-Level: 
X-Spam-Status: No, score=-102.9 tagged_above=-999 required=5 tests=[AWL=-0.076, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yjZarGi7lo3P for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 12:29:10 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id D3C6D3A69BC for <hybi@ietf.org>; Thu, 10 Feb 2011 12:29:09 -0800 (PST)
Received: from hpaq6.eem.corp.google.com (hpaq6.eem.corp.google.com [172.25.149.6]) by smtp-out.google.com with ESMTP id p1AKTMx4029326 for <hybi@ietf.org>; Thu, 10 Feb 2011 12:29:22 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297369762; bh=V7ELgaMad7eOBs9TfuQhZBRdwQE=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=rir20h5e8VZVOgevDHgiMsTHvhqLHkk29GeGXKRORuO/7pBeGGEdLdq4LEx1fZEW8 HlP1aai04FLiM/vr9YNsQ==
Received: from yxd30 (yxd30.prod.google.com [10.190.1.222]) by hpaq6.eem.corp.google.com with ESMTP id p1AKTKwP007940 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 10 Feb 2011 12:29:21 -0800
Received: by yxd30 with SMTP id 30so811970yxd.11 for <hybi@ietf.org>; Thu, 10 Feb 2011 12:29:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=npV3rf5xJCU8Qhlpip3qh6fn2PD4rmKI/BLsQ3nv7Bs=; b=D9ilJaslNWPJnHVxMhcbgYcpl/mBl7zFtDSinrRgwFuA5TLKPNvALYDDk9jm+Dlnw+ Kfp67d04hA6Yov9iaJ5A==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Gd6PlWER99hHnhbWOX1agq3mfP1oBnYqoVlFH9bJT9v8xL+F3B4+rFKF7CR8YkrkW+ vy6AjkObn1cr5gJBCXXg==
Received: by 10.151.42.8 with SMTP id u8mr3981894ybj.320.1297369759958; Thu, 10 Feb 2011 12:29:19 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Thu, 10 Feb 2011 12:28:59 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org> <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
From: John Tamplin <jat@google.com>
Date: Thu, 10 Feb 2011 15:28:59 -0500
Message-ID: <AANLkTinsXn=re_Ksr_wQdz4pyW2iXtUzBRz+nPYJtD-z@mail.gmail.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: multipart/alternative; boundary=001517510db0af45e5049bf36f5b
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 20:29:12 -0000

--001517510db0af45e5049bf36f5b
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 10, 2011 at 4:47 AM, Gabriel Montenegro <
Gabriel.Montenegro@microsoft.com> wrote:

> Yes, if one accepts UTF-8, that must be validated, no question about it.
> The point is not to disallow UTF-8, but to be able to optimize on those
> websocket connections that use binary only, so this is not a fragmenting of
> the protocol any more than any other per-session negotiable feature is.
>
> From the comments, folks seem to be thinking about Javascript Websockets
> API, and how it does not allow binary nor support streaming. That's true,
> but as we've emphasized before: we're designing the websockets protocol to
> be usable with the JS Websockets API, but is not limited to it. Other APIs
> may offer both binary and streaming.


Ok, but what exactly is the benefit of having a binary-only negotiation?
 Your implementation is always free to make assumptions about the frames
that are sent by another of your implementations, so if you want to fail the
connection on any text frame that is ok.

If you mean that you would swap out a different state machine for
binary-only connections, then why is it not sufficient to choose that state
machine based on the opcode of the first frame?

-- 
John A. Tamplin
Software Engineer (GWT), Google

--001517510db0af45e5049bf36f5b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 10, 2011 at 4:47 AM, Gabriel Montene=
gro <span dir=3D"ltr">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.co=
m">Gabriel.Montenegro@microsoft.com</a>&gt;</span> wrote:<br><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p=
adding-left:1ex;">

Yes, if one accepts UTF-8, that must be validated, no question about it. Th=
e point is not to disallow UTF-8, but to be able to optimize on those webso=
cket connections that use binary only, so this is not a fragmenting of the =
protocol any more than any other per-session negotiable feature is.<br>


<br>
>From the comments, folks seem to be thinking about Javascript Websockets AP=
I, and how it does not allow binary nor support streaming. That&#39;s true,=
 but as we&#39;ve emphasized before: we&#39;re designing the websockets pro=
tocol to be usable with the JS Websockets API, but is not limited to it. Ot=
her APIs may offer both binary and streaming.</blockquote>

<div><br></div><div>Ok, but what exactly is the benefit of having a binary-=
only negotiation? =C2=A0Your implementation is always free to make assumpti=
ons about the frames that are sent by another of your implementations, so i=
f you want to fail the connection on any text frame that is ok.</div>

<div><br></div><div>If you mean that you would swap out a different state m=
achine for binary-only connections, then why is it not sufficient to choose=
 that state machine based on the opcode of the first frame?=C2=A0</div></di=
v>

<br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--001517510db0af45e5049bf36f5b--

From tyoshino@google.com  Thu Feb 10 13:04:26 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C65243A69EB for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 13:04:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.826
X-Spam-Level: 
X-Spam-Status: No, score=-104.826 tagged_above=-999 required=5 tests=[AWL=1.150, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SLAk6ybUa-vn for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 13:04:25 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 6B7203A6838 for <hybi@ietf.org>; Thu, 10 Feb 2011 13:04:25 -0800 (PST)
Received: from wpaz9.hot.corp.google.com (wpaz9.hot.corp.google.com [172.24.198.73]) by smtp-out.google.com with ESMTP id p1AL4boe014241 for <hybi@ietf.org>; Thu, 10 Feb 2011 13:04:37 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297371877; bh=rCBjAUCdN9YhYZeN7dZGg20EnbU=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=uwxMDIY5fZ31mWXGIx9/2/bo2Gzj+mWCFKX6oE42J4GHbnZ4O4olt9LG89uRMGbRD 3LPBOEeIAATWm5pNzGAZA==
Received: from gyd8 (gyd8.prod.google.com [10.243.49.200]) by wpaz9.hot.corp.google.com with ESMTP id p1AL4aq4002160 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 10 Feb 2011 13:04:36 -0800
Received: by gyd8 with SMTP id 8so848717gyd.20 for <hybi@ietf.org>; Thu, 10 Feb 2011 13:04:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=9LzKIH8/b2jbkfQ0Gdb6lvqz+zNv4mIlMGob3y70PDo=; b=T+wmTv1mNyOSRFMHXpYm61LtAGN5zHmJTJSzH4pio8/iVBaf4/gTCL3RoIrocfdsgg elterr8G567uRiz39NIQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=EsTZSVd9nAXkLAlX1nAY9e5XBEyT+AqLMeMQaEpHTj9Qh6BRq1vJSbC+xltrMJIMil +0GiyFTYPZbDWGC8mqQg==
Received: by 10.150.144.19 with SMTP id r19mr3868740ybd.162.1297371876308; Thu, 10 Feb 2011 13:04:36 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.91.16 with HTTP; Thu, 10 Feb 2011 13:04:16 -0800 (PST)
In-Reply-To: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
References: <20110208231502.31262.8249.idtracker@localhost> <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 11 Feb 2011 06:04:16 +0900
Message-ID: <AANLkTin9mySdN_FrB7sGa+rfRARnkXs3cqPf+kFarQOn@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=000e0cd56a96d438e0049bf3ed63
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 21:04:27 -0000

--000e0cd56a96d438e0049bf3ed63
Content-Type: text/plain; charset=ISO-8859-1

Hi Yutaka-san,

On Thu, Feb 10, 2011 at 19:59, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> o Section 1.3 - discrepancy in SHA1 hash value:
>
> My python says:
> >>> h = hashlib.sha1()
> >>> h.update('dGhlIHNhbXBsZSBub25jZQ==258EAFA5-E914-47DA-95CA-
> C5AB0DC85B11')
> >>> h.hexdigest()
> '1b334d8e1b8d57c1c7a214517c106abc434282b8'
>
>
remove a space between 95CA- and C5AB, and you get what's on the spec.

>>> import hashlib
>>> h = hashlib.sha1()
>>> h.update('dGhlIHNhbXBsZSBub25jZQ==258EAFA5-E914-47DA-95CA-C5AB0DC85B11')
>>> h.hexdigest()
'b37a4f2cc0624f1690f64606cf385945b2bec4ea'


> o Section 4.5.1 - the term "body"
>
> For consistency, it should be replaced with Application Data, or "body" be
> defined explicitly in the document.
>
>
agreed

>
> o Section 4.5.1 - Close handshake
>
> It is no clear to me what 0x43 and 0x53 are trying to achieve. In TCP,
> there is FIN with no
> details of why/who is closing for graceful shutdown.
>
>
Actually, it's not intended to indicate who's closing, but to make sure what
the close frame really means, i.e. it's close initiation or close
acknowledgement. Using an analogy of TCP, close S from server is FIN, and
close S from client is ACK for server's FIN.

Without this, each peer cannot know
- the other peer just initiated close
or
- the other peer received close frame and acknowledged it

Imagine both peers send out close initiation at approximately same time.
They looks like acknowledgement but are not.

Once we can perfectly distinguish initiation and acknowledgement as
described above, we can assume "If A received close acknowledgement from B,
B has received all the data sent from A before close successfully".

If you have any idea about the usefulness of this closing handshake design,
please come to the thread "Clarify the role of closing handshake" and speak
out. We're discussing it now.

Takeshi

--000e0cd56a96d438e0049bf3ed63
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">Hi Yutaka-san,</div><div class=3D"gmail_quote"><=
br></div><div class=3D"gmail_quote">On Thu, Feb 10, 2011 at 19:59,  <span d=
ir=3D"ltr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka=
_Takeda@playstation.sony.com</a>&gt;</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;"><br><font size=3D"2" face=3D"sans-serif">o =
Section 1.3 - discrepancy in SHA1
hash value:</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">My python says:</font>
<br><font size=3D"2" face=3D"sans-serif">&gt;&gt;&gt; h =3D hashlib.sha1()<=
/font>
<br><font size=3D"2" face=3D"sans-serif">&gt;&gt;&gt; h.update(&#39;dGhlIHN=
hbXBsZSBub25jZQ=3D=3D258EAFA5-E914-47DA-95CA-
C5AB0DC85B11&#39;)</font>
<br><font size=3D"2" face=3D"sans-serif">&gt;&gt;&gt; h.hexdigest()</font>
<br><font size=3D"2" face=3D"sans-serif">&#39;1b334d8e1b8d57c1c7a214517c106=
abc434282b8&#39;</font>
<br>
<br></blockquote><div><br></div><div>remove a space between 95CA- and C5AB,=
 and you get what&#39;s on the spec.</div><div><br></div><div><div>&gt;&gt;=
&gt; import hashlib</div><div>&gt;&gt;&gt; h =3D hashlib.sha1()</div><div>

&gt;&gt;&gt; h.update(&#39;dGhlIHNhbXBsZSBub25jZQ=3D=3D258EAFA5-E914-47DA-9=
5CA-C5AB0DC85B11&#39;)</div><div>&gt;&gt;&gt; h.hexdigest()</div><div>&#39;=
b37a4f2cc0624f1690f64606cf385945b2bec4ea&#39;</div></div><div>=A0</div><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c=
cc solid;padding-left:1ex;">

<font size=3D"2" face=3D"sans-serif">o Section 4.5.1 - the term &quot;body&=
quot;</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">For consistency, it should be repl=
aced
with Application Data, or &quot;body&quot; be defined explicitly in the
document.</font>
<br>
<br></blockquote><div><br></div><div>agreed=A0</div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex;">
<br><font size=3D"2" face=3D"sans-serif">o Section 4.5.1 - Close handshake<=
/font>
<br>
<br><font size=3D"2" face=3D"sans-serif">It is no clear to me what 0x43 and=
 0x53
are trying to achieve. In TCP, there is FIN with no </font>
<br><font size=3D"2" face=3D"sans-serif">details of why/who is closing for =
graceful
shutdown.</font>
<br>
<br></blockquote><div><br></div><div><div>Actually, it&#39;s not intended t=
o indicate who&#39;s closing, but to make sure what the close frame really =
means, i.e. it&#39;s close initiation or close acknowledgement. Using an an=
alogy of TCP, close S from server is FIN, and close S from client is ACK fo=
r server&#39;s FIN.</div>

</div><div><br></div><div><div><div>Without this, each peer cannot know</di=
v></div></div><div>- the other peer just initiated close</div><div>or</div>=
<div>- the other peer received close frame and acknowledged it</div><div>

<br></div><div>Imagine both peers send out close initiation at approximatel=
y same time. They looks like acknowledgement but are not.</div><div><br></d=
iv><div>Once we can perfectly distinguish initiation and acknowledgement as=
 described above, we can assume &quot;If A received close acknowledgement f=
rom B, B has received all the data sent from A before close successfully&qu=
ot;.</div>

<div><div><div><div><br></div></div></div></div><div>If you have any idea a=
bout the usefulness of this closing handshake design, please come to the th=
read &quot;Clarify the role of closing handshake&quot; and speak out. We&#3=
9;re discussing it now.</div>

<div><br></div><div>Takeshi</div></div>

--000e0cd56a96d438e0049bf3ed63--

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 10 13:20:20 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 524F43A6838; Thu, 10 Feb 2011 13:20:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.864
X-Spam-Level: 
X-Spam-Status: No, score=-5.864 tagged_above=-999 required=5 tests=[AWL=-0.200, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yr2Os9ulMEnQ; Thu, 10 Feb 2011 13:20:18 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id AF4733A6A0D; Thu, 10 Feb 2011 13:20:18 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021013202597-431077 ; Thu, 10 Feb 2011 13:20:25 -0800 
In-Reply-To: <AANLkTinYrCzkOrWBc6on6ue1-Y7o=cFAAj1WD_Ya5_gA@mail.gmail.com>
To: John Tamplin <jat@google.com>
MIME-Version: 1.0
X-KeepSent: 7E72C738:F7E229F3-88257833:00735F56; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF7E72C738.F7E229F3-ON88257833.00735F56-88257833.00757163@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 10 Feb 2011 13:22:46 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/10/2011 01:20:25 PM, Serialize complete at 02/10/2011 01:20:25 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 01:20:25 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 01:20:32 PM, Serialize complete at 02/10/2011 01:20:32 PM
Content-Type: multipart/alternative; boundary="=_alternative 0075716088257833_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 21:20:20 -0000

This is a multipart message in MIME format.
--=_alternative 0075716088257833_=
Content-Type: text/plain; charset="US-ASCII"

Thanks John for your comments which corrected my misunderstanding!

Just a comple of things, just to summarize...

> That would let you interleave different types of frames, but not the
> same type of frames.

You are right. This multiplexing based on opcode is half-way through,
and we need to introduce some kind of channel ID for complete 
multiplexing,
which is out of scope in the current document - now I understand.

The original point I was making though was if 'Continuation frame' is 
necessary for the current spec. It doesn't harm to have it and I can live 
with it, but it still looks redundant or misleading to me.

> The primary purpose of fragmentation is to allow sending a message 
> that is of unknown size...

This got me realize my misunderstanding. Please for get about MFS thing
I mentioned. WS layer is already in control in terms of setting frame 
size to an optimal. I agree, flow control would be an issue in the future.

Thanks again,

** todo: read more archive ** 

- Yutaka


John Tamplin <jat@google.com> wrote on 02/10/2011 12:26:14 PM:

> On Thu, Feb 10, 2011 at 3:06 PM, <Yutaka_Takeda@playstation.sony.com> 
wrote:
> It's on TCP - the order is guaranteed, therefore only 1-bit of 
> information is necessary, IMO. {Just continuation or final. 
> 'first or middle' is redundant over the steamed protocol)  
>  
> Single frame: [fin=1] 
> Fragmented  : [fin=0]...[fin=1] 
> 
> It works even in the case where different frames are multiplexed. 
> (I understand, it occurs only with Control frames in the current spec.) 
> 
> From the net: [op=txt, fin=0] [op=bin, fin=0] [op=txt, fin=1] 
> Text buffer : [op=txt, fin=0]                 [op=txt, fin=1] 
> Bin. buffer :                 [op=bin, fin=0] (waiting for opt=bin, 
> fin=0 or 1) 
> 
> # any thoughts? 
> 
> That would let you interleave different types of frames, but not the
> same type of frames.  Since the initial uses are all going to be 
> text frames, that doesn't buy you anything.  A complete multiplexing
> solution also needs to address flow control issues, so I don't see 
> that the limited ability to interleave frames with different opcodesis 
useful.
>  
> I see. Good to know the purpose of the fragmentation. (please add 
> in the document) 
> 
> The primary purpose of fragmentation is to allow sending a message 
> that is of unknown size when it is started without having to buffer 
> it.  If messages couldn't be fragmented, then you would have to 
> buffer the entire message so you could count its length before you 
> could send the first byte.  With fragmentation, you choose a 
> reasonable size buffer and when the buffer is full you write a 
> fragment to the network.
> 
> A secondary use-case for fragmentation is for mulitplexing, where 
> you don't want want a large message on one logical channel to 
> monopolize the output channel, so the MUX needs to be free to split 
> the message into smaller fragments to better share the output channel.
>  
> I have not read [WSAPI] yet, though, I would assume the ping/pong 
> will be done at WS protocol level. How can you inject "ping" when 
> the first portion of long text frame has just been transmitted? 
> The payload length is already sent. You would need to implement 
> some scheduler for ping with a large buffer to avoid that. If the 
> ping is initiated by the app, then it would be another story... 
> 
> The heart of the problem I can think of is the fact that the 
> current protocol does not define maximum size of the frame for 
> text and binary. I mean, one solution would be to set up such 
> maximum frame size (or MFS - which corresponds in a way to TCP's 
> MSS) to a reasonable amount to allow multiplexed frames to flow 
> all the time with a reasonable delay. 
> 
> Read the archives -- the current solution is a hard-won compromise 
> between those who wanted simplicity of being able to write a large 
> message in a single operation (and making use of things like 
> sendfile to do it in the OS) and those who wanted fragmentation.
>   
> >  Multiplexing will be defined as an extension and will include 
> > logical channels.  Even in #2, you would have to maintain the frame 
> > type from the original frame to avoid attacks like [BINARY "invalid 
> > UTF8"] [TEXT/FIN "UTF8"] which could exploit bugs in UTF8 decoders. 

> I have to admit that I could not decipher you point. Sorry. I 
> will look for information about the UTF8 bug exploit, or could you 
> please point me to a related discussion? 
> 
> Imagine we copied the opcode into every frame, and there was an 
> implementation that decided it would avoid having to remember what 
> opcode it was processing since every frame includes the opcode. 
>  Now, it receives a fragment with a BINARY opcode, including non-
> UTF8 data.  The next fragment is TEXT/FINAL, and so the receiving 
> software verifies that the bytes sent is valid UTF8 data, appends it
> to the current message buffer, and then delivers it to the 
> application as UTF8 data.  However, the first part of the buffer was
> never validated to be UTF8 since it was received as type BINARY. 
>  Thus, you might exploit a bug in UTF8 handling in the application 
> that didn't expect to deal with invalid UTF8 sequences in a text 
message.
> 
> -- 
> John A. Tamplin
> Software Engineer (GWT), Google
--=_alternative 0075716088257833_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Thanks John for your comments which
corrected my misunderstanding!</font>
<br>
<br><font size=2 face="sans-serif">Just a comple of things, just to summarize...</font>
<br>
<br><tt><font size=2>&gt; That would let you interleave different types
of frames, but not the<br>
&gt; same type of frames.</font></tt>
<br>
<br><tt><font size=2>You are right. This multiplexing based on opcode is
half-way through,</font></tt>
<br><tt><font size=2>and we need to introduce some kind of channel ID for
complete multiplexing,</font></tt>
<br><tt><font size=2>which is out of scope in the current document - now
I understand.</font></tt>
<br>
<br><tt><font size=2>The original point I was making though was if 'Continuation
frame' is </font></tt>
<br><tt><font size=2>necessary for the current spec. It doesn't harm to
have it and I can live </font></tt>
<br><tt><font size=2>with it, but it still looks redundant or misleading
to me.</font></tt>
<br>
<br><tt><font size=2>&gt; The primary purpose of fragmentation is to allow
sending a message <br>
&gt; that is of unknown size...</font></tt>
<br>
<br><tt><font size=2>This got me realize my misunderstanding. Please for
get about MFS thing</font></tt>
<br><tt><font size=2>I mentioned. WS layer is already in control in terms
of setting frame </font></tt>
<br><tt><font size=2>size to an optimal. I agree, flow control would be
an issue in the future.<br>
</font></tt>
<br><tt><font size=2>Thanks again,</font></tt>
<br>
<br><tt><font size=2>** todo: read more archive ** </font></tt>
<br>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
<br>
<br><tt><font size=2>John Tamplin &lt;jat@google.com&gt; wrote on 02/10/2011
12:26:14 PM:<br>
<br>
&gt; On Thu, Feb 10, 2011 at 3:06 PM, &lt;Yutaka_Takeda@playstation.sony.com&gt;
wrote:</font></tt>
<br><tt><font size=2>&gt; It's on TCP - the order is guaranteed, therefore
only 1-bit of <br>
&gt; information is necessary, IMO. {Just continuation or final. <br>
&gt; 'first or middle' is redundant over the steamed protocol)&nbsp;&nbsp;</font></tt>
<br><tt><font size=2>&gt; &nbsp;</font></tt>
<br><tt><font size=2>&gt; Single frame: [fin=1] <br>
&gt; Fragmented &nbsp;: [fin=0]...[fin=1] <br>
&gt; <br>
&gt; It works even in the case where different frames are multiplexed.
<br>
&gt; (I understand, it occurs only with Control frames in the current spec.)
<br>
&gt; <br>
&gt; From the net: [op=txt, fin=0] [op=bin, fin=0] [op=txt, fin=1] <br>
&gt; Text buffer : [op=txt, fin=0] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; [op=txt, fin=1] <br>
&gt; Bin. buffer : &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
[op=bin, fin=0] (waiting for opt=bin, <br>
&gt; fin=0 or 1) <br>
&gt; <br>
&gt; # any thoughts?&nbsp;</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; That would let you interleave different types of frames, but not the<br>
&gt; same type of frames. &nbsp;Since the initial uses are all going to
be <br>
&gt; text frames, that doesn't buy you anything. &nbsp;A complete multiplexing<br>
&gt; solution also needs to address flow control issues, so I don't see
<br>
&gt; that the limited ability to interleave frames with different opcodesis
useful.</font></tt>
<br><tt><font size=2>&gt; &nbsp;</font></tt>
<br><tt><font size=2>&gt; I see. Good to know the purpose of the fragmentation.
(please add </font></tt>
<br><tt><font size=2>&gt; in the document) </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; The primary purpose of fragmentation is to allow sending a message
<br>
&gt; that is of unknown size when it is started without having to buffer
<br>
&gt; it. &nbsp;If messages couldn't be fragmented, then you would have
to <br>
&gt; buffer the entire message so you could count its length before you
<br>
&gt; could send the first byte. &nbsp;With fragmentation, you choose a
<br>
&gt; reasonable size buffer and when the buffer is full you write a <br>
&gt; fragment to the network.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; A secondary use-case for fragmentation is for mulitplexing, where
<br>
&gt; you don't want want a large message on one logical channel to <br>
&gt; monopolize the output channel, so the MUX needs to be free to split
<br>
&gt; the message into smaller fragments to better share the output channel.</font></tt>
<br><tt><font size=2>&gt; &nbsp;</font></tt>
<br><tt><font size=2>&gt; I have not read [WSAPI] yet, though, I would
assume the ping/pong <br>
&gt; will be done at WS protocol level. How can you inject &quot;ping&quot;
when <br>
&gt; the first portion of long text frame has just been transmitted? <br>
&gt; The payload length is already sent. You would need to implement <br>
&gt; some scheduler for ping with a large buffer to avoid that. If the
<br>
&gt; ping is initiated by the app, then it would be another story... <br>
&gt; <br>
&gt; The heart of the problem I can think of is the fact that the <br>
&gt; current protocol does not define maximum size of the frame for <br>
&gt; text and binary. I mean, one solution would be to set up such <br>
&gt; maximum frame size (or MFS - which corresponds in a way to TCP's <br>
&gt; MSS) to a reasonable amount to allow multiplexed frames to flow <br>
&gt; all the time with a reasonable delay. </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Read the archives -- the current solution is a hard-won compromise
<br>
&gt; between those who wanted simplicity of being able to write a large
<br>
&gt; message in a single operation (and making use of things like <br>
&gt; sendfile to do it in the OS) and those who wanted fragmentation.</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp;</font></tt>
<br><tt><font size=2>&gt; &gt; &nbsp;Multiplexing will be defined as an
extension and will include <br>
&gt; &gt; logical channels. &nbsp;Even in #2, you would have to maintain
the frame <br>
&gt; &gt; type from the original frame to avoid attacks like [BINARY &quot;invalid
<br>
&gt; &gt; UTF8&quot;] [TEXT/FIN &quot;UTF8&quot;] which could exploit bugs
in UTF8 decoders. <br>
</font></tt>
<br><tt><font size=2>&gt; I have to admit that I could not decipher you
point. Sorry. I <br>
&gt; will look for information about the UTF8 bug exploit, or could you
<br>
&gt; please point me to a related discussion?&nbsp;</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Imagine we copied the opcode into every frame, and there was an <br>
&gt; implementation that decided it would avoid having to remember what
<br>
&gt; opcode it was processing since every frame includes the opcode. <br>
&gt; &nbsp;Now, it receives a fragment with a BINARY opcode, including
non-<br>
&gt; UTF8 data. &nbsp;The next fragment is TEXT/FINAL, and so the receiving
<br>
&gt; software verifies that the bytes sent is valid UTF8 data, appends
it<br>
&gt; to the current message buffer, and then delivers it to the <br>
&gt; application as UTF8 data. &nbsp;However, the first part of the buffer
was<br>
&gt; never validated to be UTF8 since it was received as type BINARY. <br>
&gt; &nbsp;Thus, you might exploit a bug in UTF8 handling in the application
<br>
&gt; that didn't expect to deal with invalid UTF8 sequences in a text message.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; -- <br>
&gt; John A. Tamplin<br>
&gt; Software Engineer (GWT), Google</font></tt>
--=_alternative 0075716088257833_=--

From jat@google.com  Thu Feb 10 13:28:09 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4F2343A69B5 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 13:28:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.676
X-Spam-Level: 
X-Spam-Status: No, score=-105.676 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TtGP3s-GPZQA for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 13:28:08 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 443053A67D8 for <hybi@ietf.org>; Thu, 10 Feb 2011 13:28:08 -0800 (PST)
Received: from wpaz9.hot.corp.google.com (wpaz9.hot.corp.google.com [172.24.198.73]) by smtp-out.google.com with ESMTP id p1ALSLSd017507 for <hybi@ietf.org>; Thu, 10 Feb 2011 13:28:21 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297373301; bh=tUVtJ7EAdbgMAy2ZPoSptTagix4=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=BrRmhVZ0dYQT95xcl4XHTT+52WxD3hqACcFQriWAQEpNocw5lBYgLuI3rNttvY7pf yHHZoMWZ5MQL58/UGegTw==
Received: from gwj22 (gwj22.prod.google.com [10.200.10.22]) by wpaz9.hot.corp.google.com with ESMTP id p1ALRniu000363 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 10 Feb 2011 13:28:20 -0800
Received: by gwj22 with SMTP id 22so870748gwj.0 for <hybi@ietf.org>; Thu, 10 Feb 2011 13:28:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=yTzILlie7O+v+VhpAve/CRmfskwZI5dcfamAcLqBcOc=; b=CNFxdawitk4vKqdxBhU6Hq7q2KRRctFZGj9r7bGhIFcVIo31FIXHblE32mdlu46ujn ZyXq1cNeTHotqyHP4uSg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=D6Cpl+yCofrv1MZuZ5wpRVOV5Cv/KdpUTNCO+yfp8k9njc2KyXUyQCJFVSeHcoVXXL 8aMo58qA6biVubVkPm/g==
Received: by 10.150.51.21 with SMTP id y21mr3985538yby.263.1297373300036; Thu, 10 Feb 2011 13:28:20 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Thu, 10 Feb 2011 13:27:59 -0800 (PST)
In-Reply-To: <OF7E72C738.F7E229F3-ON88257833.00735F56-88257833.00757163@playstation.sony.com>
References: <AANLkTinYrCzkOrWBc6on6ue1-Y7o=cFAAj1WD_Ya5_gA@mail.gmail.com> <OF7E72C738.F7E229F3-ON88257833.00735F56-88257833.00757163@playstation.sony.com>
From: John Tamplin <jat@google.com>
Date: Thu, 10 Feb 2011 16:27:59 -0500
Message-ID: <AANLkTimLY_mfvhcYkwq-YUuZio5vn4XjV7hT1Wc_KK02@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=000e0cd6ab80b0955b049bf442f7
X-System-Of-Record: true
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 21:28:09 -0000

--000e0cd6ab80b0955b049bf442f7
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 10, 2011 at 4:22 PM, <Yutaka_Takeda@playstation.sony.com> wrote:

> The original point I was making though was if 'Continuation frame' is
> necessary for the current spec. It doesn't harm to have it and I can live
> with it, but it still looks redundant or misleading to me.
>

Right, and making all the frames have to be the same is redundant and
doesn't let you distinguish the four states.  The only way that wouldn't be
redundant is to actually have a message layer and a fragment layer, and
aside from the having two framing formats instead of one and rules for
interaction between them, there is no way to do it without wasting bits (or
switching to a bit-oriented protocol) and overcomplicating the simple cases.

It is all a compromise between competing goals, and we spent months coming
up with a framing that everyone could agree to.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6ab80b0955b049bf442f7
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 10, 2011 at 4:22 PM,  <span dir=3D"l=
tr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Takeda=
@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;">

<tt><font size=3D"2">The original point I was making though was if &#39;Con=
tinuation
frame&#39; is </font></tt>
<br><tt><font size=3D"2">necessary for the current spec. It doesn&#39;t har=
m to
have it and I can live </font></tt>
<br><tt><font size=3D"2">with it, but it still looks redundant or misleadin=
g
to me.</font></tt>
<br></blockquote><div><br></div><div>Right, and making all the frames have =
to be the same is redundant and doesn&#39;t let you distinguish the four st=
ates. =C2=A0The only way that wouldn&#39;t be redundant is to actually have=
 a message layer and a fragment layer, and aside from the having two framin=
g formats instead of one and rules for interaction between them, there is n=
o way to do it without wasting bits (or switching to a bit-oriented protoco=
l) and overcomplicating the simple cases.</div>

<div><br></div><div>It is all a compromise between competing goals, and we =
spent months coming up with a framing that everyone could agree to.</div></=
div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd6ab80b0955b049bf442f7--

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 10 15:35:46 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2764E3A6B10; Thu, 10 Feb 2011 15:35:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.814
X-Spam-Level: 
X-Spam-Status: No, score=-5.814 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_83=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SQrv7BTw1i4Y; Thu, 10 Feb 2011 15:35:44 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 003CA3A6B0A; Thu, 10 Feb 2011 15:35:43 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021015355091-437010 ; Thu, 10 Feb 2011 15:35:50 -0800 
In-Reply-To: <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
MIME-Version: 1.0
X-KeepSent: 1FBA64A7:FD3F6A29-88257833:0078A037; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF1FBA64A7.FD3F6A29-ON88257833.0078A037-88257833.0081FBEE@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 10 Feb 2011 15:39:45 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/10/2011 03:35:50 PM, Serialize complete at 02/10/2011 03:35:50 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 03:35:50 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 03:35:57 PM, Serialize complete at 02/10/2011 03:35:57 PM
Content-Type: multipart/alternative; boundary="=_alternative 0081FBE788257833_="
Cc: "hybi@ietf.org" <hybi@ietf.org>, hybi-bounces@ietf.org, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Feb 2011 23:35:46 -0000

This is a multipart message in MIME format.
--=_alternative 0081FBE788257833_=
Content-Type: text/plain; charset="US-ASCII"

Hi,

Joining this thread from another one in reply to Takeshi's message. Let me 
try to through my
thoughts...

> > o Section 4.5.1 - Close handshake 
> > 
> > It is no clear to me what 0x43 and 0x53 are trying to achieve. In 
> > TCP, there is FIN with no 
> > details of why/who is closing for graceful shutdown. 
> 
> Actually, it's not intended to indicate who's closing, but to make 
> sure what the close frame really means, i.e. it's close initiation 
> or close acknowledgement. Using an analogy of TCP, close S from 
> server is FIN, and close S from client is ACK for server's FIN.
> 
> Without this, each peer cannot know
> - the other peer just initiated close
> or
> - the other peer received close frame and acknowledged it
> 
> Imagine both peers send out close initiation at approximately same 
> time. They looks like acknowledgement but are not.
> 
> Once we can perfectly distinguish initiation and acknowledgement as 
> described above, we can assume "If A received close acknowledgement 
> from B, B has received all the data sent from A before close 
successfully".
> 
> If you have any idea about the usefulness of this closing handshake 
> design, please come to the thread "Clarify the role of closing 
> handshake" and speak out. We're discussing it now.

The current -05 as is seems good to me. Now I think it would be good to 
have 1-byte body
0x43 and 0x53, if it is important to know whether all data sent 
successfully reached the peer.
I just do not know how import that is from application's perspective.

I agree, if simultaneous Close occurs, then both ends cannot be sure if 
all the data is received
by the other peer.

Stepping back a bit, if we could assume that client always initiate Close 
in normal operation, 
then Client can tell, on receipt of Close with 0x53 after sending Close 
0x43, that something 
happened at the server. (e.g. cannot retain persistent connection due to 
excessive load, 
or some kind of failover operation at server side).  In such case, client 
should assume that 
not all data may have not reached the server, and take necessary action if 
that is important 
for the client application. As being discussed in this thread, the server 
could send some 
reason code, but I am not so sure if  that helps any, and I'm leaning 
toward more on not 
revealing any details of the situation for security reasons.

At TCP stack level, it think it is a good practice to have client initiate 
TCP-FIN always
(shutdown(socket, SHUT_WR)) after sending Close frame where possible. This 
can 
minimize the number of TCP control block in kernel memory sitting and 
waiting in either 
FIN_WAIT_1/2 or TIME_WAIT state, which could cause server resource 
exhaustion 
unexpectedly. 

After calling shutdown(soc, SHUT_WR), you can still read data from the 
peer to 
receive remaining data and lastly Close frame to close websocket 
_cleanly_.

- Yutaka





Takeshi Yoshino <tyoshino@google.com> 
Sent by: hybi-bounces@ietf.org
02/10/2011 11:18 AM

To
Greg Wilkins <gregw@webtide.com>
cc
"hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro 
<Gabriel.Montenegro@microsoft.com>
Subject
Re: [hybi] Clarify the role of closing handshake






Gabriel's idea is even simple. I don't object to that. I see the benefit 
of Greg's idea, too.

A while back, Yuta listed error cases can happen during frame processing, 
and suggested we define how we handle them. Maybe we would use abnormal 
close frame for them.
http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html

I think abnormal close frame should indicate only protocol level error 
(frame parsing error, too large message, etc.). Any error inside 
application can be exchanged on application level. So we don't have to 
extend close() interface.

CloseEvent interface should be changed. _cleanly_ must be re-defined. We 
would define three type of close, _normal close_, _abnormal close_, 
_underlying channel terminated_, and replace "wasClean" with, say, 
"reason" or something. I'm not sure if we should invoke error event, too. 
I personally think it's redundant.

Then,
- close() called on WebSocket object -> send normal close frame -> 
"normal" close event regardless of whatever happen
- any protocol level error happened on client side and sent abnormal close 
frame -> "abnormal" close event
- received normal close frame -> "normal" close event
- received abnormal close frame -> "abnormal" close event
- underlying channel is closed without receiving close frame -> 
"underlying channel terminated" close event

I think this modification on CloseEvent doesn't violate the security model 
we now have to prevent WebSocket from being abused for port scanner. 
Abnormal close is just a new variant of closure information explicitly 
sent from the server. Thoughts?

So, by putting them together, like this?

----

4.5.1.  Close

The Close message contains an opcode of 0x01.

The Close message contains a body that is a single byte in length.  This 
byte carrys the reason for the close.  For normal close, the body MUST be 
a 0x00. For abnormal close, the body MUST be a 0x01.
 
The websocket is considered fully closed when an endpoint has either sent 
or received a Close message, or when the underlying channel is closed.

The application MUST NOT send any more data messages after sent or 
received a Close message.

7.1.1.  Client-initiated closure

<I'm not sure how much it's useful to have client send normal/abnormal. 
Server cannot retry by itself so, it's not the case Greg explained. But 
maybe we can just add it as well as server.>

7.1.2.  Server-initiated closure

<No change on *abort WebSocket connection* during opening handshake>

Certain algorithms require or recommend that the server *abort2 
the WebSocket connection* after WebSocket connection is established.  To 
do so, the server must send a Close message with a single byte body 0x01 
meaning abnormal closure and close the WebSocket connection.

<We need some verb to replace abort2>

7.2.  Normal closure of connections

To *close the WebSocket connection*, the user agent MUST send a Close 
control frame with a single byte body 0x00 meaning normal closure, as 
described in Section 4.5.1.  Once an endpoint has sent or received an 
Close control frame, that endpoint must close the TCP ...  If the 
connection was closed after the client sent or received normal close 
frame, then it's called _normal close_. If the connection was closed after 
the client send or received abnormal close frame, then it's called 
_abnormal close_. Otherwise, it's called _underlying connection 
terminated_.

The user agent can distinguish protocol failure notified by abnormal close 
frame from disconnection caused by network or intermediary to allow the 
application to determine if it should retry connection or not.

...

On Thu, Feb 10, 2011 at 18:44, Greg Wilkins <gregw@webtide.com> wrote:
On 10 February 2011 20:25, Gabriel Montenegro
<Gabriel.Montenegro@microsoft.com> wrote:
> I think your simple reason would be enough (either normal or abnormal 
close for now).

cool

> To be clear: you're not arguing against the simplified semantics of 
considering the websocket closed (no further data or control) upon either 
sending or receiving a Close message, correct?

I'm not arguing either way.  I can see the benefits of half close and
flush through, but also the complexities, so I'm happy to follow herd
on this one.

cheers


>> -----Original Message-----
>> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of 
Greg
>> Wilkins
>> Sent: Wednesday, February 09, 2011 17:04
>> To: Takeshi Yoshino
>> Cc: hybi@ietf.org
>> Subject: Re: [hybi] Clarify the role of closing handshake
>>
>> One of the other aims of the closing handshake was to better identify 
error
>> condition, so as to prevent a client repeating unacceptable operations.
>>
>> For example, if a client sends a frame that is too large for the server 
to handle,
>> the server needs to indicate that an error condition has occurred.  If 
the
>> connection is closed (orderly or otherwise) , then the client might 
assume that it
>> was an idle shutdown or transient condition on the server and thus open 
a new
>> connection and continue to send over large frames.
>>
>>
>> Currently -05 says:
>>
>> 7.1.2.  Server-initiated closure
>>    Certain algorithms require or recommend that the server *abort the
>>    WebSocket connection* during the opening handshake.  To do so, the
>>    server must simply close the WebSocket connection.
>>
>>
>> the problem with this is that for a client such a close of the 
websocket
>> connection cannot be distinguished from a
>> network/intermediary failure.   I think that typically an aborted
>> connection should not be retried, but a network/intermediary failure 
should be -
>> so it would be good to be able to signal to the client the difference.
>>
>> Thus I'd like to suggest that the close handshake carry a single byte 
of reason for
>> the close.
>> I think it would be sufficient to define just:
>>
>>   0x00 Normal close
>>   0x01 Abnormal close
>>
>> But I could see an argument for something a little richer:
>>
>>  0x00 Idle close
>>  0x01 close
>>  0x02 abnormal close
>>
>> but I concede that the danger here is trying to define too many close 
states
>> _______________________________________________
>> hybi mailing list
>> hybi@ietf.org
>> https://www.ietf.org/mailman/listinfo/hybi
>
>
_______________________________________________
hybi mailing list
hybi@ietf.org
https://www.ietf.org/mailman/listinfo/hybi


--=_alternative 0081FBE788257833_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Hi,</font>
<br>
<br><font size=2 face="sans-serif">Joining this thread from another one
in reply to Takeshi's message. Let me try to through my</font>
<br><font size=2 face="sans-serif">thoughts...</font>
<br>
<br><tt><font size=2>&gt; &gt; o Section 4.5.1 - Close handshake <br>
&gt; &gt; <br>
&gt; &gt; It is no clear to me what 0x43 and 0x53 are trying to achieve.
In <br>
&gt; &gt; TCP, there is FIN with no <br>
&gt; &gt; details of why/who is closing for graceful shutdown. <br>
&gt; <br>
&gt; Actually, it's not intended to indicate who's closing, but to make
<br>
&gt; sure what the close frame really means, i.e. it's close initiation
<br>
&gt; or close acknowledgement. Using an analogy of TCP, close S from <br>
&gt; server is FIN, and close S from client is ACK for server's FIN.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Without this, each peer cannot know</font></tt>
<br><tt><font size=2>&gt; - the other peer just initiated close</font></tt>
<br><tt><font size=2>&gt; or</font></tt>
<br><tt><font size=2>&gt; - the other peer received close frame and acknowledged
it</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Imagine both peers send out close initiation at approximately same
<br>
&gt; time. They looks like acknowledgement but are not.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Once we can perfectly distinguish initiation and acknowledgement as
<br>
&gt; described above, we can assume &quot;If A received close acknowledgement
<br>
&gt; from B, B has received all the data sent from A before close successfully&quot;.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; If you have any idea about the usefulness of this closing handshake
<br>
&gt; design, please come to the thread &quot;Clarify the role of closing
<br>
&gt; handshake&quot; and speak out. We're discussing it now.</font></tt>
<br>
<br><font size=2 face="sans-serif">The current -05 as is seems good to
me. Now I think it would be good to have 1-byte body</font>
<br><font size=2 face="sans-serif">0x43 and 0x53, if it is important to
know whether all data sent successfully reached the peer.</font>
<br><font size=2 face="sans-serif">I just do not know how import that is
from application's perspective.</font>
<br>
<br><font size=2 face="sans-serif">I agree, if simultaneous Close occurs,
then both ends cannot be sure if all the data is received</font>
<br><font size=2 face="sans-serif">by the other peer.</font>
<br>
<br><font size=2 face="sans-serif">Stepping back a bit, if we could assume
that client always initiate Close in normal operation, </font>
<br><font size=2 face="sans-serif">then Client can tell, on receipt of
Close with 0x53 after sending Close 0x43, that something </font>
<br><font size=2 face="sans-serif">happened at the server. (e.g. cannot
retain persistent connection due to excessive load, </font>
<br><font size=2 face="sans-serif">or some kind of failover operation at
server side). &nbsp;In such case, client should assume that </font>
<br><font size=2 face="sans-serif">not all data may have not reached the
server, and take necessary action if that is important </font>
<br><font size=2 face="sans-serif">for the client application. As being
discussed in this thread, the server could send some </font>
<br><font size=2 face="sans-serif">reason code, but I am not so sure if
&nbsp;that helps any, and I'm leaning toward more on not </font>
<br><font size=2 face="sans-serif">revealing any details of the situation
for security reasons.</font>
<br>
<br><font size=2 face="sans-serif">At TCP stack level, it think it is a
good practice to have client initiate TCP-FIN always</font>
<br><font size=2 face="sans-serif">(shutdown(socket, SHUT_WR)) after sending
Close frame where possible. This can </font>
<br><font size=2 face="sans-serif">minimize the number of TCP control block
in kernel memory sitting and waiting in either </font>
<br><font size=2 face="sans-serif">FIN_WAIT_1/2 or TIME_WAIT state, which
could cause server resource exhaustion </font>
<br><font size=2 face="sans-serif">unexpectedly. </font>
<br>
<br><font size=2 face="sans-serif">After calling shutdown(soc, SHUT_WR),
you can still read data from the peer to </font>
<br><font size=2 face="sans-serif">receive remaining data and lastly Close
frame to close websocket _cleanly_.</font>
<br>
<br><font size=2 face="sans-serif">- Yutaka</font>
<br>
<br>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Takeshi Yoshino &lt;tyoshino@google.com&gt;</b>
</font>
<br><font size=1 face="sans-serif">Sent by: hybi-bounces@ietf.org</font>
<p><font size=1 face="sans-serif">02/10/2011 11:18 AM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">Greg Wilkins &lt;gregw@webtide.com&gt;</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">&quot;hybi@ietf.org&quot; &lt;hybi@ietf.org&gt;,
Gabriel Montenegro &lt;Gabriel.Montenegro@microsoft.com&gt;</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Re: [hybi] Clarify the role of closing
handshake</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=3>Gabriel's idea is even simple. I don't object to that.&nbsp;I
see the benefit of Greg's idea, too.</font>
<br>
<br><font size=3>A while back, Yuta listed error cases can happen during
frame processing, and suggested we define how we handle them. Maybe we
would use abnormal close frame for them.</font>
<br><a href="http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html"><font size=3 color=blue><u>http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html</u></font></a>
<br>
<br><font size=3>I think abnormal close frame should indicate only protocol
level error (frame parsing error, too large message, etc.). Any error inside
application can be exchanged on application level. So we don't have to
extend close() interface.</font>
<br>
<br><font size=3>CloseEvent interface should be changed. _cleanly_ must
be re-defined. We would define three type of close, _normal close_, _abnormal
close_, _underlying channel terminated_, and replace &quot;wasClean&quot;
with, say, &quot;reason&quot; or something. I'm not sure if we should invoke
error event, too. I personally think it's redundant.</font>
<br>
<br><font size=3>Then,</font>
<br><font size=3>- close() called on WebSocket object -&gt; send normal
close frame -&gt; &quot;normal&quot; close event regardless of whatever
happen</font>
<br><font size=3>- any protocol level error happened on client side and
sent abnormal close frame -&gt; &quot;abnormal&quot; close event</font>
<br><font size=3>- received normal close frame -&gt; &quot;normal&quot;
close event</font>
<br><font size=3>- received abnormal close frame -&gt; &quot;abnormal&quot;
close event</font>
<br><font size=3>- underlying channel is closed without receiving close
frame -&gt; &quot;underlying channel terminated&quot; close event</font>
<br>
<br><font size=3>I think this modification on CloseEvent doesn't violate
the security model we now have to prevent WebSocket from being abused for
port scanner. Abnormal close is just a new variant of closure information
explicitly sent from the server. Thoughts?</font>
<br>
<br><font size=3>So, by putting them together, like this?</font>
<br>
<br><font size=3>----</font>
<br>
<br><font size=3>4.5.1. &nbsp;Close</font>
<br>
<br><font size=3>The Close message contains an opcode of 0x01.</font>
<br>
<br><font size=3>The Close message contains a body that is a single byte
in length. &nbsp;This byte carrys the reason for the close. &nbsp;For normal
close, the body MUST be a 0x00. For abnormal close, the body MUST be a
0x01.</font>
<br><font size=3>&nbsp;</font>
<br><font size=3>The websocket is considered fully closed when an endpoint
has either sent or received a Close message, or when the underlying channel
is closed.</font>
<br>
<br><font size=3>The application MUST NOT send any more data messages after
sent or received a&nbsp;Close message.</font>
<br>
<br><font size=3>7.1.1. &nbsp;Client-initiated closure</font>
<br>
<br><font size=3>&lt;I'm not sure how much it's useful to have client send
normal/abnormal. Server cannot retry by itself so, it's not the case Greg
explained. But maybe we can just add it as well as server.&gt;</font>
<br>
<br><font size=3>7.1.2. &nbsp;Server-initiated closure</font>
<br>
<br><font size=3>&lt;No change on *abort WebSocket connection* during opening
handshake&gt;</font>
<br>
<br><font size=3>Certain algorithms require or recommend that the server
*abort2 the&nbsp;WebSocket connection* after WebSocket connection is established.
&nbsp;To do so, the&nbsp;server must send a Close message with a single
byte body 0x01 meaning&nbsp;abnormal closure and close the WebSocket connection.</font>
<br>
<br><font size=3>&lt;We need some verb to replace abort2&gt;</font>
<br>
<br><font size=3>7.2. &nbsp;Normal closure of connections</font>
<br>
<br><font size=3>To *close the WebSocket connection*, the user agent MUST
send a&nbsp;Close control frame with a single byte body 0x00 meaning normal
closure, as described in Section 4.5.1. &nbsp;Once an endpoint has sent
or received an Close control frame, that endpoint must close the TCP ...&nbsp;&nbsp;If
the connection was closed after the client sent or received normal&nbsp;close
frame, then it's called _normal close_. If the connection was closed after
the client send or received abnormal close frame, then it's called _abnormal
close_. Otherwise, it's called _underlying connection terminated_.</font>
<br>
<br><font size=3>The user agent can distinguish protocol failure notified
by abnormal close frame from disconnection caused by&nbsp;network or intermediary
to allow the application to determine if it should retry connection or
not.</font>
<br>
<br><font size=3>...</font>
<br>
<br><font size=3>On Thu, Feb 10, 2011 at 18:44, Greg Wilkins &lt;</font><a href=mailto:gregw@webtide.com><font size=3 color=blue><u>gregw@webtide.com</u></font></a><font size=3>&gt;
wrote:</font>
<br><font size=3>On 10 February 2011 20:25, Gabriel Montenegro</font>
<br><font size=3>&lt;</font><a href=mailto:Gabriel.Montenegro@microsoft.com><font size=3 color=blue><u>Gabriel.Montenegro@microsoft.com</u></font></a><font size=3>&gt;
wrote:</font>
<br><font size=3>&gt; I think your simple reason would be enough (either
normal or abnormal close for now).<br>
</font>
<br><font size=3>cool</font>
<br><font size=3><br>
&gt; To be clear: you're not arguing against the simplified semantics of
considering the websocket closed (no further data or control) upon either
sending or receiving a Close message, correct?<br>
</font>
<br><font size=3>I'm not arguing either way. &nbsp;I can see the benefits
of half close and<br>
flush through, but also the complexities, so I'm happy to follow herd<br>
on this one.<br>
<br>
cheers</font>
<br><font size=3><br>
<br>
&gt;&gt; -----Original Message-----<br>
&gt;&gt; From: </font><a href="mailto:hybi-bounces@ietf.org"><font size=3 color=blue><u>hybi-bounces@ietf.org</u></font></a><font size=3>
[mailto:</font><a href="mailto:hybi-bounces@ietf.org"><font size=3 color=blue><u>hybi-bounces@ietf.org</u></font></a><font size=3>]
On Behalf Of Greg<br>
&gt;&gt; Wilkins<br>
&gt;&gt; Sent: Wednesday, February 09, 2011 17:04<br>
&gt;&gt; To: Takeshi Yoshino<br>
&gt;&gt; Cc: </font><a href=mailto:hybi@ietf.org><font size=3 color=blue><u>hybi@ietf.org</u></font></a><font size=3><br>
&gt;&gt; Subject: Re: [hybi] Clarify the role of closing handshake<br>
&gt;&gt;<br>
&gt;&gt; One of the other aims of the closing handshake was to better identify
error<br>
&gt;&gt; condition, so as to prevent a client repeating unacceptable operations.<br>
&gt;&gt;<br>
&gt;&gt; For example, if a client sends a frame that is too large for the
server to handle,<br>
&gt;&gt; the server needs to indicate that an error condition has occurred.
&nbsp;If the<br>
&gt;&gt; connection is closed (orderly or otherwise) , then the client
might assume that it<br>
&gt;&gt; was an idle shutdown or transient condition on the server and
thus open a new<br>
&gt;&gt; connection and continue to send over large frames.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; Currently -05 says:<br>
&gt;&gt;<br>
&gt;&gt; 7.1.2. &nbsp;Server-initiated closure<br>
&gt;&gt; &nbsp; &nbsp;Certain algorithms require or recommend that the
server *abort the<br>
&gt;&gt; &nbsp; &nbsp;WebSocket connection* during the opening handshake.
&nbsp;To do so, the<br>
&gt;&gt; &nbsp; &nbsp;server must simply close the WebSocket connection.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; the problem with this is that for a client such a close of the
websocket<br>
&gt;&gt; connection cannot be distinguished from a<br>
&gt;&gt; network/intermediary failure. &nbsp; I think that typically an
aborted<br>
&gt;&gt; connection should not be retried, but a network/intermediary failure
should be -<br>
&gt;&gt; so it would be good to be able to signal to the client the difference.<br>
&gt;&gt;<br>
&gt;&gt; Thus I'd like to suggest that the close handshake carry a single
byte of reason for<br>
&gt;&gt; the close.<br>
&gt;&gt; I think it would be sufficient to define just:<br>
&gt;&gt;<br>
&gt;&gt; &nbsp; 0x00 Normal close<br>
&gt;&gt; &nbsp; 0x01 Abnormal close<br>
&gt;&gt;<br>
&gt;&gt; But I could see an argument for something a little richer:<br>
&gt;&gt;<br>
&gt;&gt; &nbsp;0x00 Idle close<br>
&gt;&gt; &nbsp;0x01 close<br>
&gt;&gt; &nbsp;0x02 abnormal close<br>
&gt;&gt;<br>
&gt;&gt; but I concede that the danger here is trying to define too many
close states<br>
&gt;&gt; _______________________________________________<br>
&gt;&gt; hybi mailing list<br>
&gt;&gt; </font><a href=mailto:hybi@ietf.org><font size=3 color=blue><u>hybi@ietf.org</u></font></a><font size=3><br>
&gt;&gt; </font><a href=https://www.ietf.org/mailman/listinfo/hybi target=_blank><font size=3 color=blue><u>https://www.ietf.org/mailman/listinfo/hybi</u></font></a><font size=3><br>
&gt;<br>
&gt;</font>
<br><tt><font size=2>_______________________________________________<br>
hybi mailing list<br>
hybi@ietf.org<br>
https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
<br>
--=_alternative 0081FBE788257833_=--

From brofield@gmail.com  Thu Feb 10 17:14:13 2011
Return-Path: <brofield@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6BE2B3A6B37 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:14:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.242
X-Spam-Level: 
X-Spam-Status: No, score=-0.242 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uGcQBRHTzQ9K for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:14:09 -0800 (PST)
Received: from mail-gx0-f172.google.com (mail-gx0-f172.google.com [209.85.161.172]) by core3.amsl.com (Postfix) with ESMTP id 5B4963A6B11 for <hybi@ietf.org>; Thu, 10 Feb 2011 17:14:09 -0800 (PST)
Received: by gxk27 with SMTP id 27so957814gxk.31 for <hybi@ietf.org>; Thu, 10 Feb 2011 17:14:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=XF0xzgGImN2TGBFJ1QodzQHJK2vHeeP2tPkNVXTBo9E=; b=b1eQDXyad0rdgr0oELDTE5wHOsmnFB1iKuBKXJN6iE4cjrcKqa2smew9gL1bVvhElI ithoNFlZhzKzeUosdXp1vroBGb4s2GmsoyZXe+SaZpYPKU2zDYw+pRawSat5NGwQaB8E O4E7bWLXYJ5KXCAe3tQd13CeBxPX4LsBRoELo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=QtbNe5ZBbcpcTe+sK9V6l/tUjNnq6wm1UY2ayflOyu1t6o9dSzILltOXZxwChjRozw qzMu/vZ9YxAhFXQsPndgWYslOb0g5/c+S5LSXI2FGBpbkwWKTRl70vAGGE/ury0tUgbm Iqvm3eyLQgdog2GJmSxDz7UutVr+7FayKS/a8=
Received: by 10.91.62.6 with SMTP id p6mr73774agk.124.1297386862273; Thu, 10 Feb 2011 17:14:22 -0800 (PST)
Received: from [192.168.24.67] (pre71388.fip.synapse.ne.jp [124.146.125.118]) by mx.google.com with ESMTPS id p14sm227494ank.14.2011.02.10.17.14.18 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 10 Feb 2011 17:14:21 -0800 (PST)
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com> <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com>
In-Reply-To: <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8A400)
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary=Apple-Mail-1--895360320
Message-Id: <7785FB1F-C733-4AE1-BACF-44556B1074A8@gmail.com>
X-Mailer: iPhone Mail (8A400)
From: Brodie Thiesfield <brofield@gmail.com>
Date: Fri, 11 Feb 2011 10:14:59 +0900
To: Takeshi Yoshino <tyoshino@google.com>
Cc: "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 01:14:13 -0000

--Apple-Mail-1--895360320
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

I have been thankful many times for the amount of detail the http error stat=
us and message can return to a client. Having both a rich code space as well=
 as a human readable message is invaluable for problem solving a connection p=
roblem. This is part of the http protocol, we shouldn't punt error condition=
 reporting to the application level in websockets.=20

Without a richer mechanism to return connection errors, debugging failures w=
ill turn into potluck of changing parameters and hoping that it works.=20

When extensions are added, the sort of error conditions may expand beyond wh=
at can be imagined now. Why not just reuse the http error mechanism with bot=
h status and optional message.

Regards,=20
Brodie




On 11/02/2011, at 4:18, Takeshi Yoshino <tyoshino@google.com> wrote:

> Gabriel's idea is even simple. I don't object to that. I see the benefit o=
f Greg's idea, too.
>=20
> A while back, Yuta listed error cases can happen during frame processing, a=
nd suggested we define how we handle them. Maybe we would use abnormal close=
 frame for them.
> http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html
>=20
> I think abnormal close frame should indicate only protocol level error (fr=
ame parsing error, too large message, etc.). Any error inside application ca=
n be exchanged on application level. So we don't have to extend close() inte=
rface.
>=20
> CloseEvent interface should be changed. _cleanly_ must be re-defined. We w=
ould define three type of close, _normal close_, _abnormal close_, _underlyi=
ng channel terminated_, and replace "wasClean" with, say, "reason" or someth=
ing. I'm not sure if we should invoke error event, too. I personally think i=
t's redundant.
>=20
> Then,
> - close() called on WebSocket object -> send normal close frame -> "normal=
" close event regardless of whatever happen
> - any protocol level error happened on client side and sent abnormal close=
 frame -> "abnormal" close event
> - received normal close frame -> "normal" close event
> - received abnormal close frame -> "abnormal" close event
> - underlying channel is closed without receiving close frame -> "underlyin=
g channel terminated" close event
>=20
> I think this modification on CloseEvent doesn't violate the security model=
 we now have to prevent WebSocket from being abused for port scanner. Abnorm=
al close is just a new variant of closure information explicitly sent from t=
he server. Thoughts?
>=20
> So, by putting them together, like this?
>=20
> ----
>=20
> 4.5.1.  Close
>=20
> The Close message contains an opcode of 0x01.
>=20
> The Close message contains a body that is a single byte in length.  This b=
yte carrys the reason for the close.  For normal close, the body MUST be a 0=
x00. For abnormal close, the body MUST be a 0x01.
> =20
> The websocket is considered fully closed when an endpoint has either sent o=
r received a Close message, or when the underlying channel is closed.
>=20
> The application MUST NOT send any more data messages after sent or receive=
d a Close message.
>=20
> 7.1.1.  Client-initiated closure
>=20
> <I'm not sure how much it's useful to have client send normal/abnormal. Se=
rver cannot retry by itself so, it's not the case Greg explained. But maybe w=
e can just add it as well as server.>
>=20
> 7.1.2.  Server-initiated closure
>=20
> <No change on *abort WebSocket connection* during opening handshake>
>=20
> Certain algorithms require or recommend that the server *abort2 the WebSoc=
ket connection* after WebSocket connection is established.  To do so, the se=
rver must send a Close message with a single byte body 0x01 meaning abnormal=
 closure and close the WebSocket connection.
>=20
> <We need some verb to replace abort2>
>=20
> 7.2.  Normal closure of connections
>=20
> To *close the WebSocket connection*, the user agent MUST send a Close cont=
rol frame with a single byte body 0x00 meaning normal closure, as described i=
n Section 4.5.1.  Once an endpoint has sent or received an Close control fra=
me, that endpoint must close the TCP ...  If the connection was closed after=
 the client sent or received normal close frame, then it's called _normal cl=
ose_. If the connection was closed after the client send or received abnorma=
l close frame, then it's called _abnormal close_. Otherwise, it's called _un=
derlying connection terminated_.
>=20
> The user agent can distinguish protocol failure notified by abnormal close=
 frame from disconnection caused by network or intermediary to allow the app=
lication to determine if it should retry connection or not.
>=20
> ...
>=20
> On Thu, Feb 10, 2011 at 18:44, Greg Wilkins <gregw@webtide.com> wrote:
> On 10 February 2011 20:25, Gabriel Montenegro
> <Gabriel.Montenegro@microsoft.com> wrote:
> > I think your simple reason would be enough (either normal or abnormal cl=
ose for now).
>=20
> cool
>=20
> > To be clear: you're not arguing against the simplified semantics of cons=
idering the websocket closed (no further data or control) upon either sendin=
g or receiving a Close message, correct?
>=20
> I'm not arguing either way.  I can see the benefits of half close and
> flush through, but also the complexities, so I'm happy to follow herd
> on this one.
>=20
> cheers
>=20
>=20
> >> -----Original Message-----
> >> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of=
 Greg
> >> Wilkins
> >> Sent: Wednesday, February 09, 2011 17:04
> >> To: Takeshi Yoshino
> >> Cc: hybi@ietf.org
> >> Subject: Re: [hybi] Clarify the role of closing handshake
> >>
> >> One of the other aims of the closing handshake was to better identify e=
rror
> >> condition, so as to prevent a client repeating unacceptable operations.=

> >>
> >> For example, if a client sends a frame that is too large for the server=
 to handle,
> >> the server needs to indicate that an error condition has occurred.  If t=
he
> >> connection is closed (orderly or otherwise) , then the client might ass=
ume that it
> >> was an idle shutdown or transient condition on the server and thus open=
 a new
> >> connection and continue to send over large frames.
> >>
> >>
> >> Currently -05 says:
> >>
> >> 7.1.2.  Server-initiated closure
> >>    Certain algorithms require or recommend that the server *abort the
> >>    WebSocket connection* during the opening handshake.  To do so, the
> >>    server must simply close the WebSocket connection.
> >>
> >>
> >> the problem with this is that for a client such a close of the websocke=
t
> >> connection cannot be distinguished from a
> >> network/intermediary failure.   I think that typically an aborted
> >> connection should not be retried, but a network/intermediary failure sh=
ould be -
> >> so it would be good to be able to signal to the client the difference.
> >>
> >> Thus I'd like to suggest that the close handshake carry a single byte o=
f reason for
> >> the close.
> >> I think it would be sufficient to define just:
> >>
> >>   0x00 Normal close
> >>   0x01 Abnormal close
> >>
> >> But I could see an argument for something a little richer:
> >>
> >>  0x00 Idle close
> >>  0x01 close
> >>  0x02 abnormal close
> >>
> >> but I concede that the danger here is trying to define too many close s=
tates
> >> _______________________________________________
> >> hybi mailing list
> >> hybi@ietf.org
> >> https://www.ietf.org/mailman/listinfo/hybi
> >
> >
>=20
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--Apple-Mail-1--895360320
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><body bgcolor=3D"#FFFFFF"><div>I have been thankful many times for the=
 amount of detail the http error status and message can return to a client. H=
aving both a rich code space as well as a human readable message is invaluab=
le for problem solving a connection problem. This is part of the http protoc=
ol, we shouldn't punt error condition reporting to the application level in w=
ebsockets.&nbsp;</div><div><br></div><span class=3D"Apple-style-span" style=3D=
"-webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-compositio=
n-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color=
: rgba(77, 128, 180, 0.230469); ">Without a richer mechanism to return conne=
ction errors, debugging failures will turn into potluck of changing paramete=
rs and hoping that it works.&nbsp;</span><div><br></div><div>When extensions=
 are added, the sort of error conditions may expand beyond what can be imagi=
ned now. Why not just reuse the http error mechanism with both status and op=
tional message.</div><div><br></div><div>Regards,&nbsp;</div><div>Brodie<br>=
<br><div><br></div><div><br></div></div><div><br>On 11/02/2011, at 4:18, Tak=
eshi Yoshino &lt;<a href=3D"mailto:tyoshino@google.com">tyoshino@google.com<=
/a>&gt; wrote:<br><br></div><div></div><blockquote type=3D"cite"><div><div>G=
abriel's idea is even simple. I don't object to that.&nbsp;I see the benefit=
 of Greg's idea, too.</div><div><div><div><br></div><div><div><div>A while b=
ack, Yuta listed error cases can happen during frame processing, and suggest=
ed we define how we handle them. Maybe we would use abnormal close frame for=
 them.</div>

<div><a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg05131.h=
tml"><a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg05131.h=
tml">http://www.ietf.org/mail-archive/web/hybi/current/msg05131.html</a></a>=
</div><div><br></div></div><div><div>I think abnormal close frame should ind=
icate only protocol level error (frame parsing error, too large message, etc=
.). Any error inside application can be exchanged on application level. So w=
e don't have to extend close() interface.</div>

<div><br></div><div><div>CloseEvent interface should be changed. _cleanly_ m=
ust be re-defined. We would define three type of close, _normal close_, _abn=
ormal close_, _underlying channel terminated_, and replace "wasClean" with, s=
ay, "reason" or something. I'm not sure if we should invoke error event, too=
. I personally think it's redundant.</div>

<div><br></div><div>Then,</div><div>- close() called on WebSocket object -&g=
t; send normal close frame -&gt; "normal" close event regardless of whatever=
 happen</div><div>- any protocol level error happened on client side and sen=
t abnormal close frame -&gt; "abnormal" close event</div>

<div>- received normal close frame -&gt; "normal" close event</div><div>- re=
ceived abnormal close frame -&gt; "abnormal" close event</div><div>- underly=
ing channel is closed without receiving close frame -&gt; "underlying channe=
l terminated" close event</div>

</div></div></div><div><br></div><div>I think this modification on CloseEven=
t doesn't violate the security model we now have to prevent WebSocket from b=
eing abused for port scanner. Abnormal close is just a new variant of closur=
e information explicitly sent from the server. Thoughts?</div>

<div><br></div><div><div><div>So, by putting them together, like this?</div>=
<div></div></div></div><div><br></div><div>----</div><div><br></div><div><di=
v>4.5.1. &nbsp;Close</div><div><br></div><div>The Close message contains an o=
pcode of 0x01.</div>

<div><br></div><div>The Close message contains a body that is a single byte i=
n length. &nbsp;This byte carrys the reason for the close. &nbsp;For normal c=
lose, the body MUST be a 0x00. For abnormal close, the body MUST be a 0x01.<=
/div>

<div>&nbsp;</div><div>The websocket is considered fully closed when an endpo=
int has either sent or received a Close message, or when the underlying chan=
nel is closed.</div><div><br></div><div><div>The application MUST NOT send a=
ny more data messages after sent or received a&nbsp;Close message.</div>

</div><div><br></div><div><div>7.1.1. &nbsp;Client-initiated closure</div></=
div><div><br></div><div>&lt;I'm not sure how much it's useful to have client=
 send normal/abnormal. Server cannot retry by itself so, it's not the case G=
reg explained. But maybe we can just add it as well as server.&gt;</div>

<div><br></div><div>7.1.2. &nbsp;Server-initiated closure</div><div><br></di=
v><div>&lt;No change on *abort WebSocket connection* during opening handshak=
e&gt;</div><div><br></div><div>Certain algorithms require or recommend that t=
he server *abort2 the&nbsp;WebSocket connection* after WebSocket connection i=
s established. &nbsp;To do so, the&nbsp;server must send a Close message wit=
h a single byte body 0x01 meaning&nbsp;abnormal closure and close the WebSoc=
ket connection.</div>

<div><br></div><div>&lt;We need some verb to replace abort2&gt;</div><div><b=
r></div><div>7.2. &nbsp;Normal closure of connections</div><div><br></div><d=
iv>To *close the WebSocket connection*, the user agent MUST send a&nbsp;Clos=
e control frame with a single byte body 0x00 meaning normal closure, as desc=
ribed in Section 4.5.1. &nbsp;Once an endpoint has sent or received an Close=
 control frame, that endpoint must close the TCP ...&nbsp;&nbsp;If the conne=
ction was closed after the client sent or received normal&nbsp;close frame, t=
hen it's called _normal close_. If the connection was closed after the clien=
t send or received abnormal close frame, then it's called _abnormal close_. O=
therwise, it's called _underlying connection terminated_.</div>

<div><br></div><div><div>The user agent can distinguish protocol failure not=
ified by abnormal close frame from disconnection caused by&nbsp;network or i=
ntermediary to allow the application to determine if it should retry connect=
ion or not.</div>

</div><div><br></div><div>...</div></div><div><br></div></div></div><div cla=
ss=3D"gmail_quote">On Thu, Feb 10, 2011 at 18:44, Greg Wilkins <span dir=3D"=
ltr">&lt;<a href=3D"mailto:gregw@webtide.com"><a href=3D"mailto:gregw@webtid=
e.com">gregw@webtide.com</a></a>&gt;</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px=
 #ccc solid;padding-left:1ex;">On 10 February 2011 20:25, Gabriel Montenegro=
<br>
<div class=3D"im">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.com"><a=
 href=3D"mailto:Gabriel.Montenegro@microsoft.com">Gabriel.Montenegro@microso=
ft.com</a></a>&gt; wrote:<br>
</div><div class=3D"im">&gt; I think your simple reason would be enough (eit=
her normal or abnormal close for now).<br>
<br>
</div>cool<br>
<div class=3D"im"><br>
&gt; To be clear: you're not arguing against the simplified semantics of con=
sidering the websocket closed (no further data or control) upon either sendi=
ng or receiving a Close message, correct?<br>
<br>
</div>I'm not arguing either way. &nbsp;I can see the benefits of half close=
 and<br>
flush through, but also the complexities, so I'm happy to follow herd<br>
on this one.<br>
<br>
cheers<br>
<div><div></div><div class=3D"h5"><br>
<br>
&gt;&gt; -----Original Message-----<br>
&gt;&gt; From: <a href=3D"mailto:hybi-bounces@ietf.org"><a href=3D"mailto:hy=
bi-bounces@ietf.org">hybi-bounces@ietf.org</a></a> [mailto:<a href=3D"mailto=
:hybi-bounces@ietf.org"><a href=3D"mailto:hybi-bounces@ietf.org">hybi-bounce=
s@ietf.org</a></a>] On Behalf Of Greg<br>
&gt;&gt; Wilkins<br>
&gt;&gt; Sent: Wednesday, February 09, 2011 17:04<br>
&gt;&gt; To: Takeshi Yoshino<br>
&gt;&gt; Cc: <a href=3D"mailto:hybi@ietf.org"><a href=3D"mailto:hybi@ietf.or=
g">hybi@ietf.org</a></a><br>
&gt;&gt; Subject: Re: [hybi] Clarify the role of closing handshake<br>
&gt;&gt;<br>
&gt;&gt; One of the other aims of the closing handshake was to better identi=
fy error<br>
&gt;&gt; condition, so as to prevent a client repeating unacceptable operati=
ons.<br>
&gt;&gt;<br>
&gt;&gt; For example, if a client sends a frame that is too large for the se=
rver to handle,<br>
&gt;&gt; the server needs to indicate that an error condition has occurred. &=
nbsp;If the<br>
&gt;&gt; connection is closed (orderly or otherwise) , then the client might=
 assume that it<br>
&gt;&gt; was an idle shutdown or transient condition on the server and thus o=
pen a new<br>
&gt;&gt; connection and continue to send over large frames.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; Currently -05 says:<br>
&gt;&gt;<br>
&gt;&gt; 7.1.2. &nbsp;Server-initiated closure<br>
&gt;&gt; &nbsp; &nbsp;Certain algorithms require or recommend that the serve=
r *abort the<br>
&gt;&gt; &nbsp; &nbsp;WebSocket connection* during the opening handshake. &n=
bsp;To do so, the<br>
&gt;&gt; &nbsp; &nbsp;server must simply close the WebSocket connection.<br>=

&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; the problem with this is that for a client such a close of the webs=
ocket<br>
&gt;&gt; connection cannot be distinguished from a<br>
&gt;&gt; network/intermediary failure. &nbsp; I think that typically an abor=
ted<br>
&gt;&gt; connection should not be retried, but a network/intermediary failur=
e should be -<br>
&gt;&gt; so it would be good to be able to signal to the client the differen=
ce.<br>
&gt;&gt;<br>
&gt;&gt; Thus I'd like to suggest that the close handshake carry a single by=
te of reason for<br>
&gt;&gt; the close.<br>
&gt;&gt; I think it would be sufficient to define just:<br>
&gt;&gt;<br>
&gt;&gt; &nbsp; 0x00 Normal close<br>
&gt;&gt; &nbsp; 0x01 Abnormal close<br>
&gt;&gt;<br>
&gt;&gt; But I could see an argument for something a little richer:<br>
&gt;&gt;<br>
&gt;&gt; &nbsp;0x00 Idle close<br>
&gt;&gt; &nbsp;0x01 close<br>
&gt;&gt; &nbsp;0x02 abnormal close<br>
&gt;&gt;<br>
&gt;&gt; but I concede that the danger here is trying to define too many clo=
se states<br>
&gt;&gt; _______________________________________________<br>
&gt;&gt; hybi mailing list<br>
&gt;&gt; <a href=3D"mailto:hybi@ietf.org"><a href=3D"mailto:hybi@ietf.org">h=
ybi@ietf.org</a></a><br>
&gt;&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_b=
lank"><a href=3D"https://www.ietf.org/mailman/listinfo/hybi">https://www.iet=
f.org/mailman/listinfo/hybi</a></a><br>
&gt;<br>
&gt;<br>
</div></div></blockquote></div><br>
</div></blockquote><blockquote type=3D"cite"><div><span>____________________=
___________________________</span><br><span>hybi mailing list</span><br><spa=
n><a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a></span><br><span><a href=
=3D"https://www.ietf.org/mailman/listinfo/hybi">https://www.ietf.org/mailman=
/listinfo/hybi</a></span><br></div></blockquote></body></html>=

--Apple-Mail-1--895360320--

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 10 17:35:05 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C8FD3A6971 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:35:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.084
X-Spam-Level: 
X-Spam-Status: No, score=-6.084 tagged_above=-999 required=5 tests=[AWL=0.180,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W7DnC1LBynHu for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:35:03 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 1621A3A672F for <hybi@ietf.org>; Thu, 10 Feb 2011 17:35:02 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021017350857-442609 ; Thu, 10 Feb 2011 17:35:08 -0800 
To: hybi@ietf.org
MIME-Version: 1.0
X-KeepSent: DD4ABE05:D6C65821-88257833:00822B82; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFDD4ABE05.D6C65821-ON88257833.00822B82-88257834.0009316B@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 10 Feb 2011 17:40:24 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/10/2011 05:35:08 PM, Serialize complete at 02/10/2011 05:35:08 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 05:35:08 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/10/2011 05:35:17 PM, Serialize complete at 02/10/2011 05:35:17 PM
Content-Type: multipart/alternative; boundary="=_alternative 0009316988257834_="
Subject: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 01:35:05 -0000

This is a multipart message in MIME format.
--=_alternative 0009316988257834_=
Content-Type: text/plain; charset="US-ASCII"

After a careful reading of -05, the following text got me thinking of 
someting important, and
I would like to point that out here, and I would like to hear your 
thoughts.

In Section 1.3:
"Any status code other than 101 must be treated as a failure and the 
websocket connection aborted."


CURRENT STATUS (from what I understand):

I realized, the WebSocket handshake is done in the first half of HTTP GET 
transaction
(GET -> 101) according to the current specification, and it never expects 
final response codes
(2xx, 3xx, 4xx, 5xx) processed as a part of handshake. The 'websocket' is 
resides in the 
second half of the GET transaction, and as WebSocket is a 
persistent/bidirectional 
connection, it will never see a final reponse to the GET request. 
WebSocket handshake has
clearly been modeled after RFC 2817 (HTTP Upgrade to TLS) and it could be 
perceived as 
'similar' to what WebSocket is trying to achieve. However, I see a 
fundamental difference
in between RFC 2817 and WebSocket as following.


ESSENTIAL DIFFERENCE FROM RFC 2817 ("Upgrade TLS"):

Difference 1:
Upgrade TLS: Upgrading underlying transport layer to TLS, but not HTTP 
layer
WebSocket: Switching HTTP to WebSocket, but not transport layer

Difference 2:
Upgrade TLS: It eventually receives final respoonse to complete 
transaction. (No compomise in HTTP functionality)
WebSocket: The transaction never ends in terms of HTTP transaction.

With Upgrade TLS, the provisional response was necessary because 
subsequent response 
needs to be conveyed over the TLS, while WebSocket shouldn't have had to 
use this 'Upgrade'
mechanism to begin with.


POSSIBLE CONSEQUENCES:

o  Cannot get full benefit out of HTTP protocol during the handshake as it 
does not expect a final response:
  For example:
   - Can not redirect WebSocket handshake to another server (for load 
balancing, fail-over, etc.)
   - Can not perform user authentication (Basic, Digest, etc.) during the 
handshake.
   - Similarly, 407 authentication cannot be forced by the server.

   ## These impact on deployment of WebSocket services.

o Relatively more complexity in adding WebSocket to the existing 
implemtation of HTTP server.
  Reasons:
   - Existing HTTP implementation is likely designed to treat 101 as a 
indefinitive 
     acceptance of the request wihere it tries to prepare for the final 
response...
   - Where, on receipt of a final response, such as 200 OK, the likelihood 
of exisiting implementaion
     would prepare for releasing HTTP protocol specific resources in 
memory to terminate
     the transaction.
 
   ## This impact on adoption of WebSocket procol by existing HTTP 
servers.
   ## It is desure a looser coupling from HTTP specific function - easy to 
add WebSocket to existing system (e.g. Apache)


MY THOUGHTS/DOUBTS

- Why couldn't WebSocket handshake be done in a complete form of HTTP 
transaction?
- Any specific reasons for ruling out the usefulness of final responses 
for the handshake?
- Is the current spec really acceptable from deployment perspectives??
- Has 'non-browser' use of WebSocket truely been considered?
  (non-browser app may not have priori knowlege of final desitnation or 
any requirement of server/proxy authentication)
- Finally, I must be completely wrong about the current spec. (my hope! 
please give me a hint!)


DESIRED SEQUENCE EXAMPLES AS I SEE:

(1) Successful handshake

Client                             server
------                             ------
  |             GET                   |
  +---------------------------------->| << Connection: websocket is most 
important
  |                                   |    'Upgrade: websocket' isn't 
necessary.
  |             200 OK                |
  +<----------------------------------| << Release HTTP sepcific resource,
  |                                   |    (it's natural as HTTP 
transaction is complete)
  |<========== WebSocket ============>|    then, mark the socket as 
'websocket'
                                           optionally read/write data on a 
new socket
                                           from a special 
process/thread...
                                           (enables loose coupling from 
HTTP server core)
(2) 307 Temporary Redirect

Client                             server1  server2
------                             -------  -------
  |             GET                   |        |
  +---------------------------------->|        | \
  |                                   |        |  : Handshake == complete 
HTTP transaction
  |       307 Temporary Redirect      |        |  :
  +<----------------------------------|        | /
  |                                   |        |
  |             GET [1]               |        |
  +------------------------------------------->| \
  |                                   |        |  : Handshake == complete 
HTTP transaction
  |             200 OK                |        |  :
  +<-------------------------------------------| /
  |                                   |        |
  |<================ WebSocket ===============>|
  |                                   |        |


# I just thought I might as well speak out my concern. I am aware it is 
pretty late for this level of dicussion at this point, however...

Awaiting any of your response/objection/denials.

Best.
- Yutaka

--=_alternative 0009316988257834_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">After a careful reading of -05, the
following text got me thinking of someting important, and</font>
<br><font size=2 face="sans-serif">I would like to point that out here,
and I would like to hear your thoughts.</font>
<br>
<br><font size=2 face="sans-serif">In Section 1.3:</font>
<br><font size=2 face="sans-serif"><i>&quot;Any status code other than
101 must be treated as a failure and the websocket connection aborted.</i>&quot;</font>
<br>
<br>
<br><font size=2 face="sans-serif">CURRENT STATUS (from what I understand):</font>
<br>
<br><font size=2 face="sans-serif">I realized, the WebSocket handshake
is done in the first half of HTTP GET transaction</font>
<br><font size=2 face="sans-serif">(GET -&gt; 101) according to the current
specification, and it never expects final response codes</font>
<br><font size=2 face="sans-serif">(2xx, 3xx, 4xx, 5xx) processed as a
part of handshake. The 'websocket' is resides in the </font>
<br><font size=2 face="sans-serif">second half of the GET transaction,
and as WebSocket is a persistent/bidirectional </font>
<br><font size=2 face="sans-serif">connection, it will never see a final
reponse to the GET request. WebSocket handshake has</font>
<br><font size=2 face="sans-serif">clearly been modeled after RFC 2817
(HTTP Upgrade to TLS) and it could be perceived as </font>
<br><font size=2 face="sans-serif">'similar' to what WebSocket is trying
to achieve. However, I see a fundamental difference</font>
<br><font size=2 face="sans-serif">in between RFC 2817 and WebSocket as
following.</font>
<br>
<br>
<br><font size=2 face="sans-serif">ESSENTIAL DIFFERENCE FROM RFC 2817 (&quot;Upgrade
TLS&quot;):</font>
<br>
<br><font size=2 face="sans-serif">Difference 1:</font>
<br><font size=2 face="sans-serif">Upgrade TLS: Upgrading underlying transport
layer to TLS, but not HTTP layer</font>
<br><font size=2 face="sans-serif">WebSocket: Switching HTTP to WebSocket,
but not transport layer</font>
<br>
<br><font size=2 face="sans-serif">Difference 2:</font>
<br><font size=2 face="sans-serif">Upgrade TLS: It eventually receives
final respoonse to complete transaction. (No compomise in HTTP functionality)</font>
<br><font size=2 face="sans-serif">WebSocket: The transaction never ends
in terms of HTTP transaction.</font>
<br>
<br><font size=2 face="sans-serif">With Upgrade TLS, the provisional response
was necessary because subsequent response </font>
<br><font size=2 face="sans-serif">needs to be conveyed over the TLS, while
WebSocket shouldn't have had to use this 'Upgrade'</font>
<br><font size=2 face="sans-serif">mechanism to begin with.</font>
<br>
<br>
<br><font size=2 face="sans-serif">POSSIBLE CONSEQUENCES:</font>
<br>
<br><font size=2 face="sans-serif">o &nbsp;Cannot get full benefit out
of HTTP protocol during the handshake as it does not expect a final response:</font>
<br><font size=2 face="sans-serif">&nbsp; For example:</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;- Can not redirect WebSocket
handshake to another server (for load balancing, fail-over, etc.)</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;- Can not perform user
authentication (Basic, Digest, etc.) during the handshake.</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;- Similarly, 407 authentication
cannot be forced by the server.</font>
<br>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;## These impact on deployment
of WebSocket services.</font>
<br>
<br><font size=2 face="sans-serif">o Relatively more complexity in adding
WebSocket to the existing implemtation of HTTP server.</font>
<br><font size=2 face="sans-serif">&nbsp; Reasons:</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;- Existing HTTP implementation
is likely designed to treat 101 as a indefinitive </font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; &nbsp;acceptance of the
request wihere it tries to prepare for the final response...</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;- Where, on receipt of
a final response, such as 200 OK, the likelihood of exisiting implementaion</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; &nbsp;would prepare for
releasing HTTP protocol specific resources in memory to terminate</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp; &nbsp;the transaction.</font>
<br><font size=2 face="sans-serif">&nbsp;</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;## This impact on adoption
of WebSocket procol by existing HTTP servers.</font>
<br><font size=2 face="sans-serif">&nbsp; &nbsp;## It is desure a looser
coupling from HTTP specific function - easy to add WebSocket to existing
system (e.g. Apache)</font>
<br>
<br>
<br><font size=2 face="sans-serif">MY THOUGHTS/DOUBTS</font>
<br>
<br><font size=2 face="sans-serif">- Why couldn't WebSocket handshake be
done in a complete form of HTTP transaction?</font>
<br><font size=2 face="sans-serif">- Any specific reasons for ruling out
the usefulness of final responses for the handshake?</font>
<br><font size=2 face="sans-serif">- Is the current spec really acceptable
from deployment perspectives??</font>
<br><font size=2 face="sans-serif">- Has 'non-browser' use of WebSocket
truely been considered?</font>
<br><font size=2 face="sans-serif">&nbsp; (non-browser app may not have
priori knowlege of final desitnation or any requirement of server/proxy
authentication)</font>
<br><font size=2 face="sans-serif">- Finally, I must be completely wrong
about the current spec. (my hope! please give me a hint!)</font>
<br>
<br>
<br><font size=2 face="sans-serif">DESIRED SEQUENCE EXAMPLES AS I SEE:</font>
<br>
<br><font size=2 face="sans-serif">(1) Successful handshake</font>
<br>
<br><font size=2 face="Fixedsys">Client &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; server</font>
<br><font size=2 face="Fixedsys">------ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ------</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; GET &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
|</font>
<br><font size=2 face="Fixedsys">&nbsp; +----------------------------------&gt;|
&lt;&lt; Connection: websocket is most important</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp;'Upgrade: websocket' isn't necessary.</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; 200 OK &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|</font>
<br><font size=2 face="Fixedsys">&nbsp; +&lt;----------------------------------|
&lt;&lt; Release HTTP sepcific resource,</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp;(it's natural as HTTP transaction is complete)</font>
<br><font size=2 face="Fixedsys">&nbsp; |&lt;========== WebSocket ============&gt;|
&nbsp; &nbsp;then, mark the socket as 'websocket'</font>
<br><font size=2 face="Fixedsys">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;optionally read/write data on a new socket</font>
<br><font size=2 face="Fixedsys">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;from a special process/thread...</font>
<br><font size=2 face="Fixedsys">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(enables loose coupling from HTTP server
core)</font>
<br><font size=2 face="sans-serif">(2) 307 Temporary Redirect</font>
<br>
<br><font size=2 face="Fixedsys">Client &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; server1
&nbsp;server2</font>
<br><font size=2 face="Fixedsys">------ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -------
&nbsp;-------</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; GET &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
| &nbsp; &nbsp; &nbsp; &nbsp;|</font>
<br><font size=2 face="Fixedsys">&nbsp; +----------------------------------&gt;|
&nbsp; &nbsp; &nbsp; &nbsp;| \</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;: Handshake == complete HTTP
transaction</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; 307 Temporary
Redirect &nbsp; &nbsp; &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;:</font>
<br><font size=2 face="Fixedsys">&nbsp; +&lt;----------------------------------|
&nbsp; &nbsp; &nbsp; &nbsp;| /</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp;|</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; GET [1] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; | &nbsp;
&nbsp; &nbsp; &nbsp;|</font>
<br><font size=2 face="Fixedsys">&nbsp; +-------------------------------------------&gt;|
\</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;: Handshake == complete HTTP
transaction</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; 200 OK &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
&nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;:</font>
<br><font size=2 face="Fixedsys">&nbsp; +&lt;-------------------------------------------|
/</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp;|</font>
<br><font size=2 face="Fixedsys">&nbsp; |&lt;================ WebSocket
===============&gt;|</font>
<br><font size=2 face="Fixedsys">&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp;|</font>
<br>
<br>
<br><font size=2 face="sans-serif"># I just thought I might as well speak
out my concern. I am aware it is pretty late for this level of dicussion
at this point, however...</font>
<br>
<br><font size=2 face="sans-serif">Awaiting any of your response/objection/denials.</font>
<br>
<br><font size=2 face="sans-serif">Best.</font>
<br><font size=2 face="sans-serif">- Yutaka</font>
<br>
--=_alternative 0009316988257834_=--

From gregw@intalio.com  Thu Feb 10 17:37:00 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 612F23A67D2 for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:37:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.575
X-Spam-Level: 
X-Spam-Status: No, score=-2.575 tagged_above=-999 required=5 tests=[AWL=0.402,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pWXd3LuYr0tc for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:36:59 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 4A1923A672F for <hybi@ietf.org>; Thu, 10 Feb 2011 17:36:59 -0800 (PST)
Received: by vws7 with SMTP id 7so1419881vws.31 for <hybi@ietf.org>; Thu, 10 Feb 2011 17:37:12 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.190.197 with SMTP id dj5mr3772362vcb.4.1297388232246; Thu, 10 Feb 2011 17:37:12 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.77.205 with HTTP; Thu, 10 Feb 2011 17:37:12 -0800 (PST)
In-Reply-To: <7785FB1F-C733-4AE1-BACF-44556B1074A8@gmail.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com> <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com> <7785FB1F-C733-4AE1-BACF-44556B1074A8@gmail.com>
Date: Fri, 11 Feb 2011 12:37:12 +1100
X-Google-Sender-Auth: 5_O4G8B8Hv5f8yfQ7IMUvNy7zhc
Message-ID: <AANLkTinfcj-rYiv4vDUBz3cmRqALttq61=hb0mC41L9h@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Brodie Thiesfield <brofield@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 01:37:00 -0000

On 11 February 2011 12:14, Brodie Thiesfield <brofield@gmail.com> wrote:
> I have been thankful many times for the amount of detail the http error
> status and message can return to a client. Having both a rich code space as
> well as a human readable message is invaluable for problem solving a
> connection problem. This is part of the http protocol, we shouldn't punt
> error condition reporting to the application level in websockets.
> Without a richer mechanism to return connection errors, debugging failures
> will turn into potluck of changing parameters and hoping that it works.
> When extensions are added, the sort of error conditions may expand beyond
> what can be imagined now. Why not just reuse the http error mechanism with
> both status and optional message.


There is indeed a great deal of goodness in 2xx/3xx for normal, 4xx
for bad client and 5xx for bad server.
If somebody could propose a similar nice error space for WS that would
get broad agreement, then I'd certainly support it.

But I don't want to get distracted with a prolonged discussion about a
detailed error space.  Normal vs Abnormal gives us the major
functional information we need, so I'm cautious about losing agreement
about that in a wider debate.    But then, so far nobody has spoken
out against such a status field.

cheers

From gregw@intalio.com  Thu Feb 10 17:48:28 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F0BF3A69AB for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:48:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.175
X-Spam-Level: 
X-Spam-Status: No, score=-2.175 tagged_above=-999 required=5 tests=[AWL=-0.198, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FdzxERIrcm+u for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:48:27 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 681423A676A for <hybi@ietf.org>; Thu, 10 Feb 2011 17:48:27 -0800 (PST)
Received: by vxi40 with SMTP id 40so1137956vxi.31 for <hybi@ietf.org>; Thu, 10 Feb 2011 17:48:40 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.192.201 with SMTP id dr9mr5785483vcb.214.1297388920492; Thu, 10 Feb 2011 17:48:40 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.77.205 with HTTP; Thu, 10 Feb 2011 17:48:40 -0800 (PST)
In-Reply-To: <OFDD4ABE05.D6C65821-ON88257833.00822B82-88257834.0009316B@playstation.sony.com>
References: <OFDD4ABE05.D6C65821-ON88257833.00822B82-88257834.0009316B@playstation.sony.com>
Date: Fri, 11 Feb 2011 12:48:40 +1100
X-Google-Sender-Auth: -WAHg1ATcZvF8uZUgbjTP55gWtc
Message-ID: <AANLkTi=rFieVgfMaBn+pqp_M1bLdf0+Bm0NCApL+Rpih@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 01:48:28 -0000

On 11 February 2011 12:40,  <Yutaka_Takeda@playstation.sony.com> wrote:
>
> o =A0Cannot get full benefit out of HTTP protocol during the handshake as=
 it
> does not expect a final response:
> =A0 For example:
> =A0 =A0- Can not redirect WebSocket handshake to another server (for load
> balancing, fail-over, etc.)
> =A0 =A0- Can not perform user authentication (Basic, Digest, etc.) during=
 the
> handshake.
> =A0 =A0- Similarly, 407 authentication cannot be forced by the server.

+1

In the ancient history of this list, I have long argued for exactly this.

Apparently there are some security concerns about browser redirection,
which I never really understood... and even if there are, I don't see
the reason that the protocol should deny the use of non 101 handshake
responses to all clients.  I think the protocol should allow arbitrary
response codes (because it can't actually prevent them being sent by
non WS servers anyway), and then individual clients can decide which
responses they will handle (which may be better discuss in the
appropriate HTML 5 forums regarding the specific websocket API).

cheers

From Gabriel.Montenegro@microsoft.com  Thu Feb 10 17:57:40 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F36B3A69DB for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:57:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.217
X-Spam-Level: 
X-Spam-Status: No, score=-10.217 tagged_above=-999 required=5 tests=[AWL=0.382, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XCtFyN9RRAdV for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 17:57:39 -0800 (PST)
Received: from smtp.microsoft.com (mail3.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id 279753A69AB for <hybi@ietf.org>; Thu, 10 Feb 2011 17:57:39 -0800 (PST)
Received: from TK5EX14HUBC101.redmond.corp.microsoft.com (157.54.7.153) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Thu, 10 Feb 2011 17:57:52 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14HUBC101.redmond.corp.microsoft.com (157.54.7.153) with Microsoft SMTP Server (TLS) id 14.1.270.2; Thu, 10 Feb 2011 17:57:52 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Thu, 10 Feb 2011 17:57:53 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Greg Wilkins <gregw@webtide.com>, "Yutaka_Takeda@playstation.sony.com" <Yutaka_Takeda@playstation.sony.com>
Thread-Topic: [hybi] Final HTTP responses and WebSocket handshake
Thread-Index: AQHLyYwlLpFV95ISsE6ndh1yDTQPUZP8DqAA//97lpA=
Date: Fri, 11 Feb 2011 01:57:51 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E085B9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <OFDD4ABE05.D6C65821-ON88257833.00822B82-88257834.0009316B@playstation.sony.com> <AANLkTi=rFieVgfMaBn+pqp_M1bLdf0+Bm0NCApL+Rpih@mail.gmail.com>
In-Reply-To: <AANLkTi=rFieVgfMaBn+pqp_M1bLdf0+Bm0NCApL+Rpih@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 01:57:40 -0000

This is not aligned with the WG consensus for HTTP compatibility (up until =
the websocket handshake is complete) declared some time back by the chairs.
The websocket handshake is not complete until a 101 comes back. So anything=
 before than (including other response codes, reauthentication, etc) are no=
t anything the websockets draft can say anything about. It's just compatibl=
e HTTP as usual.

So this is a bug in the spec, hopefully to get taken care of in 06.

> -----Original Message-----
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Greg Wilkins
> Sent: 10 February, 2011 17:49
> To: Yutaka_Takeda@playstation.sony.com
> Cc: hybi@ietf.org
> Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
>=20
> On 11 February 2011 12:40,  <Yutaka_Takeda@playstation.sony.com> wrote:
> >
> > o =A0Cannot get full benefit out of HTTP protocol during the handshake
> > as it does not expect a final response:
> > =A0 For example:
> > =A0 =A0- Can not redirect WebSocket handshake to another server (for lo=
ad
> > balancing, fail-over, etc.)
> > =A0 =A0- Can not perform user authentication (Basic, Digest, etc.) duri=
ng
> > the handshake.
> > =A0 =A0- Similarly, 407 authentication cannot be forced by the server.
>=20
> +1
>=20
> In the ancient history of this list, I have long argued for exactly this.
>=20
> Apparently there are some security concerns about browser redirection, wh=
ich
> I never really understood... and even if there are, I don't see the reaso=
n that the
> protocol should deny the use of non 101 handshake responses to all client=
s.  I
> think the protocol should allow arbitrary response codes (because it can'=
t
> actually prevent them being sent by non WS servers anyway), and then
> individual clients can decide which responses they will handle (which may=
 be
> better discuss in the appropriate HTML 5 forums regarding the specific
> websocket API).
>=20
> cheers
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi


From Gabriel.Montenegro@microsoft.com  Thu Feb 10 19:12:38 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE3133A682D for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 19:12:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.293
X-Spam-Level: 
X-Spam-Status: No, score=-10.293 tagged_above=-999 required=5 tests=[AWL=0.305, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qp3oNDJyo13F for <hybi@core3.amsl.com>; Thu, 10 Feb 2011 19:12:37 -0800 (PST)
Received: from smtp.microsoft.com (mail3.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id D78263A682B for <hybi@ietf.org>; Thu, 10 Feb 2011 19:12:37 -0800 (PST)
Received: from TK5EX14MLTC104.redmond.corp.microsoft.com (157.54.79.159) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Thu, 10 Feb 2011 19:12:51 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14MLTC104.redmond.corp.microsoft.com (157.54.79.159) with Microsoft SMTP Server (TLS) id 14.1.270.2; Thu, 10 Feb 2011 19:12:51 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Thu, 10 Feb 2011 19:12:50 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: John Tamplin <jat@google.com>, "Yutaka_Takeda@playstation.sony.com" <Yutaka_Takeda@playstation.sony.com>
Thread-Topic: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
Thread-Index: AQHLx+Yo0UGFDYibWUW5Td4aH6DkiZP7GWkAgABTTACAADQ8IA==
Date: Fri, 11 Feb 2011 03:12:50 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E08965@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <20110208231502.31262.8249.idtracker@localhost> <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com> <AANLkTimdy0tQrdMHdN7bX7ty=A47qr9oag+nAcx3RtqR@mail.gmail.com>
In-Reply-To: <AANLkTimdy0tQrdMHdN7bX7ty=A47qr9oag+nAcx3RtqR@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E08965TK5EX14MBXW605w_"
MIME-Version: 1.0
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 03:12:38 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E08965TK5EX14MBXW605w_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

SnVzdCByZXNwb25kaW5nIHRvIG9uZSBwb2ludDoNCg0KDQoNCuKAnE5vLCBzZWUgNC40LiAgT25s
eSBjb250cm9sIGZyYW1lcyBjYW4gYmUgc2VudCBpbiB0aGUgbWlkZGxlIG9mIGEgZnJhZ21lbnRl
ZCBtZXNzYWdlIChJIGJlbGlldmUgdGhlICJvcGVuIHF1ZXN0aW9uIiBsaW5lIGlzIG91dCBvZiBk
YXRlIC0tIEkgdGhpbmsgdGhlIGNvbnNlbnN1cyB3YXMgdGhhdCBjb250cm9sIGZyYW1lcyBjYW4g
YmUgaW5qZWN0ZWQgaW4gdGhlIG1pZGRsZSBvZiBhIGZyYWdtZW50ZWQgbWVzc2FnZSwgb3RoZXJ3
aXNlIHRoZSBsYXRlbmN5IG9mIHJlc3BvbmRpbmcgdG8gcGluZywgZm9yIGV4YW1wbGUsIHdvdWxk
IGJlIHZlcnkgbG9uZyBpZiBiZWhpbmQgYSBsYXJnZSBtZXNzYWdlKSwgYW5kIGNvbnRyb2wgZnJh
bWVzIGNhbm5vdCBiZSBmcmFnbWVudGVkLiDigJwNCg0KDQpBZ3JlZSwgSSB0aGluayB0aGlzIGNh
biBiZSBkZWxldGVkIGZyb20gNC40Og0KDQogICBvICBfTm90ZTogVGhlcmUgaXMgYW4gb3BlbiBx
dWVzdGlvbiBhcyB0byB3aGV0aGVyIGNvbnRyb2wgZnJhbWVzIGJlDQogICAgICBpbnRlcmplY3Rl
ZCBpbiB0aGUgbWlkZGxlIG9mIGEgZnJhZ21lbnRlZCBtZXNzYWdlLiAgSWYgc28sIGl0IG11c3QN
CiAgICAgIGJlIGRlY2lkZWQgd2hldGhlciB0aGV5IGJlIGZyYWdtZW50ZWQgKHdoaWNoIHdvdWxk
IHJlcXVpcmUga2VlcGluZw0KICAgICAgYSBzdGFjayBvZiAiaW4tcHJvZ3Jlc3MiIG1lc3NhZ2Vz
KS5fDQoNCkkgYWxzbyBiZWxpZXZlIHdlIGFncmVlZCB0aGF0IHRoZSBhbnN3ZXIgdG8gdGhlIGZp
cnN0IHF1ZXN0aW9ucyBpcyDigJx5ZXPigJ0uIFJlZ2FyZGxlc3MsIGl0IGlzIGxvZ2ljYWwuIEZv
ciBleGFtcGxlLCB5b3UgbWlnaHQgd2FudCB0byBzZW5kIGEgUGluZyAodGhlIGRlbGF5IGJldHdl
ZW4gZnJhZ21lbnRzIG1heSBiZSBsYXJnZSBhcyB0aGUgZGF0YSBpcyBwcm9kdWNlZCkgb3IgbW9y
ZSBvYnZpb3VzbHksIGEgQ2xvc2UuDQoNCkFuZCB0aGUgYW5zd2VyIHRvIHRoZSBzZWNvbmQgaGFz
IGFscmVhZHkgYmVlbiBzZXR0bGVkIGluIHRoZSBkcmFmdCBmb3IgYXQgbGVhc3QgYSBjb3VwbGUg
b2YgcmVsZWFzZXMgYXMg4oCcY29udHJvbCBtZXNzYWdlcyBjYW5ub3QgYmUgZnJhZ21lbnRlZOKA
nS4gRGVsZXRpbmcgdGhlIGFib3ZlIG1lYW5zIGFkZGluZyBhIHNlbnRlbmNlIGluIDQuNSAoY29u
dHJvbCBmcmFtZXMpIHRoZSB0aGUgZWZmZWN0IHRoYXQg4oCcQ29udHJvbCBmcmFtZXMgY2FuIGJl
IGludGVyamVjdGVkIGluIHRoZSBtaWRkbGUgb2YgYSBmcmFnbWVudGVkIG1lc3NhZ2Uu4oCdDQoN
Cg0KDQo=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E08965TK5EX14MBXW605w_
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy
bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt
YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj
cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv
VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu
dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250ZW50
PSJNaWNyb3NvZnQgV29yZCAxNCAoZmlsdGVyZWQgbWVkaXVtKSI+PHN0eWxlPjwhLS0NCi8qIEZv
bnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Ik1TIE1pbmNobyI7
DQoJcGFub3NlLTE6MiAyIDYgOSA0IDIgNSA4IDMgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt
aWx5OiJNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0KQGZvbnQt
ZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMg
MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAx
MSA2IDkgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiXEBNUyBNaW5j
aG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlv
bnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2lu
OjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250
LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl
cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv
cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN
Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp
b246dW5kZXJsaW5lO30NCnAuTXNvUGxhaW5UZXh0LCBsaS5Nc29QbGFpblRleHQsIGRpdi5Nc29Q
bGFpblRleHQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJQbGFp
biBUZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZv
bnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCglt
c28tZmFyZWFzdC1sYW5ndWFnZTpKQTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUt
dHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiOw0KCWNv
bG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5QbGFpblRleHRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJQbGFp
biBUZXh0IENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi
UGxhaW4gVGV4dCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjt9DQouTXNv
Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToi
Q2FsaWJyaSIsInNhbnMtc2VyaWYiOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkpBO30NCkBwYWdl
IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g
MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQot
LT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4
dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3Rl
IG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpl
eHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+
PC9oZWFkPjxib2R5IGxhbmc9RU4tVVMgbGluaz1ibHVlIHZsaW5rPXB1cnBsZT48ZGl2IGNsYXNz
PVdvcmRTZWN0aW9uMT48cCBjbGFzcz1Nc29QbGFpblRleHQ+SnVzdCByZXNwb25kaW5nIHRvIG9u
ZSBwb2ludDo8bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29QbGFpblRleHQ+PG86cD4mbmJzcDs8
L286cD48L3A+PHAgY2xhc3M9TXNvUGxhaW5UZXh0PuKAnE5vLCBzZWUgNC40LiAmbmJzcDtPbmx5
IGNvbnRyb2wgZnJhbWVzIGNhbiBiZSBzZW50IGluIHRoZSBtaWRkbGUgb2YgYSBmcmFnbWVudGVk
IG1lc3NhZ2UgKEkgYmVsaWV2ZSB0aGUgJnF1b3Q7b3BlbiBxdWVzdGlvbiZxdW90OyBsaW5lIGlz
IG91dCBvZiBkYXRlIC0tIEkgdGhpbmsgdGhlIGNvbnNlbnN1cyB3YXMgdGhhdCBjb250cm9sIGZy
YW1lcyBjYW4gYmUgaW5qZWN0ZWQgaW4gdGhlIG1pZGRsZSBvZiBhIGZyYWdtZW50ZWQgbWVzc2Fn
ZSwgb3RoZXJ3aXNlIHRoZSBsYXRlbmN5IG9mIHJlc3BvbmRpbmcgdG8gcGluZywgZm9yIGV4YW1w
bGUsIHdvdWxkIGJlIHZlcnkgbG9uZyBpZiBiZWhpbmQgYSBsYXJnZSBtZXNzYWdlKSwgYW5kIGNv
bnRyb2wgZnJhbWVzIGNhbm5vdCBiZSBmcmFnbWVudGVkLiDigJw8bzpwPjwvbzpwPjwvcD48cCBj
bGFzcz1Nc29QbGFpblRleHQ+PG86cD4mbmJzcDs8L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFs
PjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fu
cy1zZXJpZiI7Y29sb3I6IzFGNDk3RCc+QWdyZWUsIEkgdGhpbmsgdGhpcyBjYW4gYmUgZGVsZXRl
ZCBmcm9tIDQuNDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFu
IHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJp
ZiI7Y29sb3I6IzFGNDk3RCc+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1z
b05vcm1hbCBzdHlsZT0ncGFnZS1icmVhay1iZWZvcmU6YWx3YXlzJz48c3BhbiBsYW5nPUVOIHN0
eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyInPsKgwqAgb8Kg
IF9Ob3RlOiBUaGVyZSBpcyBhbiBvcGVuIHF1ZXN0aW9uIGFzIHRvIHdoZXRoZXIgY29udHJvbCBm
cmFtZXMgYmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdw
YWdlLWJyZWFrLWJlZm9yZTphbHdheXMnPjxzcGFuIGxhbmc9RU4gc3R5bGU9J2ZvbnQtc2l6ZTox
MC4wcHQ7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Iic+wqDCoMKgwqDCoCBpbnRlcmplY3RlZCBp
biB0aGUgbWlkZGxlIG9mIGEgZnJhZ21lbnRlZCBtZXNzYWdlLsKgIElmIHNvLCBpdCBtdXN0PG86
cD48L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0ncGFnZS1icmVhay1i
ZWZvcmU6YWx3YXlzJz48c3BhbiBsYW5nPUVOIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQt
ZmFtaWx5OiJDb3VyaWVyIE5ldyInPsKgwqAgwqDCoMKgYmUgZGVjaWRlZCB3aGV0aGVyIHRoZXkg
YmUgZnJhZ21lbnRlZCAod2hpY2ggd291bGQgcmVxdWlyZSBrZWVwaW5nPG86cD48L286cD48L3Nw
YW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0ncGFnZS1icmVhay1iZWZvcmU6YWx3YXlz
Jz48c3BhbiBsYW5nPUVOIHN0eWxlPSdmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiJDb3Vy
aWVyIE5ldyInPsKgwqDCoMKgwqAgYSBzdGFjayBvZiAmcXVvdDtpbi1wcm9ncmVzcyZxdW90OyBt
ZXNzYWdlcykuXzxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4g
bGFuZz1FTiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsInNh
bnMtc2VyaWYiO2NvbG9yOiMxRjQ5N0QnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBj
bGFzcz1Nc29Ob3JtYWw+PHNwYW4gbGFuZz1FTiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250
LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRjQ5N0QnPkkgYWxzbyBiZWxp
ZXZlIHdlIGFncmVlZCB0aGF0IHRoZSBhbnN3ZXIgdG8gdGhlIGZpcnN0IHF1ZXN0aW9ucyBpcyDi
gJx5ZXPigJ0uIFJlZ2FyZGxlc3MsIGl0IGlzIGxvZ2ljYWwuIEZvciBleGFtcGxlLCB5b3UgbWln
aHQgd2FudCB0byBzZW5kIGEgUGluZyAodGhlIGRlbGF5IGJldHdlZW4gZnJhZ21lbnRzIG1heSBi
ZSBsYXJnZSBhcyB0aGUgZGF0YSBpcyBwcm9kdWNlZCkgb3IgbW9yZSBvYnZpb3VzbHksIGEgQ2xv
c2UuPG86cD48L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBsYW5nPUVO
IHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJp
ZiI7Y29sb3I6IzFGNDk3RCc+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1z
b05vcm1hbD48c3BhbiBsYW5nPUVOIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5
OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7Y29sb3I6IzFGNDk3RCc+QW5kIHRoZSBhbnN3ZXIgdG8g
dGhlIHNlY29uZCBoYXMgYWxyZWFkeSBiZWVuIHNldHRsZWQgaW4gdGhlIGRyYWZ0IGZvciBhdCBs
ZWFzdCBhIGNvdXBsZSBvZiByZWxlYXNlcyBhcyDigJxjb250cm9sIG1lc3NhZ2VzIGNhbm5vdCBi
ZSBmcmFnbWVudGVk4oCdLiBEZWxldGluZyB0aGUgYWJvdmUgbWVhbnMgYWRkaW5nIGEgc2VudGVu
Y2UgaW4gNC41IChjb250cm9sIGZyYW1lcykgdGhlIHRoZSBlZmZlY3QgdGhhdCDigJxDb250cm9s
IGZyYW1lcyBjYW4gYmUgaW50ZXJqZWN0ZWQgaW4gdGhlIG1pZGRsZSBvZiBhIGZyYWdtZW50ZWQg
bWVzc2FnZS7igJ3CoCA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxz
cGFuIGxhbmc9RU4gc3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmki
LCJzYW5zLXNlcmlmIjtjb2xvcjojMUY0OTdEJz48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+
PHAgY2xhc3M9TXNvUGxhaW5UZXh0PjxzcGFuIGxhbmc9RU4+PG86cD4mbmJzcDs8L286cD48L3Nw
YW4+PC9wPjwvZGl2PjwvYm9keT48L2h0bWw+

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E08965TK5EX14MBXW605w_--

From julian.reschke@gmx.de  Fri Feb 11 01:48:26 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E94E23A68B8 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 01:48:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.799
X-Spam-Level: 
X-Spam-Status: No, score=-103.799 tagged_above=-999 required=5 tests=[AWL=-1.200, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0h2i9vkoeAsQ for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 01:48:25 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id E55793A683D for <hybi@ietf.org>; Fri, 11 Feb 2011 01:48:24 -0800 (PST)
Received: (qmail invoked by alias); 11 Feb 2011 09:48:37 -0000
Received: from p508F9D04.dip.t-dialin.net (EHLO [192.168.178.33]) [80.143.157.4] by mail.gmx.net (mp011) with SMTP; 11 Feb 2011 10:48:37 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX18iaSFYGEoiLZMxIv5v6CzuxP3z1WBVJ/AoqQDQHX od5VaBPXlElUbM
Message-ID: <4D5505EE.4030806@gmx.de>
Date: Fri, 11 Feb 2011 10:48:30 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
References: <OF44DCAB38.CFF4042C-ON88257833.0030697C-88257833.003C5A3E@playstation.sony.com> <4D53CB85.6070408@gmx.de>
In-Reply-To: <4D53CB85.6070408@gmx.de>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Subject: [hybi] HTML references, was: Terminology, was:  I-D Action:draft-ietf-hybi-thewebsocketprotocol-05.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 09:48:27 -0000

On 10.02.2011 12:27, Julian Reschke wrote:
> On 10.02.2011 11:59, Yutaka_Takeda@PlayStation.Sony.Com wrote:
>> ...
>> o Section 2.1 - typo?
>>
>> What is IRI? You mean, "URL"?
>> ...
>
> I see
>
>> The term "URL" is used in this section in a manner consistent with
>> the terminology used in HTML, namely, to denote a string that might
>> or might not be a valid URI or IRI and to which certain error
>> handling behaviors will be applied when the string is parsed. [HTML]
>
> This needs to be fixed to be either "URI" or "IRI" (depending on what we
> actually want, I *suspect* URI); and of course the bogus HTML reference
> needs to go.
> ...

Clarifying - we currently have a normative reference to "HTML" as a 
document on the WHATWG site, which won't work here because it's a moving 
target (see <http://blog.whatwg.org/html-is-the-new-html5>).

We should look at the individual pieces we need, and cite them properly.

After a quick check, these may fall into these categories:

1) Actual references to HTML constructs, like forms -- simply cite W3C's 
HTML spec (either 4.01 or the latest HTML 5 WD; but I believe 4.01 would 
be sufficient).

2) Definition of URL -- simply don't. Stick with IETF terminology.

3) Credits for previous websockets work -- this can be done in the prose 
of the Acknowledgments section (potentially including a precise link to 
another doc's acknowledgments), but it doesn't need an entry under 
"References".

Best regards, Julian

From brofield@gmail.com  Fri Feb 11 05:59:15 2011
Return-Path: <brofield@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B98C3A6A16 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 05:59:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.999
X-Spam-Level: 
X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_63=0.6, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0MJnMqYx7FXB for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 05:59:14 -0800 (PST)
Received: from mail-bw0-f44.google.com (mail-bw0-f44.google.com [209.85.214.44]) by core3.amsl.com (Postfix) with ESMTP id CB3293A69FF for <hybi@ietf.org>; Fri, 11 Feb 2011 05:59:13 -0800 (PST)
Received: by bwz12 with SMTP id 12so3519639bwz.31 for <hybi@ietf.org>; Fri, 11 Feb 2011 05:59:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=V8oFZ2NV8NlR0I0M2QqjnZAu/BZ0le6XcLEHDBM3/fw=; b=kJhmKop2j7RWJPg57wOzo1/roXuQc223jnK2X7D0btAy5y4Xm2omIZb0tZ0r/1C1oT RtFufY1GaZgX/QEm4tp8xyFl4SKAGpRFn1g5xKQ90GRf9bC9fa+8ZfYSaPoAB60foxlp e9EMAnvVJtS5hNf8aEq7rSXOvSwlVDH+p/TAg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=LPTbMB1K05qQ5wdCX4nY8pXCpqYLkTAY76qC3iaB/q9cWKd+zdV9mj+ylMWOsNWXf2 KxRtg/2PdetBpeTk/Mdwk/vNW8go6RSmqDKE6CTHNtKn2mWJpE3J4wsC7RZetdXef43V WgetlpDs7YiTZMwtQnJ9XGTeDT0sPpzMoqdKQ=
MIME-Version: 1.0
Received: by 10.103.199.14 with SMTP id b14mr322900muq.20.1297432767693; Fri, 11 Feb 2011 05:59:27 -0800 (PST)
Received: by 10.103.138.19 with HTTP; Fri, 11 Feb 2011 05:59:27 -0800 (PST)
In-Reply-To: <AANLkTinfcj-rYiv4vDUBz3cmRqALttq61=hb0mC41L9h@mail.gmail.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com> <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com> <7785FB1F-C733-4AE1-BACF-44556B1074A8@gmail.com> <AANLkTinfcj-rYiv4vDUBz3cmRqALttq61=hb0mC41L9h@mail.gmail.com>
Date: Fri, 11 Feb 2011 22:59:27 +0900
Message-ID: <AANLkTikHf00MhSPXhfjDv9MuG=tMQ6V3FG2VvGoV+o-8@mail.gmail.com>
From: Brodie Thiesfield <brofield@gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 13:59:15 -0000

On Fri, Feb 11, 2011 at 10:37 AM, Greg Wilkins <gregw@webtide.com> wrote:
> On 11 February 2011 12:14, Brodie Thiesfield <brofield@gmail.com> wrote:
>> I have been thankful many times for the amount of detail the http error
>> status and message can return to a client. Having both a rich code space=
 as
>> well as a human readable message is invaluable for problem solving a
>> connection problem. This is part of the http protocol, we shouldn't punt
>> error condition reporting to the application level in websockets.
>
> There is indeed a great deal of goodness in 2xx/3xx for normal, 4xx
> for bad client and 5xx for bad server.
> If somebody could propose a similar nice error space for WS that would
> get broad agreement, then I'd certainly support it.
>
> But I don't want to get distracted with a prolonged discussion about a
> detailed error space. =A0Normal vs Abnormal gives us the major
> functional information we need, so I'm cautious about losing agreement
> about that in a wider debate. =A0 =A0But then, so far nobody has spoken
> out against such a status field.

Agreed. I certainly don't have any interest in discussing what codes
are necessary or not right now. That's why I suggest that we simply
reuse the HTTP status code format of 3 digits(but not the actual
status codes), allow an optional message (single space followed by a
free-form UTF-8 message). For the moment, if only normal or abnormal
exit is required, then only specify those two errors, but at least
allow for a textual description as to what is causing the abnormal
termination. I would suggest reusing the 2xx for normal, 4xx for
client error (or message sender error) and 5xx for server error (or
message receiver) form since they are already familiar. Disallow other
error ranges.

status =3D [245] [0-9] [0-9]
message =3D ' ' utf8_character+
close_body =3D status message?

Normal:
200 normal

Abnormal:
400 bad request
500 internal server error

This would allow servers to at least close connections on a client
that has sent a bad request and give the client an idea of if the
connection was closed due to their fault or something that happened in
the server.

Status codes that I could imagine would be useful as well as a few
codes to cover the list that Yuta mentioned:

4xx
* timeout
* invalid opcode
* invalid encoding
* unexpected
* too long

5xx
* overloaded / service unavailable
* not supported

But as I said, at the very least, the 200/400/500 + optional text message.

Regards,
Brodie

From mcmanus@ducksong.com  Fri Feb 11 09:01:22 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 591343A69E7 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:01:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pmdr29ZCGa3K for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:01:21 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 068593A6A26 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:01:20 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 36021102A8; Fri, 11 Feb 2011 12:01:35 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 7A42E10157 for <hybi@ietf.org>; Fri, 11 Feb 2011 12:01:30 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: hybi <hybi@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 11 Feb 2011 12:00:31 -0500
Message-ID: <1297443631.2401.142.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Subject: [hybi] -05 editorial nits (future compression and random redundancy)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:01:22 -0000

I think -05 is great, we're really converging on something useful.

These are 2 small editorial issues from my last reading of it. Can we
add these to the tracker?

Section 1.5: "future versions will
   likely introduce additional concepts such as multiplexing and
   compression." .. This version introduces compression.

and then:

page 25 and page 30: the phrase "randomly selected randomly" seems to be cut and paste error?



-- 
http://www.getfirefox.com/



From mcmanus@ducksong.com  Fri Feb 11 09:01:38 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C7CB3A6A2C for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:01:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbG4OOqlN7PJ for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:01:37 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 539903A69D2 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:01:37 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 9CC0F102A8; Fri, 11 Feb 2011 12:01:52 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 6FBD510157 for <hybi@ietf.org>; Fri, 11 Feb 2011 12:01:47 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: hybi <hybi@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 11 Feb 2011 12:00:48 -0500
Message-ID: <1297443648.2401.143.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Subject: [hybi] -05 suggested rewrite for Section 1.8
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:01:38 -0000

Section 1.8: I suggest striking all of this text: 
"There are several options for establishing a WebSocket connection.

   On the face of it, the simplest method would seem to be to use port
   80 to get a direct connection to a WebSocket server.  Port 80
   traffic, however, will often be intercepted by HTTP proxies, which
   can lead to the connection failing to be established.

   The most reliable method, therefore, is to use TLS encryption and
   port 443 to connect directly to a WebSocket server.  This has the
   advantage of being more secure; however, TLS encryption can be
   computationally expensive."

This doesn't actually help with interop, is only contextually true, and
is the kind of statement that does not hold up well over time. The spec
is simply better without the text because it isn't adding useful at the
protocol level.


-- 
http://www.getfirefox.com/



From mcmanus@ducksong.com  Fri Feb 11 09:04:31 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4D7E63A69E7 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:04:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WPEpgza4NNs7 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:04:30 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 036D83A6956 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:04:29 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 1B2EE102A8; Fri, 11 Feb 2011 12:04:44 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id D414B10157 for <hybi@ietf.org>; Fri, 11 Feb 2011 12:04:40 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: hybi <hybi@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 11 Feb 2011 12:03:41 -0500
Message-ID: <1297443821.2401.147.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Subject: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:04:31 -0000

In client requirements (5.1), under handshake requirement #6: 
"The request MUST contain a "Connection" header whose value is equal to
"Upgrade"."

I believe that should be changed to "whose value contains the Upgrade
token" instead of the "equal" language. As currently written it
prohibits the client from concurrently using the Connection header for
other valid HTTP/1.1 purposes too, and we want to make this HTTP/1.1
compatible.

Similarly:

 "If the response lacks a Connection header or the Connection header
contains a value that is not an ASCII case-insensitive match for the
value "Upgrade", the client MUST fail the WebSocket connection." 

Again, we require an upgrade token but its ok to have other values in
there too.. in order to be http compatible we must loosen this receive
condition, and we ought to loosen the send one too.


-- 
http://www.getfirefox.com/



From mcmanus@ducksong.com  Fri Feb 11 09:13:25 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 142903A6956 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:13:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xy9xYQx9Zi7f for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:13:24 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 265F03A67BD for <hybi@ietf.org>; Fri, 11 Feb 2011 09:13:24 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id E9884102A8; Fri, 11 Feb 2011 12:13:38 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 1691810157 for <hybi@ietf.org>; Fri, 11 Feb 2011 12:13:35 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: hybi <hybi@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 11 Feb 2011 12:12:35 -0500
Message-ID: <1297444355.2401.155.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Subject: [hybi] -05: sec-websocket-nonce http response header
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:13:25 -0000

I feel kinda dumb asking this, but is the sec-websocket-nonce response
header used for anything in -05? It is required to be included in the
response, but I do not see where it is used. It is not used to verify
sec-websocket-accept.

Relatedly an editorial nit, Section 10.4 says:

"The |Sec-WebSocket-Key| and |Sec-WebSocket-Nonce| headers are used in
   the WebSocket handshake.  They are sent from the client to the server [..]"

Sec-Websocket-Nonce is not sent from the client to the server, so that should be fixed up..


-- 
http://www.getfirefox.com/



From andy.warmcat.com@googlemail.com  Fri Feb 11 09:16:57 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 914D23A6860 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:16:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dyfd5ktaQ-sK for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:16:56 -0800 (PST)
Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by core3.amsl.com (Postfix) with ESMTP id 3DDCF3A67BD for <hybi@ietf.org>; Fri, 11 Feb 2011 09:16:56 -0800 (PST)
Received: by eyd10 with SMTP id 10so1591454eyd.31 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:17:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=AvHOGIabbRL5ssSfhTwxXRQe3FZBOjLoBz+wxkafxq8=; b=LsG0ET6jitHr0n/xUbQRATye5mxd2qu2Tazt/WpjrUS00qnuLddJct7wRu9B9uxHY4 +rLnFkv+6w3tVYlJFegWfdZvgo/Q6JRoe/yBxxI6o0UAY7U0UVe69lRQyPBAFPIJz2fn XUhMU+wuRpGdljIW7M1ZHtQKXKWlDdKFD/k6I=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=fqcGsm+tA3l5ln3unJfXK+ZgwYul1R7Xvabckfy+9NZKCzKLuK8stcRIwJWt9Hgj+0 Oj5PIRwIeDjiDPuBLb0Un1ZPq0wnOvaF7JPOIWE94p/b0TIxtEOfg6XJlqO8UWMZqs5J jLzfBhtFl20rh14G1/NGHoqAonZDHbwsg8qBc=
Received: by 10.213.113.140 with SMTP id a12mr690330ebq.91.1297444621833; Fri, 11 Feb 2011 09:17:01 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id u1sm884492eeh.16.2011.02.11.09.16.56 (version=SSLv3 cipher=OTHER); Fri, 11 Feb 2011 09:16:57 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D556F07.90206@warmcat.com>
Date: Fri, 11 Feb 2011 17:16:55 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
References: <1297444355.2401.155.camel@ds9.ducksong.com>
In-Reply-To: <1297444355.2401.155.camel@ds9.ducksong.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] -05: sec-websocket-nonce http response header
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:16:57 -0000

On 02/11/11 17:12, Somebody in the thread at some point said:
> I feel kinda dumb asking this, but is the sec-websocket-nonce response
> header used for anything in -05? It is required to be included in the
> response, but I do not see where it is used. It is not used to verify
> sec-websocket-accept.
>
> Relatedly an editorial nit, Section 10.4 says:
>
> "The |Sec-WebSocket-Key| and |Sec-WebSocket-Nonce| headers are used in
>     the WebSocket handshake.  They are sent from the client to the server [..]"
>
> Sec-Websocket-Nonce is not sent from the client to the server, so that should be fixed up..

Yeah in 04 it was the server's ingredient in the shared connection key. 
  But in 05, they don't keep a 20-byte connection key any more and just 
use the per-frame key raw without referring to anything else.

So this is a (mistaken) holdover from 04 you spotted I think that can be 
deleted.

-Andy



From salvatore.loreto@ericsson.com  Fri Feb 11 09:32:43 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3343E3A67DA for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:32:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level: 
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dWcJSyVPxKG6 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:32:41 -0800 (PST)
Received: from mailgw10.se.ericsson.net (mailgw10.se.ericsson.net [193.180.251.61]) by core3.amsl.com (Postfix) with ESMTP id 5AA563A6778 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:32:41 -0800 (PST)
X-AuditID: c1b4fb3d-b7b89ae0000036a3-78-4d5572c767f2
Received: from esessmw0256.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw10.se.ericsson.net (Symantec Mail Security) with SMTP id C1.2F.13987.7C2755D4; Fri, 11 Feb 2011 18:32:55 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0256.eemea.ericsson.se (153.88.115.97) with Microsoft SMTP Server id 8.2.234.1; Fri, 11 Feb 2011 18:32:55 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id 127672328	for <hybi@ietf.org>; Fri, 11 Feb 2011 19:32:55 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id CDEE6506C9	for <hybi@ietf.org>; Fri, 11 Feb 2011 19:32:54 +0200 (EET)
Received: from Salvatore-Loretos-MacBook-Pro.local (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 4F7B95057B	for <hybi@ietf.org>; Fri, 11 Feb 2011 19:32:53 +0200 (EET)
Message-ID: <4D5572C5.2000703@ericsson.com>
Date: Fri, 11 Feb 2011 18:32:53 +0100
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
References: <OF1FBA64A7.FD3F6A29-ON88257833.0078A037-88257833.0081FBEE@playstation.sony.com>
In-Reply-To: <OF1FBA64A7.FD3F6A29-ON88257833.0078A037-88257833.0081FBEE@playstation.sony.com>
Content-Type: multipart/alternative; boundary="------------050903020402060609000509"
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:32:43 -0000

--------------050903020402060609000509
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

On 2/11/11 12:39 AM, Yutaka_Takeda@PlayStation.Sony.Com wrote:
>
> Hi,
>
> Joining this thread from another one in reply to Takeshi's message. 
> Let me try to through my
> thoughts...
>
> > > o Section 4.5.1 - Close handshake
> > >
> > > It is no clear to me what 0x43 and 0x53 are trying to achieve. In
> > > TCP, there is FIN with no
> > > details of why/who is closing for graceful shutdown.
> >
> > Actually, it's not intended to indicate who's closing, but to make
> > sure what the close frame really means, i.e. it's close initiation
> > or close acknowledgement. Using an analogy of TCP, close S from
> > server is FIN, and close S from client is ACK for server's FIN.
> >
> > Without this, each peer cannot know
> > - the other peer just initiated close
> > or
> > - the other peer received close frame and acknowledged it
> >
> > Imagine both peers send out close initiation at approximately same
> > time. They looks like acknowledgement but are not.
> >
> > Once we can perfectly distinguish initiation and acknowledgement as
> > described above, we can assume "If A received close acknowledgement
> > from B, B has received all the data sent from A before close 
> successfully".
> >
> > If you have any idea about the usefulness of this closing handshake
> > design, please come to the thread "Clarify the role of closing
> > handshake" and speak out. We're discussing it now.
>
> The current -05 as is seems good to me. Now I think it would be good 
> to have 1-byte body
> 0x43 and 0x53, if it is important to know whether all data sent 
> successfully reached the peer.
> I just do not know how import that is from application's perspective.

Hi Yutaka

People seems agree that this can be handled at application level,
(the fact that you also say that it is difficult to know how important 
that is
from an application's prospective seem that you agree on that, but then
the rest of your message confuse me, can you clarify what you would like?)

People seems agree, withing this thread, that at protocol level it is 
enough to go for the simplest scenario:

- Peer B assumes that no more data is coming from peer A when B receives 
closing
initiation from A.

please read the text suggested from Takeshi in
http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html
and check if it works for you

cheers
/Sal

-- 
Salvatore Loreto
www.sloreto.com




--------------050903020402060609000509
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
    <title></title>
  </head>
  <body bgcolor="#ffffff" text="#000000">
    On 2/11/11 12:39 AM, <a class="moz-txt-link-abbreviated" href="mailto:Yutaka_Takeda@PlayStation.Sony.Com">Yutaka_Takeda@PlayStation.Sony.Com</a> wrote:
    <blockquote
cite="mid:OF1FBA64A7.FD3F6A29-ON88257833.0078A037-88257833.0081FBEE@playstation.sony.com"
      type="cite">
      <br>
      <font face="sans-serif" size="2">Hi,</font>
      <br>
      <br>
      <font face="sans-serif" size="2">Joining this thread from another
        one
        in reply to Takeshi's message. Let me try to through my</font>
      <br>
      <font face="sans-serif" size="2">thoughts...</font>
      <br>
      <br>
      <tt><font size="2">&gt; &gt; o Section 4.5.1 - Close handshake <br>
          &gt; &gt; <br>
          &gt; &gt; It is no clear to me what 0x43 and 0x53 are trying
          to achieve.
          In <br>
          &gt; &gt; TCP, there is FIN with no <br>
          &gt; &gt; details of why/who is closing for graceful shutdown.
          <br>
          &gt; <br>
          &gt; Actually, it's not intended to indicate who's closing,
          but to make
          <br>
          &gt; sure what the close frame really means, i.e. it's close
          initiation
          <br>
          &gt; or close acknowledgement. Using an analogy of TCP, close
          S from <br>
          &gt; server is FIN, and close S from client is ACK for
          server's FIN.</font></tt>
      <br>
      <tt><font size="2">&gt; <br>
          &gt; Without this, each peer cannot know</font></tt>
      <br>
      <tt><font size="2">&gt; - the other peer just initiated close</font></tt>
      <br>
      <tt><font size="2">&gt; or</font></tt>
      <br>
      <tt><font size="2">&gt; - the other peer received close frame and
          acknowledged
          it</font></tt>
      <br>
      <tt><font size="2">&gt; <br>
          &gt; Imagine both peers send out close initiation at
          approximately same
          <br>
          &gt; time. They looks like acknowledgement but are not.</font></tt>
      <br>
      <tt><font size="2">&gt; <br>
          &gt; Once we can perfectly distinguish initiation and
          acknowledgement as
          <br>
          &gt; described above, we can assume "If A received close
          acknowledgement
          <br>
          &gt; from B, B has received all the data sent from A before
          close successfully".</font></tt>
      <br>
      <tt><font size="2">&gt; <br>
          &gt; If you have any idea about the usefulness of this closing
          handshake
          <br>
          &gt; design, please come to the thread "Clarify the role of
          closing
          <br>
          &gt; handshake" and speak out. We're discussing it now.</font></tt>
      <br>
      <br>
      <font face="sans-serif" size="2">The current -05 as is seems good
        to
        me. Now I think it would be good to have 1-byte body</font>
      <br>
      <font face="sans-serif" size="2">0x43 and 0x53, if it is important
        to
        know whether all data sent successfully reached the peer.</font>
      <br>
      <font face="sans-serif" size="2">I just do not know how import
        that is
        from application's perspective.</font>
      <br>
    </blockquote>
    <br>
    Hi Yutaka<br>
    <br>
    People seems agree that this can be handled at application level,<br>
    (the fact that you also say that it is difficult to know how
    important that is<br>
    from an application's prospective seem that you agree on that, but
    then<br>
    the rest of your message confuse me, can you clarify what you would
    like?)<br>
    <br>
    People seems agree, withing this thread, that at protocol level it
    is enough to go for the simplest scenario:<br>
    <br>
    - Peer B assumes that no more data is coming from peer A when B
    receives closing <br>
    initiation from A.<br>
    <br>
    please read the text suggested from Takeshi in <br>
    <a class="moz-txt-link-freetext" href="http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html">http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html</a><br>
    and check if it works for you<br>
    <br>
    cheers<br>
    /Sal<br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Salvatore Loreto
<a class="moz-txt-link-abbreviated" href="http://www.sloreto.com">www.sloreto.com</a></pre>
    <br>
    <br>
  </body>
</html>

--------------050903020402060609000509--

From tyoshino@google.com  Fri Feb 11 09:46:45 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C8F923A688F for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:46:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.401
X-Spam-Level: 
X-Spam-Status: No, score=-105.401 tagged_above=-999 required=5 tests=[AWL=0.575, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PwZy1Dtfwxbs for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 09:46:44 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id B811D3A67AF for <hybi@ietf.org>; Fri, 11 Feb 2011 09:46:44 -0800 (PST)
Received: from hpaq3.eem.corp.google.com (hpaq3.eem.corp.google.com [172.25.149.3]) by smtp-out.google.com with ESMTP id p1BHkwvN014160 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:46:59 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297446419; bh=Xxfwmdn7fZnb1OnFJKE41lQ8HTk=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=MdFD0Oc9s+XIn3ecKTMRE+/yRzTHSwcmvqqvidNoXehbUq14LOljwVrUQFHdeEqdr Iwjp0lQlDyWg5HCAOJAjA==
Received: from gwb17 (gwb17.prod.google.com [10.200.2.17]) by hpaq3.eem.corp.google.com with ESMTP id p1BHkumj009558 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 11 Feb 2011 09:46:57 -0800
Received: by gwb17 with SMTP id 17so1184036gwb.30 for <hybi@ietf.org>; Fri, 11 Feb 2011 09:46:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=fV8rsPtDolT+lo0NJtiV2a8JzZHHX3pxH/LBm1gIBb8=; b=tFMARHc2nOR5/jnLX0f7Qbis0ZCT+Ao3sGCo8Fu/KlJlKVln7mSBOv7ZS+zTVbosb1 l3HtFVIeqN4giX84n7lQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=vicE+nCusMucJgJwrCe08bbaD6eni/JMq4EkcY0CJ2GHhClEsMPoUFjSQlSq8+4n39 OJXM3hfeKRCJT488oHBg==
Received: by 10.150.204.2 with SMTP id b2mr840781ybg.447.1297446416437; Fri, 11 Feb 2011 09:46:56 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.91.16 with HTTP; Fri, 11 Feb 2011 09:46:31 -0800 (PST)
In-Reply-To: <4D556F07.90206@warmcat.com>
References: <1297444355.2401.155.camel@ds9.ducksong.com> <4D556F07.90206@warmcat.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 11 Feb 2011 09:46:31 -0800
Message-ID: <AANLkTikhfAG3XaJGJ=xxXS+LueCRWObHod58h5ViS1oz@mail.gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: multipart/alternative; boundary=000e0cd37526c45070049c054834
X-System-Of-Record: true
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] -05: sec-websocket-nonce http response header
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 17:46:45 -0000

--000e0cd37526c45070049c054834
Content-Type: text/plain; charset=ISO-8859-1

Yes, and it's already addressed on the ToT.
http://trac.tools.ietf.org/wg/hybi/trac/changeset/64/websocket/draft-ietf-hybi-thewebsocketprotocol.xml

On Fri, Feb 11, 2011 at 09:16, Andy Green <andy@warmcat.com> wrote:

> On 02/11/11 17:12, Somebody in the thread at some point said:
>
>> I feel kinda dumb asking this, but is the sec-websocket-nonce response
>> header used for anything in -05? It is required to be included in the
>> response, but I do not see where it is used. It is not used to verify
>> sec-websocket-accept.
>>
>> Relatedly an editorial nit, Section 10.4 says:
>>
>> "The |Sec-WebSocket-Key| and |Sec-WebSocket-Nonce| headers are used in
>>    the WebSocket handshake.  They are sent from the client to the server
>> [..]"
>>
>> Sec-Websocket-Nonce is not sent from the client to the server, so that
>> should be fixed up..
>>
>
> Yeah in 04 it was the server's ingredient in the shared connection key.
>  But in 05, they don't keep a 20-byte connection key any more and just use
> the per-frame key raw without referring to anything else.
>
> So this is a (mistaken) holdover from 04 you spotted I think that can be
> deleted.
>
> -Andy

--000e0cd37526c45070049c054834
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Yes,=A0and it&#39;s already addressed on the ToT.<div><a href=3D"http://tra=
c.tools.ietf.org/wg/hybi/trac/changeset/64/websocket/draft-ietf-hybi-theweb=
socketprotocol.xml" target=3D"_blank">http://trac.tools.ietf.org/wg/hybi/tr=
ac/changeset/64/websocket/draft-ietf-hybi-thewebsocketprotocol.xml</a></div=
>


<div><br><div class=3D"gmail_quote">On Fri, Feb 11, 2011 at 09:16, Andy Gre=
en <span dir=3D"ltr">&lt;<a href=3D"mailto:andy@warmcat.com" target=3D"_bla=
nk">andy@warmcat.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex=
">


<div>On 02/11/11 17:12, Somebody in the thread at some point said:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
I feel kinda dumb asking this, but is the sec-websocket-nonce response<br>
header used for anything in -05? It is required to be included in the<br>
response, but I do not see where it is used. It is not used to verify<br>
sec-websocket-accept.<br>
<br>
Relatedly an editorial nit, Section 10.4 says:<br>
<br>
&quot;The |Sec-WebSocket-Key| and |Sec-WebSocket-Nonce| headers are used in=
<br>
 =A0 =A0the WebSocket handshake. =A0They are sent from the client to the se=
rver [..]&quot;<br>
<br>
Sec-Websocket-Nonce is not sent from the client to the server, so that shou=
ld be fixed up..<br>
</blockquote>
<br></div>
Yeah in 04 it was the server&#39;s ingredient in the shared connection key.=
 =A0But in 05, they don&#39;t keep a 20-byte connection key any more and ju=
st use the per-frame key raw without referring to anything else.<br>
<br>
So this is a (mistaken) holdover from 04 you spotted I think that can be de=
leted.<br><font color=3D"#888888">
<br>
-Andy</font></blockquote></div></div>

--000e0cd37526c45070049c054834--

From Gabriel.Montenegro@microsoft.com  Fri Feb 11 12:51:29 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7CE793A6878 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 12:51:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.344
X-Spam-Level: 
X-Spam-Status: No, score=-10.344 tagged_above=-999 required=5 tests=[AWL=0.254, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKZsM2mLyZXh for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 12:51:28 -0800 (PST)
Received: from smtp.microsoft.com (mailc.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id 086853A67B3 for <hybi@ietf.org>; Fri, 11 Feb 2011 12:51:27 -0800 (PST)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Fri, 11 Feb 2011 12:51:43 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) with Microsoft SMTP Server (TLS) id 14.1.270.2; Fri, 11 Feb 2011 12:51:43 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Fri, 11 Feb 2011 12:51:44 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Salvatore Loreto <salvatore.loreto@ericsson.com>, "hybi@ietf.org" <hybi@ietf.org>
Thread-Topic: [hybi] Clarify the role of closing handshake
Thread-Index: AQHLyLZQD4/LNEvRdUK4csWEI+DaLJP6cYsAgAABlOCAAI+qgIAAoGMAgABJG4CAASvVgP//sUJw
Date: Fri, 11 Feb 2011 20:51:41 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B4D1@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <OF1FBA64A7.FD3F6A29-ON88257833.0078A037-88257833.0081FBEE@playstation.sony.com> <4D5572C5.2000703@ericsson.com>
In-Reply-To: <4D5572C5.2000703@ericsson.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B4D1TK5EX14MBXW605w_"
MIME-Version: 1.0
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 20:51:29 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B4D1TK5EX14MBXW605w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

+1 on Takeshi's text

People seems agree, withing this thread, that at protocol level it is enoug=
h to go for the simplest scenario:

- Peer B assumes that no more data is coming from peer A when B receives cl=
osing
initiation from A.

please read the text suggested from Takeshi in
http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html
and check if it works for you


--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B4D1TK5EX14MBXW605w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV=3D"Content-Type" CONTENT=
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros=
oft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Consolas;
	panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";
	color:black;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML Preformatted Char";
	margin:0in;
	margin-bottom:.0001pt;
	font-size:10.0pt;
	font-family:"Courier New";
	color:black;}
tt
	{mso-style-priority:99;
	font-family:"Courier New";}
span.HTMLPreformattedChar
	{mso-style-name:"HTML Preformatted Char";
	mso-style-priority:99;
	mso-style-link:"HTML Preformatted";
	font-family:"Consolas","serif";
	color:black;}
span.EmailStyle20
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=3Dwhite lang=3DEN-US=
 link=3Dblue vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal>=
<span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1=
F497D'>+1 on Takeshi&#8217;s text<o:p></o:p></span></p><div style=3D'border=
:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><p class=3DMs=
oNormal><br>People seems agree, withing this thread, that at protocol level=
 it is enough to go for the simplest scenario:<br><br>- Peer B assumes that=
 no more data is coming from peer A when B receives closing <br>initiation =
from A.<br><br>please read the text suggested from Takeshi in <br><a href=
=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html">http:/=
/www.ietf.org/mail-archive/web/hybi/current/msg06285.html</a><br>and check =
if it works for you<o:p></o:p></p><p class=3DMsoNormal style=3D'margin-bott=
om:12.0pt'><o:p>&nbsp;</o:p></p></div></div></body></html>=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B4D1TK5EX14MBXW605w_--

From Yutaka_Takeda@PlayStation.Sony.Com  Fri Feb 11 12:52:10 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4ECA23A6878; Fri, 11 Feb 2011 12:52:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.114
X-Spam-Level: 
X-Spam-Status: No, score=-6.114 tagged_above=-999 required=5 tests=[AWL=0.150,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uiu+IrGl116r; Fri, 11 Feb 2011 12:52:08 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 905783A67B3; Fri, 11 Feb 2011 12:52:08 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021112521777-468464 ; Fri, 11 Feb 2011 12:52:17 -0800 
In-Reply-To: <4D5572C5.2000703@ericsson.com>
To: Salvatore Loreto <salvatore.loreto@ericsson.com>
MIME-Version: 1.0
X-KeepSent: AAD26076:80417033-88257834:006C2055; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Fri, 11 Feb 2011 12:54:13 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/11/2011 12:52:17 PM, Serialize complete at 02/11/2011 12:52:17 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/11/2011 12:52:17 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/11/2011 12:52:24 PM, Serialize complete at 02/11/2011 12:52:24 PM
Content-Type: multipart/alternative; boundary="=_alternative 0072D42C88257834_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 20:52:10 -0000

This is a multipart message in MIME format.
--=_alternative 0072D42C88257834_=
Content-Type: text/plain; charset="US-ASCII"

Hi,

> - Peer B assumes that no more data is coming from peer A when B 
> receives closing 
> initiation from A.

I agree - much simpler

As a side note, the other option (b) requires one extra state to wait 
for an acknowledgement upon sending Close frame. I was wondering who 
would be responsible for managing lifetime of the extra state, and 
yet it would be complicated.

Here is my comments to Takeshi's proposal in: 
http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html 

> 4.5.1.  Close
> 
> The Close message contains an opcode of 0x01.
> 
> The Close message contains a body that is a single byte in length. 
>  This byte carrys the reason for the close.  For normal close, the 
> body MUST be a 0x00. For abnormal close, the body MUST be a 0x01.
>  
> The websocket is considered fully closed when an endpoint has either
> sent or received a Close message, or when the underlying channel is 
closed.
> 
> The application MUST NOT send any more data messages after sent or 
> received a Close message.

Looks good.

> 
> 7.1.1.  Client-initiated closure
> 
> <I'm not sure how much it's useful to have client send 
> normal/abnormal. Server cannot retry by itself so, it's not the case
> Greg explained. But maybe we can just add it as well as server.>

I do not see the usefulness of the normal/abnormal at app level either.
But it may be helpful for counting such events to monitor for admin 
purposes or for trouble shooting.

> 
> 7.1.2.  Server-initiated closure
> 
> <No change on *abort WebSocket connection* during opening handshake>
> 
> Certain algorithms require or recommend that the server *abort2 
> the WebSocket connection* after WebSocket connection is established.
>  To do so, the server must send a Close message with a single byte 
> body 0x01 meaning abnormal closure and close the WebSocket connection.
> 
> <We need some verb to replace abort2>

I am ok this to be as is (besides 'abort2')

> 7.2.  Normal closure of connections
> 
> To *close the WebSocket connection*, the user agent MUST send 
> a Close control frame with a single byte body 0x00 meaning normal 
> closure, as described in Section 4.5.1.  Once an endpoint has sent 
> or received an Close control frame, that endpoint must close the TCP

As long as we cannot rule out the case where there may be incoming
data in the TCP buffer at the time of Close frame send, the endpoint
should not close socket right away, otherwise TCP-RST is sent to the 
peer, and the Close frame that has just sent may not reach the 
remote app. So, WebSocket layer needs to take care of this cleanup
sequence:

[App]          [WS-layer]     [TCP socket]
  |    close()     |               |<--- data
  +--------------->|  send(Close)  |<--- data
  |<- - - - - - - -|-------------->|----> FIN
  |                |  * recv()     |<--- data
  |                |till EOS(0 rtn)|
  |                |-------------->|
  |                |    close(|    |
  |                |-------------->x
  |                |

This is an implementation issue, but worth mentioning.

> ...  If the connection was closed after the client sent or received 
> normal close frame, then it's called _normal close_. If the 
> connection was closed after the client send or received abnormal 
> close frame, then it's called _abnormal close_. Otherwise, it's 
> called _underlying connection terminated_.
> 
> The user agent can distinguish protocol failure notified by abnormal
> close frame from disconnection caused by network or intermediary to 
> allow the application to determine if it should retry connection or not.

Sounds good.


Best.
--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060


hybi-bounces@ietf.org wrote on 02/11/2011 09:32:53 AM:

> The current -05 as is seems good to me. Now I think it would be good
> to have 1-byte body 
> 0x43 and 0x53, if it is important to know whether all data sent 
> successfully reached the peer. 
> I just do not know how import that is from application's perspective. 
> 
> Hi Yutaka
> 
> People seems agree that this can be handled at application level,
> (the fact that you also say that it is difficult to know how important 
that is
> from an application's prospective seem that you agree on that, but then
> the rest of your message confuse me, can you clarify what you would 
like?)
> 
> People seems agree, withing this thread, that at protocol level it 
> is enough to go for the simplest scenario:
> 
> - Peer B assumes that no more data is coming from peer A when B 
> receives closing 
> initiation from A.
> 
> please read the text suggested from Takeshi in 
> http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html
> and check if it works for you
> 
> cheers
> /Sal

> -- 
> Salvatore Loreto
> www.sloreto.com
> 
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 0072D42C88257834_=
Content-Type: text/html; charset="US-ASCII"


<br><tt><font size=2>Hi,</font></tt>
<br>
<br><tt><font size=2>&gt; - Peer B assumes that no more data is coming
from peer A when B <br>
&gt; receives closing <br>
&gt; initiation from A.<br>
</font></tt>
<br><tt><font size=2>I agree - much simpler</font></tt>
<br>
<br><tt><font size=2>As a side note, the other option (b) requires one
extra state to wait </font></tt>
<br><tt><font size=2>for an acknowledgement upon sending Close frame. I
was wondering who </font></tt>
<br><tt><font size=2>would be responsible for managing lifetime of the
extra state, and </font></tt>
<br><tt><font size=2>yet it would be complicated.</font></tt>
<br>
<br><font size=2 face="sans-serif">Here is my comments to Takeshi's proposal
in: </font>
<br><a href="http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html"><font size=3 color=blue><u>http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html</u></font></a><font size=3>
</font>
<br>
<br><tt><font size=2>&gt; 4.5.1. &nbsp;Close</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; The Close message contains an opcode of 0x01.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; The Close message contains a body that is a single byte in length.
<br>
&gt; &nbsp;This byte carrys the reason for the close. &nbsp;For normal
close, the <br>
&gt; body MUST be a 0x00. For abnormal close, the body MUST be a 0x01.</font></tt>
<br><tt><font size=2>&gt; &nbsp;</font></tt>
<br><tt><font size=2>&gt; The websocket is considered fully closed when
an endpoint has either<br>
&gt; sent or received a Close message, or when the underlying channel is
closed.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; The application MUST NOT send any more data messages after sent or
<br>
&gt; received a&nbsp;Close message.</font></tt>
<br>
<br><tt><font size=2>Looks good.</font></tt>
<br>
<br><tt><font size=2>&gt; <br>
&gt; 7.1.1. &nbsp;Client-initiated closure</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; &lt;I'm not sure how much it's useful to have client send <br>
&gt; normal/abnormal. Server cannot retry by itself so, it's not the case<br>
&gt; Greg explained. But maybe we can just add it as well as server.&gt;</font></tt>
<br>
<br><tt><font size=2>I do not see the usefulness of the normal/abnormal
at app level either.</font></tt>
<br><tt><font size=2>But it may be helpful for counting such events to
monitor for admin </font></tt>
<br><tt><font size=2>purposes or for trouble shooting.</font></tt>
<br>
<br><tt><font size=2>&gt; <br>
&gt; 7.1.2. &nbsp;Server-initiated closure</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; &lt;No change on *abort WebSocket connection* during opening handshake&gt;</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Certain algorithms require or recommend that the server *abort2 <br>
&gt; the&nbsp;WebSocket connection* after WebSocket connection is established.<br>
&gt; &nbsp;To do so, the&nbsp;server must send a Close message with a single
byte <br>
&gt; body 0x01 meaning&nbsp;abnormal closure and close the WebSocket connection.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; &lt;We need some verb to replace abort2&gt;</font></tt>
<br>
<br><tt><font size=2>I am ok this to be as is (besides 'abort2')</font></tt>
<br>
<br><tt><font size=2>&gt; 7.2. &nbsp;Normal closure of connections</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; To *close the WebSocket connection*, the user agent MUST send <br>
&gt; a&nbsp;Close control frame with a single byte body 0x00 meaning normal
<br>
&gt; closure, as described in Section 4.5.1. &nbsp;Once an endpoint has
sent <br>
&gt; or received an Close control frame, that endpoint must close the TCP</font></tt>
<br>
<br><tt><font size=2>As long as we cannot rule out the case where there
may be incoming</font></tt>
<br><tt><font size=2>data in the TCP buffer at the time of Close frame
send, the endpoint</font></tt>
<br><tt><font size=2>should not close socket right away, otherwise TCP-RST
is sent to the </font></tt>
<br><tt><font size=2>peer, and the Close frame that has just sent may not
reach the </font></tt>
<br><tt><font size=2>remote app. So, WebSocket layer needs to take care
of this cleanup</font></tt>
<br><tt><font size=2>sequence:</font></tt>
<br>
<br><tt><font size=2>[App] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;[WS-layer]
&nbsp; &nbsp; [TCP socket]</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp;close() &nbsp; &nbsp; | &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&lt;--- data</font></tt>
<br><tt><font size=2>&nbsp; +---------------&gt;| &nbsp;send(Close) &nbsp;|&lt;---
data</font></tt>
<br><tt><font size=2>&nbsp; |&lt;- - - - - - - -|--------------&gt;|----&gt;
FIN</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp;| &nbsp;* recv() &nbsp; &nbsp; |&lt;--- data</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp;|till EOS(0 rtn)|</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp;|--------------&gt;|</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp;| &nbsp; &nbsp;close(| &nbsp; &nbsp;|</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp;|--------------&gt;x</font></tt>
<br><tt><font size=2>&nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp;|</font></tt>
<br>
<br><tt><font size=2>This is an implementation issue, but worth mentioning.</font></tt>
<br>
<br><tt><font size=2>&gt; ...&nbsp;&nbsp;If the connection was closed after
the client sent or received <br>
&gt; normal&nbsp;close frame, then it's called _normal close_. If the <br>
&gt; connection was closed after the client send or received abnormal <br>
&gt; close frame, then it's called _abnormal close_. Otherwise, it's <br>
&gt; called _underlying connection terminated_.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; The user agent can distinguish protocol failure notified by abnormal<br>
&gt; close frame from disconnection caused by&nbsp;network or intermediary
to <br>
&gt; allow the application to determine if it should retry connection or
not.</font></tt>
<br>
<br><tt><font size=2>Sounds good.</font></tt>
<br>
<br>
<br><font size=2 face="sans-serif">Best.</font>
<br><font size=2 face="sans-serif">--<br>
Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
</font>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/11/2011 09:32:53
AM:<br>
<br>
&gt; The current -05 as is seems good to me. Now I think it would be good<br>
&gt; to have 1-byte body <br>
&gt; 0x43 and 0x53, if it is important to know whether all data sent <br>
&gt; successfully reached the peer. <br>
&gt; I just do not know how import that is from application's perspective.
</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Hi Yutaka<br>
&gt; <br>
&gt; People seems agree that this can be handled at application level,<br>
&gt; (the fact that you also say that it is difficult to know how important
that is<br>
&gt; from an application's prospective seem that you agree on that, but
then<br>
&gt; the rest of your message confuse me, can you clarify what you would
like?)<br>
&gt; <br>
&gt; People seems agree, withing this thread, that at protocol level it
<br>
&gt; is enough to go for the simplest scenario:<br>
&gt; <br>
&gt; - Peer B assumes that no more data is coming from peer A when B <br>
&gt; receives closing <br>
&gt; initiation from A.<br>
&gt; <br>
&gt; please read the text suggested from Takeshi in <br>
&gt; http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html<br>
&gt; and check if it works for you<br>
&gt; <br>
&gt; cheers<br>
&gt; /Sal<br>
</font></tt>
<br><tt><font size=2>&gt; -- <br>
&gt; Salvatore Loreto<br>
&gt; www.sloreto.com</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 0072D42C88257834_=--

From Gabriel.Montenegro@microsoft.com  Fri Feb 11 13:08:24 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 12D513A6A57 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 13:08:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.304
X-Spam-Level: 
X-Spam-Status: No, score=-10.304 tagged_above=-999 required=5 tests=[AWL=0.142, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8, SARE_SUB_ENC_UTF8=0.152]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NcQkiDA5yLRl for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 13:08:23 -0800 (PST)
Received: from smtp.microsoft.com (smtp.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id 2C4F43A69DA for <hybi@ietf.org>; Fri, 11 Feb 2011 13:08:23 -0800 (PST)
Received: from TK5EX14HUBC103.redmond.corp.microsoft.com (157.54.86.9) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Fri, 11 Feb 2011 13:08:38 -0800
Received: from TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com (157.54.71.39) by TK5EX14HUBC103.redmond.corp.microsoft.com (157.54.86.9) with Microsoft SMTP Server (TLS) id 14.1.270.2; Fri, 11 Feb 2011 13:08:38 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.39]) with mapi; Fri, 11 Feb 2011 13:08:38 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: John Tamplin <jat@google.com>
Thread-Topic: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
Thread-Index: AQHLyWE7P869ZWLkN0mQKtPc6q7qDZP8yIrA
Date: Fri, 11 Feb 2011 21:08:37 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EB@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org> <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTinsXn=re_Ksr_wQdz4pyW2iXtUzBRz+nPYJtD-z@mail.gmail.com>
In-Reply-To: <AANLkTinsXn=re_Ksr_wQdz4pyW2iXtUzBRz+nPYJtD-z@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EBTK5EX14MBXW605w_"
MIME-Version: 1.0
Cc: "hybi@ietf.org" <hybi@ietf.org>, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 21:08:24 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EBTK5EX14MBXW605w_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

Sm9obiBzYWlkOg0K4oCcSWYgeW91IG1lYW4gdGhhdCB5b3Ugd291bGQgc3dhcCBvdXQgYSBkaWZm
ZXJlbnQgc3RhdGUgbWFjaGluZSBmb3IgYmluYXJ5LW9ubHkgY29ubmVjdGlvbnMsIHRoZW4gd2h5
IGlzIGl0IG5vdCBzdWZmaWNpZW50IHRvIGNob29zZSB0aGF0IHN0YXRlIG1hY2hpbmUgYmFzZWQg
b24gdGhlIG9wY29kZSBvZiB0aGUgZmlyc3QgZnJhbWU/IOKAnA0KDQpJIHJlYWxpemUgbm93IHRo
YXQgdGhpcyB3b3Jrcy4gSSB3YXMgY29uZnVzZWQgYWJvdXQgdGhlIHNjZW5hcmlvIGluIHdoaWNo
IG9uZSB3b3VsZCBzZW5kIGEgbWVzc2FnZSBjb21wcmlzaW5nIG11bHRpcGxlIGZyYWdtZW50cy4g
SSB3YXMgdW5kZXIgdGhlIGltcHJlc3Npb24gdGhhdCB0aGlzIHdvdWxkIGFsbG93IG1peGluZyB0
ZXh0IGFuZCBiaW5hcnkgZnJhZ21lbnRzLiBUaGlzIGRpc2N1c3Npb24gYW5kIGFub3RoZXIgbG9v
ayBhdCA0LjQgaGFzIG5vdyBjbGFyaWZpZWQgdG8gbWUgdGhhdCB0aGlzIGlzIG5vdCB0aGUgY2Fz
ZS4gT25seSB0aGUgZmlyc3QgZnJhZ21lbnQgY2FuIHNwZWNpZnkgdGhlIHR5cGUgb2YgZWl0aGVy
IOKAnHRleHTigJ0gb3Ig4oCcYmluYXJ54oCdLiBBbGwgc3Vic2VxdWVudCBmcmFnbWVudHMgaW4g
dGhhdCBtZXNzYWdlIGNhbm5vdCBjaGFuZ2UgdGhlIHR5cGUgc2luY2UgdGhlIG9wY29kZeKAmXMg
b25seSB2YWxpZCB2YWx1ZSBpcyAweDAgKOKAnGNvbnRpbnVhdGlvbuKAnSksIHNvIG5laXRoZXIg
4oCcdGV4dOKAnSBub3Ig4oCcYmluYXJ54oCdIG5vciBhbnl0aGluZyBlbHNlIGlzIHBvc3NpYmxl
Lg0KDQpJIHdvdWxkIHN1Z2dlc3QgYWRkaW5nIHNvbWUgY2xhcmlmeWluZyB0ZXh0IGF0IHRoZSBl
bmQgb2YgNC40IHBvaW50aW5nIHRoaXMgb3V0IGFzIGZvbGxvd3M6DQoNCk9MRDoNCiAgIG8gIEFu
IGludGVybWVkaWFyeSBNQVkgY2hhbmdlIHRoZSBmcmFnbWVudGF0aW9uIG9mIGEgbWVzc2FnZSBp
ZiB0aGUNCiAgICAgIG1lc3NhZ2UgdXNlcyBvbmx5IG9wY29kZSBhbmQgcmVzZXJ2ZWQgYml0IHZh
bHVlcyBrbm93biB0byB0aGUNCiAgICAgIGludGVybWVkaWFyeS4NCg0KTkVXOg0KDQogICBvICBB
biBpbnRlcm1lZGlhcnkgTUFZIGNoYW5nZSB0aGUgZnJhZ21lbnRhdGlvbiBvZiBhIG1lc3NhZ2Ug
aWYgdGhlDQoNCiAgICAgIG1lc3NhZ2UgdXNlcyBvbmx5IG9wY29kZSBhbmQgcmVzZXJ2ZWQgYml0
IHZhbHVlcyBrbm93biB0byB0aGUNCg0KICAgICAgaW50ZXJtZWRpYXJ5Lg0KDQoNCg0KICAgQXMg
YSBjb25zZXF1ZW5jZSBvZiB0aGVzZSBydWxlcywgYWxsIGZyYWdtZW50cyBvZiBhIG1lc3NhZ2Ug
YXJlIG9mIHRoZSBzYW1lIHR5cGUsDQoNCiAgIGFzIHNldCBieSB0aGUgZmlyc3QgZnJhZ21lbnTi
gJlzIG9wY29kZS4gU2luY2UgQ29udHJvbCBmcmFtZXMgY2Fubm90IGJlIGZyYWdtZW50ZWQsDQoN
CiAgIHRoZSB0eXBlIGZvciBhbGwgZnJhZ21lbnRzIGluIGEgbWVzc2FnZSBNVVNUIGJlIGVpdGhl
ciB0ZXh0IG9yIGJpbmFyeS4NCg==

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EBTK5EX14MBXW605w_
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy
bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt
YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj
cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv
VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu
dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250ZW50
PSJNaWNyb3NvZnQgV29yZCAxNCAoZmlsdGVyZWQgbWVkaXVtKSI+PHN0eWxlPjwhLS0NCi8qIEZv
bnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Ik1TIE1pbmNobyI7
DQoJcGFub3NlLTE6MiAyIDYgOSA0IDIgNSA4IDMgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt
aWx5OiJNUyBNaW5jaG8iOw0KCXBhbm9zZS0xOjIgMiA2IDkgNCAyIDUgOCAzIDQ7fQ0KQGZvbnQt
ZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMg
MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxATVMgTWluY2hvIjsNCglwYW5vc2Ut
MToyIDIgNiA5IDQgMiA1IDggMyA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05v
cm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2lu
LWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVz
IE5ldyBSb21hbiIsInNlcmlmIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z
dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp
bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w
cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9
DQpwcmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFBy
ZWZvcm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN
Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5F
bWFpbFN0eWxlMTcNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p
bHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uSFRNTFBy
ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi
Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt
YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJbXNvLWZhcmVhc3QtbGFuZ3Vh
Z2U6WkgtVFc7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7
DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCgltc28tZmFyZWFzdC1sYW5n
dWFnZTpKQTt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFy
Z2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpX
b3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo
YXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRp
Zl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0
Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0Pjwv
eG1sPjwhW2VuZGlmXS0tPjwvaGVhZD48Ym9keSBsYW5nPUVOLVVTIGxpbms9Ymx1ZSB2bGluaz1w
dXJwbGU+PGRpdiBjbGFzcz1Xb3JkU2VjdGlvbjE+PHAgY2xhc3M9TXNvTm9ybWFsPkpvaG4gc2Fp
ZDo8bzpwPjwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+4oCcSWYgeW91IG1lYW4gdGhhdCB5
b3Ugd291bGQgc3dhcCBvdXQgYSBkaWZmZXJlbnQgc3RhdGUgbWFjaGluZSBmb3IgYmluYXJ5LW9u
bHkgY29ubmVjdGlvbnMsIHRoZW4gd2h5IGlzIGl0IG5vdCBzdWZmaWNpZW50IHRvIGNob29zZSB0
aGF0IHN0YXRlIG1hY2hpbmUgYmFzZWQgb24gdGhlIG9wY29kZSBvZiB0aGUgZmlyc3QgZnJhbWU/
Jm5ic3A74oCcPHNwYW4gc3R5bGU9J2NvbG9yOiMxRjQ5N0QnPjxvOnA+PC9vOnA+PC9zcGFuPjwv
cD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m
YW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjtjb2xvcjojMUY0OTdEJz48bzpwPiZuYnNwOzwv
bzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6
MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7Y29sb3I6IzFGNDk3RCc+
SSByZWFsaXplIG5vdyB0aGF0IHRoaXMgd29ya3MuIEkgd2FzIGNvbmZ1c2VkIGFib3V0IHRoZSBz
Y2VuYXJpbyBpbiB3aGljaCBvbmUgd291bGQgc2VuZCBhIG1lc3NhZ2UgY29tcHJpc2luZyBtdWx0
aXBsZSBmcmFnbWVudHMuIEkgd2FzIHVuZGVyIHRoZSBpbXByZXNzaW9uIHRoYXQgdGhpcyB3b3Vs
ZCBhbGxvdyBtaXhpbmcgdGV4dCBhbmQgYmluYXJ5IGZyYWdtZW50cy4gVGhpcyBkaXNjdXNzaW9u
IGFuZCBhbm90aGVyIGxvb2sgYXQgNC40IGhhcyBub3cgY2xhcmlmaWVkIHRvIG1lIHRoYXQgdGhp
cyBpcyBub3QgdGhlIGNhc2UuIE9ubHkgdGhlIGZpcnN0IGZyYWdtZW50IGNhbiBzcGVjaWZ5IHRo
ZSB0eXBlIG9mIGVpdGhlciDigJx0ZXh04oCdIG9yIOKAnGJpbmFyeeKAnS4gQWxsIHN1YnNlcXVl
bnQgZnJhZ21lbnRzIGluIHRoYXQgbWVzc2FnZSBjYW5ub3QgY2hhbmdlIHRoZSB0eXBlIHNpbmNl
IHRoZSBvcGNvZGXigJlzIG9ubHkgdmFsaWQgdmFsdWUgaXMgMHgwICjigJxjb250aW51YXRpb27i
gJ0pLCBzbyBuZWl0aGVyIOKAnHRleHTigJ0gbm9yIOKAnGJpbmFyeeKAnSBub3IgYW55dGhpbmcg
ZWxzZSBpcyBwb3NzaWJsZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFs
PjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fu
cy1zZXJpZiI7Y29sb3I6IzFGNDk3RCc+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjxwIGNs
YXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToi
Q2FsaWJyaSIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRjQ5N0QnPkkgd291bGQgc3VnZ2VzdCBhZGRp
bmcgc29tZSBjbGFyaWZ5aW5nIHRleHQgYXQgdGhlIGVuZCBvZiA0LjQgcG9pbnRpbmcgdGhpcyBv
dXQgYXMgZm9sbG93czo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxz
cGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1z
ZXJpZiI7Y29sb3I6IzFGNDk3RCc+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPjxwIGNsYXNz
PU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2Fs
aWJyaSIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRjQ5N0QnPk9MRDo8bzpwPjwvbzpwPjwvc3Bhbj48
L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMnPjxz
cGFuIGxhbmc9RU4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6IkNvdXJpZXIg
TmV3Iic+wqDCoCBvwqAgQW4gaW50ZXJtZWRpYXJ5IE1BWSBjaGFuZ2UgdGhlIGZyYWdtZW50YXRp
b24gb2YgYSBtZXNzYWdlIGlmIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29O
b3JtYWwgc3R5bGU9J3BhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyc+PHNwYW4gbGFuZz1FTiBzdHls
ZT0nZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseToiQ291cmllciBOZXciJz7CoMKgwqDCoMKg
IG1lc3NhZ2UgdXNlcyBvbmx5IG9wY29kZSBhbmQgcmVzZXJ2ZWQgYml0IHZhbHVlcyBrbm93biB0
byB0aGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsIHN0eWxlPSdwYWdl
LWJyZWFrLWJlZm9yZTphbHdheXMnPjxzcGFuIGxhbmc9RU4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4w
cHQ7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Iic+wqDCoMKgwqDCoCBpbnRlcm1lZGlhcnkuPG86
cD48L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1z
aXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRjQ5
N0QnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4g
c3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlm
Ijtjb2xvcjojMUY0OTdEJz5ORVc6PG86cD48L286cD48L3NwYW4+PC9wPjxwcmUgc3R5bGU9J3Bh
Z2UtYnJlYWstYmVmb3JlOmFsd2F5cyc+PHNwYW4gbGFuZz1FTiBzdHlsZT0nZm9udC1zaXplOjEw
LjBwdCc+wqDCoCBvwqAgQW4gaW50ZXJtZWRpYXJ5IE1BWSBjaGFuZ2UgdGhlIGZyYWdtZW50YXRp
b24gb2YgYSBtZXNzYWdlIGlmIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPjxwcmUgc3R5bGU9
J3BhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyc+PHNwYW4gbGFuZz1FTiBzdHlsZT0nZm9udC1zaXpl
OjEwLjBwdCc+wqDCoMKgwqDCoCBtZXNzYWdlIHVzZXMgb25seSBvcGNvZGUgYW5kIHJlc2VydmVk
IGJpdCB2YWx1ZXMga25vd24gdG8gdGhlPG86cD48L286cD48L3NwYW4+PC9wcmU+PHByZSBzdHls
ZT0ncGFnZS1icmVhay1iZWZvcmU6YWx3YXlzJz48c3BhbiBsYW5nPUVOIHN0eWxlPSdmb250LXNp
emU6MTAuMHB0Jz7CoMKgwqDCoMKgIGludGVybWVkaWFyeS48bzpwPjwvbzpwPjwvc3Bhbj48L3By
ZT48cHJlIHN0eWxlPSdwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMnPjxzcGFuIGxhbmc9RU4gc3R5
bGU9J2ZvbnQtc2l6ZToxMC4wcHQnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcHJlPjxwcmUg
c3R5bGU9J3BhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyc+PHNwYW4gbGFuZz1FTiBzdHlsZT0nZm9u
dC1zaXplOjEwLjBwdCc+wqDCoCBBcyBhIGNvbnNlcXVlbmNlIG9mIHRoZXNlIHJ1bGVzLCBhbGwg
ZnJhZ21lbnRzIG9mIGEgbWVzc2FnZSBhcmUgb2YgdGhlIHNhbWUgdHlwZSwgPG86cD48L286cD48
L3NwYW4+PC9wcmU+PHByZSBzdHlsZT0ncGFnZS1icmVhay1iZWZvcmU6YWx3YXlzJz48c3BhbiBs
YW5nPUVOIHN0eWxlPSdmb250LXNpemU6MTAuMHB0Jz7CoMKgwqBhcyBzZXQgYnkgdGhlIGZpcnN0
IGZyYWdtZW504oCZcyBvcGNvZGUuIFNpbmNlIENvbnRyb2wgZnJhbWVzIGNhbm5vdCBiZSBmcmFn
bWVudGVkLDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPjxwcmUgc3R5bGU9J3BhZ2UtYnJlYWstYmVm
b3JlOmFsd2F5cyc+PHNwYW4gbGFuZz1FTiBzdHlsZT0nZm9udC1zaXplOjEwLjBwdCc+wqDCoCB0
aGUgdHlwZSBmb3IgYWxsIGZyYWdtZW50cyBpbiBhIG1lc3NhZ2UgTVVTVCBiZSBlaXRoZXIgdGV4
dCBvciBiaW5hcnkuPG86cD48L286cD48L3NwYW4+PC9wcmU+PC9kaXY+PC9ib2R5PjwvaHRtbD4=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EBTK5EX14MBXW605w_--

From Yutaka_Takeda@PlayStation.Sony.Com  Fri Feb 11 13:12:42 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9FAE93A6B0D; Fri, 11 Feb 2011 13:12:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.985
X-Spam-Level: 
X-Spam-Status: No, score=-4.985 tagged_above=-999 required=5 tests=[AWL=-1.021, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, MANGLED_SAVELE=2.3, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s0pD0f3Xe5V7; Fri, 11 Feb 2011 13:12:41 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id EEDB53A6A57; Fri, 11 Feb 2011 13:12:40 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021113125146-469236 ; Fri, 11 Feb 2011 13:12:51 -0800 
In-Reply-To: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com>
To: Salvatore Loreto <salvatore.loreto@ericsson.com>
MIME-Version: 1.0
X-KeepSent: 4A78F456:78EA8086-88257834:00735B16; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Fri, 11 Feb 2011 13:15:01 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/11/2011 01:12:51 PM, Serialize complete at 02/11/2011 01:12:51 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/11/2011 01:12:51 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/11/2011 01:12:57 PM, Serialize complete at 02/11/2011 01:12:57 PM
Content-Type: multipart/alternative; boundary="=_alternative 0074BBCA88257834_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 21:12:42 -0000

This is a multipart message in MIME format.
--=_alternative 0074BBCA88257834_=
Content-Type: text/plain; charset="US-ASCII"

Let me correct some typo in the diagram:


[App]          [WS-layer]     [TCP socket] 
  |    close()     |               |
  +--------------->|  send(Close)  |<--- data 
  |<- - - - - - - -|-------------->|
  |                |  shutdown(WR) |<--- data 
  |                |-------------->| ----> FIN 
  |                |  * recv()     |<--- data 
  |                |till EOS(0 rtn)| 
  |                |-------------->| 
  |                |    close()    | <--- FIN 
  |                |-------------->x 
  |                |               : 


# It's not so simpler after all, is it? :)

This is what it takes to send 'data'(in this case 'Close frame'  to peer 
right before
closing TCP connection.

If this is too complicated, then don't bother sending 'Close' but just 
close TCP socket,
which would be the simplest. My preference is to do above cleanup 
properly.

Best.
--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060


hybi-bounces@ietf.org wrote on 02/11/2011 12:54:13 PM:

> 
> Hi, 
> 
> > - Peer B assumes that no more data is coming from peer A when B 
> > receives closing 
> > initiation from A.
> 
> I agree - much simpler 
> 
> As a side note, the other option (b) requires one extra state to wait 
> for an acknowledgement upon sending Close frame. I was wondering who 
> would be responsible for managing lifetime of the extra state, and 
> yet it would be complicated. 
> 
> Here is my comments to Takeshi's proposal in: 
> http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html 
> 
> > 4.5.1.  Close 
> > 
> > The Close message contains an opcode of 0x01. 
> > 
> > The Close message contains a body that is a single byte in length. 
> >  This byte carrys the reason for the close.  For normal close, the 
> > body MUST be a 0x00. For abnormal close, the body MUST be a 0x01. 
> > 
> > The websocket is considered fully closed when an endpoint has either
> > sent or received a Close message, or when the underlying channel is 
closed.
> > 
> > The application MUST NOT send any more data messages after sent or 
> > received a Close message. 
> 
> Looks good. 
> 
> > 
> > 7.1.1.  Client-initiated closure 
> > 
> > <I'm not sure how much it's useful to have client send 
> > normal/abnormal. Server cannot retry by itself so, it's not the case
> > Greg explained. But maybe we can just add it as well as server.> 
> 
> I do not see the usefulness of the normal/abnormal at app level either. 
> But it may be helpful for counting such events to monitor for admin 
> purposes or for trouble shooting. 
> 
> > 
> > 7.1.2.  Server-initiated closure 
> > 
> > <No change on *abort WebSocket connection* during opening handshake> 
> > 
> > Certain algorithms require or recommend that the server *abort2 
> > the WebSocket connection* after WebSocket connection is established.
> >  To do so, the server must send a Close message with a single byte 
> > body 0x01 meaning abnormal closure and close the WebSocket connection. 

> > 
> > <We need some verb to replace abort2> 
> 
> I am ok this to be as is (besides 'abort2') 
> 
> > 7.2.  Normal closure of connections 
> > 
> > To *close the WebSocket connection*, the user agent MUST send 
> > a Close control frame with a single byte body 0x00 meaning normal 
> > closure, as described in Section 4.5.1.  Once an endpoint has sent 
> > or received an Close control frame, that endpoint must close the TCP 
> 
> As long as we cannot rule out the case where there may be incoming 
> data in the TCP buffer at the time of Close frame send, the endpoint 
> should not close socket right away, otherwise TCP-RST is sent to the 
> peer, and the Close frame that has just sent may not reach the 
> remote app. So, WebSocket layer needs to take care of this cleanup 
> sequence: 
> 
> [App]          [WS-layer]     [TCP socket] 
>   |    close()     |               |<--- data 
>   +--------------->|  send(Close)  |<--- data 
>   |<- - - - - - - -|-------------->|----> FIN 
>   |                |  * recv()     |<--- data 
>   |                |till EOS(0 rtn)| 
>   |                |-------------->| 
>   |                |    close(|    | 
>   |                |-------------->x 
>   |                | 
> 
> This is an implementation issue, but worth mentioning. 
> 
> > ...  If the connection was closed after the client sent or received 
> > normal close frame, then it's called _normal close_. If the 
> > connection was closed after the client send or received abnormal 
> > close frame, then it's called _abnormal close_. Otherwise, it's 
> > called _underlying connection terminated_. 
> > 
> > The user agent can distinguish protocol failure notified by abnormal
> > close frame from disconnection caused by network or intermediary to 
> > allow the application to determine if it should retry connection or 
not. 
> 
> Sounds good. 
> 
> 
> Best. 
> --
> Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
> Office: 650 655 7484   Fax: 650 655 8060
> 
> 
> hybi-bounces@ietf.org wrote on 02/11/2011 09:32:53 AM:
> 
> > The current -05 as is seems good to me. Now I think it would be good
> > to have 1-byte body 
> > 0x43 and 0x53, if it is important to know whether all data sent 
> > successfully reached the peer. 
> > I just do not know how import that is from application's perspective. 
> > 
> > Hi Yutaka
> > 
> > People seems agree that this can be handled at application level,
> > (the fact that you also say that it is difficult to know how 
> important that is
> > from an application's prospective seem that you agree on that, but 
then
> > the rest of your message confuse me, can you clarify what you would 
like?)
> > 
> > People seems agree, withing this thread, that at protocol level it 
> > is enough to go for the simplest scenario:
> > 
> > - Peer B assumes that no more data is coming from peer A when B 
> > receives closing 
> > initiation from A.
> > 
> > please read the text suggested from Takeshi in 
> > http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html
> > and check if it works for you
> > 
> > cheers
> > /Sal
> 
> > -- 
> > Salvatore Loreto
> > www.sloreto.com 
> > 
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 0074BBCA88257834_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Let me correct some typo in the diagram:</font>
<br>
<br>
<br><tt><font size=2>[App] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;[WS-layer]
&nbsp; &nbsp; [TCP socket]</font></tt><font size=3> </font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp;close() &nbsp; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; |<br>
 &nbsp;+---------------&gt;| &nbsp;send(Close) &nbsp;|&lt;--- data</font></tt><font size=3>
</font><tt><font size=2><br>
 &nbsp;|&lt;- - - - - - - -|--------------&gt;|<br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;shutdown(WR)
|&lt;--- data</font></tt><font size=3> </font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|--------------&gt;</font></tt><font size=3>|
</font><tt><font size=2>----&gt; FIN</font></tt><font size=3> </font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;*
recv() &nbsp; &nbsp; |&lt;--- data</font></tt><font size=3> </font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|till EOS(0
rtn)|</font></tt><font size=3> </font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|--------------&gt;|</font></tt><font size=3>
</font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;
&nbsp;close() &nbsp; &nbsp;|</font></tt><font size=3> </font><tt><font size=2>&lt;---
FIN</font></tt><font size=3> </font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|--------------&gt;x</font></tt><font size=3>
</font><tt><font size=2><br>
 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp;</font></tt>
<br>
<br>
<br><font size=2 face="sans-serif"># It's not so simpler after all, is
it? :)</font>
<br>
<br><font size=2 face="sans-serif">This is what it takes to send 'data'(in
this case 'Close frame' &nbsp;to peer right before</font>
<br><font size=2 face="sans-serif">closing TCP connection.</font>
<br>
<br><font size=2 face="sans-serif">If this is too complicated, then don't
bother sending 'Close' but just close TCP socket,</font>
<br><font size=2 face="sans-serif">which would be the simplest. My preference
is to do above cleanup properly.</font>
<br>
<br><font size=2 face="sans-serif">Best.</font>
<br><font size=2 face="sans-serif">--<br>
Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
</font>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/11/2011 12:54:13
PM:<br>
<br>
&gt; <br>
&gt; Hi, <br>
&gt; <br>
&gt; &gt; - Peer B assumes that no more data is coming from peer A when
B <br>
&gt; &gt; receives closing <br>
&gt; &gt; initiation from A.<br>
&gt; <br>
&gt; I agree - much simpler <br>
&gt; <br>
&gt; As a side note, the other option (b) requires one extra state to wait
<br>
&gt; for an acknowledgement upon sending Close frame. I was wondering who
<br>
&gt; would be responsible for managing lifetime of the extra state, and
<br>
&gt; yet it would be complicated. <br>
&gt; <br>
&gt; Here is my comments to Takeshi's proposal in: <br>
&gt; http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html <br>
&gt; <br>
&gt; &gt; 4.5.1. &nbsp;Close <br>
&gt; &gt; <br>
&gt; &gt; The Close message contains an opcode of 0x01. <br>
&gt; &gt; <br>
&gt; &gt; The Close message contains a body that is a single byte in length.
<br>
&gt; &gt; &nbsp;This byte carrys the reason for the close. &nbsp;For normal
close, the <br>
&gt; &gt; body MUST be a 0x00. For abnormal close, the body MUST be a 0x01.
<br>
&gt; &gt; &nbsp; <br>
&gt; &gt; The websocket is considered fully closed when an endpoint has
either<br>
&gt; &gt; sent or received a Close message, or when the underlying channel
is closed.<br>
&gt; &gt; <br>
&gt; &gt; The application MUST NOT send any more data messages after sent
or <br>
&gt; &gt; received a Close message. <br>
&gt; <br>
&gt; Looks good. <br>
&gt; <br>
&gt; &gt; <br>
&gt; &gt; 7.1.1. &nbsp;Client-initiated closure <br>
&gt; &gt; <br>
&gt; &gt; &lt;I'm not sure how much it's useful to have client send <br>
&gt; &gt; normal/abnormal. Server cannot retry by itself so, it's not the
case<br>
&gt; &gt; Greg explained. But maybe we can just add it as well as server.&gt;
<br>
&gt; <br>
&gt; I do not see the usefulness of the normal/abnormal at app level either.
<br>
&gt; But it may be helpful for counting such events to monitor for admin
<br>
&gt; purposes or for trouble shooting. <br>
&gt; <br>
&gt; &gt; <br>
&gt; &gt; 7.1.2. &nbsp;Server-initiated closure <br>
&gt; &gt; <br>
&gt; &gt; &lt;No change on *abort WebSocket connection* during opening
handshake&gt; <br>
&gt; &gt; <br>
&gt; &gt; Certain algorithms require or recommend that the server *abort2
<br>
&gt; &gt; the WebSocket connection* after WebSocket connection is established.<br>
&gt; &gt; &nbsp;To do so, the server must send a Close message with a single
byte <br>
&gt; &gt; body 0x01 meaning abnormal closure and close the WebSocket connection.
<br>
&gt; &gt; <br>
&gt; &gt; &lt;We need some verb to replace abort2&gt; <br>
&gt; <br>
&gt; I am ok this to be as is (besides 'abort2') <br>
&gt; <br>
&gt; &gt; 7.2. &nbsp;Normal closure of connections <br>
&gt; &gt; <br>
&gt; &gt; To *close the WebSocket connection*, the user agent MUST send
<br>
&gt; &gt; a Close control frame with a single byte body 0x00 meaning normal
<br>
&gt; &gt; closure, as described in Section 4.5.1. &nbsp;Once an endpoint
has sent <br>
&gt; &gt; or received an Close control frame, that endpoint must close
the TCP <br>
&gt; <br>
&gt; As long as we cannot rule out the case where there may be incoming
<br>
&gt; data in the TCP buffer at the time of Close frame send, the endpoint
<br>
&gt; should not close socket right away, otherwise TCP-RST is sent to the
<br>
&gt; peer, and the Close frame that has just sent may not reach the <br>
&gt; remote app. So, WebSocket layer needs to take care of this cleanup
<br>
&gt; sequence: <br>
&gt; <br>
&gt; [App] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;[WS-layer] &nbsp; &nbsp; [TCP
socket] <br>
&gt; &nbsp; | &nbsp; &nbsp;close() &nbsp; &nbsp; | &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; |&lt;--- data <br>
&gt; &nbsp; +---------------&gt;| &nbsp;send(Close) &nbsp;|&lt;--- data
<br>
&gt; &nbsp; |&lt;- - - - - - - -|--------------&gt;|----&gt; FIN <br>
&gt; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
&nbsp;* recv() &nbsp; &nbsp; |&lt;--- data <br>
&gt; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|till
EOS(0 rtn)| <br>
&gt; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|--------------&gt;|
<br>
&gt; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
&nbsp; &nbsp;close(| &nbsp; &nbsp;| <br>
&gt; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|--------------&gt;x
<br>
&gt; &nbsp; | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
<br>
&gt; <br>
&gt; This is an implementation issue, but worth mentioning. <br>
&gt; <br>
&gt; &gt; ... &nbsp;If the connection was closed after the client sent
or received <br>
&gt; &gt; normal close frame, then it's called _normal close_. If the <br>
&gt; &gt; connection was closed after the client send or received abnormal
<br>
&gt; &gt; close frame, then it's called _abnormal close_. Otherwise, it's
<br>
&gt; &gt; called _underlying connection terminated_. <br>
&gt; &gt; <br>
&gt; &gt; The user agent can distinguish protocol failure notified by abnormal<br>
&gt; &gt; close frame from disconnection caused by network or intermediary
to <br>
&gt; &gt; allow the application to determine if it should retry connection
or not. <br>
&gt; <br>
&gt; Sounds good. <br>
&gt; <br>
&gt; <br>
&gt; Best. <br>
&gt; --<br>
&gt; Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
&gt; Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
&gt; <br>
&gt; <br>
&gt; hybi-bounces@ietf.org wrote on 02/11/2011 09:32:53 AM:<br>
&gt; <br>
&gt; &gt; The current -05 as is seems good to me. Now I think it would
be good<br>
&gt; &gt; to have 1-byte body <br>
&gt; &gt; 0x43 and 0x53, if it is important to know whether all data sent
<br>
&gt; &gt; successfully reached the peer. <br>
&gt; &gt; I just do not know how import that is from application's perspective.
<br>
&gt; &gt; <br>
&gt; &gt; Hi Yutaka<br>
&gt; &gt; <br>
&gt; &gt; People seems agree that this can be handled at application level,<br>
&gt; &gt; (the fact that you also say that it is difficult to know how
<br>
&gt; important that is<br>
&gt; &gt; from an application's prospective seem that you agree on that,
but then<br>
&gt; &gt; the rest of your message confuse me, can you clarify what you
would like?)<br>
&gt; &gt; <br>
&gt; &gt; People seems agree, withing this thread, that at protocol level
it <br>
&gt; &gt; is enough to go for the simplest scenario:<br>
&gt; &gt; <br>
&gt; &gt; - Peer B assumes that no more data is coming from peer A when
B <br>
&gt; &gt; receives closing <br>
&gt; &gt; initiation from A.<br>
&gt; &gt; <br>
&gt; &gt; please read the text suggested from Takeshi in <br>
&gt; &gt; http://www.ietf.org/mail-archive/web/hybi/current/msg06285.html<br>
&gt; &gt; and check if it works for you<br>
&gt; &gt; <br>
&gt; &gt; cheers<br>
&gt; &gt; /Sal<br>
&gt; <br>
&gt; &gt; -- <br>
&gt; &gt; Salvatore Loreto<br>
&gt; &gt; www.sloreto.com <br>
&gt; &gt; <br>
&gt; &gt; _______________________________________________<br>
&gt; &gt; hybi mailing list<br>
&gt; &gt; hybi@ietf.org<br>
&gt; &gt; https://www.ietf.org/mailman/listinfo/hybi<br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 0074BBCA88257834_=--

From jat@google.com  Fri Feb 11 13:49:12 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5EC123A6A04 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 13:49:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.8
X-Spam-Level: 
X-Spam-Status: No, score=-105.8 tagged_above=-999 required=5 tests=[AWL=0.024,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qqALYvnj66En for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 13:49:11 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 2B3F83A699F for <hybi@ietf.org>; Fri, 11 Feb 2011 13:49:11 -0800 (PST)
Received: from hpaq11.eem.corp.google.com (hpaq11.eem.corp.google.com [172.25.149.11]) by smtp-out.google.com with ESMTP id p1BLnQVH005848 for <hybi@ietf.org>; Fri, 11 Feb 2011 13:49:26 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297460966; bh=peolxe3vumQWNmfReVOd+wEKlOc=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=usN3zcK7+7iGI12JUuS6YPFtNWsZzAW/5wtM+oZ9oqKQaw2qAJ9wT/3otSPYgZXLJ xTqUJUiT9OXIiV6EaaZbA==
Received: from gyd12 (gyd12.prod.google.com [10.243.49.204]) by hpaq11.eem.corp.google.com with ESMTP id p1BLn1WQ029122 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 11 Feb 2011 13:49:25 -0800
Received: by gyd12 with SMTP id 12so1336504gyd.17 for <hybi@ietf.org>; Fri, 11 Feb 2011 13:49:24 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=Hdxo19PMt3EW6fiFz/5sMd9ZQswwVOUWYC48OClFrVI=; b=vrnVgyGVU+DiuF9W6TRrdSnaMK+d+N0VspM75W7g37IugCWk75gXWHEcc1etiFgHhX iBJgtpm4NkjuH6bhuMnw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=UgTd6JwJiKXpUELj5Falu3loxDceLFojSb0sqWTDRsZtOUUR9BIiDmUv7tb309Ag5w JrOlaQpJHoR34E8Ey9Ow==
Received: by 10.150.145.21 with SMTP id s21mr1102875ybd.434.1297460964382; Fri, 11 Feb 2011 13:49:24 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Fri, 11 Feb 2011 13:49:04 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EB@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org> <buc6l61vlv7fh3s8nmu335g3d7897pcf0r@hive.bjoern.hoehrmann.de> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0501B@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTinsXn=re_Ksr_wQdz4pyW2iXtUzBRz+nPYJtD-z@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E0B5EB@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
From: John Tamplin <jat@google.com>
Date: Fri, 11 Feb 2011 16:49:04 -0500
Message-ID: <AANLkTi==Re953Aj2Bwv-FVA15dnM8DXkbNWHJChYgCVn@mail.gmail.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: multipart/alternative; boundary=0015174bdbf2e45a4f049c08ab62
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] thewebsocketprotocol #40 (new): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 21:49:12 -0000

--0015174bdbf2e45a4f049c08ab62
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Feb 11, 2011 at 4:08 PM, Gabriel Montenegro <
Gabriel.Montenegro@microsoft.com> wrote:

> OLD:
>
>    o  An intermediary MAY change the fragmentation of a message if the
>
>       message uses only opcode and reserved bit values known to the
>
>       intermediary.
>
>
>
> NEW:
>
>    o  An intermediary MAY change the fragmentation of a message if the
>
>       message uses only opcode and reserved bit values known to the
>
>       intermediary.
>
>
>
>    As a consequence of these rules, all fragments of a message are of the=
 same type,
>
>    as set by the first fragment=E2=80=99s opcode. Since Control frames ca=
nnot be fragmented,
>
>    the type for all fragments in a message MUST be either text or binary.
>
>
I don't object to this, but I note the general problem of saying essentiall=
y
the same thing several places in the document in slightly different ways.
 If we aren't very careful, there will be slight differences and thus
ambiguity as to which one is correct.

--=20
John A. Tamplin
Software Engineer (GWT), Google

--0015174bdbf2e45a4f049c08ab62
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 11, 2011 at 4:08 PM, Gabriel Montene=
gro <span dir=3D"ltr">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.co=
m">Gabriel.Montenegro@microsoft.com</a>&gt;</span> wrote:<br><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p=
adding-left:1ex;">

<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple"><div><p class=3D"MsoNorm=
al"><span class=3D"Apple-style-span" style=3D"color: rgb(31, 73, 125); font=
-size: 15px; ">OLD:</span></p><p class=3D"MsoNormal"><span lang=3D"EN" styl=
e=3D"font-size:10.0pt;font-family:&quot;Courier New&quot;">=C2=A0=C2=A0 o=
=C2=A0 An intermediary MAY change the fragmentation of a message if the</sp=
an></p>

<p class=3D"MsoNormal"><span lang=3D"EN" style=3D"font-size:10.0pt;font-fam=
ily:&quot;Courier New&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 message uses on=
ly opcode and reserved bit values known to the</span></p><p class=3D"MsoNor=
mal"><span lang=3D"EN" style=3D"font-size:10.0pt;font-family:&quot;Courier =
New&quot;">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 intermediary.</span></p>

<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">=C2=
=A0</span></p><p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:=
#1F497D">NEW:</span></p><pre><span lang=3D"EN" style=3D"font-size:10.0pt">=
=C2=A0=C2=A0 o=C2=A0 An intermediary MAY change the fragmentation of a mess=
age if the</span></pre>

<pre><span lang=3D"EN" style=3D"font-size:10.0pt">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 message uses only opcode and reserved bit values known to the</span>=
</pre><pre><span lang=3D"EN" style=3D"font-size:10.0pt">=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 intermediary.</span></pre><pre><span lang=3D"EN" style=3D"font=
-size:10.0pt">=C2=A0</span></pre>

<pre><span lang=3D"EN" style=3D"font-size:10.0pt">=C2=A0=C2=A0 As a consequ=
ence of these rules, all fragments of a message are of the same type, </spa=
n></pre><pre><span lang=3D"EN" style=3D"font-size:10.0pt">=C2=A0=C2=A0=C2=
=A0as set by the first fragment=E2=80=99s opcode. Since Control frames cann=
ot be fragmented,</span></pre>

<pre><span lang=3D"EN" style=3D"font-size:10.0pt">=C2=A0=C2=A0 the type for=
 all fragments in a message MUST be either text or binary.</span></pre></di=
v></div></blockquote></div><br>I don&#39;t object to this, but I note the g=
eneral problem of saying essentially the same thing several places in the d=
ocument in slightly different ways. =C2=A0If we aren&#39;t very careful, th=
ere will be slight differences and thus ambiguity as to which one is correc=
t.<br clear=3D"all">

<br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--0015174bdbf2e45a4f049c08ab62--

From Yutaka_Takeda@PlayStation.Sony.Com  Fri Feb 11 15:22:42 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CA9D3A69EA; Fri, 11 Feb 2011 15:22:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.008
X-Spam-Level: 
X-Spam-Status: No, score=-6.008 tagged_above=-999 required=5 tests=[AWL=0.256,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oO7MAp7RL0f8; Fri, 11 Feb 2011 15:22:40 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 892333A6838; Fri, 11 Feb 2011 15:22:40 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021115224888-474291 ; Fri, 11 Feb 2011 15:22:48 -0800 
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E085B9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
MIME-Version: 1.0
X-KeepSent: E5DF3EED:178115CB-88257834:007C1420; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFE5DF3EED.178115CB-ON88257834.007C1420-88257834.0080BA73@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Fri, 11 Feb 2011 15:26:02 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/11/2011 03:22:48 PM, Serialize complete at 02/11/2011 03:22:48 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/11/2011 03:22:48 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/11/2011 03:22:57 PM, Serialize complete at 02/11/2011 03:22:57 PM
Content-Type: multipart/alternative; boundary="=_alternative 0080BA7188257834_="
Cc: hybi-bounces@ietf.org, "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Feb 2011 23:22:42 -0000

This is a multipart message in MIME format.
--=_alternative 0080BA7188257834_=
Content-Type: text/plain; charset="US-ASCII"

> This is not aligned with the WG consensus for HTTP compatibility (up
> until the websocket handshake is complete) declared some time back 
> by the chairs.
> The websocket handshake is not complete until a 101 comes back. So 
> anything before than (including other response codes, 
> reauthentication, etc) are not anything the websockets draft can say
> anything about. It's just compatible HTTP as usual.

Ah, I see. So, HTTP transaction can be iterated until 101 comes in.
I may have over-reacted to the text:

> In Section 1.3: 
> "Any status code other than 101 must be treated as a failure and the 
websocket connection aborted." 

I agree, this needs to be fixed. In fact, any status code other than 101 
MUST be handled
in a way that conforms with HTTP. (which is out of scope of this 
document).

Does any have any thoughts on my other concern?

> o Relatively more complexi in adding WebSocket to the existing 
implemtation of HTTP server. 
>   Reasons: 
>    - Existing HTTP implementation is likely designed to treat 101 as a 
indefinitive 
>      acceptance of the request wihere it tries to prepare for the final 
response... 
>    - Where, on receipt of a final response, such as 200 OK, the 
likelihood of exisiting implementaion 
>      would prepare for releasing HTTP protocol specific resources in 
memory to terminate 
>      the transaction. 
>   
>    ## This impact on adoption of WebSocket procol by existing HTTP 
servers. 
>    ## It is desired a loose coupling with HTTP specific function - easy 
to add WebSocket to existing system (e.g. Apache) 

Say, we try to implement WebSocket in Apache, or via Apache module. Since 
actual WebSocket
connection resides in the middle of the HTTP GET transaction, the process 
or thread that is
processing the transaction has taken up its sufficiently large resources 
for handling any type of
HTTP transaction, and most of which will no longer be necessary once the 
WS handshake is 
complete. Consequently, such implementation in Apache will be very 
expensive and probably
not practical for large scale deployment.

If we could complete the WS handshake in a complete HTTP transaction 
(successful 
handshake completes on receipt of 200 OK, for example), then this will 
have a completely
different view. Coming back to the example with Apache, the resources for 
the transaction
(process/thread/mempool/context, etc.) can be released completely. What 
needs to done
is in its socket management code be modified to leave the socket (at this 
point being 
'websocket' open and transfer it to an internal or external facility that 
can efficiently handle
persistent/bidirectional communication.

More specifically, the Connection header is about what to do with the 
underlying connection
*after* the current transaction is complete. So, we only needed to define 
a new value to
the Connection header like:

    Connection: websocket

(# of course, 'Sec-Websocket-xxx' headers are still necessary, 'Upgrade: 
websocket' can be eliminated.)

This can be reported to the socket management layer to tell, "the socket 
is going to be used
as WebSocket". (don't close and don't use it for subsequent HTTP 
transactions.)
Please notice that, there's no HTTP layer involved at this point!

This is clearly MUCH less work than tackling situation where transaction 
is left open upon 
101 response, and yet MUCH cleaner solution for introducing WebSocket 
feature into
existing HTTP servers.


Any thoughs?

--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060


hybi-bounces@ietf.org wrote on 02/10/2011 05:57:51 PM:

> This is not aligned with the WG consensus for HTTP compatibility (up
> until the websocket handshake is complete) declared some time back 
> by the chairs.
> The websocket handshake is not complete until a 101 comes back. So 
> anything before than (including other response codes, 
> reauthentication, etc) are not anything the websockets draft can say
> anything about. It's just compatible HTTP as usual.
> 
> So this is a bug in the spec, hopefully to get taken care of in 06.
> 
> > -----Original Message-----
> > From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf 
Of
> > Greg Wilkins
> > Sent: 10 February, 2011 17:49
> > To: Yutaka_Takeda@playstation.sony.com
> > Cc: hybi@ietf.org
> > Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
> > 
> > On 11 February 2011 12:40,  <Yutaka_Takeda@playstation.sony.com> 
wrote:
> > >
> > > o  Cannot get full benefit out of HTTP protocol during the handshake
> > > as it does not expect a final response:
> > >   For example:
> > >    - Can not redirect WebSocket handshake to another server (for 
load
> > > balancing, fail-over, etc.)
> > >    - Can not perform user authentication (Basic, Digest, etc.) 
during
> > > the handshake.
> > >    - Similarly, 407 authentication cannot be forced by the server.
> > 
> > +1
> > 
> > In the ancient history of this list, I have long argued for exactly 
this.
> > 
> > Apparently there are some security concerns about browser redirection, 
which
> > I never really understood... and even if there are, I don't see 
> the reason that the
> > protocol should deny the use of non 101 handshake responses to all
> clients.  I
> > think the protocol should allow arbitrary response codes (because it 
can't
> > actually prevent them being sent by non WS servers anyway), and then
> > individual clients can decide which responses they will handle (which 
may be
> > better discuss in the appropriate HTML 5 forums regarding the specific
> > websocket API).
> > 
> > cheers
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
> 
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 0080BA7188257834_=
Content-Type: text/html; charset="US-ASCII"


<br><tt><font size=2>&gt; This is not aligned with the WG consensus for
HTTP compatibility (up<br>
&gt; until the websocket handshake is complete) declared some time back
<br>
&gt; by the chairs.<br>
&gt; The websocket handshake is not complete until a 101 comes back. So
<br>
&gt; anything before than (including other response codes, <br>
&gt; reauthentication, etc) are not anything the websockets draft can say<br>
&gt; anything about. It's just compatible HTTP as usual.<br>
</font></tt>
<br><tt><font size=2>Ah, I see. So, HTTP transaction can be iterated until
101 comes in.</font></tt>
<br><tt><font size=2>I may have over-reacted to the text:</font></tt>
<br>
<br><font size=2 face="sans-serif">&gt; In Section 1.3:</font><font size=3>
</font><font size=2 face="sans-serif"><i><br>
&gt; &quot;Any status code other than 101 must be treated as a failure
and the websocket connection aborted.</i>&quot;</font><font size=3> <br>
</font>
<br><font size=3>I agree, this needs to be fixed. In fact, any status code
other than 101 MUST be handled</font>
<br><font size=3>in a way that conforms with HTTP. (which is out of scope
of this document).</font>
<br>
<br><font size=3>Does any have any thoughts on my other concern?</font>
<br>
<br><font size=2 color=blue face="sans-serif">&gt; o Relatively more complexi
in adding WebSocket to the existing implemtation of HTTP server.</font><font size=3 color=blue>
</font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; Reasons:</font><font size=3 color=blue> </font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; &nbsp;- Existing HTTP implementation is likely designed to
treat 101 as a indefinitive <br>
&gt; &nbsp; &nbsp; &nbsp;acceptance of the request wihere it tries to prepare
for the final response...</font><font size=3 color=blue> </font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; &nbsp;- Where, on receipt of a final response, such as 200
OK, the likelihood of exisiting implementaion</font><font size=3 color=blue>
</font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; &nbsp; &nbsp;would prepare for releasing HTTP protocol specific
resources in memory to terminate</font><font size=3 color=blue> </font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; &nbsp; &nbsp;the transaction.</font><font size=3 color=blue>
</font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp;</font><font size=3 color=blue> </font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; &nbsp;## This impact on adoption of WebSocket procol by existing
HTTP servers.</font><font size=3 color=blue> </font><font size=2 color=blue face="sans-serif"><br>
&gt; &nbsp; &nbsp;## It is desired a loose coupling with HTTP specific
function - easy to add WebSocket to existing system (e.g. Apache)</font><font size=3 color=blue>
</font><font size=3><br>
</font>
<br><font size=3>Say, we try to implement WebSocket in Apache, or via Apache
module. Since actual WebSocket</font>
<br><font size=3>connection resides in the middle of the HTTP GET transaction,
the process or thread that is</font>
<br><font size=3>processing the transaction has taken up its sufficiently
large resources for handling any type of</font>
<br><font size=3>HTTP transaction, and most of which will no longer be
necessary once the WS handshake is </font>
<br><font size=3>complete. Consequently, such implementation in Apache
will be very expensive and probably</font>
<br><font size=3>not practical for large scale deployment.</font>
<br>
<br><font size=3>If we could complete the WS handshake in a complete HTTP
transaction (successful </font>
<br><font size=3>handshake completes on receipt of 200 OK, for example),
then this will have a completely</font>
<br><font size=3>different view. Coming back to the example with Apache,
the resources for the transaction</font>
<br><font size=3>(process/thread/mempool/context, etc.) can be released
completely. What needs to done</font>
<br><font size=3>is in its socket management code be modified to leave
the socket (at this point being </font>
<br><font size=3>'websocket' open and transfer it to an internal or external
facility that can efficiently handle</font>
<br><font size=3>persistent/bidirectional communication.</font>
<br>
<br><font size=3>More specifically, the Connection header is about what
to do with the underlying connection</font>
<br><font size=3>*after* the current transaction is complete. So, we only
needed to define a new value to</font>
<br><font size=3>the Connection header like:</font>
<br>
<br><font size=3>&nbsp; &nbsp; Connection: websocket</font>
<br>
<br><font size=3>(# of course, 'Sec-Websocket-xxx' headers are still necessary,
'Upgrade: websocket' can be eliminated.)</font>
<br>
<br><font size=3>This can be reported to the socket management layer to
tell, &quot;the socket is going to be used</font>
<br><font size=3>as WebSocket&quot;. (don't close and don't use it for
subsequent HTTP transactions.)</font>
<br><font size=3>Please notice that, there's no HTTP layer involved at
this point!</font>
<br>
<br><font size=3>This is clearly MUCH less work than tackling situation
where transaction is left open upon </font>
<br><font size=3>101 response, and yet MUCH cleaner solution for introducing
WebSocket feature into</font>
<br><font size=3>existing HTTP servers.</font>
<br>
<br>
<br><font size=3>Any thoughs?</font>
<br>
<br><font size=2 face="sans-serif">--<br>
Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
</font>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/10/2011 05:57:51
PM:<br>
<br>
&gt; This is not aligned with the WG consensus for HTTP compatibility (up<br>
&gt; until the websocket handshake is complete) declared some time back
<br>
&gt; by the chairs.<br>
&gt; The websocket handshake is not complete until a 101 comes back. So
<br>
&gt; anything before than (including other response codes, <br>
&gt; reauthentication, etc) are not anything the websockets draft can say<br>
&gt; anything about. It's just compatible HTTP as usual.<br>
&gt; <br>
&gt; So this is a bug in the spec, hopefully to get taken care of in 06.<br>
&gt; <br>
&gt; &gt; -----Original Message-----<br>
&gt; &gt; From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On
Behalf Of<br>
&gt; &gt; Greg Wilkins<br>
&gt; &gt; Sent: 10 February, 2011 17:49<br>
&gt; &gt; To: Yutaka_Takeda@playstation.sony.com<br>
&gt; &gt; Cc: hybi@ietf.org<br>
&gt; &gt; Subject: Re: [hybi] Final HTTP responses and WebSocket handshake<br>
&gt; &gt; <br>
&gt; &gt; On 11 February 2011 12:40, &nbsp;&lt;Yutaka_Takeda@playstation.sony.com&gt;
wrote:<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; o &nbsp;Cannot get full benefit out of HTTP protocol during
the handshake<br>
&gt; &gt; &gt; as it does not expect a final response:<br>
&gt; &gt; &gt; &nbsp; For example:<br>
&gt; &gt; &gt; &nbsp; &nbsp;- Can not redirect WebSocket handshake to another
server (for load<br>
&gt; &gt; &gt; balancing, fail-over, etc.)<br>
&gt; &gt; &gt; &nbsp; &nbsp;- Can not perform user authentication (Basic,
Digest, etc.) during<br>
&gt; &gt; &gt; the handshake.<br>
&gt; &gt; &gt; &nbsp; &nbsp;- Similarly, 407 authentication cannot be forced
by the server.<br>
&gt; &gt; <br>
&gt; &gt; +1<br>
&gt; &gt; <br>
&gt; &gt; In the ancient history of this list, I have long argued for exactly
this.<br>
&gt; &gt; <br>
&gt; &gt; Apparently there are some security concerns about browser redirection,
which<br>
&gt; &gt; I never really understood... and even if there are, I don't see
<br>
&gt; the reason that the<br>
&gt; &gt; protocol should deny the use of non 101 handshake responses to
all<br>
&gt; clients. &nbsp;I<br>
&gt; &gt; think the protocol should allow arbitrary response codes (because
it can't<br>
&gt; &gt; actually prevent them being sent by non WS servers anyway), and
then<br>
&gt; &gt; individual clients can decide which responses they will handle
(which may be<br>
&gt; &gt; better discuss in the appropriate HTML 5 forums regarding the
specific<br>
&gt; &gt; websocket API).<br>
&gt; &gt; <br>
&gt; &gt; cheers<br>
&gt; &gt; _______________________________________________<br>
&gt; &gt; hybi mailing list<br>
&gt; &gt; hybi@ietf.org<br>
&gt; &gt; https://www.ietf.org/mailman/listinfo/hybi<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 0080BA7188257834_=--

From tyoshino@google.com  Fri Feb 11 16:17:53 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6597C3A69D1 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 16:17:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.293
X-Spam-Level: 
X-Spam-Status: No, score=-105.293 tagged_above=-999 required=5 tests=[AWL=0.083, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_35=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2gURha3uNdvA for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 16:17:52 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id ADBB23A6A24 for <hybi@ietf.org>; Fri, 11 Feb 2011 16:17:51 -0800 (PST)
Received: from kpbe19.cbf.corp.google.com (kpbe19.cbf.corp.google.com [172.25.105.83]) by smtp-out.google.com with ESMTP id p1C0I695032764 for <hybi@ietf.org>; Fri, 11 Feb 2011 16:18:07 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297469887; bh=rAg/V+0jF0il7d9UUipZ32FYY5g=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=IQi7szgcoODXlu+i9z5/ERqH+utePD6sRPJHBVphpx3WUbM/SbaUHXgJ7e1qlykJb nK9MLmFjxLCJ1aKDBrtXg==
Received: from gxk8 (gxk8.prod.google.com [10.202.11.8]) by kpbe19.cbf.corp.google.com with ESMTP id p1C0I5xr015228 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 11 Feb 2011 16:18:05 -0800
Received: by gxk8 with SMTP id 8so1405997gxk.41 for <hybi@ietf.org>; Fri, 11 Feb 2011 16:18:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=DtgghnXGS7IyCQcLMtHcQdHAoIqNgaxNJZf7LAoEg3U=; b=TVvMr1euo4BgepMWyz80DyoLs811NRvZkR58/rGrvgXrRhfGEAfVkM4mfZUTTdELHp fz0f1GnYi7UxmsbBGLDA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=IUxSpB3bBBtxA3xsnQcu+C7lI68gy6iFOP84dYcX4vBIPxdemzBzsB8TzBoUkwlGyw O/BrG3vx/75YcSzftdqA==
Received: by 10.151.26.18 with SMTP id d18mr1357101ybj.48.1297469884921; Fri, 11 Feb 2011 16:18:04 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.91.16 with HTTP; Fri, 11 Feb 2011 16:17:44 -0800 (PST)
In-Reply-To: <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com>
References: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com> <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 11 Feb 2011 16:17:44 -0800
Message-ID: <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=000e0cd6a87898f871049c0abff6
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Feb 2011 00:17:53 -0000

--000e0cd6a87898f871049c0abff6
Content-Type: text/plain; charset=ISO-8859-1

Hi Yutaka,

Thank you for joining the discussion.

Good point. I know that close(2) with incoming data remaining unread in
kernel causes RST for example on Linux. It looks like this is very platform
dependent.

Let me confirm your claim. Here, you mean that RST coming after PSH(Close
frame octets) may cause trouble the receiver side in recv-ing Close frame
octets? In a bit different context but I see that Jamie is also saying so
in http://www.ietf.org/mail-archive/web/hybi/current/msg01044.html. On what
platform this really occurs for example? Just curious. Linux socket allows
us to recv data PSH-ed before RST, then ECONNRESET is returned, so I missed
this point.

If we still take the way to drop Close reply,
- Just as a hint for intermediaries to know the session is abandoned earlier
than transport layer phenomenon (as Gabriel first suggested), it's still
worth try to send out Close and let intermediaries see it, I think. We don't
have to make it sure that it's seen by intermediaries or delivered to the
other peer.
- If we decide to let a Close frame carry error code (as Greg and Brodie
suggest), yes, it may be problematic that Close frames are dropped even
though there's no network/intermediate problem.

Let's go through again what each case means,
- received abnormal Close frame means there was any protocol level problem
- received normal Close frame means the other peer is satisfied. this never
means data is delivered
- didn't receive Close means (?)
-- because of RST issue
-- because of network issue

We have to give (?) some semantics that's not confusing.
- (?) := "there was network layer error" : this statement is bad, confusing.
application that frequently exchanges data may suffer RST issue, and retry
though it's actually caused by their own traffic.
- (?) := "there was transport layer error" : still not so clear
- (?) := ... any suggestion?

On Fri, Feb 11, 2011 at 13:15, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> Let me correct some typo in the diagram:
>
>
> [App]          [WS-layer]     [TCP socket]
>
>  |    close()     |               |
>  +--------------->|  send(Close)  |<--- data
>  |<- - - - - - - -|-------------->|
>  |                |  shutdown(WR) |<--- data
>  |                |-------------->| ----> FIN
>  |                |  * recv()     |<--- data
>  |                |till EOS(0 rtn)|
>  |                |-------------->|
>  |                |    close()    | <--- FIN
>  |                |-------------->x
>  |                |               :
>
>
> # It's not so simpler after all, is it? :)
>
> This is what it takes to send 'data'(in this case 'Close frame'  to peer
> right before
> closing TCP connection.
>
> If this is too complicated, then don't bother sending 'Close' but just
> close TCP socket,
> which would be the simplest. My preference is to do above cleanup properly.
>
>
IIRC, there was discussion in designing -00 closing handshake that we should
avoid underlying transport layer's semantics in realizing WebSocket layer
event. To follow this philosophy, we could replace the last FIN with Close
frame. i.e. we again ask both sides send a Close frame so that both sides
can safely invoke close(2) after seeing Close frame.

...snip


> > As long as we cannot rule out the case where there may be incoming
> > data in the TCP buffer at the time of Close frame send, the endpoint
> > should not close socket right away, otherwise TCP-RST is sent to the
> > peer, and the Close frame that has just sent may not reach the
> > remote app. So, WebSocket layer needs to take care of this cleanup
> > sequence:
> >
> > [App]          [WS-layer]     [TCP socket]
> >   |    close()     |               |<--- data
> >   +--------------->|  send(Close)  |<--- data
> >   |<- - - - - - - -|-------------->|----> FIN
> >   |                |  * recv()     |<--- data
> >   |                |till EOS(0 rtn)|
> >   |                |-------------->|
> >   |                |    close(|    |
> >   |                |-------------->x
> >   |                |
> >
> > This is an implementation issue, but worth mentioning.
> >
>

...snip

--000e0cd6a87898f871049c0abff6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Yutaka,<div><br></div><div>Thank you for joining the discussion.</div><d=
iv><br></div><div><div>Good point.=A0I=A0know that close(2) with incoming d=
ata remaining unread in kernel causes RST for example on Linux. It looks li=
ke this is very platform dependent.</div>

<div><div><br></div><div>Let me confirm your claim. Here, you mean that RST=
 coming after PSH(Close frame octets) may cause trouble the receiver side i=
n recv-ing Close frame octets? In a bit different context but I see that Ja=
mie is also saying so in=A0<a href=3D"http://www.ietf.org/mail-archive/web/=
hybi/current/msg01044.html">http://www.ietf.org/mail-archive/web/hybi/curre=
nt/msg01044.html</a>. On what platform this really occurs for example? Just=
 curious.=A0Linux socket allows us to recv data PSH-ed before RST, then ECO=
NNRESET is returned, so I missed this point.</div>

</div><div><br></div><div>If we still take the way to drop Close reply,</di=
v><div>- Just as a hint for intermediaries to know the session is abandoned=
 earlier than transport layer phenomenon (as Gabriel first suggested), it&#=
39;s still worth try to send out Close and let intermediaries see it, I thi=
nk. We don&#39;t have to make it sure that it&#39;s seen by intermediaries =
or delivered to the other peer.</div>

<div>- If we decide to let a Close frame carry error code (as Greg and Brod=
ie suggest), yes, it may be problematic that Close frames are dropped even =
though there&#39;s no network/intermediate problem.</div><div><br></div>

<div>Let&#39;s go through again what each case means,</div><div>- received =
abnormal Close frame means there was any protocol level problem</div><div>-=
 received normal Close frame means the other peer is satisfied. this never =
means data is delivered</div>

<div>- didn&#39;t receive Close means (?)</div><div>-- because of RST issue=
</div><div>-- because of network issue</div><div><br></div><div>We have to =
give (?) some semantics that&#39;s not confusing.</div><div>- (?) :=3D &quo=
t;there was network layer error&quot; : this statement is bad, confusing. a=
pplication that frequently exchanges data may suffer RST issue, and retry t=
hough it&#39;s actually caused by their own traffic.</div>

<div>- (?) :=3D &quot;there was transport layer error&quot; : still not so =
clear</div><div>- (?) :=3D ... any suggestion?</div><div><br></div></div><d=
iv class=3D"gmail_quote">On Fri, Feb 11, 2011 at 13:15,  <span dir=3D"ltr">=
&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Takeda@pla=
ystation.sony.com</a>&gt;</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">
<br><font size=3D"2" face=3D"sans-serif">Let me correct some typo in the di=
agram:</font>
<br><div class=3D"im">
<br>
<br><tt><font size=3D"2">[App] =A0 =A0 =A0 =A0 =A0[WS-layer]
=A0 =A0 [TCP socket]</font></tt><font size=3D"3"> </font></div><tt><font si=
ze=3D"2"><br>
 =A0| =A0 =A0close() =A0 =A0 | =A0 =A0 =A0 =A0
=A0 =A0 =A0 |<br>
 =A0+---------------&gt;| =A0send(Close) =A0|&lt;--- data</font></tt><font =
size=3D"3">
</font><tt><font size=3D"2"><br>
 =A0|&lt;- - - - - - - -|--------------&gt;|<br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0| =A0shutdown(WR)
|&lt;--- data</font></tt><font size=3D"3"> </font><tt><font size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|--------------&gt;</font></tt><font s=
ize=3D"3">|
</font><tt><font size=3D"2">----&gt; FIN</font></tt><font size=3D"3"> </fon=
t><tt><font size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0| =A0*
recv() =A0 =A0 |&lt;--- data</font></tt><font size=3D"3"> </font><tt><font =
size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|till EOS(0
rtn)|</font></tt><font size=3D"3"> </font><tt><font size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|--------------&gt;|</font></tt><font =
size=3D"3">
</font><tt><font size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0| =A0
=A0close() =A0 =A0|</font></tt><font size=3D"3"> </font><tt><font size=3D"2=
">&lt;---
FIN</font></tt><font size=3D"3"> </font><tt><font size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|--------------&gt;x</font></tt><font =
size=3D"3">
</font><tt><font size=3D"2"><br>
 =A0| =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0| =A0
=A0 =A0 =A0 =A0 =A0 =A0 : =A0 =A0 =A0 =A0
=A0 =A0 =A0 =A0</font></tt>
<br>
<br>
<br><font size=3D"2" face=3D"sans-serif"># It&#39;s not so simpler after al=
l, is
it? :)</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">This is what it takes to send &#39=
;data&#39;(in
this case &#39;Close frame&#39; =A0to peer right before</font>
<br><font size=3D"2" face=3D"sans-serif">closing TCP connection.</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">If this is too complicated, then d=
on&#39;t
bother sending &#39;Close&#39; but just close TCP socket,</font>
<br><font size=3D"2" face=3D"sans-serif">which would be the simplest. My pr=
eference
is to do above cleanup properly.</font>
<br><div class=3D"im">
<font size=3D"2"><div><div class=3D"h5"><br></div></div></font></div></bloc=
kquote><div><br></div><div>IIRC, there was discussion in designing -00 clos=
ing handshake that we should avoid underlying transport layer&#39;s semanti=
cs in realizing WebSocket layer event. To follow this philosophy, we could =
replace the last FIN with Close frame. i.e. we again ask both sides send a =
Close frame so that both sides can safely invoke close(2) after seeing Clos=
e frame.</div>

<div><br></div><div>...snip</div><div>=A0</div><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;"><div class=3D"im"><font size=3D"2"><div><div class=3D"h5">
&gt; As long as we cannot rule out the case where there may be incoming
<br>
&gt; data in the TCP buffer at the time of Close frame send, the endpoint
<br>
&gt; should not close socket right away, otherwise TCP-RST is sent to the
<br>
&gt; peer, and the Close frame that has just sent may not reach the <br>
&gt; remote app. So, WebSocket layer needs to take care of this cleanup
<br>
&gt; sequence: <br>
&gt; <br>
&gt; [App] =A0 =A0 =A0 =A0 =A0[WS-layer] =A0 =A0 [TCP
socket] <br>
&gt; =A0 | =A0 =A0close() =A0 =A0 | =A0 =A0 =A0
=A0 =A0 =A0 =A0 |&lt;--- data <br>
&gt; =A0 +---------------&gt;| =A0send(Close) =A0|&lt;--- data
<br>
&gt; =A0 |&lt;- - - - - - - -|--------------&gt;|----&gt; FIN <br>
&gt; =A0 | =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|
=A0* recv() =A0 =A0 |&lt;--- data <br>
&gt; =A0 | =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|till
EOS(0 rtn)| <br>
&gt; =A0 | =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|--------------&gt;|
<br>
&gt; =A0 | =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|
=A0 =A0close(| =A0 =A0| <br>
&gt; =A0 | =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|--------------&gt;x
<br>
&gt; =A0 | =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0|
<br>
&gt; <br>
&gt; This is an implementation issue, but worth mentioning. <br>
&gt;=A0</div></div></font></div></blockquote><div>=A0</div><div>...snip</di=
v></div><br>

--000e0cd6a87898f871049c0abff6--

From john.fallows@kaazing.com  Fri Feb 11 16:59:27 2011
Return-Path: <john.fallows@kaazing.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 995673A6A57 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 16:59:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.976
X-Spam-Level: 
X-Spam-Status: No, score=-2.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dLh1Aj3NmDJG for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 16:59:26 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id 563C23A6A6A for <hybi@ietf.org>; Fri, 11 Feb 2011 16:59:26 -0800 (PST)
Received: by iym1 with SMTP id 1so3196730iym.31 for <hybi@ietf.org>; Fri, 11 Feb 2011 16:59:42 -0800 (PST)
MIME-Version: 1.0
Received: by 10.42.218.136 with SMTP id hq8mr1494036icb.379.1297472380637; Fri, 11 Feb 2011 16:59:40 -0800 (PST)
Received: by 10.42.179.202 with HTTP; Fri, 11 Feb 2011 16:59:40 -0800 (PST)
X-Originating-IP: [24.130.233.21]
In-Reply-To: <AANLkTi=rFieVgfMaBn+pqp_M1bLdf0+Bm0NCApL+Rpih@mail.gmail.com>
References: <OFDD4ABE05.D6C65821-ON88257833.00822B82-88257834.0009316B@playstation.sony.com> <AANLkTi=rFieVgfMaBn+pqp_M1bLdf0+Bm0NCApL+Rpih@mail.gmail.com>
Date: Fri, 11 Feb 2011 16:59:40 -0800
Message-ID: <AANLkTimqWYiF010-NV7Fkrkrei+TcdV+V2stwLTZYLFM@mail.gmail.com>
From: John Fallows <john.fallows@kaazing.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: multipart/alternative; boundary=20cf3043475c5a9177049c0b5486
Cc: hybi@ietf.org, Yutaka_Takeda@playstation.sony.com
Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Feb 2011 00:59:27 -0000

--20cf3043475c5a9177049c0b5486
Content-Type: text/plain; charset=ISO-8859-1

Agreed.

I would much prefer to see full HTTP compatibility before the handshake
completes with a 101 response.

John.

On Thu, Feb 10, 2011 at 5:48 PM, Greg Wilkins <gregw@webtide.com> wrote:

> On 11 February 2011 12:40,  <Yutaka_Takeda@playstation.sony.com> wrote:
> >
> > o  Cannot get full benefit out of HTTP protocol during the handshake as
> it
> > does not expect a final response:
> >   For example:
> >    - Can not redirect WebSocket handshake to another server (for load
> > balancing, fail-over, etc.)
> >    - Can not perform user authentication (Basic, Digest, etc.) during the
> > handshake.
> >    - Similarly, 407 authentication cannot be forced by the server.
>
> +1
>
> In the ancient history of this list, I have long argued for exactly this.
>
> Apparently there are some security concerns about browser redirection,
> which I never really understood... and even if there are, I don't see
> the reason that the protocol should deny the use of non 101 handshake
> responses to all clients.  I think the protocol should allow arbitrary
> response codes (because it can't actually prevent them being sent by
> non WS servers anyway), and then individual clients can decide which
> responses they will handle (which may be better discuss in the
> appropriate HTML 5 forums regarding the specific websocket API).
>
> cheers
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>



-- 
>|< Kaazing Corporation >|<
John Fallows | CTO | +1.650.960.8148
444 Castro St, Suite 1100 | Mountain View, CA 94041, USA

--20cf3043475c5a9177049c0b5486
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Agreed. =A0<div><br></div><div>I would much prefer to see full HTTP compati=
bility before the handshake completes with a 101 response.<br><br></div><di=
v>John.</div><div><br><div class=3D"gmail_quote">On Thu, Feb 10, 2011 at 5:=
48 PM, Greg Wilkins <span dir=3D"ltr">&lt;<a href=3D"mailto:gregw@webtide.c=
om">gregw@webtide.com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;"><div class=3D"im">On 11 February 2011 12:40=
, =A0&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Taked=
a@playstation.sony.com</a>&gt; wrote:<br>

&gt;<br>
&gt; o =A0Cannot get full benefit out of HTTP protocol during the handshake=
 as it<br>
&gt; does not expect a final response:<br>
&gt; =A0 For example:<br>
&gt; =A0 =A0- Can not redirect WebSocket handshake to another server (for l=
oad<br>
&gt; balancing, fail-over, etc.)<br>
&gt; =A0 =A0- Can not perform user authentication (Basic, Digest, etc.) dur=
ing the<br>
&gt; handshake.<br>
&gt; =A0 =A0- Similarly, 407 authentication cannot be forced by the server.=
<br>
<br>
</div>+1<br>
<br>
In the ancient history of this list, I have long argued for exactly this.<b=
r>
<br>
Apparently there are some security concerns about browser redirection,<br>
which I never really understood... and even if there are, I don&#39;t see<b=
r>
the reason that the protocol should deny the use of non 101 handshake<br>
responses to all clients. =A0I think the protocol should allow arbitrary<br=
>
response codes (because it can&#39;t actually prevent them being sent by<br=
>
non WS servers anyway), and then individual clients can decide which<br>
responses they will handle (which may be better discuss in the<br>
appropriate HTML 5 forums regarding the specific websocket API).<br>
<br>
cheers<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</blockquote></div><br><br clear=3D"all"><br>-- <br>&gt;|&lt; Kaazing Corpo=
ration &gt;|&lt;<br>John Fallows | CTO | +1.650.960.8148<div>444 Castro St,=
 Suite 1100=A0| Mountain View, CA 94041, USA</div><br>
</div>

--20cf3043475c5a9177049c0b5486--

From tyoshino@google.com  Fri Feb 11 17:25:44 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8EBC33A6A62 for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 17:25:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.976
X-Spam-Level: 
X-Spam-Status: No, score=-102.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mDVnmen9M1Xh for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 17:25:43 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 2C7A03A6A21 for <hybi@ietf.org>; Fri, 11 Feb 2011 17:25:42 -0800 (PST)
Received: from hpaq14.eem.corp.google.com (hpaq14.eem.corp.google.com [172.25.149.14]) by smtp-out.google.com with ESMTP id p1C1Pupd003598 for <hybi@ietf.org>; Fri, 11 Feb 2011 17:25:56 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297473956; bh=r+bF9MDOCqo1Fi+lM7DUGYRcyKs=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=i4mdDlK0eehzv0owFKRpsYnSIcDWwHY78yqcywiqq9dMzTXKGRCAWwvZRK0RmHyh3 2/7HEV2NrhF3ZFLu262hQ==
Received: from ywo7 (ywo7.prod.google.com [10.192.15.7]) by hpaq14.eem.corp.google.com with ESMTP id p1C1PoAn031994 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 11 Feb 2011 17:25:51 -0800
Received: by ywo7 with SMTP id 7so1377969ywo.33 for <hybi@ietf.org>; Fri, 11 Feb 2011 17:25:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=8Cy/cbpKn0+iPFjnNiW3RCUly7e+KnmTJSZqfqDmYTY=; b=BIMzgQBW6A4hYW1qAT8eBTaEM/TAfCQdxUL7E5+WEq2kvzd1M8/HXi/f7qjhfuM35g O2OFwkzzk/mn34JRfqKQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=b1tqwRiO0pK4N4m/GSSPEDh3Gh2b/g5SpUeFTNeqPblyADaEJYiV9U18sJi3hr2fkF nVzJlpLo2w4Hs1JY/P9g==
Received: by 10.150.204.2 with SMTP id b2mr1342868ybg.447.1297473948262; Fri, 11 Feb 2011 17:25:48 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.91.16 with HTTP; Fri, 11 Feb 2011 17:25:27 -0800 (PST)
In-Reply-To: <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com>
References: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com> <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com> <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 11 Feb 2011 17:25:27 -0800
Message-ID: <AANLkTikFBdEGwcoya6o7BNAz9cKtetoz6Ahy-0MN4RQu@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=000e0cd37526caa2bb049c0bb194
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Feb 2011 01:25:44 -0000

--000e0cd37526caa2bb049c0bb194
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 11, 2011 at 16:17, Takeshi Yoshino <tyoshino@google.com> wrote:

>  - didn't receive Close means (?)
> -- because of RST issue
> -- because of network issue
>
> We have to give (?) some semantics that's not confusing.
>

s/semantics/explanation/


> If this is too complicated, then don't bother sending 'Close' but just
>> close TCP socket,
>> which would be the simplest. My preference is to do above cleanup
>> properly.
>>
>>
> IIRC, there was discussion in designing -00 closing handshake that we
> should avoid underlying transport layer's semantics in realizing WebSocket
> layer event.
>

Citing Hixie's post
http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html

... -- people cited numerous examples of cases where we can't rely on
TCP semantics in practice -- ...


> To follow this philosophy, we could replace the last FIN with Close frame.
> i.e. we again ask both sides send a Close frame so that both sides can
> safely invoke close(2) after seeing Close frame.
>
>
Note that this is the same as "2) drop feature-b)" in my first post in this
thread
- a bit more complicated than what Gabriel proposed and I've cleaned up into
text
- intermediaries have to keep the connection until it sees Close frame on
both direction
- a peer have to wait for reply just to deal with this RST hazard even
though it's not interested in the other peer any more

--000e0cd37526caa2bb049c0bb194
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 11, 2011 at 16:17, Takeshi Yoshino <=
span dir=3D"ltr">&lt;<a href=3D"mailto:tyoshino@google.com" target=3D"_blan=
k">tyoshino@google.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_=
quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1=
ex">


<div>
<div>- didn&#39;t receive Close means (?)</div><div>-- because of RST issue=
</div><div>-- because of network issue</div><div><br></div><div>We have to =
give (?) some semantics that&#39;s not confusing.</div></div></blockquote>


<div>=A0</div><div class=3D"gmail_quote"><div>s/semantics/explanation/</div=
></div><div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class=3D"gmail_quo=
te"><div>


<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><font size=3D"2" face=3D"sans-serif">If this=
 is too complicated, then don&#39;t
bother sending &#39;Close&#39; but just close TCP socket,</font>
<br><font size=3D"2" face=3D"sans-serif">which would be the simplest. My pr=
eference
is to do above cleanup properly.</font>
<br><div>
<font size=3D"2"><div><div><br></div></div></font></div></blockquote><div><=
br></div></div><div>IIRC, there was discussion in designing -00 closing han=
dshake that we should avoid underlying transport layer&#39;s semantics in r=
ealizing WebSocket layer event.</div>


</div></blockquote><div><br></div><div>Citing Hixie&#39;s post=A0<a href=3D=
"http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html" target=3D=
"_blank">http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html</a=
></div>

<div><br></div>
<div><div>... -- people cited numerous examples of cases where we can&#39;t=
 rely on=A0</div><div>TCP semantics in practice -- ...</div></div><div>=A0<=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-le=
ft:1px #ccc solid;padding-left:1ex">


<div class=3D"gmail_quote"><div>To follow this philosophy, we could replace=
 the last FIN with Close frame. i.e. we again ask both sides send a Close f=
rame so that both sides can safely invoke close(2) after seeing Close frame=
.</div>


</div><br>
</blockquote></div><br><div>Note that=A0this is the same as &quot;<span sty=
le=3D"border-collapse:collapse;font-family:arial, sans-serif;font-size:13px=
">2) drop feature-b)&quot;=A0</span>in my first post in this thread</div><d=
iv>

- a bit more complicated than what Gabriel proposed and I&#39;ve cleaned up=
 into text</div>
<div>- intermediaries have to keep the connection until it sees Close frame=
 on both direction</div><div>- a peer have to wait for reply just to deal w=
ith this RST hazard even though it&#39;s not interested in the other peer a=
ny more</div>

<div><br></div>

--000e0cd37526caa2bb049c0bb194--

From ifette@google.com  Fri Feb 11 18:17:41 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E954E3A69EE for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 18:17:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.676
X-Spam-Level: 
X-Spam-Status: No, score=-102.676 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Y93GmZjMVjY for <hybi@core3.amsl.com>; Fri, 11 Feb 2011 18:17:41 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id B4DCD3A6849 for <hybi@ietf.org>; Fri, 11 Feb 2011 18:17:40 -0800 (PST)
Received: from wpaz24.hot.corp.google.com (wpaz24.hot.corp.google.com [172.24.198.88]) by smtp-out.google.com with ESMTP id p1C2Ht8A001213 for <hybi@ietf.org>; Fri, 11 Feb 2011 18:17:55 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297477075; bh=HV9Zl7KGtN6arpoAjMs12hcAFRk=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=eQhMAwuRg95EIu4kvLppmTYaHO5dFtPbICqrmaGTv3l0VhTl2rycDhgiOEwmFsLNj oEnnE0Z3JJatIaXG6561g==
Received: from iwn6 (iwn6.prod.google.com [10.241.68.70]) by wpaz24.hot.corp.google.com with ESMTP id p1C2Hr52025155 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 11 Feb 2011 18:17:54 -0800
Received: by iwn6 with SMTP id 6so3975642iwn.15 for <hybi@ietf.org>; Fri, 11 Feb 2011 18:17:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=6KULOxf3t38ol/sky4bUiFrhApLGZ+rXiBA68jr7yMo=; b=omTgvlFRReo+p7FGtUgAfzGw8xPnKUqHAPDzW+pLoz2SQSeAU4MhLoJ3D0tGGBucCB 0TuV3ySXkQS5PX0fJ31g==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=vuZhvFTYOqSx2UpQWKReW96pBcnCoRpxfZJByu6MPNr2fJPdAAsvgNJzR57q5ZCHY2 UN7DVQY953/ymE4C8gTA==
MIME-Version: 1.0
Received: by 10.231.36.205 with SMTP id u13mr898997ibd.155.1297477073592; Fri, 11 Feb 2011 18:17:53 -0800 (PST)
Received: by 10.231.37.133 with HTTP; Fri, 11 Feb 2011 18:17:53 -0800 (PST)
In-Reply-To: <1297443631.2401.142.camel@ds9.ducksong.com>
References: <1297443631.2401.142.camel@ds9.ducksong.com>
Date: Fri, 11 Feb 2011 18:17:53 -0800
Message-ID: <AANLkTim0ZUNaUgNYU7N55KUFJLuXibHfur-jrgeE9n7c@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Content-Type: multipart/alternative; boundary=0022152d60191360ff049c0c6c11
X-System-Of-Record: true
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] -05 editorial nits (future compression and random redundancy)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Feb 2011 02:17:42 -0000

--0022152d60191360ff049c0c6c11
Content-Type: text/plain; charset=UTF-8

The "randomly selected randomly" is already fixed in svn, the other I will
address tomorrow, currently on a layover at Minneapolis coming back from a
conference...

-Ian

On Fri, Feb 11, 2011 at 9:00 AM, Pat McManus @Mozilla
<mcmanus@ducksong.com>wrote:

> I think -05 is great, we're really converging on something useful.
>
> These are 2 small editorial issues from my last reading of it. Can we
> add these to the tracker?
>
> Section 1.5: "future versions will
>   likely introduce additional concepts such as multiplexing and
>   compression." .. This version introduces compression.
>
> and then:
>
> page 25 and page 30: the phrase "randomly selected randomly" seems to be
> cut and paste error?
>
>
>
> --
> http://www.getfirefox.com/
>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--0022152d60191360ff049c0c6c11
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

The &quot;randomly selected randomly&quot; is already fixed in svn, the oth=
er I will address tomorrow, currently on a layover at Minneapolis coming ba=
ck from a conference...<div><br></div><div>-Ian<br><br><div class=3D"gmail_=
quote">
On Fri, Feb 11, 2011 at 9:00 AM, Pat McManus @Mozilla <span dir=3D"ltr">&lt=
;<a href=3D"mailto:mcmanus@ducksong.com">mcmanus@ducksong.com</a>&gt;</span=
> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo=
rder-left:1px #ccc solid;padding-left:1ex;">
I think -05 is great, we&#39;re really converging on something useful.<br>
<br>
These are 2 small editorial issues from my last reading of it. Can we<br>
add these to the tracker?<br>
<br>
Section 1.5: &quot;future versions will<br>
 =C2=A0 likely introduce additional concepts such as multiplexing and<br>
 =C2=A0 compression.&quot; .. This version introduces compression.<br>
<br>
and then:<br>
<br>
page 25 and page 30: the phrase &quot;randomly selected randomly&quot; seem=
s to be cut and paste error?<br>
<font color=3D"#888888"><br>
<br>
<br>
--<br>
<a href=3D"http://www.getfirefox.com/" target=3D"_blank">http://www.getfire=
fox.com/</a><br>
<br>
<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</font></blockquote></div><br></div>

--0022152d60191360ff049c0c6c11--

From gregw@intalio.com  Sun Feb 13 16:16:40 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BDE483A6ADA; Sun, 13 Feb 2011 16:16:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.136
X-Spam-Level: 
X-Spam-Status: No, score=-2.136 tagged_above=-999 required=5 tests=[AWL=-0.159, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K0AVQtHfG4x0; Sun, 13 Feb 2011 16:16:40 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id D55DE3A6A76; Sun, 13 Feb 2011 16:16:39 -0800 (PST)
Received: by vxi40 with SMTP id 40so2498539vxi.31 for <multiple recipients>; Sun, 13 Feb 2011 16:17:00 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.178.139 with SMTP id bm11mr96485vcb.39.1297642620780; Sun, 13 Feb 2011 16:17:00 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.77.205 with HTTP; Sun, 13 Feb 2011 16:17:00 -0800 (PST)
In-Reply-To: <OFE5DF3EED.178115CB-ON88257834.007C1420-88257834.0080BA73@playstation.sony.com>
References: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E085B9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <OFE5DF3EED.178115CB-ON88257834.007C1420-88257834.0080BA73@playstation.sony.com>
Date: Mon, 14 Feb 2011 11:17:00 +1100
X-Google-Sender-Auth: 5VbBS3kjN5D1UMk95vSrYPeg5io
Message-ID: <AANLkTimw6KVjfADREN39KzaB5uoy_Zn92ebKymSV1Lga@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: "hybi@ietf.org" <hybi@ietf.org>, hybi-bounces@ietf.org, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 00:16:40 -0000

On 12 February 2011 10:26,  <Yutaka_Takeda@playstation.sony.com> wrote:
>> In Section 1.3:
>> "Any status code other than 101 must be treated as a failure and the
>> websocket connection aborted."
>
> I agree, this needs to be fixed. In fact, any status code other than 101
> MUST be handled
> in a way that conforms with HTTP. (which is out of scope of this document).

I have a little concern with saying MUST be handled, as that could be
a little confusing. I don't think we can say that every client MUST
follow redirects, or MUST implement BASIC/DIGEST authentication.
Ignoring a redirect is still HTTP compliant behaviour.

I think we need to consider this in two parts: 1) what the handshake
can carry ; 2) what clients will commonly handle/respect.

For 1) I do not think their should be any restriction in the protocol
document about what the server can send back.  Any valid HTTP response
should be allowable.

For 2) I personally think that browsers at least should follow
redirects and support some common forms of authentication, but I
accept that is probably more an issue for the HTML5 community to
discuss rather than this WG.  But I certainly don't want to be telling
other non browser clients that they must follow redirects.

cheers

From gregw@intalio.com  Sun Feb 13 16:24:07 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5FF303A6ADA for <hybi@core3.amsl.com>; Sun, 13 Feb 2011 16:24:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.609
X-Spam-Level: 
X-Spam-Status: No, score=-2.609 tagged_above=-999 required=5 tests=[AWL=0.368,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kVpzMA8LmKbo for <hybi@core3.amsl.com>; Sun, 13 Feb 2011 16:24:06 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 45AEC3A69DC for <hybi@ietf.org>; Sun, 13 Feb 2011 16:24:06 -0800 (PST)
Received: by vws7 with SMTP id 7so2902679vws.31 for <hybi@ietf.org>; Sun, 13 Feb 2011 16:24:27 -0800 (PST)
MIME-Version: 1.0
Received: by 10.220.178.139 with SMTP id bm11mr102377vcb.39.1297643067328; Sun, 13 Feb 2011 16:24:27 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.220.77.205 with HTTP; Sun, 13 Feb 2011 16:24:27 -0800 (PST)
In-Reply-To: <1297444355.2401.155.camel@ds9.ducksong.com>
References: <1297444355.2401.155.camel@ds9.ducksong.com>
Date: Mon, 14 Feb 2011 11:24:27 +1100
X-Google-Sender-Auth: TUBxUqxSAcv9HvFOyh5jUHly-Hs
Message-ID: <AANLkTinMEdfNGEQXOMFOfYsQiRsORCSW7KUDCyAiu9GN@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] -05: sec-websocket-nonce http response header
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 00:24:07 -0000

On 12 February 2011 04:12, Pat McManus @Mozilla <mcmanus@ducksong.com> wrote:
> Sec-Websocket-Nonce is not sent from the client to the server, so that should be fixed up..

Also is there any benefit in having Sec- on any of the headers sent
from the server?
My understanding is that Sec- is a browser mechanism to restrict what
can be sent from XHR and thus is not applicable to server headers.

cheers

From ibc@aliax.net  Mon Feb 14 08:53:01 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 269593A6A57 for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 08:53:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Shi4on15WVLp for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 08:53:00 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id 505FD3A6A0F for <hybi@ietf.org>; Mon, 14 Feb 2011 08:53:00 -0800 (PST)
Received: by qyk34 with SMTP id 34so1468135qyk.10 for <hybi@ietf.org>; Mon, 14 Feb 2011 08:53:23 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.82.85 with SMTP id a21mr2976216qcl.235.1297702402656; Mon, 14 Feb 2011 08:53:22 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Mon, 14 Feb 2011 08:53:22 -0800 (PST)
In-Reply-To: <AANLkTinMEdfNGEQXOMFOfYsQiRsORCSW7KUDCyAiu9GN@mail.gmail.com>
References: <1297444355.2401.155.camel@ds9.ducksong.com> <AANLkTinMEdfNGEQXOMFOfYsQiRsORCSW7KUDCyAiu9GN@mail.gmail.com>
Date: Mon, 14 Feb 2011 17:53:22 +0100
Message-ID: <AANLkTinvpCPFz_DvPDpzNhaA3kkKhP7Xg-mcTocPiL0m@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] -05: sec-websocket-nonce http response header
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 16:53:01 -0000

2011/2/14 Greg Wilkins <gregw@webtide.com>:
> On 12 February 2011 04:12, Pat McManus @Mozilla <mcmanus@ducksong.com> wr=
ote:
>> Sec-Websocket-Nonce is not sent from the client to the server, so that s=
hould be fixed up..
>
> Also is there any benefit in having Sec- on any of the headers sent
> from the server?

Perhaps the draft has changed too much in last version, but AFAIK
Sec-Websocket-Nonce (sent by the server) is required for the client in
order to mask data.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From tyoshino@google.com  Mon Feb 14 11:32:33 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 27EDB3A6DAE for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 11:32:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.614
X-Spam-Level: 
X-Spam-Status: No, score=-105.614 tagged_above=-999 required=5 tests=[AWL=0.362, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 581bShhk6vRF for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 11:32:32 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id EF8683A6D55 for <hybi@ietf.org>; Mon, 14 Feb 2011 11:32:31 -0800 (PST)
Received: from hpaq12.eem.corp.google.com (hpaq12.eem.corp.google.com [172.25.149.12]) by smtp-out.google.com with ESMTP id p1EJWsJg006459 for <hybi@ietf.org>; Mon, 14 Feb 2011 11:32:54 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297711974; bh=PG1Utp6AmSS2Ox3LhMgDT9hAndQ=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Content-Type; b=O5XkHNpDyVK3qGrKQOzZOR4X+DYtWfAOnEoLh2KN5Fvvm6SHqxm/5lmBSEsvmFXVd SEyw3HSlWJxkqRjYShwBQ==
Received: from iwn8 (iwn8.prod.google.com [10.241.68.72]) by hpaq12.eem.corp.google.com with ESMTP id p1EJW72U004163 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 14 Feb 2011 11:32:53 -0800
Received: by iwn8 with SMTP id 8so5080400iwn.6 for <hybi@ietf.org>; Mon, 14 Feb 2011 11:32:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-type; bh=YY0BFQXjlf7f59dq8b0ziYomidUzk5/EbrOkxNlekxY=; b=k3y4dXUGTOe1XvEN+Lnz9QfWN78bq/qSBzBdoTVbuQHICfqidmsp4p4m5LEx9v7BDB clJwve7evHX6i8S1TJsw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; b=cZcWQ3Eb6vU1jZJP1ROzCCv+N3vkHJUi9HQAzu9shuOW5KmsXrtFEQUW8bIo4yDMP7 sPIuveUGyuKtfB2F18Ag==
Received: by 10.231.35.204 with SMTP id q12mr3364129ibd.4.1297711972243; Mon, 14 Feb 2011 11:32:52 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Mon, 14 Feb 2011 11:32:32 -0800 (PST)
In-Reply-To: <AANLkTikFBdEGwcoya6o7BNAz9cKtetoz6Ahy-0MN4RQu@mail.gmail.com>
References: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com> <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com> <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com> <AANLkTikFBdEGwcoya6o7BNAz9cKtetoz6Ahy-0MN4RQu@mail.gmail.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Mon, 14 Feb 2011 11:32:32 -0800
Message-ID: <AANLkTin-RAVzrENx7973mg+pC2PDjSd26tfC2sLGCoa7@mail.gmail.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=002215049077205ac1049c431dfc
X-System-Of-Record: true
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 19:32:33 -0000

--002215049077205ac1049c431dfc
Content-Type: text/plain; charset=ISO-8859-1

I'd like to summarize proposals again. It seems there's consensus on
dropping acknowledgement feature, so I list only the others.

I prefer [B].

[Proposal A-1]
Role of Close frame
- Help intermediaries know the session is no longer used
- Pass status code to the other peer

Algorithm
- To initiate close, a peer MUST send Close frame, and then the peer MUST
-- close the underlying transport channel ... (*)
- Once a peer received a Close frame, the peer MUST close the underlying
transport channel
- A peer MUST NOT send any more data (including control) after sending or
receiving a Close frame

Pros
- There's no wait state needs to be handled after a peer decided to abandon
the WebSocket

Cons
- When a peer call close(2) with some data left not recv-ed, the peer's TCP
stack may send out RST. This can impede the other peer from receiving Close
frame or even some data before a Close frame

[Proposal A-2]
Replace (*) in A-2 with this
-- wait until the underlying transport channel is closed (by recv until EoS,
wait for close event, etc.) with some timeout

Pros
- There's a wait state needs to be handled after a peer decided to abandon
the WebSocket

Cons
- No more data is coming after Close frame, and therefore a peer can call
close(2) on its TCP socket safely
- The algorithm depends on the underlying transport channel's EoS signal

[Proposal B]
Role of Close frame
- Help intermediaries know the session is no longer used
- Pass status code to the other peer
- Let each peer call close(2) on its TCP socket safely

Algorithm
- To initiate close, send a Close frame
- Once received a Close frame
-- (already sent a Close frame) close the underlying transport channel
-- (otherwise) send a Close frame, and then close the underlying transport
channel
- A peer MUST NOT send any more data (including control) after sending a
Close frame

Reception of a Close frame means
- All data the other peer sent has arrived

Reception of a Close frame DOES NOT mean
- All data has been delivered to the other peer

Pros
- There's a wait state needs to be handled after a peer decided to abandon
the WebSocket

Cons
- No more data is coming after a Close frame, and therefore a peer can call
close(2) on its TCP socket safely

--002215049077205ac1049c431dfc
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>I&#39;d like to summarize proposals again. It seems there&#39;s consen=
sus on dropping acknowledgement feature, so I list only the others.</div><d=
iv><br></div><div>I prefer [B].</div><div><br></div><div>[Proposal A-1]</di=
v>

<div>Role of Close frame</div><div>- Help intermediaries know the session i=
s no longer used</div><div>- Pass status code to the other peer</div><div><=
br></div><div>Algorithm</div><div>- To initiate close, a peer MUST send Clo=
se frame, and then the peer MUST</div>

<div>-- close the underlying transport channel ... (*)</div><div>- Once a p=
eer received a Close frame, the peer MUST close the underlying transport ch=
annel</div><div><div><div>- A peer MUST NOT send any more data (including c=
ontrol) after sending or receiving a Close frame</div>

</div></div><div><br></div><div>Pros</div><div>- There&#39;s no wait state =
needs to be handled after a peer decided to abandon the WebSocket</div><div=
><br></div><div>Cons</div><div>- When a peer call close(2) with some data l=
eft not recv-ed, the=A0peer&#39;s TCP stack may send out RST. This can impe=
de the other peer from receiving Close frame or even some data before a Clo=
se frame</div>

<div><br></div><div>[Proposal A-2]</div><div>Replace (*) in A-2 with this</=
div><div><div>-- wait until the underlying transport channel is closed (by =
recv until EoS, wait for close event, etc.)=A0with some timeout</div></div>

<div><br></div><div><div>Pros</div><div>- There&#39;s a wait state needs to=
 be handled=A0after a peer decided to abandon the WebSocket</div><div><br><=
/div><div><div>Cons</div><div>- No more data is coming after Close frame, a=
nd therefore a peer can call close(2) on its TCP socket safely</div>

</div></div><div>- The algorithm depends on the underlying transport channe=
l&#39;s EoS signal</div><div><br></div>[Proposal B]<div><div><div><div>Role=
 of Close frame</div><div>- Help intermediaries know the session is no long=
er used</div>

<div>- Pass status code to the other peer</div><div>- Let each peer call cl=
ose(2) on its TCP socket safely</div><div><br></div><div>Algorithm</div><di=
v>- To initiate close, send a Close frame</div><div>- Once received a Close=
 frame</div>

<div>-- (already sent a Close frame)=A0close the underlying transport chann=
el</div><div>-- (otherwise)=A0send a Close frame, and then close the underl=
ying transport channel</div><div><div>- A peer MUST NOT send any more data =
(including control) after sending a Close frame</div>

</div><div><br></div><div>Reception of a Close frame means</div><div>- All =
data the other peer sent has arrived</div><div><br></div><div>Reception of =
a Close frame DOES NOT mean</div><div>- All data has been delivered to the =
other peer</div>

</div></div></div><div><br></div><div>Pros</div><div>- There&#39;s a wait s=
tate needs to be handled=A0after a peer decided to abandon the WebSocket</d=
iv><div><br></div><div><div>Cons</div><div>- No more data is coming after a=
 Close frame, and therefore a peer can call close(2) on its TCP socket safe=
ly</div>

</div><div><br></div>

--002215049077205ac1049c431dfc--

From Yutaka_Takeda@PlayStation.Sony.Com  Mon Feb 14 11:43:46 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B0EB83A6DA3; Mon, 14 Feb 2011 11:43:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.036
X-Spam-Level: 
X-Spam-Status: No, score=-6.036 tagged_above=-999 required=5 tests=[AWL=0.228,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FcJGxmmuAXOt; Mon, 14 Feb 2011 11:43:45 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 3529A3A6D9B; Mon, 14 Feb 2011 11:43:45 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021411440259-529646 ; Mon, 14 Feb 2011 11:44:02 -0800 
In-Reply-To: <OFE5DF3EED.178115CB-ON88257834.007C1420-88257834.0080BA73@playstation.sony.com>
To: "hybi@ietf.org" <hybi@ietf.org>
MIME-Version: 1.0
X-KeepSent: 8FB0AAA9:E1FAD4D2-88257837:0069F6E2; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF8FB0AAA9.E1FAD4D2-ON88257837.0069F6E2-88257837.006C674E@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Mon, 14 Feb 2011 11:44:02 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/14/2011 11:44:02 AM, Serialize complete at 02/14/2011 11:44:02 AM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/14/2011 11:44:02 AM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/14/2011 11:44:09 AM, Serialize complete at 02/14/2011 11:44:09 AM
Content-Type: multipart/alternative; boundary="=_alternative 006C674B88257837_="
Cc: hybi-bounces@ietf.org, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 19:43:46 -0000

This is a multipart message in MIME format.
--=_alternative 006C674B88257837_=
Content-Type: text/plain; charset="US-ASCII"

Hi,

> Does any have any thoughts on my other concern? 
> > o Relatively more complexi in adding WebSocket to the existing 
> implemtation of HTTP server. 
> ...

Please let me take back the above comments.

What HTTP offers with Upgrade header and 101 response is not just
for switching underlying protocol but also including HTTP layaer 
itself. Therefore, what I was pointing out wan inherent in HTTP 
protocol, not in WebSocket. Under WebSocket's requirements, 
REQ.8 and REQ.9, I agree that the current approach with Upgrade
header/101 is the best possible way for WebSocket to reuse 
existing HTTP features.


- Yutaka


hybi-bounces@ietf.org wrote on 02/11/2011 03:26:02 PM:

> 
> > This is not aligned with the WG consensus for HTTP compatibility (up
> > until the websocket handshake is complete) declared some time back 
> > by the chairs.
> > The websocket handshake is not complete until a 101 comes back. So 
> > anything before than (including other response codes, 
> > reauthentication, etc) are not anything the websockets draft can say
> > anything about. It's just compatible HTTP as usual.
> 
> Ah, I see. So, HTTP transaction can be iterated until 101 comes in. 
> I may have over-reacted to the text: 
> 
> > In Section 1.3: 
> > "Any status code other than 101 must be treated as a failure and 
> the websocket connection aborted." 
> 
> I agree, this needs to be fixed. In fact, any status code other than
> 101 MUST be handled 
> in a way that conforms with HTTP. (which is out of scope of this 
document). 
> 
> Does any have any thoughts on my other concern? 
> 
> > o Relatively more complexi in adding WebSocket to the existing 
> implemtation of HTTP server. 
> >   Reasons: 
> >    - Existing HTTP implementation is likely designed to treat 101 
> as a indefinitive 
> >      acceptance of the request wihere it tries to prepare for the 
> final response... 
> >    - Where, on receipt of a final response, such as 200 OK, the 
> likelihood of exisiting implementaion 
> >      would prepare for releasing HTTP protocol specific resources 
> in memory to terminate 
> >      the transaction. 
> > 
> >    ## This impact on adoption of WebSocket procol by existing HTTP 
servers.
> >    ## It is desired a loose coupling with HTTP specific function -
> easy to add WebSocket to existing system (e.g. Apache) 
> 
> Say, we try to implement WebSocket in Apache, or via Apache module. 
> Since actual WebSocket 
> connection resides in the middle of the HTTP GET transaction, the 
> process or thread that is 
> processing the transaction has taken up its sufficiently large 
> resources for handling any type of 
> HTTP transaction, and most of which will no longer be necessary once
> the WS handshake is 
> complete. Consequently, such implementation in Apache will be very 
> expensive and probably 
> not practical for large scale deployment. 
> 
> If we could complete the WS handshake in a complete HTTP transaction
> (successful 
> handshake completes on receipt of 200 OK, for example), then this 
> will have a completely 
> different view. Coming back to the example with Apache, the 
> resources for the transaction 
> (process/thread/mempool/context, etc.) can be released completely. 
> What needs to done 
> is in its socket management code be modified to leave the socket (at
> this point being 
> 'websocket' open and transfer it to an internal or external facility
> that can efficiently handle 
> persistent/bidirectional communication. 
> 
> More specifically, the Connection header is about what to do with 
> the underlying connection 
> *after* the current transaction is complete. So, we only needed to 
> define a new value to 
> the Connection header like: 
> 
>     Connection: websocket 
> 
> (# of course, 'Sec-Websocket-xxx' headers are still necessary, 
> 'Upgrade: websocket' can be eliminated.) 
> 
> This can be reported to the socket management layer to tell, "the 
> socket is going to be used 
> as WebSocket". (don't close and don't use it for subsequent HTTP 
> transactions.) 
> Please notice that, there's no HTTP layer involved at this point! 
> 
> This is clearly MUCH less work than tackling situation where 
> transaction is left open upon 
> 101 response, and yet MUCH cleaner solution for introducing 
> WebSocket feature into 
> existing HTTP servers. 
> 
> 
> Any thoughs? 
> 
> --
> Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
> Office: 650 655 7484   Fax: 650 655 8060
> 
> 
> hybi-bounces@ietf.org wrote on 02/10/2011 05:57:51 PM:
> 
> > This is not aligned with the WG consensus for HTTP compatibility (up
> > until the websocket handshake is complete) declared some time back 
> > by the chairs.
> > The websocket handshake is not complete until a 101 comes back. So 
> > anything before than (including other response codes, 
> > reauthentication, etc) are not anything the websockets draft can say
> > anything about. It's just compatible HTTP as usual.
> > 
> > So this is a bug in the spec, hopefully to get taken care of in 06.
> > 
> > > -----Original Message-----
> > > From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf 
Of
> > > Greg Wilkins
> > > Sent: 10 February, 2011 17:49
> > > To: Yutaka_Takeda@playstation.sony.com
> > > Cc: hybi@ietf.org
> > > Subject: Re: [hybi] Final HTTP responses and WebSocket handshake
> > > 
> > > On 11 February 2011 12:40,  <Yutaka_Takeda@playstation.sony.com> 
wrote:
> > > >
> > > > o  Cannot get full benefit out of HTTP protocol during the 
handshake
> > > > as it does not expect a final response:
> > > >   For example:
> > > >    - Can not redirect WebSocket handshake to another server (for 
load
> > > > balancing, fail-over, etc.)
> > > >    - Can not perform user authentication (Basic, Digest, etc.) 
during
> > > > the handshake.
> > > >    - Similarly, 407 authentication cannot be forced by the server.
> > > 
> > > +1
> > > 
> > > In the ancient history of this list, I have long argued for exactly 
this.
> > > 
> > > Apparently there are some security concerns about browser 
> redirection, which
> > > I never really understood... and even if there are, I don't see 
> > the reason that the
> > > protocol should deny the use of non 101 handshake responses to all
> > clients.  I
> > > think the protocol should allow arbitrary response codes (because it 
can't
> > > actually prevent them being sent by non WS servers anyway), and then
> > > individual clients can decide which responses they will handle 
> (which may be
> > > better discuss in the appropriate HTML 5 forums regarding the 
specific
> > > websocket API).
> > > 
> > > cheers
> > > _______________________________________________
> > > hybi mailing list
> > > hybi@ietf.org
> > > https://www.ietf.org/mailman/listinfo/hybi
> > 
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 006C674B88257837_=
Content-Type: text/html; charset="US-ASCII"


<br><tt><font size=2>Hi,</font></tt>
<br>
<br><tt><font size=2>&gt; Does any have any thoughts on my other concern?
<br>
&gt; &gt; o Relatively more complexi in adding WebSocket to the existing
<br>
&gt; implemtation of HTTP server. </font></tt>
<br><tt><font size=2>&gt; ...<br>
</font></tt>
<br><tt><font size=2>Please let me take back the above comments.</font></tt>
<br>
<br><tt><font size=2>What HTTP offers with Upgrade header and 101 response
is not just</font></tt>
<br><tt><font size=2>for switching underlying protocol but also including
HTTP layaer </font></tt>
<br><tt><font size=2>itself. Therefore, what I was pointing out wan inherent
in HTTP </font></tt>
<br><tt><font size=2>protocol, not in WebSocket. Under WebSocket's requirements,
</font></tt>
<br><tt><font size=2>REQ.8 and REQ.9, I agree that the current approach
with Upgrade</font></tt>
<br><tt><font size=2>header/101 is the best possible way for WebSocket
to reuse </font></tt>
<br><tt><font size=2>existing HTTP features.</font></tt>
<br>
<br>
<br><font size=2 face="sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/11/2011 03:26:02
PM:<br>
<br>
&gt; <br>
&gt; &gt; This is not aligned with the WG consensus for HTTP compatibility
(up<br>
&gt; &gt; until the websocket handshake is complete) declared some time
back <br>
&gt; &gt; by the chairs.<br>
&gt; &gt; The websocket handshake is not complete until a 101 comes back.
So <br>
&gt; &gt; anything before than (including other response codes, <br>
&gt; &gt; reauthentication, etc) are not anything the websockets draft
can say<br>
&gt; &gt; anything about. It's just compatible HTTP as usual.<br>
&gt; <br>
&gt; Ah, I see. So, HTTP transaction can be iterated until 101 comes in.
<br>
&gt; I may have over-reacted to the text: <br>
&gt; <br>
&gt; &gt; In Section 1.3: <br>
&gt; &gt; &quot;Any status code other than 101 must be treated as a failure
and <br>
&gt; the websocket connection aborted.&quot; <br>
&gt; <br>
&gt; I agree, this needs to be fixed. In fact, any status code other than<br>
&gt; 101 MUST be handled <br>
&gt; in a way that conforms with HTTP. (which is out of scope of this document).
<br>
&gt; <br>
&gt; Does any have any thoughts on my other concern? <br>
&gt; <br>
&gt; &gt; o Relatively more complexi in adding WebSocket to the existing
<br>
&gt; implemtation of HTTP server. <br>
&gt; &gt; &nbsp; Reasons: <br>
&gt; &gt; &nbsp; &nbsp;- Existing HTTP implementation is likely designed
to treat 101 <br>
&gt; as a indefinitive <br>
&gt; &gt; &nbsp; &nbsp; &nbsp;acceptance of the request wihere it tries
to prepare for the <br>
&gt; final response... <br>
&gt; &gt; &nbsp; &nbsp;- Where, on receipt of a final response, such as
200 OK, the <br>
&gt; likelihood of exisiting implementaion <br>
&gt; &gt; &nbsp; &nbsp; &nbsp;would prepare for releasing HTTP protocol
specific resources <br>
&gt; in memory to terminate <br>
&gt; &gt; &nbsp; &nbsp; &nbsp;the transaction. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; &nbsp; &nbsp;## This impact on adoption of WebSocket procol by
existing HTTP servers.<br>
&gt; &gt; &nbsp; &nbsp;## It is desired a loose coupling with HTTP specific
function -<br>
&gt; easy to add WebSocket to existing system (e.g. Apache) <br>
&gt; <br>
&gt; Say, we try to implement WebSocket in Apache, or via Apache module.
<br>
&gt; Since actual WebSocket <br>
&gt; connection resides in the middle of the HTTP GET transaction, the
<br>
&gt; process or thread that is <br>
&gt; processing the transaction has taken up its sufficiently large <br>
&gt; resources for handling any type of <br>
&gt; HTTP transaction, and most of which will no longer be necessary once<br>
&gt; the WS handshake is <br>
&gt; complete. Consequently, such implementation in Apache will be very
<br>
&gt; expensive and probably <br>
&gt; not practical for large scale deployment. <br>
&gt; <br>
&gt; If we could complete the WS handshake in a complete HTTP transaction<br>
&gt; (successful <br>
&gt; handshake completes on receipt of 200 OK, for example), then this
<br>
&gt; will have a completely <br>
&gt; different view. Coming back to the example with Apache, the <br>
&gt; resources for the transaction <br>
&gt; (process/thread/mempool/context, etc.) can be released completely.
<br>
&gt; What needs to done <br>
&gt; is in its socket management code be modified to leave the socket (at<br>
&gt; this point being <br>
&gt; 'websocket' open and transfer it to an internal or external facility<br>
&gt; that can efficiently handle <br>
&gt; persistent/bidirectional communication. <br>
&gt; <br>
&gt; More specifically, the Connection header is about what to do with
<br>
&gt; the underlying connection <br>
&gt; *after* the current transaction is complete. So, we only needed to
<br>
&gt; define a new value to <br>
&gt; the Connection header like: <br>
&gt; <br>
&gt; &nbsp; &nbsp; Connection: websocket <br>
&gt; <br>
&gt; (# of course, 'Sec-Websocket-xxx' headers are still necessary, <br>
&gt; 'Upgrade: websocket' can be eliminated.) <br>
&gt; <br>
&gt; This can be reported to the socket management layer to tell, &quot;the
<br>
&gt; socket is going to be used <br>
&gt; as WebSocket&quot;. (don't close and don't use it for subsequent HTTP
<br>
&gt; transactions.) <br>
&gt; Please notice that, there's no HTTP layer involved at this point!
<br>
&gt; <br>
&gt; This is clearly MUCH less work than tackling situation where <br>
&gt; transaction is left open upon <br>
&gt; 101 response, and yet MUCH cleaner solution for introducing <br>
&gt; WebSocket feature into <br>
&gt; existing HTTP servers. <br>
&gt; <br>
&gt; <br>
&gt; Any thoughs? <br>
&gt; <br>
&gt; --<br>
&gt; Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
&gt; Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
&gt; <br>
&gt; <br>
&gt; hybi-bounces@ietf.org wrote on 02/10/2011 05:57:51 PM:<br>
&gt; <br>
&gt; &gt; This is not aligned with the WG consensus for HTTP compatibility
(up<br>
&gt; &gt; until the websocket handshake is complete) declared some time
back <br>
&gt; &gt; by the chairs.<br>
&gt; &gt; The websocket handshake is not complete until a 101 comes back.
So <br>
&gt; &gt; anything before than (including other response codes, <br>
&gt; &gt; reauthentication, etc) are not anything the websockets draft
can say<br>
&gt; &gt; anything about. It's just compatible HTTP as usual.<br>
&gt; &gt; <br>
&gt; &gt; So this is a bug in the spec, hopefully to get taken care of
in 06.<br>
&gt; &gt; <br>
&gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org]
On Behalf Of<br>
&gt; &gt; &gt; Greg Wilkins<br>
&gt; &gt; &gt; Sent: 10 February, 2011 17:49<br>
&gt; &gt; &gt; To: Yutaka_Takeda@playstation.sony.com<br>
&gt; &gt; &gt; Cc: hybi@ietf.org<br>
&gt; &gt; &gt; Subject: Re: [hybi] Final HTTP responses and WebSocket handshake<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; On 11 February 2011 12:40, &nbsp;&lt;Yutaka_Takeda@playstation.sony.com&gt;
wrote:<br>
&gt; &gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; o &nbsp;Cannot get full benefit out of HTTP protocol
during the handshake<br>
&gt; &gt; &gt; &gt; as it does not expect a final response:<br>
&gt; &gt; &gt; &gt; &nbsp; For example:<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;- Can not redirect WebSocket handshake
to another server (for load<br>
&gt; &gt; &gt; &gt; balancing, fail-over, etc.)<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;- Can not perform user authentication
(Basic, Digest, etc.) during<br>
&gt; &gt; &gt; &gt; the handshake.<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;- Similarly, 407 authentication cannot
be forced by the server.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; +1<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; In the ancient history of this list, I have long argued
for exactly this.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Apparently there are some security concerns about browser
<br>
&gt; redirection, which<br>
&gt; &gt; &gt; I never really understood... and even if there are, I don't
see <br>
&gt; &gt; the reason that the<br>
&gt; &gt; &gt; protocol should deny the use of non 101 handshake responses
to all<br>
&gt; &gt; clients. &nbsp;I<br>
&gt; &gt; &gt; think the protocol should allow arbitrary response codes
(because it can't<br>
&gt; &gt; &gt; actually prevent them being sent by non WS servers anyway),
and then<br>
&gt; &gt; &gt; individual clients can decide which responses they will
handle <br>
&gt; (which may be<br>
&gt; &gt; &gt; better discuss in the appropriate HTML 5 forums regarding
the specific<br>
&gt; &gt; &gt; websocket API).<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; cheers<br>
&gt; &gt; &gt; _______________________________________________<br>
&gt; &gt; &gt; hybi mailing list<br>
&gt; &gt; &gt; hybi@ietf.org<br>
&gt; &gt; &gt; https://www.ietf.org/mailman/listinfo/hybi<br>
&gt; &gt; <br>
&gt; &gt; _______________________________________________<br>
&gt; &gt; hybi mailing list<br>
&gt; &gt; hybi@ietf.org<br>
&gt; &gt; https://www.ietf.org/mailman/listinfo/hybi<br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 006C674B88257837_=--

From tyoshino@google.com  Mon Feb 14 11:49:24 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8DDF23A6DB1 for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 11:49:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.686
X-Spam-Level: 
X-Spam-Status: No, score=-105.686 tagged_above=-999 required=5 tests=[AWL=0.290, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hB3VabzcAz1s for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 11:49:23 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 7294F3A6DA6 for <hybi@ietf.org>; Mon, 14 Feb 2011 11:49:23 -0800 (PST)
Received: from hpaq12.eem.corp.google.com (hpaq12.eem.corp.google.com [172.25.149.12]) by smtp-out.google.com with ESMTP id p1EJnk1P030459 for <hybi@ietf.org>; Mon, 14 Feb 2011 11:49:46 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297712986; bh=aOSLlrKzmi6GPUkBIVv2Shha4bY=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=HTdoMnM4qlfTmp7C9nxY32KWftp8gUcUlJdchT0PJYyY3WoE6gz/rGrP8kLugCqqo IThNnDdHpxlNmrvlT/EPA==
Received: from iwc10 (iwc10.prod.google.com [10.241.65.138]) by hpaq12.eem.corp.google.com with ESMTP id p1EJmV2L027450 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 14 Feb 2011 11:49:45 -0800
Received: by iwc10 with SMTP id 10so5089879iwc.28 for <hybi@ietf.org>; Mon, 14 Feb 2011 11:49:44 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=VVk5Rrm+TtZNnH7zZEhCOsyi9pMCyTo+3Vbnh/dEaJM=; b=Ukp/CenO2Zlp6Wadqs+fnrBHaS+D3BOylj+PPT0IE0D8zivdxsEPiG0Yqeumc/YjMY iY0m/2rJ4MDABQwIs18g==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=knVFa7eJcwH76Np2afiUujuyiaVYwucE2lCI+09EUv8gGKW8euo+zKW3OiqC54Fr6o CDUngs49ajfRTsZQ/dng==
Received: by 10.42.178.134 with SMTP id bm6mr5467431icb.523.1297712984540; Mon, 14 Feb 2011 11:49:44 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Mon, 14 Feb 2011 11:49:24 -0800 (PST)
In-Reply-To: <AANLkTikHf00MhSPXhfjDv9MuG=tMQ6V3FG2VvGoV+o-8@mail.gmail.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com> <AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com> <AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com> <7785FB1F-C733-4AE1-BACF-44556B1074A8@gmail.com> <AANLkTinfcj-rYiv4vDUBz3cmRqALttq61=hb0mC41L9h@mail.gmail.com> <AANLkTikHf00MhSPXhfjDv9MuG=tMQ6V3FG2VvGoV+o-8@mail.gmail.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Mon, 14 Feb 2011 11:49:24 -0800
Message-ID: <AANLkTi=O6peLVFks-+phmQ=MTtrXddixj5_LYKvg6xWv@mail.gmail.com>
To: Brodie Thiesfield <brofield@gmail.com>
Content-Type: multipart/alternative; boundary=90e6ba6e8d9c76c650049c435923
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 19:49:24 -0000

--90e6ba6e8d9c76c650049c435923
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 11, 2011 at 05:59, Brodie Thiesfield <brofield@gmail.com> wrote:
>
> termination. I would suggest reusing the 2xx for normal, 4xx for
> client error (or message sender error) and 5xx for server error (or
> message receiver) form since they are already familiar. Disallow other
>

+1 for using these terms, message sender error and message receiver error

Status codes that I could imagine would be useful as well as a few
> codes to cover the list that Yuta mentioned:
>
> 4xx
> * timeout
> * invalid opcode
> * invalid encoding
> * unexpected
> * too long
>
> 5xx
> * overloaded / service unavailable
> * not supported
>
> But as I said, at the very least, the 200/400/500 + optional text message.
>

Sounds not bad.

This must be aligned with what discussed on another thread about opening
handshake status code. Having very similar code for two purposes can be
confusing.

--90e6ba6e8d9c76c650049c435923
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 11, 2011 at 05:59, Brodie Thiesfield=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:brofield@gmail.com" target=3D"_bla=
nk">brofield@gmail.com</a>&gt;</span> wrote:<blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">


termination. I would suggest reusing the 2xx for normal, 4xx for<br>
client error (or message sender error) and 5xx for server error (or<br>
message receiver) form since they are already familiar. Disallow other<br><=
/blockquote><div><br></div><div>+1 for using these terms, message sender er=
ror and message receiver error</div><div><br></div><blockquote class=3D"gma=
il_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-lef=
t:1ex">

Status codes that I could imagine would be useful as well as a few<br>
codes to cover the list that Yuta mentioned:<br>
<br>
4xx<br>
* timeout<br>
* invalid opcode<br>
* invalid encoding<br>
* unexpected<br>
* too long<br>
<br>
5xx<br>
* overloaded / service unavailable<br>
* not supported<br>
<br>
But as I said, at the very least, the 200/400/500 + optional text message.<=
br></blockquote><div>=A0</div></div><div>Sounds not bad.</div><div><br></di=
v><div>This must be aligned with what discussed on another thread about ope=
ning handshake status code. Having very similar code for two purposes can b=
e confusing.</div>

<div><br></div>

--90e6ba6e8d9c76c650049c435923--

From Gabriel.Montenegro@microsoft.com  Mon Feb 14 12:33:46 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BADD33A6DA1 for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 12:33:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.398
X-Spam-Level: 
X-Spam-Status: No, score=-10.398 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XIxjoH72Fzz for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 12:33:40 -0800 (PST)
Received: from smtp.microsoft.com (mail3.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id 7E2203A6AB9 for <hybi@ietf.org>; Mon, 14 Feb 2011 12:33:40 -0800 (PST)
Received: from TK5EX14MLTC103.redmond.corp.microsoft.com (157.54.79.174) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Mon, 14 Feb 2011 12:34:04 -0800
Received: from TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com (157.54.71.39) by TK5EX14MLTC103.redmond.corp.microsoft.com (157.54.79.174) with Microsoft SMTP Server (TLS) id 14.1.270.2; Mon, 14 Feb 2011 12:34:03 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.39]) with mapi; Mon, 14 Feb 2011 12:34:02 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Takeshi Yoshino <tyoshino@google.com>, "hybi@ietf.org" <hybi@ietf.org>
Thread-Topic: [hybi] Clarify the role of closing handshake
Thread-Index: AQHLyLZQD4/LNEvRdUK4csWEI+DaLJP6cYsAgAABlOCAAI+qgIAAoGMAgABJG4CAASvVgIAAOECAgAAF0ICAADMNAIAAEuuAgARUZAD//4iRsA==
Date: Mon, 14 Feb 2011 20:34:01 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com> <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com> <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com> <AANLkTikFBdEGwcoya6o7BNAz9cKtetoz6Ahy-0MN4RQu@mail.gmail.com> <AANLkTin-RAVzrENx7973mg+pC2PDjSd26tfC2sLGCoa7@mail.gmail.com>
In-Reply-To: <AANLkTin-RAVzrENx7973mg+pC2PDjSd26tfC2sLGCoa7@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9TK5EX14MBXW605w_"
MIME-Version: 1.0
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 20:33:46 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9TK5EX14MBXW605w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

In A-2 and B, it seems you reversed the Pros and Cons.

I'm not clear on the algorithm for B. Could you formulate in terms of peers=
 A and B and clarify which side is doing what?

At any rate, the cons of adding a wait state and additional complexity in t=
he protocol is why I prefer the simplicity of A.

Most of the time, there won't be a gracious Close, as users will kill the b=
rowser window, exit out of the tab, etc. So I fear we're complicating the p=
rotocol for dubious benefits. We have to deal with sudden termination anywa=
y.  At any rate, even if the RST prevents the other peer from receiving the=
 WS_Close, the intermediaries will see it.

This is a case of added complexity for very little benefit.

From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of Tak=
eshi Yoshino
Sent: Monday, February 14, 2011 11:33
To: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake

I'd like to summarize proposals again. It seems there's consensus on droppi=
ng acknowledgement feature, so I list only the others.

I prefer [B].

[Proposal A-1]
Role of Close frame
- Help intermediaries know the session is no longer used
- Pass status code to the other peer

Algorithm
- To initiate close, a peer MUST send Close frame, and then the peer MUST
-- close the underlying transport channel ... (*)
- Once a peer received a Close frame, the peer MUST close the underlying tr=
ansport channel
- A peer MUST NOT send any more data (including control) after sending or r=
eceiving a Close frame

Pros
- There's no wait state needs to be handled after a peer decided to abandon=
 the WebSocket

Cons
- When a peer call close(2) with some data left not recv-ed, the peer's TCP=
 stack may send out RST. This can impede the other peer from receiving Clos=
e frame or even some data before a Close frame

[Proposal A-2]
Replace (*) in A-2 with this
-- wait until the underlying transport channel is closed (by recv until EoS=
, wait for close event, etc.) with some timeout

Pros
- There's a wait state needs to be handled after a peer decided to abandon =
the WebSocket

Cons
- No more data is coming after Close frame, and therefore a peer can call c=
lose(2) on its TCP socket safely
- The algorithm depends on the underlying transport channel's EoS signal

[Proposal B]
Role of Close frame
- Help intermediaries know the session is no longer used
- Pass status code to the other peer
- Let each peer call close(2) on its TCP socket safely

Algorithm
- To initiate close, send a Close frame
- Once received a Close frame
-- (already sent a Close frame) close the underlying transport channel
-- (otherwise) send a Close frame, and then close the underlying transport =
channel
- A peer MUST NOT send any more data (including control) after sending a Cl=
ose frame

Reception of a Close frame means
- All data the other peer sent has arrived

Reception of a Close frame DOES NOT mean
- All data has been delivered to the other peer

Pros
- There's a wait state needs to be handled after a peer decided to abandon =
the WebSocket

Cons
- No more data is coming after a Close frame, and therefore a peer can call=
 close(2) on its TCP socket safely


--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9TK5EX14MBXW605w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40"><head><meta http-equiv=3DContent-Type content=
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros=
oft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue vli=
nk=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span style=3D'f=
ont-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In A-2 an=
d B, it seems you reversed the Pros and Cons.<o:p></o:p></span></p><p class=
=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-se=
rif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'=
>I&#8217;m not clear on the algorithm for B. Could you formulate in terms o=
f peers A and B and clarify which side is doing what?<o:p></o:p></span></p>=
<p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri",=
"sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNorma=
l><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:=
#1F497D'>At any rate, the cons of adding a wait state and additional comple=
xity in the protocol is why I prefer the simplicity of A.<o:p></o:p></span>=
</p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calib=
ri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoN=
ormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";co=
lor:#1F497D'>Most of the time, there won&#8217;t be a gracious Close, as us=
ers will kill the browser window, exit out of the tab, etc. So I fear we&#8=
217;re complicating the protocol for dubious benefits. We have to deal with=
 sudden termination anyway. &nbsp;At any rate, even if the RST prevents the=
 other peer from receiving the WS_Close, the intermediaries will see it. <o=
:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;fo=
nt-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span></p=
><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri"=
,"sans-serif";color:#1F497D'>This is a case of added complexity for very li=
ttle benefit.<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font=
-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;<=
/o:p></span></p><div style=3D'border:none;border-left:solid blue 1.5pt;padd=
ing:0in 0in 0in 4.0pt'><div><div style=3D'border:none;border-top:solid #B5C=
4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=3DMsoNormal><b><span style=3D=
'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> hybi-bounces@=
ietf.org [mailto:hybi-bounces@ietf.org] <b>On Behalf Of </b>Takeshi Yoshino=
<br><b>Sent:</b> Monday, February 14, 2011 11:33<br><b>To:</b> hybi@ietf.or=
g<br><b>Subject:</b> Re: [hybi] Clarify the role of closing handshake<o:p><=
/o:p></span></p></div></div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><div>=
<p class=3DMsoNormal>I'd like to summarize proposals again. It seems there'=
s consensus on dropping acknowledgement feature, so I list only the others.=
<o:p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><=
div><p class=3DMsoNormal>I prefer [B].<o:p></o:p></p></div><div><p class=3D=
MsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>[Proposal A-=
1]<o:p></o:p></p></div><div><p class=3DMsoNormal>Role of Close frame<o:p></=
o:p></p></div><div><p class=3DMsoNormal>- Help intermediaries know the sess=
ion is no longer used<o:p></o:p></p></div><div><p class=3DMsoNormal>- Pass =
status code to the other peer<o:p></o:p></p></div><div><p class=3DMsoNormal=
><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Algorithm<o:p></o:p><=
/p></div><div><p class=3DMsoNormal>- To initiate close, a peer MUST send Cl=
ose frame, and then the peer MUST<o:p></o:p></p></div><div><p class=3DMsoNo=
rmal>-- close the underlying transport channel ... (*)<o:p></o:p></p></div>=
<div><p class=3DMsoNormal>- Once a peer received a Close frame, the peer MU=
ST close the underlying transport channel<o:p></o:p></p></div><div><div><di=
v><p class=3DMsoNormal>- A peer MUST NOT send any more data (including cont=
rol) after sending or receiving a Close frame<o:p></o:p></p></div></div></d=
iv><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMso=
Normal>Pros<o:p></o:p></p></div><div><p class=3DMsoNormal>- There's no wait=
 state needs to be handled after a peer decided to abandon the WebSocket<o:=
p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div=
><p class=3DMsoNormal>Cons<o:p></o:p></p></div><div><p class=3DMsoNormal>- =
When a peer call close(2) with some data left not recv-ed, the&nbsp;peer's =
TCP stack may send out RST. This can impede the other peer from receiving C=
lose frame or even some data before a Close frame<o:p></o:p></p></div><div>=
<p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>[=
Proposal A-2]<o:p></o:p></p></div><div><p class=3DMsoNormal>Replace (*) in =
A-2 with this<o:p></o:p></p></div><div><div><p class=3DMsoNormal>-- wait un=
til the underlying transport channel is closed (by recv until EoS, wait for=
 close event, etc.)&nbsp;with some timeout<o:p></o:p></p></div></div><div><=
p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><div><p class=3DMsoNorm=
al>Pros<o:p></o:p></p></div><div><p class=3DMsoNormal>- There's a wait stat=
e needs to be handled&nbsp;after a peer decided to abandon the WebSocket<o:=
p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div=
><div><p class=3DMsoNormal>Cons<o:p></o:p></p></div><div><p class=3DMsoNorm=
al>- No more data is coming after Close frame, and therefore a peer can cal=
l close(2) on its TCP socket safely<o:p></o:p></p></div></div></div><div><p=
 class=3DMsoNormal>- The algorithm depends on the underlying transport chan=
nel's EoS signal<o:p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;<=
/o:p></p></div><p class=3DMsoNormal>[Proposal B]<o:p></o:p></p><div><div><d=
iv><div><p class=3DMsoNormal>Role of Close frame<o:p></o:p></p></div><div><=
p class=3DMsoNormal>- Help intermediaries know the session is no longer use=
d<o:p></o:p></p></div><div><p class=3DMsoNormal>- Pass status code to the o=
ther peer<o:p></o:p></p></div><div><p class=3DMsoNormal>- Let each peer cal=
l close(2) on its TCP socket safely<o:p></o:p></p></div><div><p class=3DMso=
Normal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Algorithm<o:p><=
/o:p></p></div><div><p class=3DMsoNormal>- To initiate close, send a Close =
frame<o:p></o:p></p></div><div><p class=3DMsoNormal>- Once received a Close=
 frame<o:p></o:p></p></div><div><p class=3DMsoNormal>-- (already sent a Clo=
se frame)&nbsp;close the underlying transport channel<o:p></o:p></p></div><=
div><p class=3DMsoNormal>-- (otherwise)&nbsp;send a Close frame, and then c=
lose the underlying transport channel<o:p></o:p></p></div><div><div><p clas=
s=3DMsoNormal>- A peer MUST NOT send any more data (including control) afte=
r sending a Close frame<o:p></o:p></p></div></div><div><p class=3DMsoNormal=
><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Reception of a Close =
frame means<o:p></o:p></p></div><div><p class=3DMsoNormal>- All data the ot=
her peer sent has arrived<o:p></o:p></p></div><div><p class=3DMsoNormal><o:=
p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Reception of a Close fram=
e DOES NOT mean<o:p></o:p></p></div><div><p class=3DMsoNormal>- All data ha=
s been delivered to the other peer<o:p></o:p></p></div></div></div></div><d=
iv><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNorma=
l>Pros<o:p></o:p></p></div><div><p class=3DMsoNormal>- There's a wait state=
 needs to be handled&nbsp;after a peer decided to abandon the WebSocket<o:p=
></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div>=
<div><p class=3DMsoNormal>Cons<o:p></o:p></p></div><div><p class=3DMsoNorma=
l>- No more data is coming after a Close frame, and therefore a peer can ca=
ll close(2) on its TCP socket safely<o:p></o:p></p></div></div><div><p clas=
s=3DMsoNormal><o:p>&nbsp;</o:p></p></div></div></div></body></html>=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9TK5EX14MBXW605w_--

From andy.warmcat.com@googlemail.com  Mon Feb 14 12:37:22 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6D40E3A6C4E for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 12:37:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oDC217Tzl48k for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 12:37:21 -0800 (PST)
Received: from mail-ew0-f44.google.com (mail-ew0-f44.google.com [209.85.215.44]) by core3.amsl.com (Postfix) with ESMTP id 0F8663A6AD5 for <hybi@ietf.org>; Mon, 14 Feb 2011 12:37:20 -0800 (PST)
Received: by ewy8 with SMTP id 8so2845837ewy.31 for <hybi@ietf.org>; Mon, 14 Feb 2011 12:37:44 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=fnlx3Xw1M18gCP2/5UycNEsTvhjr6sL6kFIHQM4z4ao=; b=EeHHF4QrnhC3yWm7I5wY5wS2ulHIl65sL8VhQw2qW1Nxz5oEp2z8ZHkbDtvfNGz85z bE2XO6oraKB8wYDVWOIkD16YUtb5PLIZFJ6corKVsdJk7+P2GPb+bGC6GN9qJIrAr4Do z1zicjsQB0wmtN2cN7uyFSOzXfh2ZDzDfETjc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=wYB/W9GgBFElj5XmjtQdlzsAH0xzrii0QSHqHK7w6JqfD6bEdlvXmFpVQFC9hX0P9b Fe2wt5yR2nstSLk+WyZtVb4Z1XN4tx+sS4brSOM9XCyBxf9Y/RvVlIHNbzXHTDommF9C /EAYJ01rKRVTiOccD6UV4B6RGZziDg+yZlvK4=
Received: by 10.213.9.130 with SMTP id l2mr555569ebl.72.1297715863932; Mon, 14 Feb 2011 12:37:43 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id x54sm2828399eeh.5.2011.02.14.12.37.42 (version=SSLv3 cipher=OTHER); Mon, 14 Feb 2011 12:37:43 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D599296.7020803@warmcat.com>
Date: Mon, 14 Feb 2011 20:37:42 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Takeshi Yoshino <tyoshino@google.com>
References: <AANLkTi=wAwQHGbu_vVS5o9yNuC-M=e_hWwtU5F6UPGqm@mail.gmail.com>	<AANLkTimGHPmGSB1hCr2VJ3O8bFJiEkvdkvqptt6A8mBA@mail.gmail.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126E04F34@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<AANLkTimRezbkgnicmSqhX+Go5UYAazTU9WWHpH8oe_7K@mail.gmail.com>	<AANLkTinh1jUbei-FhMAkRcGoT9-z7RJQv4Q_7DweiwcL@mail.gmail.com>	<7785FB1F-C733-4AE1-BACF-44556B1074A8@gmail.com>	<AANLkTinfcj-rYiv4vDUBz3cmRqALttq61=hb0mC41L9h@mail.gmail.com>	<AANLkTikHf00MhSPXhfjDv9MuG=tMQ6V3FG2VvGoV+o-8@mail.gmail.com> <AANLkTi=O6peLVFks-+phmQ=MTtrXddixj5_LYKvg6xWv@mail.gmail.com>
In-Reply-To: <AANLkTi=O6peLVFks-+phmQ=MTtrXddixj5_LYKvg6xWv@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: "hybi@ietf.org" <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 20:37:22 -0000

On 02/14/2011 07:49 PM, Somebody in the thread at some point said:

> This must be aligned with what discussed on another thread about opening
> handshake status code. Having very similar code for two purposes can be
> confusing.

Well I don't mind what is decided in either case, but to be clear in the 
opening handshake case it's in http protocol and using http conventions, 
even the server response is valid http.  So it uses http status concept.

But in the close case all that is long gone and it's websocket protocol 
which is totally different from http conventions.  So it seems it would 
be OK if it uses a different status concept if it wants to use any 
status concept at all at websocket close time.

-Andy

From tyoshino@google.com  Mon Feb 14 15:25:50 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8923A3A6DA9 for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 15:25:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.734
X-Spam-Level: 
X-Spam-Status: No, score=-105.734 tagged_above=-999 required=5 tests=[AWL=0.242, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SIHsrm7QRCsb for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 15:25:49 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 4B4653A6DD7 for <hybi@ietf.org>; Mon, 14 Feb 2011 15:25:49 -0800 (PST)
Received: from hpaq6.eem.corp.google.com (hpaq6.eem.corp.google.com [172.25.149.6]) by smtp-out.google.com with ESMTP id p1ENQCad016918 for <hybi@ietf.org>; Mon, 14 Feb 2011 15:26:12 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297725972; bh=ltSegTiyvJUVSms9auFI+wUI3L0=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=h7Rt1f4zqO39Hxp/1680MbJvAn2xbybn/udS7TjocYwshPEcbuC5Ds5bWsQwv3iFk 2D7PYrdCBua8LTpfLCmxQ==
Received: from iyb26 (iyb26.prod.google.com [10.241.49.90]) by hpaq6.eem.corp.google.com with ESMTP id p1ENQ73Y027587 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 14 Feb 2011 15:26:10 -0800
Received: by iyb26 with SMTP id 26so5491103iyb.41 for <hybi@ietf.org>; Mon, 14 Feb 2011 15:26:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=3xsQtouuuWf63Rv36Hh+mpusrTvoNkDpiFtxL5GezpA=; b=V5Ut5mFR5IylLM76AFEgOixfGwUdzEupEpO1KPdhd8CbWhj5jWyDxSzZBaDhh35e35 iNFM9a6uRy6Ye46tXeow==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=OQi7Uwi2pNaqJeVcVN21xYQhieRupx3QuZgjBJTy6AmLbq1OTOgJbRRR3Rga7T76Vh KVNe3l3h8yBCvcymIKzQ==
Received: by 10.231.39.73 with SMTP id f9mr3507377ibe.79.1297725970425; Mon, 14 Feb 2011 15:26:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Mon, 14 Feb 2011 15:25:49 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <OFAAD26076.80417033-ON88257834.006C2055-88257834.0072D42E@playstation.sony.com> <OF4A78F456.78EA8086-ON88257834.00735B16-88257834.0074BBCC@playstation.sony.com> <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com> <AANLkTikFBdEGwcoya6o7BNAz9cKtetoz6Ahy-0MN4RQu@mail.gmail.com> <AANLkTin-RAVzrENx7973mg+pC2PDjSd26tfC2sLGCoa7@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Mon, 14 Feb 2011 15:25:49 -0800
Message-ID: <AANLkTinD5M5MbqeMKar-DgpKaU3EAWHZVD9Y0zPfG1ok@mail.gmail.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: multipart/alternative; boundary=0003255752fe7baaa2049c465f2a
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Feb 2011 23:25:50 -0000

--0003255752fe7baaa2049c465f2a
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On Mon, Feb 14, 2011 at 12:34, Gabriel Montenegro <
Gabriel.Montenegro@microsoft.com> wrote:

> In A-2 and B, it seems you reversed the Pros and Cons.
>

Oops. Yes, it's reversed...


> I=92m not clear on the algorithm for B. Could you formulate in terms of p=
eers
> A and B and clarify which side is doing what?
>

Here's pseudo code for [B].

private closeWriteChannel() {
  socket.send(CLOSE_FRAME);
  writeChannelClosed =3D true;
}

public initiateClose() {
  closeWriteChannel();
}

public onReceivedCloseFrame() {
  if (!writeChannelClosed) {
    closeWriteChannel();
  }
  socket.close();
}

Here's what happens on each peer.

Normal case:

1. Peer A initiates close by sending a Close frame to peer B
2. Peer B receives a Close frame
3. Peer B sends a Close frame to peer A
4. Peer B closes the underlying transport channel
5. Peer A receives a Close frame
6. Peer A closes the underlying transport channel

In case both side initiate close at approximately same time:

1.
Peer A initiates close by sending a Close frame to peer B
Peer B initiates close by sending a Close frame to peer A
2.
Peer A receives a Close frame
Peer B receives a Close frame
3.
Peer A closes the underlying transport channel
Peer B closes the underlying transport channel


> At any rate, the cons of adding a wait state and additional complexity in
> the protocol is why I prefer the simplicity of A.
>
>
>
> Most of the time, there won=92t be a gracious Close, as users will kill t=
he
> browser window, exit out of the tab, etc. So I fear we=92re complicating =
the
> protocol for dubious benefits. We have to deal with sudden termination
> anyway.  At any rate, even if the RST prevents the other peer from receiv=
ing
> the WS_Close, the intermediaries will see it.
>

Yes, as far as intermediaries are built to deal with such RST.


>
>
> This is a case of added complexity for very little benefit.
>

I'm not so eager to adopt B. Hmm, ok, how about putting only A-1 as require=
d
spec, and some note for implementor explaining the RST issue and A-2
(Yutaka's idea) as optional solution?

Takeshi

--0003255752fe7baaa2049c465f2a
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Mon, Feb 14, 2011 at 12:34, Gabriel Montenegr=
o <span dir=3D"ltr">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.com"=
 target=3D"_blank">Gabriel.Montenegro@microsoft.com</a>&gt;</span> wrote:<b=
r><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:=
1px #ccc solid;padding-left:1ex">


<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple"><div><p class=3D"MsoNorm=
al"><span style=3D"font-size:11.0pt;color:#1F497D">In A-2 and B, it seems y=
ou reversed the Pros and Cons.</span></p></div></div></blockquote><div><br>=
</div>


<div>Oops. Yes, it&#39;s reversed...</div><div>=A0</div><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex"><div lang=3D"EN-US" link=3D"blue" vlink=3D"purple"><div><p cl=
ass=3D"MsoNormal">


<span style=3D"font-size:11.0pt;color:#1F497D">I=92m not clear on the algor=
ithm for B. Could you formulate in terms of peers A and B and clarify which=
 side is doing what?</span></p></div></div></blockquote><div><br></div><div=
>

Here&#39;s pseudo code for [B].</div><div><br></div><div>private closeWrite=
Channel() {</div><div>=A0=A0<span style=3D"border-collapse:collapse;font-fa=
mily:arial, sans-serif;font-size:13px">socket.send(CLOSE_FRAME);</span></di=
v>


<div><span style=3D"border-collapse:collapse;font-family:arial, sans-serif;=
font-size:13px">=A0=A0writeChannelClosed =3D true;</span><span style=3D"bor=
der-collapse:collapse;font-family:arial, sans-serif;font-size:13px">=A0</sp=
an></div>


<div>}</div><div><br></div><div>public initiateClose() {</div><div><span st=
yle=3D"border-collapse:collapse;font-family:arial, sans-serif;font-size:13p=
x"><div>=A0=A0closeWriteChannel();</div><div>
}</div><div><br></div><div>public onReceivedCloseFrame() {</div><div>=A0=A0=
if (!writeChannelClosed) {</div><div>=A0=A0 =A0closeWriteChannel();</div><d=
iv>=A0=A0}</div><div>=A0=A0socket.close();</div><div></div></span></div><di=
v>}</div><div>


<br></div><div>Here&#39;s what happens on each peer.</div><div><br></div><d=
iv>Normal case:</div><div><br></div><div><span style=3D"border-collapse:col=
lapse;font-family:arial, sans-serif;font-size:13px"><div>
1. Peer A initiates close by sending a Close frame to peer B</div><div>2. P=
eer B receives a Close frame</div><div>3. Peer B sends a Close frame to pee=
r A</div><div>4. Peer B closes the underlying transport channel</div><div>


5. Peer A receives a Close frame</div><div>6. Peer A closes the underlying =
transport channel</div><div><div><br></div><div>In case both side initiate =
close at approximately same time:</div><div><br></div><div>1.</div><div>


Peer A initiates close by sending a Close frame to peer B</div><div>Peer B =
initiates close by sending a Close frame to peer A</div><div>2.</div><div>P=
eer A receives a Close frame</div><div>Peer B receives a Close frame</div>


<div>3.</div><div><div>Peer A=A0closes the underlying transport channel</di=
v><div>Peer B=A0closes the underlying transport channel</div></div></div></=
span></div><div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:=
0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">


<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple"><div><p class=3D"MsoNorm=
al"><span style=3D"font-size:11.0pt;color:#1F497D">At any rate, the cons of=
 adding a wait state and additional complexity in the protocol is why I pre=
fer the simplicity of A.</span></p>


<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">=A0</=
span></p><p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;color:#1F49=
7D">Most of the time, there won=92t be a gracious Close, as users will kill=
 the browser window, exit out of the tab, etc. So I fear we=92re complicati=
ng the protocol for dubious benefits. We have to deal with sudden terminati=
on anyway. =A0At any rate, even if the RST prevents the other peer from rec=
eiving the WS_Close, the intermediaries will see it.</span></p>


</div></div></blockquote><div><br></div><div>Yes, as far as intermediaries =
are built to deal with such RST.</div><div>=A0</div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex">


<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple"><div><p class=3D"MsoNorm=
al"><span style=3D"font-size:11.0pt;color:#1F497D"> </span></p><p class=3D"=
MsoNormal"><span style=3D"font-size:11.0pt;color:#1F497D">=A0</span></p><p =
class=3D"MsoNormal">


<span style=3D"font-size:11.0pt;color:#1F497D">This is a case of added comp=
lexity for very little benefit.</span></p></div></div></blockquote><div><br=
></div><div>I&#39;m not so eager to adopt B. Hmm, ok, how about putting onl=
y A-1 as required spec, and some note for implementor explaining the RST is=
sue and A-2 (Yutaka&#39;s idea) as optional solution?</div>


<div><br></div><div>Takeshi</div></div>

--0003255752fe7baaa2049c465f2a--

From Yutaka_Takeda@PlayStation.Sony.Com  Mon Feb 14 16:14:20 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 680723A6DE6 for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 16:14:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.459
X-Spam-Level: 
X-Spam-Status: No, score=-5.459 tagged_above=-999 required=5 tests=[AWL=-0.395, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_32=0.6, J_CHICKENPOX_35=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 66LmCkL2OJUj for <hybi@core3.amsl.com>; Mon, 14 Feb 2011 16:14:19 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 691583A6D7D for <hybi@ietf.org>; Mon, 14 Feb 2011 16:14:15 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021416143193-541947 ; Mon, 14 Feb 2011 16:14:31 -0800 
In-Reply-To: <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
MIME-Version: 1.0
X-KeepSent: 161FAA38:F9E0465F-88257837:007F80AD; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF161FAA38.F9E0465F-ON88257837.007F80AD-88257838.00015665@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Mon, 14 Feb 2011 16:14:35 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/14/2011 04:14:31 PM, Serialize complete at 02/14/2011 04:14:31 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/14/2011 04:14:31 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/14/2011 04:14:40 PM, Serialize complete at 02/14/2011 04:14:40 PM
Content-Type: multipart/alternative; boundary="=_alternative 0001566388257838_="
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 00:14:20 -0000

This is a multipart message in MIME format.
--=_alternative 0001566388257838_=
Content-Type: text/plain; charset="US-ASCII"

Hi Takeshi-san,

My comments inline..

Takeshi Yoshino <tyoshino@google.com> wrote on 02/11/2011 04:17:44 PM:

> Hi Yutaka,
> 
> Thank you for joining the discussion.
> 
> Good point. I know that close(2) with incoming data remaining unread
> in kernel causes RST for example on Linux. It looks like this is 
> very platform dependent.

Yes, that may be platform dependent. At least, my linux (Ubuntu 9.04)
and my Windows XP SP3 send RST on close() when there's data in the receive
buffer.

> Let me confirm your claim. Here, you mean that RST coming after 
> PSH(Close frame octets) may cause trouble the receiver side in recv-
> ing Close frame octets?

Yes, but not limited to it. recv() may allow receiver to read data reached 

before RST(on Linux), but any send() after RST will fail with ECONRESET 
for sure. 
On this send error, typical implementation may close socket without 
bothering 
to read data in the receive buffer.

> In a bit different context but I see that 
> Jamie is also saying so in http://www.ietf.org/mail-
> archive/web/hybi/current/msg01044.html. On what platform this really
> occurs for example? Just curious. Linux socket allows us to recv 
> data PSH-ed before RST, then ECONNRESET is returned, so I missed this 
point.

Yes, my linux, too it lets receiver to read data received before RST.
My windows, though, does not seem to let receiver to read the data and 
recv()
returned 'ECONNRESET' right away.

# If we need some experiment, I can help.


> If we still take the way to drop Close reply,
> - Just as a hint for intermediaries to know the session is abandoned
> earlier than transport layer phenomenon (as Gabriel first 
> suggested), it's still worth try to send out Close and let 
> intermediaries see it, I think. We don't have to make it sure that 
> it's seen by intermediaries or delivered to the other peer.

# I am still not sure why 'intermediaries' need to see it. I will look 
into Gabriels suggestion.

> - If we decide to let a Close frame carry error code (as Greg and 
> Brodie suggest), yes, it may be problematic that Close frames are 
> dropped even though there's no network/intermediate problem.

Right.

> IIRC, there was discussion in designing -00 closing handshake that 
> we should avoid underlying transport layer's semantics in realizing 
> WebSocket layer event. To follow this philosophy, we could replace 
> the last FIN with Close frame. i.e. we again ask both sides send a 
> Close frame so that both sides can safely invoke close(2) after 
> seeing Close frame.

In browser usage, can we actually wait for Close frame from the peer
after sending Close frame (=app already closed.) ?
When user jumps to another page, or close browser, is WS-layer able
to wait for Close frame to begin with? It just occurred to me...
(I have no knowledge in browser design/policy.)

Best.
- Yutaka

--=_alternative 0001566388257838_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Hi Takeshi-san,</font>
<br>
<br><font size=2 face="sans-serif">My comments inline..</font>
<br>
<br><tt><font size=2>Takeshi Yoshino &lt;tyoshino@google.com&gt; wrote
on 02/11/2011 04:17:44 PM:<br>
<br>
&gt; Hi Yutaka,</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Thank you for joining the discussion.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Good point.&nbsp;I&nbsp;know that close(2) with incoming data remaining
unread<br>
&gt; in kernel causes RST for example on Linux. It looks like this is <br>
&gt; very platform dependent.</font></tt>
<br>
<br><tt><font size=2>Yes, that may be platform dependent. At least, my
linux (Ubuntu 9.04)</font></tt>
<br><tt><font size=2>and my Windows XP SP3 send RST on close() when there's
data in the receive</font></tt>
<br><tt><font size=2>buffer.</font></tt>
<br>
<br><tt><font size=2>&gt; Let me confirm your claim. Here, you mean that
RST coming after <br>
&gt; PSH(Close frame octets) may cause trouble the receiver side in recv-<br>
&gt; ing Close frame octets?</font></tt>
<br>
<br><tt><font size=2>Yes, but not limited to it. recv() may allow receiver
to read data reached </font></tt>
<br><tt><font size=2>before RST(on Linux), but any send() after RST will
fail with ECONRESET for sure. </font></tt>
<br><tt><font size=2>On this send error, typical implementation may close
socket without bothering </font></tt>
<br><tt><font size=2>to read data in the receive buffer.</font></tt>
<br>
<br><tt><font size=2>&gt; In a bit different context but I see that <br>
&gt; Jamie is also saying so in&nbsp;http://www.ietf.org/mail-<br>
&gt; archive/web/hybi/current/msg01044.html. On what platform this really<br>
&gt; occurs for example? Just curious.&nbsp;Linux socket allows us to recv
<br>
&gt; data PSH-ed before RST, then ECONNRESET is returned, so I missed this
point.</font></tt>
<br>
<br><tt><font size=2>Yes, my linux, too it lets receiver to read data received
before RST.</font></tt>
<br><tt><font size=2>My windows, though, does not seem to let receiver
to read the data and recv()</font></tt>
<br><tt><font size=2>returned 'ECONNRESET' right away.</font></tt>
<br>
<br><tt><font size=2># If we need some experiment, I can help.</font></tt>
<br>
<br>
<br><tt><font size=2>&gt; If we still take the way to drop Close reply,</font></tt>
<br><tt><font size=2>&gt; - Just as a hint for intermediaries to know the
session is abandoned<br>
&gt; earlier than transport layer phenomenon (as Gabriel first <br>
&gt; suggested), it's still worth try to send out Close and let <br>
&gt; intermediaries see it, I think. We don't have to make it sure that
<br>
&gt; it's seen by intermediaries or delivered to the other peer.</font></tt>
<br>
<br><tt><font size=2># I am still not sure why 'intermediaries' need to
see it. I will look into Gabriels suggestion.</font></tt>
<br>
<br><tt><font size=2>&gt; - If we decide to let a Close frame carry error
code (as Greg and <br>
&gt; Brodie suggest), yes, it may be problematic that Close frames are
<br>
&gt; dropped even though there's no network/intermediate problem.</font></tt>
<br>
<br><tt><font size=2>Right.</font></tt>
<br>
<br><tt><font size=2>&gt; IIRC, there was discussion in designing -00 closing
handshake that <br>
&gt; we should avoid underlying transport layer's semantics in realizing
<br>
&gt; WebSocket layer event. To follow this philosophy, we could replace
<br>
&gt; the last FIN with Close frame. i.e. we again ask both sides send a
<br>
&gt; Close frame so that both sides can safely invoke close(2) after <br>
&gt; seeing Close frame.</font></tt>
<br>
<br><tt><font size=2>In browser usage, can we actually wait for Close frame
from the peer</font></tt>
<br><tt><font size=2>after sending Close frame (=app already closed.) ?</font></tt>
<br><tt><font size=2>When user jumps to another page, or close browser,
is WS-layer able</font></tt>
<br><tt><font size=2>to wait for Close frame to begin with? It just occurred
to me...</font></tt>
<br><tt><font size=2>(I have no knowledge in browser design/policy.)</font></tt>
<br>
<br><tt><font size=2>Best.</font></tt>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
--=_alternative 0001566388257838_=--

From Yutaka_Takeda@PlayStation.Sony.Com  Mon Feb 14 17:21:24 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 573413A6D9B; Mon, 14 Feb 2011 17:21:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.423
X-Spam-Level: 
X-Spam-Status: No, score=-5.423 tagged_above=-999 required=5 tests=[AWL=-0.359, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_22=0.6, J_CHICKENPOX_31=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OGX8xNz2571Q; Mon, 14 Feb 2011 17:21:19 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 7E4673A6A0C; Mon, 14 Feb 2011 17:21:19 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021417213830-544629 ; Mon, 14 Feb 2011 17:21:38 -0800 
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
MIME-Version: 1.0
X-KeepSent: 30386040:0060CBE1-88257838:0006060F; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF30386040.0060CBE1-ON88257838.0006060F-88257838.00077B4D@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Mon, 14 Feb 2011 17:21:42 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/14/2011 05:21:37 PM, Serialize complete at 02/14/2011 05:21:37 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/14/2011 05:21:38 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/14/2011 05:21:44 PM, Serialize complete at 02/14/2011 05:21:44 PM
Content-Type: multipart/alternative; boundary="=_alternative 00077B4B88257838_="
Cc: hybi-bounces@ietf.org, "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 01:21:24 -0000

This is a multipart message in MIME format.
--=_alternative 00077B4B88257838_=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="ISO-8859-1"

Hi Gabriel,

> Most of the time, there won?t be a gracious Close, as users will=20
> kill the browser window, exit out of the tab, etc. So I fear we?re=20
> complicating the protocol for dubious benefits. We have to deal with
> sudden termination anyway.  At any rate, even if the RST prevents=20
> the other peer from receiving the WS=5FClose, the intermediaries will see=
=20
it.=20

I was wondering about it.

> This is a case of added complexity for very little benefit.

Say, a client is trying to send an application data (for example,=20
'presence' update) before closing=20
WebSocket. The application data may not reach the server application=20
either in some=20
condition. It is not just 'Close frame' that may not reach.

If we cannot handle 'closing state' in the case where user kills the=20
browser window, then the
consequence would be the loss of *application data*, which may not be=20
trivial...

Any thoughts?
--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060


hybi-bounces@ietf.org wrote on 02/14/2011 12:34:01 PM:

> In A-2 and B, it seems you reversed the Pros and Cons.
>=20
> I?m not clear on the algorithm for B. Could you formulate in terms=20
> of peers A and B and clarify which side is doing what?
>=20
> At any rate, the cons of adding a wait state and additional=20
> complexity in the protocol is why I prefer the simplicity of A.
>=20
> Most of the time, there won?t be a gracious Close, as users will=20
> kill the browser window, exit out of the tab, etc. So I fear we?re=20
> complicating the protocol for dubious benefits. We have to deal with
> sudden termination anyway.  At any rate, even if the RST prevents=20
> the other peer from receiving the WS=5FClose, the intermediaries will see=
=20
it.=20
>=20
> This is a case of added complexity for very little benefit.
>=20
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of=20
> Takeshi Yoshino
> Sent: Monday, February 14, 2011 11:33
> To: hybi@ietf.org
> Subject: Re: [hybi] Clarify the role of closing handshake
>=20
> I'd like to summarize proposals again. It seems there's consensus on
> dropping acknowledgement feature, so I list only the others.
>=20
> I prefer [B].
>=20
> [Proposal A-1]
> Role of Close frame
> - Help intermediaries know the session is no longer used
> - Pass status code to the other peer
>=20
> Algorithm
> - To initiate close, a peer MUST send Close frame, and then the peer=20
MUST
> -- close the underlying transport channel ... (*)
> - Once a peer received a Close frame, the peer MUST close the=20
> underlying transport channel
> - A peer MUST NOT send any more data (including control) after=20
> sending or receiving a Close frame
>=20
> Pros
> - There's no wait state needs to be handled after a peer decided to=20
> abandon the WebSocket
>=20
> Cons
> - When a peer call close(2) with some data left not recv-ed, the=20
> peer's TCP stack may send out RST. This can impede the other peer=20
> from receiving Close frame or even some data before a Close frame
>=20
> [Proposal A-2]
> Replace (*) in A-2 with this
> -- wait until the underlying transport channel is closed (by recv=20
> until EoS, wait for close event, etc.) with some timeout
>=20
> Pros
> - There's a wait state needs to be handled after a peer decided to=20
> abandon the WebSocket
>=20
> Cons
> - No more data is coming after Close frame, and therefore a peer can
> call close(2) on its TCP socket safely
> - The algorithm depends on the underlying transport channel's EoS signal
>=20
> [Proposal B]
> Role of Close frame
> - Help intermediaries know the session is no longer used
> - Pass status code to the other peer
> - Let each peer call close(2) on its TCP socket safely
>=20
> Algorithm
> - To initiate close, send a Close frame
> - Once received a Close frame
> -- (already sent a Close frame) close the underlying transport channel
> -- (otherwise) send a Close frame, and then close the underlying=20
> transport channel
> - A peer MUST NOT send any more data (including control) after=20
> sending a Close frame
>=20
> Reception of a Close frame means
> - All data the other peer sent has arrived
>=20
> Reception of a Close frame DOES NOT mean
> - All data has been delivered to the other peer
>=20
> Pros
> - There's a wait state needs to be handled after a peer decided to=20
> abandon the WebSocket
>=20
> Cons
> - No more data is coming after a Close frame, and therefore a peer=20
> can call close(2) on its TCP socket safely
>  =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 00077B4B88257838_=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="ISO-8859-1"


<br><tt><font size=3D2>Hi Gabriel,</font></tt>
<br>
<br><tt><font size=3D2>&gt; Most of the time, there won&#8217;t be a gracio=
us
Close, as users will <br>
&gt; kill the browser window, exit out of the tab, etc. So I fear we&#8217;=
re
<br>
&gt; complicating the protocol for dubious benefits. We have to deal with<b=
r>
&gt; sudden termination anyway. &nbsp;At any rate, even if the RST prevents
<br>
&gt; the other peer from receiving the WS=5FClose, the intermediaries will
see it. </font></tt>
<br>
<br><tt><font size=3D2>I was wondering about it.</font></tt>
<br>
<br><tt><font size=3D2>&gt; This is a case of added complexity for very lit=
tle
benefit.</font></tt>
<br>
<br><font size=3D2 face=3D"sans-serif">Say, a client is trying to send an a=
pplication
data (for example, 'presence' update) before closing </font>
<br><font size=3D2 face=3D"sans-serif">WebSocket. The application data may
not reach the server application either in some </font>
<br><font size=3D2 face=3D"sans-serif">condition. It is not just 'Close fra=
me'
that may not reach.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">If we cannot handle 'closing state'
in the case where user kills the browser window, then the</font>
<br><font size=3D2 face=3D"sans-serif">consequence would be the loss of *ap=
plication
data*, which may not be trivial...</font>
<br>
<br><font size=3D2 face=3D"sans-serif">Any thoughts?</font>
<br><font size=3D2 face=3D"sans-serif">--<br>
Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
</font>
<br>
<br><tt><font size=3D2>hybi-bounces@ietf.org wrote on 02/14/2011 12:34:01
PM:<br>
<br>
&gt; In A-2 and B, it seems you reversed the Pros and Cons.</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; I&#8217;m not clear on the algorithm for B. Cou=
ld
you formulate in terms <br>
&gt; of peers A and B and clarify which side is doing what?</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; At any rate, the cons of adding a wait state
and additional <br>
&gt; complexity in the protocol is why I prefer the simplicity of A.</font>=
</tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Most of the time, there won&#8217;t be a gracio=
us
Close, as users will <br>
&gt; kill the browser window, exit out of the tab, etc. So I fear we&#8217;=
re
<br>
&gt; complicating the protocol for dubious benefits. We have to deal with<b=
r>
&gt; sudden termination anyway. &nbsp;At any rate, even if the RST prevents
<br>
&gt; the other peer from receiving the WS=5FClose, the intermediaries will
see it. </font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; This is a case of added complexity for very lit=
tle
benefit.</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; From: hybi-bounces@ietf.org [mailto:hybi-bounce=
s@ietf.org]
On Behalf Of <br>
&gt; Takeshi Yoshino<br>
&gt; Sent: Monday, February 14, 2011 11:33<br>
&gt; To: hybi@ietf.org<br>
&gt; Subject: Re: [hybi] Clarify the role of closing handshake</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; I'd like to summarize proposals again. It seems
there's consensus on<br>
&gt; dropping acknowledgement feature, so I list only the others.</font></t=
t>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; I prefer [B].</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; [Proposal A-1]</font></tt>
<br><tt><font size=3D2>&gt; Role of Close frame</font></tt>
<br><tt><font size=3D2>&gt; - Help intermediaries know the session is no
longer used</font></tt>
<br><tt><font size=3D2>&gt; - Pass status code to the other peer</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Algorithm</font></tt>
<br><tt><font size=3D2>&gt; - To initiate close, a peer MUST send Close fra=
me,
and then the peer MUST</font></tt>
<br><tt><font size=3D2>&gt; -- close the underlying transport channel ...
(*)</font></tt>
<br><tt><font size=3D2>&gt; - Once a peer received a Close frame, the peer
MUST close the <br>
&gt; underlying transport channel</font></tt>
<br><tt><font size=3D2>&gt; - A peer MUST NOT send any more data (including
control) after <br>
&gt; sending or receiving a Close frame</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Pros</font></tt>
<br><tt><font size=3D2>&gt; - There's no wait state needs to be handled aft=
er
a peer decided to <br>
&gt; abandon the WebSocket</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Cons</font></tt>
<br><tt><font size=3D2>&gt; - When a peer call close(2) with some data left
not recv-ed, the <br>
&gt; peer's TCP stack may send out RST. This can impede the other peer
<br>
&gt; from receiving Close frame or even some data before a Close frame</fon=
t></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; [Proposal A-2]</font></tt>
<br><tt><font size=3D2>&gt; Replace (*) in A-2 with this</font></tt>
<br><tt><font size=3D2>&gt; -- wait until the underlying transport channel
is closed (by recv <br>
&gt; until EoS, wait for close event, etc.) with some timeout</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Pros</font></tt>
<br><tt><font size=3D2>&gt; - There's a wait state needs to be handled after
a peer decided to <br>
&gt; abandon the WebSocket</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Cons</font></tt>
<br><tt><font size=3D2>&gt; - No more data is coming after Close frame, and
therefore a peer can<br>
&gt; call close(2) on its TCP socket safely</font></tt>
<br><tt><font size=3D2>&gt; - The algorithm depends on the underlying trans=
port
channel's EoS signal</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; [Proposal B]</font></tt>
<br><tt><font size=3D2>&gt; Role of Close frame</font></tt>
<br><tt><font size=3D2>&gt; - Help intermediaries know the session is no
longer used</font></tt>
<br><tt><font size=3D2>&gt; - Pass status code to the other peer</font></tt>
<br><tt><font size=3D2>&gt; - Let each peer call close(2) on its TCP socket
safely</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Algorithm</font></tt>
<br><tt><font size=3D2>&gt; - To initiate close, send a Close frame</font><=
/tt>
<br><tt><font size=3D2>&gt; - Once received a Close frame</font></tt>
<br><tt><font size=3D2>&gt; -- (already sent a Close frame) close the under=
lying
transport channel</font></tt>
<br><tt><font size=3D2>&gt; -- (otherwise) send a Close frame, and then clo=
se
the underlying <br>
&gt; transport channel</font></tt>
<br><tt><font size=3D2>&gt; - A peer MUST NOT send any more data (including
control) after <br>
&gt; sending a Close frame</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Reception of a Close frame means</font></tt>
<br><tt><font size=3D2>&gt; - All data the other peer sent has arrived</fon=
t></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Reception of a Close frame DOES NOT mean</font>=
</tt>
<br><tt><font size=3D2>&gt; - All data has been delivered to the other peer=
</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Pros</font></tt>
<br><tt><font size=3D2>&gt; - There's a wait state needs to be handled after
a peer decided to <br>
&gt; abandon the WebSocket</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Cons</font></tt>
<br><tt><font size=3D2>&gt; - No more data is coming after a Close frame,
and therefore a peer <br>
&gt; can call close(2) on its TCP socket safely</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 00077B4B88257838_=--

From Gabriel.Montenegro@microsoft.com  Mon Feb 14 17:31:44 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3B4D03A6E02; Mon, 14 Feb 2011 17:31:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.42
X-Spam-Level: 
X-Spam-Status: No, score=-10.42 tagged_above=-999 required=5 tests=[AWL=0.178,  BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Hw2Ix1BkuMG; Mon, 14 Feb 2011 17:31:36 -0800 (PST)
Received: from smtp.microsoft.com (mail3.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id 75F383A6E00; Mon, 14 Feb 2011 17:31:36 -0800 (PST)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Mon, 14 Feb 2011 17:32:00 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) with Microsoft SMTP Server (TLS) id 14.1.270.2; Mon, 14 Feb 2011 17:32:00 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi; Mon, 14 Feb 2011 17:32:00 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: "Yutaka_Takeda@PlayStation.Sony.Com" <Yutaka_Takeda@PlayStation.Sony.Com>
Thread-Topic: [hybi] Clarify the role of closing handshake
Thread-Index: AQHLyLZQD4/LNEvRdUK4csWEI+DaLJP6cYsAgAABlOCAAI+qgIAAoGMAgABJG4CAASvVgIAAOECAgAAF0ICAADMNAIAAEuuAgARUZAD//4iRsIAA2P0A//97msA=
Date: Tue, 15 Feb 2011 01:31:50 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534D@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E142C9@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <OF30386040.0060CBE1-ON88257838.0006060F-88257838.00077B4D@playstation.sony.com>
In-Reply-To: <OF30386040.0060CBE1-ON88257838.0006060F-88257838.00077B4D@playstation.sony.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534DTK5EX14MBXW605w_"
MIME-Version: 1.0
Cc: "hybi-bounces@ietf.org" <hybi-bounces@ietf.org>, "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 01:31:44 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534DTK5EX14MBXW605w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Not sure why the presence update would not have happened beforehand. At any=
 rate, I'm sure there's apps where that last bit of data matters. But there=
's also apps in which that last bit of data doesn't matter at all. If an ap=
p really cares, it should handle its data draining itself, and only issue t=
he WS_Close() afterwards.

From: Yutaka_Takeda@PlayStation.Sony.Com [mailto:Yutaka_Takeda@PlayStation.=
Sony.Com]
Sent: 14 February, 2011 17:22
To: Gabriel Montenegro
Cc: hybi@ietf.org; hybi-bounces@ietf.org; Takeshi Yoshino
Subject: Re: [hybi] Clarify the role of closing handshake


Hi Gabriel,

> Most of the time, there won't be a gracious Close, as users will
> kill the browser window, exit out of the tab, etc. So I fear we're
> complicating the protocol for dubious benefits. We have to deal with
> sudden termination anyway.  At any rate, even if the RST prevents
> the other peer from receiving the WS_Close, the intermediaries will see i=
t.

I was wondering about it.

> This is a case of added complexity for very little benefit.

Say, a client is trying to send an application data (for example, 'presence=
' update) before closing
WebSocket. The application data may not reach the server application either=
 in some
condition. It is not just 'Close frame' that may not reach.

If we cannot handle 'closing state' in the case where user kills the browse=
r window, then the
consequence would be the loss of *application data*, which may not be trivi=
al...

Any thoughts?
--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060


hybi-bounces@ietf.org<mailto:hybi-bounces@ietf.org> wrote on 02/14/2011 12:=
34:01 PM:

> In A-2 and B, it seems you reversed the Pros and Cons.
>
> I'm not clear on the algorithm for B. Could you formulate in terms
> of peers A and B and clarify which side is doing what?
>
> At any rate, the cons of adding a wait state and additional
> complexity in the protocol is why I prefer the simplicity of A.
>
> Most of the time, there won't be a gracious Close, as users will
> kill the browser window, exit out of the tab, etc. So I fear we're
> complicating the protocol for dubious benefits. We have to deal with
> sudden termination anyway.  At any rate, even if the RST prevents
> the other peer from receiving the WS_Close, the intermediaries will see i=
t.
>
> This is a case of added complexity for very little benefit.
>
> From: hybi-bounces@ietf.org<mailto:hybi-bounces@ietf.org> [mailto:hybi-bo=
unces@ietf.org]<mailto:[mailto:hybi-bounces@ietf.org]> On Behalf Of
> Takeshi Yoshino
> Sent: Monday, February 14, 2011 11:33
> To: hybi@ietf.org<mailto:hybi@ietf.org>
> Subject: Re: [hybi] Clarify the role of closing handshake
>
> I'd like to summarize proposals again. It seems there's consensus on
> dropping acknowledgement feature, so I list only the others.
>
> I prefer [B].
>
> [Proposal A-1]
> Role of Close frame
> - Help intermediaries know the session is no longer used
> - Pass status code to the other peer
>
> Algorithm
> - To initiate close, a peer MUST send Close frame, and then the peer MUST
> -- close the underlying transport channel ... (*)
> - Once a peer received a Close frame, the peer MUST close the
> underlying transport channel
> - A peer MUST NOT send any more data (including control) after
> sending or receiving a Close frame
>
> Pros
> - There's no wait state needs to be handled after a peer decided to
> abandon the WebSocket
>
> Cons
> - When a peer call close(2) with some data left not recv-ed, the
> peer's TCP stack may send out RST. This can impede the other peer
> from receiving Close frame or even some data before a Close frame
>
> [Proposal A-2]
> Replace (*) in A-2 with this
> -- wait until the underlying transport channel is closed (by recv
> until EoS, wait for close event, etc.) with some timeout
>
> Pros
> - There's a wait state needs to be handled after a peer decided to
> abandon the WebSocket
>
> Cons
> - No more data is coming after Close frame, and therefore a peer can
> call close(2) on its TCP socket safely
> - The algorithm depends on the underlying transport channel's EoS signal
>
> [Proposal B]
> Role of Close frame
> - Help intermediaries know the session is no longer used
> - Pass status code to the other peer
> - Let each peer call close(2) on its TCP socket safely
>
> Algorithm
> - To initiate close, send a Close frame
> - Once received a Close frame
> -- (already sent a Close frame) close the underlying transport channel
> -- (otherwise) send a Close frame, and then close the underlying
> transport channel
> - A peer MUST NOT send any more data (including control) after
> sending a Close frame
>
> Reception of a Close frame means
> - All data the other peer sent has arrived
>
> Reception of a Close frame DOES NOT mean
> - All data has been delivered to the other peer
>
> Pros
> - There's a wait state needs to be handled after a peer decided to
> abandon the WebSocket
>
> Cons
> - No more data is coming after a Close frame, and therefore a peer
> can call close(2) on its TCP socket safely
>  _______________________________________________
> hybi mailing list
> hybi@ietf.org<mailto:hybi@ietf.org>
> https://www.ietf.org/mailman/listinfo/hybi

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534DTK5EX14MBXW605w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV=3D"Content-Type" CONTENT=
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros=
oft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
tt
	{mso-style-priority:99;
	font-family:"Courier New";}
span.EmailStyle18
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";
	mso-fareast-language:JA;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue vli=
nk=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span style=3D'f=
ont-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Not sure =
why the presence update would not have happened beforehand. At any rate, I&=
#8217;m sure there&#8217;s apps where that last bit of data matters. But th=
ere&#8217;s also apps in which that last bit of data doesn&#8217;t matter a=
t all. If an app really cares, it should handle its data draining itself, a=
nd only issue the WS_Close() afterwards. <o:p></o:p></span></p><p class=3DM=
soNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"=
;color:#1F497D'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <o:p></o:p></span></p>=
<div style=3D'border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt'><div><div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;paddin=
g:3.0pt 0in 0in 0in'><p class=3DMsoNormal><b><span style=3D'font-size:10.0p=
t;font-family:"Tahoma","sans-serif"'>From:</span></b><span style=3D'font-si=
ze:10.0pt;font-family:"Tahoma","sans-serif"'> Yutaka_Takeda@PlayStation.Son=
y.Com [mailto:Yutaka_Takeda@PlayStation.Sony.Com] <br><b>Sent:</b> 14 Febru=
ary, 2011 17:22<br><b>To:</b> Gabriel Montenegro<br><b>Cc:</b> hybi@ietf.or=
g; hybi-bounces@ietf.org; Takeshi Yoshino<br><b>Subject:</b> Re: [hybi] Cla=
rify the role of closing handshake<o:p></o:p></span></p></div></div><p clas=
s=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><br><tt><span style=
=3D'font-size:10.0pt'>Hi Gabriel,</span></tt> <br><br><tt><span style=3D'fo=
nt-size:10.0pt'>&gt; Most of the time, there won&#8217;t be a gracious Clos=
e, as users will </span></tt><span style=3D'font-size:10.0pt;font-family:"C=
ourier New"'><br><tt>&gt; kill the browser window, exit out of the tab, etc=
. So I fear we&#8217;re </tt><br><tt>&gt; complicating the protocol for dub=
ious benefits. We have to deal with</tt><br><tt>&gt; sudden termination any=
way. &nbsp;At any rate, even if the RST prevents </tt><br><tt>&gt; the othe=
r peer from receiving the WS_Close, the intermediaries will see it. </tt></=
span><br><br><tt><span style=3D'font-size:10.0pt'>I was wondering about it.=
</span></tt> <br><br><tt><span style=3D'font-size:10.0pt'>&gt; This is a ca=
se of added complexity for very little benefit.</span></tt> <br><br><span s=
tyle=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>Say, a client is=
 trying to send an application data (for example, 'presence' update) before=
 closing </span><br><span style=3D'font-size:10.0pt;font-family:"Arial","sa=
ns-serif"'>WebSocket. The application data may not reach the server applica=
tion either in some </span><br><span style=3D'font-size:10.0pt;font-family:=
"Arial","sans-serif"'>condition. It is not just 'Close frame' that may not =
reach.</span> <br><br><span style=3D'font-size:10.0pt;font-family:"Arial","=
sans-serif"'>If we cannot handle 'closing state' in the case where user kil=
ls the browser window, then the</span> <br><span style=3D'font-size:10.0pt;=
font-family:"Arial","sans-serif"'>consequence would be the loss of *applica=
tion data*, which may not be trivial...</span> <br><br><span style=3D'font-=
size:10.0pt;font-family:"Arial","sans-serif"'>Any thoughts?</span> <br><spa=
n style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>--<br>Yutaka =
Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>Office: 650 655 74=
84 &nbsp; Fax: 650 655 8060<br></span><br><br><tt><span style=3D'font-size:=
10.0pt'><a href=3D"mailto:hybi-bounces@ietf.org">hybi-bounces@ietf.org</a> =
wrote on 02/14/2011 12:34:01 PM:</span></tt><span style=3D'font-size:10.0pt=
;font-family:"Courier New"'><br><br><tt>&gt; In A-2 and B, it seems you rev=
ersed the Pros and Cons.</tt></span> <br><tt><span style=3D'font-size:10.0p=
t'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; I&=
#8217;m not clear on the algorithm for B. Could you formulate in terms </sp=
an></tt><span style=3D'font-size:10.0pt;font-family:"Courier New"'><br><tt>=
&gt; of peers A and B and clarify which side is doing what?</tt></span> <br=
><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span=
 style=3D'font-size:10.0pt'>&gt; At any rate, the cons of adding a wait sta=
te and additional </span></tt><span style=3D'font-size:10.0pt;font-family:"=
Courier New"'><br><tt>&gt; complexity in the protocol is why I prefer the s=
implicity of A.</tt></span> <br><tt><span style=3D'font-size:10.0pt'>&gt; &=
nbsp;</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; Most of the=
 time, there won&#8217;t be a gracious Close, as users will </span></tt><sp=
an style=3D'font-size:10.0pt;font-family:"Courier New"'><br><tt>&gt; kill t=
he browser window, exit out of the tab, etc. So I fear we&#8217;re </tt><br=
><tt>&gt; complicating the protocol for dubious benefits. We have to deal w=
ith</tt><br><tt>&gt; sudden termination anyway. &nbsp;At any rate, even if =
the RST prevents </tt><br><tt>&gt; the other peer from receiving the WS_Clo=
se, the intermediaries will see it. </tt></span><br><tt><span style=3D'font=
-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'font-size:10.0=
pt'>&gt; This is a case of added complexity for very little benefit.</span>=
</tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br>=
<tt><span style=3D'font-size:10.0pt'>&gt; From: <a href=3D"mailto:hybi-boun=
ces@ietf.org">hybi-bounces@ietf.org</a> <a href=3D"mailto:[mailto:hybi-boun=
ces@ietf.org]">[mailto:hybi-bounces@ietf.org]</a> On Behalf Of </span></tt>=
<span style=3D'font-size:10.0pt;font-family:"Courier New"'><br><tt>&gt; Tak=
eshi Yoshino</tt><br><tt>&gt; Sent: Monday, February 14, 2011 11:33</tt><br=
><tt>&gt; To: <a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a></tt><br><t=
t>&gt; Subject: Re: [hybi] Clarify the role of closing handshake</tt></span=
> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt>=
<span style=3D'font-size:10.0pt'>&gt; I'd like to summarize proposals again=
. It seems there's consensus on</span></tt><span style=3D'font-size:10.0pt;=
font-family:"Courier New"'><br><tt>&gt; dropping acknowledgement feature, s=
o I list only the others.</tt></span> <br><tt><span style=3D'font-size:10.0=
pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; I=
 prefer [B].</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbs=
p;</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; [Proposal A-1]=
</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; Role of Close fr=
ame</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; - Help interm=
ediaries know the session is no longer used</span></tt> <br><tt><span style=
=3D'font-size:10.0pt'>&gt; - Pass status code to the other peer</span></tt>=
 <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><=
span style=3D'font-size:10.0pt'>&gt; Algorithm</span></tt> <br><tt><span st=
yle=3D'font-size:10.0pt'>&gt; - To initiate close, a peer MUST send Close f=
rame, and then the peer MUST</span></tt> <br><tt><span style=3D'font-size:1=
0.0pt'>&gt; -- close the underlying transport channel ... (*)</span></tt> <=
br><tt><span style=3D'font-size:10.0pt'>&gt; - Once a peer received a Close=
 frame, the peer MUST close the </span></tt><span style=3D'font-size:10.0pt=
;font-family:"Courier New"'><br><tt>&gt; underlying transport channel</tt><=
/span> <br><tt><span style=3D'font-size:10.0pt'>&gt; - A peer MUST NOT send=
 any more data (including control) after </span></tt><span style=3D'font-si=
ze:10.0pt;font-family:"Courier New"'><br><tt>&gt; sending or receiving a Cl=
ose frame</tt></span> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;<=
/span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; Pros</span></tt> =
<br><tt><span style=3D'font-size:10.0pt'>&gt; - There's no wait state needs=
 to be handled after a peer decided to </span></tt><span style=3D'font-size=
:10.0pt;font-family:"Courier New"'><br><tt>&gt; abandon the WebSocket</tt><=
/span> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br=
><tt><span style=3D'font-size:10.0pt'>&gt; Cons</span></tt> <br><tt><span s=
tyle=3D'font-size:10.0pt'>&gt; - When a peer call close(2) with some data l=
eft not recv-ed, the </span></tt><span style=3D'font-size:10.0pt;font-famil=
y:"Courier New"'><br><tt>&gt; peer's TCP stack may send out RST. This can i=
mpede the other peer </tt><br><tt>&gt; from receiving Close frame or even s=
ome data before a Close frame</tt></span> <br><tt><span style=3D'font-size:=
10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&g=
t; [Proposal A-2]</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt;=
 Replace (*) in A-2 with this</span></tt> <br><tt><span style=3D'font-size:=
10.0pt'>&gt; -- wait until the underlying transport channel is closed (by r=
ecv </span></tt><span style=3D'font-size:10.0pt;font-family:"Courier New"'>=
<br><tt>&gt; until EoS, wait for close event, etc.) with some timeout</tt><=
/span> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br=
><tt><span style=3D'font-size:10.0pt'>&gt; Pros</span></tt> <br><tt><span s=
tyle=3D'font-size:10.0pt'>&gt; - There's a wait state needs to be handled a=
fter a peer decided to </span></tt><span style=3D'font-size:10.0pt;font-fam=
ily:"Courier New"'><br><tt>&gt; abandon the WebSocket</tt></span> <br><tt><=
span style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=
=3D'font-size:10.0pt'>&gt; Cons</span></tt> <br><tt><span style=3D'font-siz=
e:10.0pt'>&gt; - No more data is coming after Close frame, and therefore a =
peer can</span></tt><span style=3D'font-size:10.0pt;font-family:"Courier Ne=
w"'><br><tt>&gt; call close(2) on its TCP socket safely</tt></span> <br><tt=
><span style=3D'font-size:10.0pt'>&gt; - The algorithm depends on the under=
lying transport channel's EoS signal</span></tt> <br><tt><span style=3D'fon=
t-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'font-size:10.=
0pt'>&gt; [Proposal B]</span></tt> <br><tt><span style=3D'font-size:10.0pt'=
>&gt; Role of Close frame</span></tt> <br><tt><span style=3D'font-size:10.0=
pt'>&gt; - Help intermediaries know the session is no longer used</span></t=
t> <br><tt><span style=3D'font-size:10.0pt'>&gt; - Pass status code to the =
other peer</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; - Let =
each peer call close(2) on its TCP socket safely</span></tt> <br><tt><span =
style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'f=
ont-size:10.0pt'>&gt; Algorithm</span></tt> <br><tt><span style=3D'font-siz=
e:10.0pt'>&gt; - To initiate close, send a Close frame</span></tt> <br><tt>=
<span style=3D'font-size:10.0pt'>&gt; - Once received a Close frame</span><=
/tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; -- (already sent a Close=
 frame) close the underlying transport channel</span></tt> <br><tt><span st=
yle=3D'font-size:10.0pt'>&gt; -- (otherwise) send a Close frame, and then c=
lose the underlying </span></tt><span style=3D'font-size:10.0pt;font-family=
:"Courier New"'><br><tt>&gt; transport channel</tt></span> <br><tt><span st=
yle=3D'font-size:10.0pt'>&gt; - A peer MUST NOT send any more data (includi=
ng control) after </span></tt><span style=3D'font-size:10.0pt;font-family:"=
Courier New"'><br><tt>&gt; sending a Close frame</tt></span> <br><tt><span =
style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'f=
ont-size:10.0pt'>&gt; Reception of a Close frame means</span></tt> <br><tt>=
<span style=3D'font-size:10.0pt'>&gt; - All data the other peer sent has ar=
rived</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; &nbsp;</spa=
n></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; Reception of a Close =
frame DOES NOT mean</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&g=
t; - All data has been delivered to the other peer</span></tt> <br><tt><spa=
n style=3D'font-size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D=
'font-size:10.0pt'>&gt; Pros</span></tt> <br><tt><span style=3D'font-size:1=
0.0pt'>&gt; - There's a wait state needs to be handled after a peer decided=
 to </span></tt><span style=3D'font-size:10.0pt;font-family:"Courier New"'>=
<br><tt>&gt; abandon the WebSocket</tt></span> <br><tt><span style=3D'font-=
size:10.0pt'>&gt; &nbsp;</span></tt> <br><tt><span style=3D'font-size:10.0p=
t'>&gt; Cons</span></tt> <br><tt><span style=3D'font-size:10.0pt'>&gt; - No=
 more data is coming after a Close frame, and therefore a peer </span></tt>=
<span style=3D'font-size:10.0pt;font-family:"Courier New"'><br><tt>&gt; can=
 call close(2) on its TCP socket safely</tt></span> <br><tt><span style=3D'=
font-size:10.0pt'>&gt; &nbsp;______________________________________________=
_</span></tt><span style=3D'font-size:10.0pt;font-family:"Courier New"'><br=
><tt>&gt; hybi mailing list</tt><br><tt>&gt; <a href=3D"mailto:hybi@ietf.or=
g">hybi@ietf.org</a></tt><br><tt>&gt; <a href=3D"https://www.ietf.org/mailm=
an/listinfo/hybi">https://www.ietf.org/mailman/listinfo/hybi</a></tt></span=
><o:p></o:p></p></div></div></body></html>=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534DTK5EX14MBXW605w_--

From Yutaka_Takeda@PlayStation.Sony.Com  Tue Feb 15 12:24:54 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3BBB13A6D75; Tue, 15 Feb 2011 12:24:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.093
X-Spam-Level: 
X-Spam-Status: No, score=-5.093 tagged_above=-999 required=5 tests=[AWL=-0.629, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_22=0.6, J_CHICKENPOX_31=0.6, J_CHICKENPOX_51=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dOSk-laGkwWe; Tue, 15 Feb 2011 12:24:45 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id AA2F53A6D73; Tue, 15 Feb 2011 12:24:45 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021512250663-574269 ; Tue, 15 Feb 2011 12:25:06 -0800 
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534D@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
MIME-Version: 1.0
X-KeepSent: 5442EF1E:2B5095C9-88257838:006DA28B; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF5442EF1E.2B5095C9-ON88257838.006DA28B-88257838.00702999@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Tue, 15 Feb 2011 12:25:06 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/15/2011 12:25:06 PM, Serialize complete at 02/15/2011 12:25:06 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 12:25:06 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 12:25:12 PM, Serialize complete at 02/15/2011 12:25:12 PM
Content-Type: multipart/alternative; boundary="=_alternative 0070299788257838_="
Cc: "hybi-bounces@ietf.org" <hybi-bounces@ietf.org>, "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 20:24:54 -0000

This is a multipart message in MIME format.
--=_alternative 0070299788257838_=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="ISO-8859-1"

> If an app really cares, it should handle its data=20
> draining itself, and only issue the WS=5FClose() afterwards.=20

So, now the question here is WHO should be responsible for the 'last-bit=20
draining'.

If application wants to send a data to a server when browser is closing=20
(triggered by user),
for example, is there a way to be sure that the server app received it?

I have embarrassingly limited knowledge of JavaScript but from my=20
understanding,
you can catch such event by using

   window.onbeforeunload =3D function()
   {   return do=5Fsomething() }

With XmlHttpRequest, you can send data *synchrnously" to be sure that the=20
data has
reached the server. But WebSocket, there's no way to block send()=20
operation (there's
no build-in response to websocket). What could be the possible workaround=20
to this case?
(Brwoser/JS/WSAPI expert should chime in here...)

I personally think that WS-layer should be responsible for the last-bit=20
draining rather than
pushing the responsibility to the application. WebSocket being=20
"bidirectional" raises=20
this issue we did not see in request/response based HTTP. With the same=20
reason why
TCP has rather complicated graceful shutdown mechanism, WebSocket should=20
also
take care of this issue, IMO.

Best.

- Yutaka



hybi-bounces@ietf.org wrote on 02/14/2011 05:31:50 PM:

> Not sure why the presence update would not have happened beforehand.
> At any rate, I?m sure there?s apps where that last bit of data=20
> matters. But there?s also apps in which that last bit of data doesn?
> t matter at all. If an app really cares, it should handle its data=20
> draining itself, and only issue the WS=5FClose() afterwards.=20
> =20
> From: Yutaka=5FTakeda@PlayStation.Sony.Com [mailto:
> Yutaka=5FTakeda@PlayStation.Sony.Com]=20
> Sent: 14 February, 2011 17:22
> To: Gabriel Montenegro
> Cc: hybi@ietf.org; hybi-bounces@ietf.org; Takeshi Yoshino
> Subject: Re: [hybi] Clarify the role of closing handshake
>=20
>=20
> Hi Gabriel,=20
>=20
> > Most of the time, there won?t be a gracious Close, as users will=20
> > kill the browser window, exit out of the tab, etc. So I fear we?re=20
> > complicating the protocol for dubious benefits. We have to deal with
> > sudden termination anyway.  At any rate, even if the RST prevents=20
> > the other peer from receiving the WS=5FClose, the intermediaries will=20
see it.=20
>=20
> I was wondering about it.=20
>=20
> > This is a case of added complexity for very little benefit.=20
>=20
> Say, a client is trying to send an application data (for example,=20
> 'presence' update) before closing=20
> WebSocket. The application data may not reach the server application
> either in some=20
> condition. It is not just 'Close frame' that may not reach.=20
>=20
> If we cannot handle 'closing state' in the case where user kills the
> browser window, then the=20
> consequence would be the loss of *application data*, which may not=20
> be trivial...=20
>=20
> Any thoughts?=20
> --
> Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
> Office: 650 655 7484   Fax: 650 655 8060
>=20
>=20
> hybi-bounces@ietf.org wrote on 02/14/2011 12:34:01 PM:
>=20
> > In A-2 and B, it seems you reversed the Pros and Cons.=20
> >=20
> > I?m not clear on the algorithm for B. Could you formulate in terms=20
> > of peers A and B and clarify which side is doing what?=20
> >=20
> > At any rate, the cons of adding a wait state and additional=20
> > complexity in the protocol is why I prefer the simplicity of A.=20
> >=20
> > Most of the time, there won?t be a gracious Close, as users will=20
> > kill the browser window, exit out of the tab, etc. So I fear we?re=20
> > complicating the protocol for dubious benefits. We have to deal with
> > sudden termination anyway.  At any rate, even if the RST prevents=20
> > the other peer from receiving the WS=5FClose, the intermediaries will=20
see it.=20
> >=20
> > This is a case of added complexity for very little benefit.=20
> >=20
> > From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf=20
Of=20
> > Takeshi Yoshino
> > Sent: Monday, February 14, 2011 11:33
> > To: hybi@ietf.org
> > Subject: Re: [hybi] Clarify the role of closing handshake=20
> >=20
> > I'd like to summarize proposals again. It seems there's consensus on
> > dropping acknowledgement feature, so I list only the others.=20
> >=20
> > I prefer [B].=20
> >=20
> > [Proposal A-1]=20
> > Role of Close frame=20
> > - Help intermediaries know the session is no longer used=20
> > - Pass status code to the other peer=20
> >=20
> > Algorithm=20
> > - To initiate close, a peer MUST send Close frame, and then the peer=20
MUST=20
> > -- close the underlying transport channel ... (*)=20
> > - Once a peer received a Close frame, the peer MUST close the=20
> > underlying transport channel=20
> > - A peer MUST NOT send any more data (including control) after=20
> > sending or receiving a Close frame=20
> >=20
> > Pros=20
> > - There's no wait state needs to be handled after a peer decided to=20
> > abandon the WebSocket=20
> >=20
> > Cons=20
> > - When a peer call close(2) with some data left not recv-ed, the=20
> > peer's TCP stack may send out RST. This can impede the other peer=20
> > from receiving Close frame or even some data before a Close frame=20
> >=20
> > [Proposal A-2]=20
> > Replace (*) in A-2 with this=20
> > -- wait until the underlying transport channel is closed (by recv=20
> > until EoS, wait for close event, etc.) with some timeout=20
> >=20
> > Pros=20
> > - There's a wait state needs to be handled after a peer decided to=20
> > abandon the WebSocket=20
> >=20
> > Cons=20
> > - No more data is coming after Close frame, and therefore a peer can
> > call close(2) on its TCP socket safely=20
> > - The algorithm depends on the underlying transport channel's EoS=20
signal=20
> >=20
> > [Proposal B]=20
> > Role of Close frame=20
> > - Help intermediaries know the session is no longer used=20
> > - Pass status code to the other peer=20
> > - Let each peer call close(2) on its TCP socket safely=20
> >=20
> > Algorithm=20
> > - To initiate close, send a Close frame=20
> > - Once received a Close frame=20
> > -- (already sent a Close frame) close the underlying transport channel =


> > -- (otherwise) send a Close frame, and then close the underlying=20
> > transport channel=20
> > - A peer MUST NOT send any more data (including control) after=20
> > sending a Close frame=20
> >=20
> > Reception of a Close frame means=20
> > - All data the other peer sent has arrived=20
> >=20
> > Reception of a Close frame DOES NOT mean=20
> > - All data has been delivered to the other peer=20
> >=20
> > Pros=20
> > - There's a wait state needs to be handled after a peer decided to=20
> > abandon the WebSocket=20
> >=20
> > Cons=20
> > - No more data is coming after a Close frame, and therefore a peer=20
> > can call close(2) on its TCP socket safely=20
> >  =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
> =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 0070299788257838_=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="ISO-8859-1"


<br><tt><font size=3D2>&gt; If an app really cares, it should handle its
data <br>
&gt; draining itself, and only issue the WS=5FClose() afterwards. </font></=
tt>
<br>
<br><font size=3D2 face=3D"sans-serif">So, now the question here is WHO sho=
uld
be responsible for the 'last-bit draining'.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">If application wants to send a data
to a server when browser is closing (triggered by user),</font>
<br><font size=3D2 face=3D"sans-serif">for example, is there a way to be su=
re
that the server app received it?</font>
<br>
<br><font size=3D2 face=3D"sans-serif">I have embarrassingly limited knowle=
dge
of JavaScript but from my understanding,</font>
<br><font size=3D2 face=3D"sans-serif">you can catch such event by using</f=
ont>
<br>
<br><font size=3D2 face=3D"sans-serif">&nbsp; &nbsp;window.onbeforeunload =
=3D
function()</font>
<br><font size=3D2 face=3D"sans-serif">&nbsp; &nbsp;{ &nbsp; return do=5Fso=
mething()
}</font>
<br>
<br><font size=3D2 face=3D"sans-serif">With XmlHttpRequest, you can send da=
ta
*synchrnously&quot; to be sure that the data has</font>
<br><font size=3D2 face=3D"sans-serif">reached the server. But WebSocket, t=
here's
no way to block send() operation (there's</font>
<br><font size=3D2 face=3D"sans-serif">no build-in response to websocket).
What could be the possible workaround to this case?</font>
<br><font size=3D2 face=3D"sans-serif">(Brwoser/JS/WSAPI expert should chime
in here...)</font>
<br>
<br><font size=3D2 face=3D"sans-serif">I personally think that WS-layer sho=
uld
be responsible for the last-bit draining rather than</font>
<br><font size=3D2 face=3D"sans-serif">pushing the responsibility to the ap=
plication.
WebSocket being &quot;bidirectional&quot; raises </font>
<br><font size=3D2 face=3D"sans-serif">this issue we did not see in request=
/response
based HTTP. With the same reason why</font>
<br><font size=3D2 face=3D"sans-serif">TCP has rather complicated graceful
shutdown mechanism, WebSocket should also</font>
<br><font size=3D2 face=3D"sans-serif">take care of this issue, IMO.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">Best.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">- Yutaka</font>
<br>
<br>
<br>
<br><tt><font size=3D2>hybi-bounces@ietf.org wrote on 02/14/2011 05:31:50
PM:<br>
<br>
&gt; Not sure why the presence update would not have happened beforehand.<b=
r>
&gt; At any rate, I&#8217;m sure there&#8217;s apps where that last bit of =
data <br>
&gt; matters. But there&#8217;s also apps in which that last bit of data do=
esn&#8217;<br>
&gt; t matter at all. If an app really cares, it should handle its data
<br>
&gt; draining itself, and only issue the WS=5FClose() afterwards. </font></=
tt>
<br><tt><font size=3D2>&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</font=
></tt>
<br><tt><font size=3D2>&gt; From: Yutaka=5FTakeda@PlayStation.Sony.Com [mai=
lto:<br>
&gt; Yutaka=5FTakeda@PlayStation.Sony.Com] <br>
&gt; Sent: 14 February, 2011 17:22<br>
&gt; To: Gabriel Montenegro<br>
&gt; Cc: hybi@ietf.org; hybi-bounces@ietf.org; Takeshi Yoshino<br>
&gt; Subject: Re: [hybi] Clarify the role of closing handshake</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; <br>
&gt; Hi Gabriel, <br>
&gt; <br>
&gt; &gt; Most of the time, there won&#8217;t be a gracious Close, as users
will <br>
&gt; &gt; kill the browser window, exit out of the tab, etc. So I fear
we&#8217;re <br>
&gt; &gt; complicating the protocol for dubious benefits. We have to deal
with<br>
&gt; &gt; sudden termination anyway. &nbsp;At any rate, even if the RST
prevents <br>
&gt; &gt; the other peer from receiving the WS=5FClose, the intermediaries
will see it. <br>
&gt; <br>
&gt; I was wondering about it. <br>
&gt; <br>
&gt; &gt; This is a case of added complexity for very little benefit. <br>
&gt; <br>
&gt; Say, a client is trying to send an application data (for example,
<br>
&gt; 'presence' update) before closing <br>
&gt; WebSocket. The application data may not reach the server application<b=
r>
&gt; either in some <br>
&gt; condition. It is not just 'Close frame' that may not reach. <br>
&gt; <br>
&gt; If we cannot handle 'closing state' in the case where user kills the<b=
r>
&gt; browser window, then the <br>
&gt; consequence would be the loss of *application data*, which may not
<br>
&gt; be trivial... <br>
&gt; <br>
&gt; Any thoughts? <br>
&gt; --<br>
&gt; Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
&gt; Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
&gt; <br>
&gt; <br>
&gt; hybi-bounces@ietf.org wrote on 02/14/2011 12:34:01 PM:<br>
&gt; <br>
&gt; &gt; In A-2 and B, it seems you reversed the Pros and Cons. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; I&#8217;m not clear on the algorithm for B. Could you formulate in
terms <br>
&gt; &gt; of peers A and B and clarify which side is doing what? <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; At any rate, the cons of adding a wait state and additional <br>
&gt; &gt; complexity in the protocol is why I prefer the simplicity of
A. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Most of the time, there won&#8217;t be a gracious Close, as users
will <br>
&gt; &gt; kill the browser window, exit out of the tab, etc. So I fear
we&#8217;re <br>
&gt; &gt; complicating the protocol for dubious benefits. We have to deal
with<br>
&gt; &gt; sudden termination anyway. &nbsp;At any rate, even if the RST
prevents <br>
&gt; &gt; the other peer from receiving the WS=5FClose, the intermediaries
will see it. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; This is a case of added complexity for very little benefit. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On
Behalf Of <br>
&gt; &gt; Takeshi Yoshino<br>
&gt; &gt; Sent: Monday, February 14, 2011 11:33<br>
&gt; &gt; To: hybi@ietf.org<br>
&gt; &gt; Subject: Re: [hybi] Clarify the role of closing handshake <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; I'd like to summarize proposals again. It seems there's consensus
on<br>
&gt; &gt; dropping acknowledgement feature, so I list only the others.
<br>
&gt; &gt; &nbsp; <br>
&gt; &gt; I prefer [B]. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; [Proposal A-1] <br>
&gt; &gt; Role of Close frame <br>
&gt; &gt; - Help intermediaries know the session is no longer used <br>
&gt; &gt; - Pass status code to the other peer <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Algorithm <br>
&gt; &gt; - To initiate close, a peer MUST send Close frame, and then the
peer MUST <br>
&gt; &gt; -- close the underlying transport channel ... (*) <br>
&gt; &gt; - Once a peer received a Close frame, the peer MUST close the
<br>
&gt; &gt; underlying transport channel <br>
&gt; &gt; - A peer MUST NOT send any more data (including control) after
<br>
&gt; &gt; sending or receiving a Close frame <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Pros <br>
&gt; &gt; - There's no wait state needs to be handled after a peer decided
to <br>
&gt; &gt; abandon the WebSocket <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Cons <br>
&gt; &gt; - When a peer call close(2) with some data left not recv-ed,
the <br>
&gt; &gt; peer's TCP stack may send out RST. This can impede the other
peer <br>
&gt; &gt; from receiving Close frame or even some data before a Close frame
<br>
&gt; &gt; &nbsp; <br>
&gt; &gt; [Proposal A-2] <br>
&gt; &gt; Replace (*) in A-2 with this <br>
&gt; &gt; -- wait until the underlying transport channel is closed (by
recv <br>
&gt; &gt; until EoS, wait for close event, etc.) with some timeout <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Pros <br>
&gt; &gt; - There's a wait state needs to be handled after a peer decided
to <br>
&gt; &gt; abandon the WebSocket <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Cons <br>
&gt; &gt; - No more data is coming after Close frame, and therefore a peer
can<br>
&gt; &gt; call close(2) on its TCP socket safely <br>
&gt; &gt; - The algorithm depends on the underlying transport channel's
EoS signal <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; [Proposal B] <br>
&gt; &gt; Role of Close frame <br>
&gt; &gt; - Help intermediaries know the session is no longer used <br>
&gt; &gt; - Pass status code to the other peer <br>
&gt; &gt; - Let each peer call close(2) on its TCP socket safely <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Algorithm <br>
&gt; &gt; - To initiate close, send a Close frame <br>
&gt; &gt; - Once received a Close frame <br>
&gt; &gt; -- (already sent a Close frame) close the underlying transport
channel <br>
&gt; &gt; -- (otherwise) send a Close frame, and then close the underlying
<br>
&gt; &gt; transport channel <br>
&gt; &gt; - A peer MUST NOT send any more data (including control) after
<br>
&gt; &gt; sending a Close frame <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Reception of a Close frame means <br>
&gt; &gt; - All data the other peer sent has arrived <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Reception of a Close frame DOES NOT mean <br>
&gt; &gt; - All data has been delivered to the other peer <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Pros <br>
&gt; &gt; - There's a wait state needs to be handled after a peer decided
to <br>
&gt; &gt; abandon the WebSocket <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Cons <br>
&gt; &gt; - No more data is coming after a Close frame, and therefore a
peer <br>
&gt; &gt; can call close(2) on its TCP socket safely <br>
&gt; &gt; &nbsp;=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F<br>
&gt; &gt; hybi mailing list<br>
&gt; &gt; hybi@ietf.org<br>
&gt; &gt; https://www.ietf.org/mailman/listinfo/hybi<br>
&gt; =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 0070299788257838_=--

From jat@google.com  Tue Feb 15 12:29:07 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4B0433A6D9A for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 12:29:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.901
X-Spam-Level: 
X-Spam-Status: No, score=-105.901 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e+oZPMUR54HV for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 12:29:06 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 024423A6D99 for <hybi@ietf.org>; Tue, 15 Feb 2011 12:29:05 -0800 (PST)
Received: from hpaq14.eem.corp.google.com (hpaq14.eem.corp.google.com [172.25.149.14]) by smtp-out.google.com with ESMTP id p1FKTVM5009751 for <hybi@ietf.org>; Tue, 15 Feb 2011 12:29:32 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297801772; bh=7zm0BveuyGpC+hHxZg5KsxByl18=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=B6xnvWrafO2h3skjszMvhAN7uznRdj3r+SoTcdpw1tudOlxxuQhaK5eOgYS/bKxN5 pWmlnkHg5WiYtPJzyDbKQ==
Received: from ywc21 (ywc21.prod.google.com [10.192.3.21]) by hpaq14.eem.corp.google.com with ESMTP id p1FKTT7I021466 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 12:29:30 -0800
Received: by ywc21 with SMTP id 21so314785ywc.37 for <hybi@ietf.org>; Tue, 15 Feb 2011 12:29:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=UobW+mnadi9y6VmsSS3vYI3p+SC8xqyz1skOGVr8raY=; b=oYtp+JSo2UuICaPNy/sS4xKSZuMumvpjNMoLt3cC7+HSaCwAzL5pJfIB47oirnzwCZ vqgL/NxxgzfZRxQiO4lg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=bxjzNDHLb6Xg6UhoZ7Szu7EYXiLwUn+4UjPk7Yuu2FRYWuWZEIPWILWd8S5+KXzPMK Ubw0L5/zuuUaUV662F+w==
Received: by 10.150.145.21 with SMTP id s21mr1881812ybd.434.1297801769117; Tue, 15 Feb 2011 12:29:29 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.206.19 with HTTP; Tue, 15 Feb 2011 12:29:02 -0800 (PST)
In-Reply-To: <OF5442EF1E.2B5095C9-ON88257838.006DA28B-88257838.00702999@playstation.sony.com>
References: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534D@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <OF5442EF1E.2B5095C9-ON88257838.006DA28B-88257838.00702999@playstation.sony.com>
From: John Tamplin <jat@google.com>
Date: Tue, 15 Feb 2011 15:29:02 -0500
Message-ID: <AANLkTim+wf0T2FNd3YRVAgqhHYhsWbgFsrSLZNoLqPS+@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=0015174bdbf26feacd049c580561
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>, "hybi-bounces@ietf.org" <hybi-bounces@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 20:29:07 -0000

--0015174bdbf26feacd049c580561
Content-Type: text/plain; charset=UTF-8

On Tue, Feb 15, 2011 at 3:25 PM, <Yutaka_Takeda@playstation.sony.com> wrote:

> If application wants to send a data to a server when browser is closing
> (triggered by user),
> for example, is there a way to be sure that the server app received it?
>
> I have embarrassingly limited knowledge of JavaScript but from my
> understanding,
> you can catch such event by using
>
>    window.onbeforeunload = function()
>    {   return do_something() }
>
>
I don't know how reliable that is, but certainly the browser could crash,
the user could close the browser, the machine could be suspended, the
network connection may be lost, etc.  There are any number of things that
would prevent the last bit of application data from getting to the server,
and the client/server has to be able to deal with that already.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--0015174bdbf26feacd049c580561
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Tue, Feb 15, 2011 at 3:25 PM,  <span dir=3D"l=
tr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Takeda=
@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;">

<div class=3D"im"><font size=3D"2" face=3D"sans-serif">If application wants=
 to send a data
to a server when browser is closing (triggered by user),</font>
</div><font size=3D"2" face=3D"sans-serif">for example, is there a way to b=
e sure
that the server app received it?</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">I have embarrassingly limited know=
ledge
of JavaScript but from my understanding,</font>
<br><font size=3D"2" face=3D"sans-serif">you can catch such event by using<=
/font>
<br>
<br><font size=3D"2" face=3D"sans-serif">=C2=A0 =C2=A0window.onbeforeunload=
 =3D
function()</font>
<br><font size=3D"2" face=3D"sans-serif">=C2=A0 =C2=A0{ =C2=A0 return do_so=
mething()
}</font>
<br>
<br></blockquote><div><br></div><div>I don&#39;t know how reliable that is,=
 but certainly the browser could crash, the user could close the browser, t=
he machine could be suspended, the network connection may be lost, etc. =C2=
=A0There are any number of things that would prevent the last bit of applic=
ation data from getting to the server, and the client/server has to be able=
 to deal with that already.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--0015174bdbf26feacd049c580561--

From theturtle32@gmail.com  Tue Feb 15 12:30:30 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 763473A6DA0 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 12:30:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wlCDDS3lTG6k for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 12:30:29 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id 102CC3A6D99 for <hybi@ietf.org>; Tue, 15 Feb 2011 12:30:29 -0800 (PST)
Received: by iwc10 with SMTP id 10so590727iwc.31 for <hybi@ietf.org>; Tue, 15 Feb 2011 12:30:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type:content-transfer-encoding; bh=W7k7G2bQ7/+CEwxxjr80uG30sGnOKsClzyI0f3CUIRs=; b=uqoJef6boTJ2SuBAUelAmL38V5SBapeB/6GzA5EqyQotvGlj6GKPuZVIdAzqw///Ri E7h+QEjrOMuxGsPFo5qWxD7s0QHZRK4rPH8MrnuiEhxUPXytKam3xDbm8xiqhpVDTRh4 lr8CWwT/Msjbr1Ziaj5VYXu0mjeRCs7i2TGGE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=gwPFraJze5ilIo5Do7vMG7KTcyC4MTbcyhdSbBr8RTtip1lUpaTJnhYnlpqe5DBO6M B6k9HTZT1kqw68py5+ZMH8OnX9TZS+ScMxBYZwmF9r4TfrfU4v4or51eSvY1GAY6eyru 2s17BeRmWUnsorUD2yTKaBHy/H0NzeNkLK8do=
MIME-Version: 1.0
Received: by 10.231.20.68 with SMTP id e4mr4295189ibb.194.1297801855077; Tue, 15 Feb 2011 12:30:55 -0800 (PST)
Received: by 10.231.144.193 with HTTP; Tue, 15 Feb 2011 12:30:54 -0800 (PST)
In-Reply-To: <OF5442EF1E.2B5095C9-ON88257838.006DA28B-88257838.00702999@playstation.sony.com>
References: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534D@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <OF5442EF1E.2B5095C9-ON88257838.006DA28B-88257838.00702999@playstation.sony.com>
Date: Tue, 15 Feb 2011 12:30:54 -0800
Message-ID: <AANLkTi=Y+_xERQ+ED9HEZwX+u46CW4cOYu8cB32QKjrF@mail.gmail.com>
From: Brian <theturtle32@gmail.com>
To: "hybi@ietf.org" <hybi@ietf.org>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 20:30:30 -0000

This kind of practice is a really bad design.  You should *always*
build your web application knowing that any client could just drop off
the face of the planet at any moment.  Never, ever, rely on a
beforeunload type event to send some final data to the server or save
state, *especially* with XHR synchronous mode, as that creates a slow
response time for the user to leave the page.  If you need to sync
state to the server, that should be done continuously throughout the
user's time on the page.

Such things should always, categorically, be handled in some other
fashion.  If you need, with websocket, to detect that the user's gone
away (such as for an IM system to show that they're offline), you can
do that on the server when you detect the connection is closed.  If
you're using xhr-polling or similar, a reasonably short timeout on the
server during which the user doesn't reconnect for more data should
suffice as a suitable "user has gone away" event.

Brian

On Tue, Feb 15, 2011 at 12:25 PM,  <Yutaka_Takeda@playstation.sony.com> wro=
te:
>
>> If an app really cares, it should handle its data
>> draining itself, and only issue the WS_Close() afterwards.
>
> So, now the question here is WHO should be responsible for the 'last-bit
> draining'.
>
> If application wants to send a data to a server when browser is closing
> (triggered by user),
> for example, is there a way to be sure that the server app received it?
>
> I have embarrassingly limited knowledge of JavaScript but from my
> understanding,
> you can catch such event by using
>
> =A0 =A0window.onbeforeunload =3D function()
> =A0 =A0{ =A0 return do_something() }
>
> With XmlHttpRequest, you can send data *synchrnously" to be sure that the
> data has
> reached the server. But WebSocket, there's no way to block send() operati=
on
> (there's
> no build-in response to websocket). What could be the possible workaround=
 to
> this case?
> (Brwoser/JS/WSAPI expert should chime in here...)
>
> I personally think that WS-layer should be responsible for the last-bit
> draining rather than
> pushing the responsibility to the application. WebSocket being
> "bidirectional" raises
> this issue we did not see in request/response based HTTP. With the same
> reason why
> TCP has rather complicated graceful shutdown mechanism, WebSocket should
> also
> take care of this issue, IMO.
>
> Best.
>
> - Yutaka
>
>
>
> hybi-bounces@ietf.org wrote on 02/14/2011 05:31:50 PM:
>
>> Not sure why the presence update would not have happened beforehand.
>> At any rate, I=92m sure there=92s apps where that last bit of data
>> matters. But there=92s also apps in which that last bit of data doesn=92
>> t matter at all. If an app really cares, it should handle its data
>> draining itself, and only issue the WS_Close() afterwards.
>>
>>
>> From: Yutaka_Takeda@PlayStation.Sony.Com [mailto:
>> Yutaka_Takeda@PlayStation.Sony.Com]
>> Sent: 14 February, 2011 17:22
>> To: Gabriel Montenegro
>> Cc: hybi@ietf.org; hybi-bounces@ietf.org; Takeshi Yoshino
>> Subject: Re: [hybi] Clarify the role of closing handshake
>>
>>
>> Hi Gabriel,
>>
>> > Most of the time, there won=92t be a gracious Close, as users will
>> > kill the browser window, exit out of the tab, etc. So I fear we=92re
>> > complicating the protocol for dubious benefits. We have to deal with
>> > sudden termination anyway. =A0At any rate, even if the RST prevents
>> > the other peer from receiving the WS_Close, the intermediaries will se=
e
>> > it.
>>
>> I was wondering about it.
>>
>> > This is a case of added complexity for very little benefit.
>>
>> Say, a client is trying to send an application data (for example,
>> 'presence' update) before closing
>> WebSocket. The application data may not reach the server application
>> either in some
>> condition. It is not just 'Close frame' that may not reach.
>>
>> If we cannot handle 'closing state' in the case where user kills the
>> browser window, then the
>> consequence would be the loss of *application data*, which may not
>> be trivial...
>>
>> Any thoughts?
>> --
>> Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
>> Office: 650 655 7484 =A0 Fax: 650 655 8060
>>
>>
>> hybi-bounces@ietf.org wrote on 02/14/2011 12:34:01 PM:
>>
>> > In A-2 and B, it seems you reversed the Pros and Cons.
>> >
>> > I=92m not clear on the algorithm for B. Could you formulate in terms
>> > of peers A and B and clarify which side is doing what?
>> >
>> > At any rate, the cons of adding a wait state and additional
>> > complexity in the protocol is why I prefer the simplicity of A.
>> >
>> > Most of the time, there won=92t be a gracious Close, as users will
>> > kill the browser window, exit out of the tab, etc. So I fear we=92re
>> > complicating the protocol for dubious benefits. We have to deal with
>> > sudden termination anyway. =A0At any rate, even if the RST prevents
>> > the other peer from receiving the WS_Close, the intermediaries will se=
e
>> > it.
>> >
>> > This is a case of added complexity for very little benefit.
>> >
>> > From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf O=
f
>> > Takeshi Yoshino
>> > Sent: Monday, February 14, 2011 11:33
>> > To: hybi@ietf.org
>> > Subject: Re: [hybi] Clarify the role of closing handshake
>> >
>> > I'd like to summarize proposals again. It seems there's consensus on
>> > dropping acknowledgement feature, so I list only the others.
>> >
>> > I prefer [B].
>> >
>> > [Proposal A-1]
>> > Role of Close frame
>> > - Help intermediaries know the session is no longer used
>> > - Pass status code to the other peer
>> >
>> > Algorithm
>> > - To initiate close, a peer MUST send Close frame, and then the peer
>> > MUST
>> > -- close the underlying transport channel ... (*)
>> > - Once a peer received a Close frame, the peer MUST close the
>> > underlying transport channel
>> > - A peer MUST NOT send any more data (including control) after
>> > sending or receiving a Close frame
>> >
>> > Pros
>> > - There's no wait state needs to be handled after a peer decided to
>> > abandon the WebSocket
>> >
>> > Cons
>> > - When a peer call close(2) with some data left not recv-ed, the
>> > peer's TCP stack may send out RST. This can impede the other peer
>> > from receiving Close frame or even some data before a Close frame
>> >
>> > [Proposal A-2]
>> > Replace (*) in A-2 with this
>> > -- wait until the underlying transport channel is closed (by recv
>> > until EoS, wait for close event, etc.) with some timeout
>> >
>> > Pros
>> > - There's a wait state needs to be handled after a peer decided to
>> > abandon the WebSocket
>> >
>> > Cons
>> > - No more data is coming after Close frame, and therefore a peer can
>> > call close(2) on its TCP socket safely
>> > - The algorithm depends on the underlying transport channel's EoS sign=
al
>> >
>> > [Proposal B]
>> > Role of Close frame
>> > - Help intermediaries know the session is no longer used
>> > - Pass status code to the other peer
>> > - Let each peer call close(2) on its TCP socket safely
>> >
>> > Algorithm
>> > - To initiate close, send a Close frame
>> > - Once received a Close frame
>> > -- (already sent a Close frame) close the underlying transport channel
>> > -- (otherwise) send a Close frame, and then close the underlying
>> > transport channel
>> > - A peer MUST NOT send any more data (including control) after
>> > sending a Close frame
>> >
>> > Reception of a Close frame means
>> > - All data the other peer sent has arrived
>> >
>> > Reception of a Close frame DOES NOT mean
>> > - All data has been delivered to the other peer
>> >
>> > Pros
>> > - There's a wait state needs to be handled after a peer decided to
>> > abandon the WebSocket
>> >
>> > Cons
>> > - No more data is coming after a Close frame, and therefore a peer
>> > can call close(2) on its TCP socket safely
>> > =A0_______________________________________________
>> > hybi mailing list
>> > hybi@ietf.org
>> > https://www.ietf.org/mailman/listinfo/hybi
>> _______________________________________________
>> hybi mailing list
>> hybi@ietf.org
>> https://www.ietf.org/mailman/listinfo/hybi
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>

From stpeter@stpeter.im  Tue Feb 15 12:33:05 2011
Return-Path: <stpeter@stpeter.im>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CBEE83A6D52 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 12:33:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.599
X-Spam-Level: 
X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gc0jYaopVQau for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 12:33:04 -0800 (PST)
Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 0DACB3A6C43 for <hybi@ietf.org>; Tue, 15 Feb 2011 12:33:04 -0800 (PST)
Received: from dhcp-64-101-72-185.cisco.com (dhcp-64-101-72-185.cisco.com [64.101.72.185]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 8127E400F6 for <hybi@ietf.org>; Tue, 15 Feb 2011 13:51:33 -0700 (MST)
Message-ID: <4D5AE318.9080308@stpeter.im>
Date: Tue, 15 Feb 2011 13:33:28 -0700
From: Peter Saint-Andre <stpeter@stpeter.im>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
References: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1534D@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>	<OF5442EF1E.2B5095C9-ON88257838.006DA28B-88257838.00702999@playstation.sony.com> <AANLkTi=Y+_xERQ+ED9HEZwX+u46CW4cOYu8cB32QKjrF@mail.gmail.com>
In-Reply-To: <AANLkTi=Y+_xERQ+ED9HEZwX+u46CW4cOYu8cB32QKjrF@mail.gmail.com>
X-Enigmail-Version: 1.1.1
OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms080600060405090200080409"
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 20:33:06 -0000

This is a cryptographically signed message in MIME format.

--------------ms080600060405090200080409
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 2/15/11 1:30 PM, Brian wrote:

> If you need, with websocket, to detect that the user's gone
> away (such as for an IM system to show that they're offline), you can
> do that on the server when you detect the connection is closed.  If
> you're using xhr-polling or similar, a reasonably short timeout on the
> server during which the user doesn't reconnect for more data should
> suffice as a suitable "user has gone away" event.

Agreed. And this is what we do in IM systems like XMPP (whether using
the TCP binding or BOSH).

Peter

--=20
Peter Saint-Andre
https://stpeter.im/




--------------ms080600060405090200080409
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIITzjCC
BjQwggQcoAMCAQICASMwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3
MTAyNDIxMDMzM1oXDTE3MTAyNDIxMDMzM1owgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1T
dGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWdu
aW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIENs
aWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALmjSW4SPiDKlAinvVeL
ZOVfItiuP1aRHL530E7QUc9icCwL33+PH+Js1HAh8CgWFl34sOxx1FJyS/C4VLPRsqDfP72j
tzCVUAL0DAxZ7wgzQvFz7x61jGxfhYhqYb1+PPOLkYBbkRIrPMg3dLEdKmXIYJYXDH+mB/V/
jLo73/Kb7h/rNoNg/oHHSv5Jolyvp5IY2btfcTBfW/telEFj5rDTX2juTvZ3Qhf3XQX5ca3Q
7A10zrUV/cWJOJ7F5RltbEIaboZmX5JBUb3FhUiAdBotehAX6DbDOuYoJtVxmGof6GuVGcPo
98K4TJf8FHo+UA9EOVDp/W7fCqKT4sXk/XkCAwEAAaOCAa0wggGpMA8GA1UdEwEB/wQFMAMB
Af8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBR7iZySlyShhEcCy3T8LvSs3DLl8zAfBgNV
HSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRaMFgwJwYIKwYBBQUH
MAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYhaHR0cDovL3d3
dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6Ly93d3cu
c3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20v
c2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0
dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQELBQADggIBAGpd
SbdLFMhirxK37V4gE00+uW74UdAXtDgQI3AsRZWtaRtKHgAxFBSteqz4kDkeAjH/1b+K8tQR
6cxSI2nho7qOaPW/UpzOfSS/MeKK/9vfM2lfs+uItXH7LWtvS9wD1erfH1a+BXHCrCp4LA1l
fADDhRIiGTSS3i0Zu5xV3INNRHrCCCl6patltQ8RZTqzDMri7ombgIxjN51Zo7xV77EZcThV
0GA8iIN+7T53uHhUJpjfLIztHs/69OclRvHux9hCflfOm7GY5Sc4nqjfES+5XPArGGWiQSEk
ez37QfXqsxO3oCHK4b3DFZysG4uyOuC/WL80ab3muQ3tgwjBhq0D3JZN5kvu5gSuNZPa1WrV
hEgXkd6C7s5stqB6/htVpshG08jRz9DEutGM9oKQ1ncTivbfPNx7pILoHWvvT7N5i/puVoNu
bPUmLXh/2wA6wzAzuuoONiIL14Xpw6jLSnqpaLWElo2yTIFZ/CU/nCvvpW1Dj1457P3Ci9bD
0RPkWSR+CuucpgxrEmaw4UOLxflzuYYaq1RJwygOO5K0s2bAWOcXpgteyUOnQ3d/EjJAWRri
2v0ubiq+4H3KUOMlbznlPAY/1T8YyyJPM88+Ueahe/AW1zoUwZayNcTnuM7cq6yBV8Wr3GOI
LFXhtT0UVuJLChPMJKVKVsa7qNorlLkMMIIGxzCCBa+gAwIBAgICAIswDQYJKoZIhvcNAQEF
BQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJT
ZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBD
bGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0xMDEwMTQwMTM2MzRa
Fw0xMjEwMTQxMjAxMDdaMIHAMSAwHgYDVQQNExcyNzQ1ODEtOU5YMDRxeExEYjBvNDY5VDEL
MAkGA1UEBhMCVVMxETAPBgNVBAgTCENvbG9yYWRvMQ8wDQYDVQQHEwZEZW52ZXIxLDAqBgNV
BAsTI1N0YXJ0Q29tIFRydXN0ZWQgQ2VydGlmaWNhdGUgTWVtYmVyMRowGAYDVQQDExFQZXRl
ciBTYWludC1BbmRyZTEhMB8GCSqGSIb3DQEJARYSc3RwZXRlckBzdHBldGVyLmltMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuERvnrkpQTx9wbJfgxbNKEYvt0IilecZRUM6
wrbCzIUPCocuYhaAJcQoqIyHaKybPQ7f+DIGIAolAa3dHnNdlsXP2smTft/ZNpj10PIG5bil
NAqLUYwmLJaEaqY7BMW8423U3blW43/luLJk/Pq4OsWcw7AK3LeVh1U/HOgqhin26N3h72X1
nbLEpZFrgcp8egmWtXLCbLBDMqUK3j6wjLldni79muzYEVqU0A5GqSeb8Wc4kIx8VI5yL24J
KzinG2iVRP5ZDEbOZETzBXJabUsV56XSxqPG9DK6ke+ybCiL/wKV1HFqdtFB1y25lfvHgOP2
gyEApBKEDNjgLmKyyQIDAQABo4IC+zCCAvcwCQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYD
VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBS2EW2iNB+g0EibKJLBdv8I
eLovVDAfBgNVHSMEGDAWgBR7iZySlyShhEcCy3T8LvSs3DLl8zAdBgNVHREEFjAUgRJzdHBl
dGVyQHN0cGV0ZXIuaW0wggFCBgNVHSAEggE5MIIBNTCCATEGCysGAQQBgbU3AQICMIIBIDAu
BggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0BggrBgEF
BQcCARYoaHR0cDovL3d3dy5zdGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjCBtwYIKwYB
BQUHAgIwgaowFBYNU3RhcnRDb20gTHRkLjADAgEBGoGRTGltaXRlZCBMaWFiaWxpdHksIHNl
ZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFydHNz
bC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0c3Ns
LmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9jcnR1
My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2NzcC5z
dGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNVHRIE
HDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBADVtbXJG
tKAr55xc/OUM546gXUybI72Bank0w739Mv+9BBNtq9rMEvCnLmSKhBi76c1mdXh6zXs8RQDo
6nR/aPabE3llF2T4z80smi9jfnl3y9dpu9TcgDoqDLZ7a2lBlW656XAAQzHjvLp2MC7/mxlg
PYH2axa+q40mAYM20GbNsAEGbWQT1IqIh0BcLLsgbaMJHbyG/57zd9JLyMX3Vry1L1fJRQr3
GeLxMV5RtxN+mBgxrwFz/cOc09COiFExlsHgekpB5O43gqsAU16MXypyoSt4MrSfKTMHIGx6
2RF/M6vqUlvhi28gk2ZUvQ/+OX5+gjcZyooEzAAn4RuOKNswggbHMIIFr6ADAgECAgIAizAN
BgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4x
KzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMT
L1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBMB4XDTEw
MTAxNDAxMzYzNFoXDTEyMTAxNDEyMDEwN1owgcAxIDAeBgNVBA0TFzI3NDU4MS05TlgwNHF4
TERiMG80NjlUMQswCQYDVQQGEwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRl
bnZlcjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0aWZpY2F0ZSBNZW1iZXIxGjAY
BgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcNAQkBFhJzdHBldGVyQHN0cGV0
ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4RG+euSlBPH3Bsl+DFs0o
Ri+3QiKV5xlFQzrCtsLMhQ8Khy5iFoAlxCiojIdorJs9Dt/4MgYgCiUBrd0ec12Wxc/ayZN+
39k2mPXQ8gbluKU0CotRjCYsloRqpjsExbzjbdTduVbjf+W4smT8+rg6xZzDsArct5WHVT8c
6CqGKfbo3eHvZfWdssSlkWuBynx6CZa1csJssEMypQrePrCMuV2eLv2a7NgRWpTQDkapJ5vx
ZziQjHxUjnIvbgkrOKcbaJVE/lkMRs5kRPMFclptSxXnpdLGo8b0MrqR77JsKIv/ApXUcWp2
0UHXLbmV+8eA4/aDIQCkEoQM2OAuYrLJAgMBAAGjggL7MIIC9zAJBgNVHRMEAjAAMAsGA1Ud
DwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFLYRbaI0
H6DQSJsoksF2/wh4ui9UMB8GA1UdIwQYMBaAFHuJnJKXJKGERwLLdPwu9KzcMuXzMB0GA1Ud
EQQWMBSBEnN0cGV0ZXJAc3RwZXRlci5pbTCCAUIGA1UdIASCATkwggE1MIIBMQYLKwYBBAGB
tTcBAgIwggEgMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3ku
cGRmMDQGCCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUu
cGRmMIG3BggrBgEFBQcCAjCBqjAUFg1TdGFydENvbSBMdGQuMAMCAQEagZFMaW1pdGVkIExp
YWJpbGl0eSwgc2VlIHNlY3Rpb24gKkxlZ2FsIExpbWl0YXRpb25zKiBvZiB0aGUgU3RhcnRD
b20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUG9saWN5IGF2YWlsYWJsZSBhdCBodHRwOi8v
d3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMGMGA1UdHwRcMFowK6ApoCeGJWh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tL2NydHUzLWNybC5jcmwwK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRz
c2wuY29tL2NydHUzLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0
dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MzL2NsaWVudC9jYTBCBggrBgEFBQcw
AoY2aHR0cDovL3d3dy5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMy5jbGllbnQuY2Eu
Y3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0BAQUF
AAOCAQEANW1tcka0oCvnnFz85QznjqBdTJsjvYFqeTTDvf0y/70EE22r2swS8KcuZIqEGLvp
zWZ1eHrNezxFAOjqdH9o9psTeWUXZPjPzSyaL2N+eXfL12m71NyAOioMtntraUGVbrnpcABD
MeO8unYwLv+bGWA9gfZrFr6rjSYBgzbQZs2wAQZtZBPUioiHQFwsuyBtowkdvIb/nvN30kvI
xfdWvLUvV8lFCvcZ4vExXlG3E36YGDGvAXP9w5zT0I6IUTGWweB6SkHk7jeCqwBTXoxfKnKh
K3gytJ8pMwcgbHrZEX8zq+pSW+GLbyCTZlS9D/45fn6CNxnKigTMACfhG44o2zGCA80wggPJ
AgEBMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UE
CxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRD
b20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAgCLMAkGBSsOAwIa
BQCgggIOMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTExMDIx
NTIwMzMyOFowIwYJKoZIhvcNAQkEMRYEFEGH+B5IrWdcaeLIlyDnHtcGXf+lMF8GCSqGSIb3
DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggq
hkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBpAYJKwYBBAGCNxAEMYGWMIGT
MIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2Vj
dXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xh
c3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAgCLMIGmBgsqhkiG9w0BCRAC
CzGBlqCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNV
BAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0
Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgIAizANBgkqhkiG
9w0BAQEFAASCAQAt/ohcm9+OFP+7YhcUkYFclFN0FtrQHuFz+68e95DrDB4wyeUbhWlKhd48
fQcErqb/QkwK2jqPCm6MLOqZbWFVHbdUJDmm2ECKajdnQDmL8XlhCbECRJxcINi1KXWmoDnc
87V1S93CYvt5F7ukuentuuMYozI2SjpRAMKSdU2fsidrzj8wDJvqw984DAG7rPPvsmEyCgCm
e7LfIrs91zGZPRFRgZGCGTFuKNkPy72Net1onHsNFBIJhPcob1HouLSBufnUBdqk/tyj9Y/a
Nzl844t7sGPhVW/23Za8jR5Rg1QykYslX9+fKr1wkN9I7J00wmbnlCFVu+9OvOGHZqPLAAAA
AAAA
--------------ms080600060405090200080409--

From Yutaka_Takeda@PlayStation.Sony.Com  Tue Feb 15 13:45:05 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 958003A6AFD; Tue, 15 Feb 2011 13:45:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.945
X-Spam-Level: 
X-Spam-Status: No, score=-5.945 tagged_above=-999 required=5 tests=[AWL=0.319,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ylGBzNPUpd8N; Tue, 15 Feb 2011 13:45:03 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 14F773A6ADB; Tue, 15 Feb 2011 13:45:01 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021513452108-577167 ; Tue, 15 Feb 2011 13:45:21 -0800 
In-Reply-To: <4D5AE318.9080308@stpeter.im>
To: Peter Saint-Andre <stpeter@stpeter.im>
MIME-Version: 1.0
X-KeepSent: 9E69202E:36384265-88257838:00749E83; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Tue, 15 Feb 2011 13:45:22 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/15/2011 01:45:20 PM, Serialize complete at 02/15/2011 01:45:20 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 01:45:21 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 01:45:28 PM, Serialize complete at 02/15/2011 01:45:28 PM
Content-Type: multipart/alternative; boundary="=_alternative 007782C988257838_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 21:45:05 -0000

This is a multipart message in MIME format.
--=_alternative 007782C988257838_=
Content-Type: text/plain; charset="US-ASCII"

Okay, I admit my example was bad.

Just to be clear, even with this code:

      websocket.send("a-message-needs-to-reach-server")
      websocket.close()

>From your opinions, programmers should not expect that the message always 
reach the server. (granted)

Now, here's another question for you.

If onclose() callback is made on the websocket, would it be helpful if 
that callback (with wasClean=true) guarantees
that the message has been delivered to the server?

# trying to figure out whether graceful shutdown at least during 'closing' 
state would ever be helpful.

Thanks,
- Yutaka


hybi-bounces@ietf.org wrote on 02/15/2011 12:33:28 PM:

> On 2/15/11 1:30 PM, Brian wrote:
> 
> > If you need, with websocket, to detect that the user's gone
> > away (such as for an IM system to show that they're offline), you can
> > do that on the server when you detect the connection is closed.  If
> > you're using xhr-polling or similar, a reasonably short timeout on the
> > server during which the user doesn't reconnect for more data should
> > suffice as a suitable "user has gone away" event.
> 
> Agreed. And this is what we do in IM systems like XMPP (whether using
> the TCP binding or BOSH).
> 
> Peter
> 
> -- 
> Peter Saint-Andre
> https://stpeter.im/
> 
> 
> 
> [attachment "smime.p7s" deleted by Yutaka Takeda/R&D/SCEA] 
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 007782C988257838_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Okay, I admit my example was bad.</font>
<br>
<br><font size=2 face="sans-serif">Just to be clear, even with this code:</font>
<br>
<br><font size=2 face="Fixedsys">&nbsp; &nbsp; &nbsp; websocket.send(&quot;a-message-needs-to-reach-server&quot;)</font>
<br><font size=2 face="Fixedsys">&nbsp; &nbsp; &nbsp; websocket.close()</font>
<br>
<br><font size=2 face="sans-serif">From your opinions, programmers should
not expect that the message always reach the server. (granted)</font>
<br>
<br><font size=2 face="sans-serif">Now, here's another question for you.</font>
<br>
<br><font size=2 face="sans-serif">If onclose() callback is made on the
websocket, would it be helpful if that callback (with wasClean=true) guarantees</font>
<br><font size=2 face="sans-serif">that the message has been delivered
to the server?</font>
<br>
<br><font size=2 face="sans-serif"># trying to figure out whether graceful
shutdown at least during 'closing' state would ever be helpful.</font>
<br>
<br><font size=2 face="sans-serif">Thanks,</font>
<br><font size=2 face="sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/15/2011 12:33:28
PM:<br>
<br>
&gt; On 2/15/11 1:30 PM, Brian wrote:<br>
&gt; <br>
&gt; &gt; If you need, with websocket, to detect that the user's gone<br>
&gt; &gt; away (such as for an IM system to show that they're offline),
you can<br>
&gt; &gt; do that on the server when you detect the connection is closed.
&nbsp;If<br>
&gt; &gt; you're using xhr-polling or similar, a reasonably short timeout
on the<br>
&gt; &gt; server during which the user doesn't reconnect for more data
should<br>
&gt; &gt; suffice as a suitable &quot;user has gone away&quot; event.<br>
&gt; <br>
&gt; Agreed. And this is what we do in IM systems like XMPP (whether using<br>
&gt; the TCP binding or BOSH).<br>
&gt; <br>
&gt; Peter<br>
&gt; <br>
&gt; -- <br>
&gt; Peter Saint-Andre<br>
&gt; https://stpeter.im/<br>
&gt; <br>
&gt; <br>
&gt; <br>
&gt; [attachment &quot;smime.p7s&quot; deleted by Yutaka Takeda/R&amp;D/SCEA]
<br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 007782C988257838_=--

From ifette@google.com  Tue Feb 15 14:27:37 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CAAC83A6D7C for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 14:27:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.931
X-Spam-Level: 
X-Spam-Status: No, score=-104.931 tagged_above=-999 required=5 tests=[AWL=0.744, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1k46K9Dp7rJh for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 14:27:36 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id B839E3A6DE9 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:27:35 -0800 (PST)
Received: from kpbe15.cbf.corp.google.com (kpbe15.cbf.corp.google.com [172.25.105.79]) by smtp-out.google.com with ESMTP id p1FMS1KT008644 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:28:01 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297808882; bh=JITlnhZZpelMYXOoniS2Zp1rmJc=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=mh2elXbgvY1xl2l/isf+Fs0Ysw9+XKSbs00MozZnVASaUUBDKHTfsdkyP3227MPkx lLJBw0hu+spA2fyXxuunw==
Received: from iwc10 (iwc10.prod.google.com [10.241.65.138]) by kpbe15.cbf.corp.google.com with ESMTP id p1FMRcD7019971 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 14:28:00 -0800
Received: by iwc10 with SMTP id 10so697687iwc.0 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:28:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=yh+5vdh6ECFQnoUjhiWUY24YuTBiE4nzoDTlilrqZas=; b=UiXRtu7YPbTxGYE1C/+5FWrs/nrb02etgdk06fkOzuDOv5SaychK/RdfMWQP7OtN8G rzrWtjOD/jG4vlViKwXg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=cr9oiix/WsEvabmk9tM6Zj1XQMdcUULfjoOXxXO8/lT5j8rgIXQpv79SWI0N3T8aG3 3+XOkHCjKMUyBR8Z/0Gw==
MIME-Version: 1.0
Received: by 10.42.229.7 with SMTP id jg7mr7449681icb.211.1297808879123; Tue, 15 Feb 2011 14:27:59 -0800 (PST)
Received: by 10.231.37.133 with HTTP; Tue, 15 Feb 2011 14:27:58 -0800 (PST)
In-Reply-To: <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com>
References: <4D5AE318.9080308@stpeter.im> <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com>
Date: Tue, 15 Feb 2011 14:27:58 -0800
Message-ID: <AANLkTinXR_kTQ2vFt8AqLWPJd1XYxMxuhbVwGgRGqKO0@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=20cf30549dcf39fc94049c59ade8
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 22:27:38 -0000

--20cf30549dcf39fc94049c59ade8
Content-Type: text/plain; charset=UTF-8

On Tue, Feb 15, 2011 at 1:45 PM, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> Okay, I admit my example was bad.
>
> Just to be clear, even with this code:
>
>       websocket.send("a-message-needs-to-reach-server")
>       websocket.close()
>
> From your opinions, programmers should not expect that the message always
> reach the server. (granted)
>
> Now, here's another question for you.
>
> If onclose() callback is made on the websocket, would it be helpful if that
> callback (with wasClean=true) guarantees
> that the message has been delivered to the server?
>
>
I am not sure how many people would use it, but I think it would be
straightforward and cheap to provide that information so I wouldn't have any
problem with it.

I am trying to get out a -06 that resolves some of the CLOSE issues, but
currently I'm getting caught up by a few other things at work today.

What I'm currently looking at is this: (comments welcome)

         <t>The Close message contains an opcode of 0x01.</t>
          <t>The Close message contains no body (the body has zero
length).</t>
          <t>The application MUST NOT send any more data messages after
sending
          a close message.</t>
          <t>If an endpoint receives a Close message and that endpoint did
not
          previously send a Close message, the endpoint MUST send a Close
          message in response. It SHOULD do so as soon as is practical.
          </t>
          <t>After both sending and receiving a close message, an endpoint
          considers the websocket connection closed, and
          SHOULD close the underlying TCP connection.</t>
          <t>If a client and server both send a Close message at the same
time,
          both endpoints will have sent and received a Close message and
should
          consider the websocket connection closed and close the underlying
          TCP connection.</t>


> # trying to figure out whether graceful shutdown at least during 'closing'
> state would ever be helpful.
>
> Thanks,
> - Yutaka
>
>
> hybi-bounces@ietf.org wrote on 02/15/2011 12:33:28 PM:
>
>
> > On 2/15/11 1:30 PM, Brian wrote:
> >
> > > If you need, with websocket, to detect that the user's gone
> > > away (such as for an IM system to show that they're offline), you can
> > > do that on the server when you detect the connection is closed.  If
> > > you're using xhr-polling or similar, a reasonably short timeout on the
> > > server during which the user doesn't reconnect for more data should
> > > suffice as a suitable "user has gone away" event.
> >
> > Agreed. And this is what we do in IM systems like XMPP (whether using
> > the TCP binding or BOSH).
> >
> > Peter
> >
> > --
> > Peter Saint-Andre
> > https://stpeter.im/
> >
> >
> >
> > [attachment "smime.p7s" deleted by Yutaka Takeda/R&D/SCEA]
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>

--20cf30549dcf39fc94049c59ade8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Tue, Feb 15, 2011 at 1:45 PM,  <span dir=3D"l=
tr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_Takeda=
@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;">

<br><font size=3D"2" face=3D"sans-serif">Okay, I admit my example was bad.<=
/font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Just to be clear, even with this c=
ode:</font>
<br>
<br><font size=3D"2" face=3D"Fixedsys">=C2=A0 =C2=A0 =C2=A0 websocket.send(=
&quot;a-message-needs-to-reach-server&quot;)</font>
<br><font size=3D"2" face=3D"Fixedsys">=C2=A0 =C2=A0 =C2=A0 websocket.close=
()</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">From your opinions, programmers sh=
ould
not expect that the message always reach the server. (granted)</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Now, here&#39;s another question f=
or you.</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">If onclose() callback is made on t=
he
websocket, would it be helpful if that callback (with wasClean=3Dtrue) guar=
antees</font>
<br><font size=3D"2" face=3D"sans-serif">that the message has been delivere=
d
to the server?</font>
<br>
<br></blockquote><div><br></div><div>I am not sure how many people would us=
e it, but I think it would be straightforward and cheap to provide that inf=
ormation so I wouldn&#39;t have any problem with it.</div><div><br></div>
<div>I am trying to get out a -06 that resolves some of the CLOSE issues, b=
ut currently I&#39;m getting caught up by a few other things at work today.=
</div><div><br></div><div>What I&#39;m currently looking at is this: (comme=
nts welcome)</div>
<div><br></div><div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 &lt;t&gt;The Clo=
se message contains an opcode of 0x01.&lt;/t&gt;</div><div>=C2=A0=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0&lt;t&gt;The Close message contains no body (the bo=
dy has zero length).&lt;/t&gt;</div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0&lt;t&gt;The application MUST NOT send any more data messages after s=
ending</div>
<div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a close message.&lt;/t&gt;</di=
v><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;t&gt;If an endpoint rece=
ives a Close message and that endpoint did not</div><div>=C2=A0=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0previously send a Close message, the endpoint MUST =
send a Close</div>
<div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0message in response. It SHOULD=
 do so as soon as is practical.</div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0&lt;/t&gt;</div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;t&g=
t;After both sending and receiving a close message, an endpoint</div><div>=
=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0considers the websocket connection =
closed, and</div>
<div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0SHOULD close the underlying TC=
P connection.&lt;/t&gt;</div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&=
lt;t&gt;If a client and server both send a Close message at the same time,<=
/div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0both endpoints will have =
sent and received a Close message and should</div>
<div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0consider the websocket connect=
ion closed and close the underlying</div><div>=C2=A0=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0TCP connection.&lt;/t&gt;</div><div>=C2=A0</div></div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s=
olid;padding-left:1ex;">
<font size=3D"2" face=3D"sans-serif"># trying to figure out whether gracefu=
l
shutdown at least during &#39;closing&#39; state would ever be helpful.</fo=
nt>
<br>
<br><font size=3D"2" face=3D"sans-serif">Thanks,</font>
<br><font size=3D"2" face=3D"sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=3D"2"><a href=3D"mailto:hybi-bounces@ietf.org" target=3D=
"_blank">hybi-bounces@ietf.org</a> wrote on 02/15/2011 12:33:28
PM:<div><div></div><div class=3D"h5"><br>
<br>
&gt; On 2/15/11 1:30 PM, Brian wrote:<br>
&gt; <br>
&gt; &gt; If you need, with websocket, to detect that the user&#39;s gone<b=
r>
&gt; &gt; away (such as for an IM system to show that they&#39;re offline),
you can<br>
&gt; &gt; do that on the server when you detect the connection is closed.
=C2=A0If<br>
&gt; &gt; you&#39;re using xhr-polling or similar, a reasonably short timeo=
ut
on the<br>
&gt; &gt; server during which the user doesn&#39;t reconnect for more data
should<br>
&gt; &gt; suffice as a suitable &quot;user has gone away&quot; event.<br>
&gt; <br>
&gt; Agreed. And this is what we do in IM systems like XMPP (whether using<=
br>
&gt; the TCP binding or BOSH).<br>
&gt; <br>
&gt; Peter<br>
&gt; <br>
&gt; -- <br>
&gt; Peter Saint-Andre<br>
&gt; <a href=3D"https://stpeter.im/" target=3D"_blank">https://stpeter.im/<=
/a><br>
&gt; <br>
&gt; <br>
&gt; <br></div></div>
&gt; [attachment &quot;smime.p7s&quot; deleted by Yutaka Takeda/R&amp;D/SCE=
A]
<br><div class=3D"im">
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; <a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><b=
r>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blan=
k">https://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></font></tt><br>_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
<br></blockquote></div><br>

--20cf30549dcf39fc94049c59ade8--

From tyoshino@google.com  Tue Feb 15 14:45:36 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9E51B3A6DC9 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 14:45:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.476
X-Spam-Level: 
X-Spam-Status: No, score=-104.476 tagged_above=-999 required=5 tests=[AWL=1.500, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id svNdYluYoWLD for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 14:45:35 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id E53A43A6C43 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:45:32 -0800 (PST)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p1FMjwEx031278 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:45:58 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297809958; bh=JMZolSOY5nUia0joSRtG5hwmh2k=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=WL8UHQQE7w2670qdwkDEMC7S7GpjDIP8e3BlhkPQgAQl9DZjL7gT/d0sgWw8JdVr+ l+HAoep1mX5uE2J5DuEsw==
Received: from iyj8 (iyj8.prod.google.com [10.241.51.72]) by wpaz37.hot.corp.google.com with ESMTP id p1FMjpqn021730 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 14:45:57 -0800
Received: by iyj8 with SMTP id 8so612633iyj.33 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:45:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=dlzSwLQ62B6SQjxWJPlRnt6XoPdWgetZFM07UfwOYKE=; b=oL4mAVHKCWV/XTaSyWnNcACmjNn/zafhDt+9pcHdglu1gIDua0BgBuF8VATugOuatS vwJM1FIMSyMwktT0A3Gw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=wcbFX9tD8rLQOMFVM9t9c2Rb0E71uGPo1RyJ/GpWnBuZoiYJ0ax8HCZUlN9KTec+JA 6cgqxgaTbiHQdSoFx6RA==
Received: by 10.42.164.138 with SMTP id g10mr7396272icy.389.1297809956746; Tue, 15 Feb 2011 14:45:56 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Tue, 15 Feb 2011 14:45:36 -0800 (PST)
In-Reply-To: <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com>
References: <4D5AE318.9080308@stpeter.im> <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Tue, 15 Feb 2011 14:45:36 -0800
Message-ID: <AANLkTin+5mxtbD4GbNK1X2P3CEyLQngOB06qj9sN-Gjh@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=90e6ba6e8c9675358d049c59ed1d
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 22:45:36 -0000

--90e6ba6e8c9675358d049c59ed1d
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Feb 15, 2011 at 13:45, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> Okay, I admit my example was bad.
>
> Just to be clear, even with this code:
>
>       websocket.send("a-message-needs-to-reach-server")
>       websocket.close()
>
> From your opinions, programmers should not expect that the message always
> reach the server. (granted)
>
>
Yes, this point should be noted in the spec, or developers may
misunderstand.


> Now, here's another question for you.
>
> If onclose() callback is made on the websocket, would it be helpful if that
> callback (with wasClean=true) guarantees
> that the message has been delivered to the server?
>
>
Just to be sure, again I'd like to note that ... the complex algorithm in
-05 realizes this (wasClean=true iff received Close frame with "C"), but any
of the proposal A-1, A-2, B I wrote don't. What A-2 and B can do is just
avoiding RST hazard case.


> # trying to figure out whether graceful shutdown at least during 'closing'
> state would ever be helpful.
>
>
I personally think since an application can have its own ack to take care of
this, we don't have to have this feature as mandatory in WebSocket.


> Thanks,
> - Yutaka
>
>
> hybi-bounces@ietf.org wrote on 02/15/2011 12:33:28 PM:
>
>
> > On 2/15/11 1:30 PM, Brian wrote:
> >
> > > If you need, with websocket, to detect that the user's gone
> > > away (such as for an IM system to show that they're offline), you can
> > > do that on the server when you detect the connection is closed.  If
> > > you're using xhr-polling or similar, a reasonably short timeout on the
> > > server during which the user doesn't reconnect for more data should
> > > suffice as a suitable "user has gone away" event.
> >
> > Agreed. And this is what we do in IM systems like XMPP (whether using
> > the TCP binding or BOSH).
> >
> > Peter
> >
> > --
> > Peter Saint-Andre
> > https://stpeter.im/
> >
> >
> >
> > [attachment "smime.p7s" deleted by Yutaka Takeda/R&D/SCEA]
> > _______________________________________________
> > hybi mailing list
> > hybi@ietf.org
> > https://www.ietf.org/mailman/listinfo/hybi
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>

--90e6ba6e8c9675358d049c59ed1d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Tue, Feb 15, 2011 at 13:45,  <span dir=3D"ltr=
">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com" target=3D"_blan=
k">Yutaka_Takeda@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex">



<br><font size=3D"2" face=3D"sans-serif">Okay, I admit my example was bad.<=
/font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Just to be clear, even with this c=
ode:</font>
<br>
<br><font size=3D"2" face=3D"Fixedsys">=A0 =A0 =A0 websocket.send(&quot;a-m=
essage-needs-to-reach-server&quot;)</font>
<br><font size=3D"2" face=3D"Fixedsys">=A0 =A0 =A0 websocket.close()</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">From your opinions, programmers sh=
ould
not expect that the message always reach the server. (granted)</font>
<br>
<br></blockquote><div><br></div><div>Yes, this point should be noted in the=
 spec, or developers may misunderstand.</div><div>=A0</div><blockquote clas=
s=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pad=
ding-left:1ex">


<font size=3D"2" face=3D"sans-serif">Now, here&#39;s another question for y=
ou.</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">If onclose() callback is made on t=
he
websocket, would it be helpful if that callback (with wasClean=3Dtrue) guar=
antees</font>
<br><font size=3D"2" face=3D"sans-serif">that the message has been delivere=
d
to the server?</font>
<br>
<br></blockquote><div><br></div><div>Just to be sure, again I&#39;d like to=
 note that ... the complex algorithm in -05 realizes this (wasClean=3Dtrue =
iff received Close frame with &quot;C&quot;), but any of the proposal A-1, =
A-2, B I wrote don&#39;t.=A0What A-2 and B can do is just avoiding RST haza=
rd case.</div>


<div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;=
border-left:1px #ccc solid;padding-left:1ex"><font size=3D"2" face=3D"sans-=
serif"># trying to figure out whether graceful
shutdown at least during &#39;closing&#39; state would ever be helpful.</fo=
nt>
<br>
<br></blockquote><div><br></div><div>I personally think since an applicatio=
n can have its own ack to take care of this, we don&#39;t have to have this=
 feature as mandatory in WebSocket.</div><div>=A0</div><blockquote class=3D=
"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding=
-left:1ex">


<font size=3D"2" face=3D"sans-serif">Thanks,</font>
<br><font size=3D"2" face=3D"sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=3D"2"><a href=3D"mailto:hybi-bounces@ietf.org" target=3D=
"_blank">hybi-bounces@ietf.org</a> wrote on 02/15/2011 12:33:28
PM:<div><div></div><div><br>
<br>
&gt; On 2/15/11 1:30 PM, Brian wrote:<br>
&gt; <br>
&gt; &gt; If you need, with websocket, to detect that the user&#39;s gone<b=
r>
&gt; &gt; away (such as for an IM system to show that they&#39;re offline),
you can<br>
&gt; &gt; do that on the server when you detect the connection is closed.
=A0If<br>
&gt; &gt; you&#39;re using xhr-polling or similar, a reasonably short timeo=
ut
on the<br>
&gt; &gt; server during which the user doesn&#39;t reconnect for more data
should<br>
&gt; &gt; suffice as a suitable &quot;user has gone away&quot; event.<br>
&gt; <br>
&gt; Agreed. And this is what we do in IM systems like XMPP (whether using<=
br>
&gt; the TCP binding or BOSH).<br>
&gt; <br>
&gt; Peter<br>
&gt; <br>
&gt; -- <br>
&gt; Peter Saint-Andre<br>
&gt; <a href=3D"https://stpeter.im/" target=3D"_blank">https://stpeter.im/<=
/a><br>
&gt; <br>
&gt; <br>
&gt; <br></div></div>
&gt; [attachment &quot;smime.p7s&quot; deleted by Yutaka Takeda/R&amp;D/SCE=
A]
<br><div>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; <a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><b=
r>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blan=
k">https://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></font></tt><br>_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
<br></blockquote></div><br>

--90e6ba6e8c9675358d049c59ed1d--

From jlee@antwerkz.com  Tue Feb 15 14:48:42 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A8A3C3A6C43 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 14:48:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.016
X-Spam-Level: 
X-Spam-Status: No, score=-1.016 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2O2h1gaSgKbf for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 14:48:41 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 2BB7C3A6A3D for <hybi@ietf.org>; Tue, 15 Feb 2011 14:48:41 -0800 (PST)
Received: by fxm9 with SMTP id 9so839594fxm.31 for <hybi@ietf.org>; Tue, 15 Feb 2011 14:49:07 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.74.5 with SMTP id s5mr3256800faj.72.1297810146924; Tue, 15 Feb 2011 14:49:06 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Tue, 15 Feb 2011 14:49:06 -0800 (PST)
In-Reply-To: <AANLkTin+5mxtbD4GbNK1X2P3CEyLQngOB06qj9sN-Gjh@mail.gmail.com>
References: <4D5AE318.9080308@stpeter.im> <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com> <AANLkTin+5mxtbD4GbNK1X2P3CEyLQngOB06qj9sN-Gjh@mail.gmail.com>
Date: Tue, 15 Feb 2011 17:49:06 -0500
Message-ID: <AANLkTimpa0A8UbS-N+d2NsHzYyCibvq9TXyDF9yZaT14@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=20cf3054a38fcb1a4d049c59f8cc
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 22:48:43 -0000

--20cf3054a38fcb1a4d049c59f8cc
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Feb 15, 2011 at 5:45 PM, Takeshi Yoshino <tyoshino@google.com>wrote:

> On Tue, Feb 15, 2011 at 13:45, <Yutaka_Takeda@playstation.sony.com> wrote:
>
>>
>> Okay, I admit my example was bad.
>>
>> Just to be clear, even with this code:
>>
>>       websocket.send("a-message-needs-to-reach-server")
>>       websocket.close()
>>
>> From your opinions, programmers should not expect that the message always
>> reach the server. (granted)
>>
>>
> Yes, this point should be noted in the spec, or developers may
> misunderstand.
>

In the grizzly version, I actually just queue up the close frame behind the
others.  Is this not what should happen?  Should the close frame jump to the
front of the line?


>
>
>> Now, here's another question for you.
>>
>> If onclose() callback is made on the websocket, would it be helpful if
>> that callback (with wasClean=true) guarantees
>> that the message has been delivered to the server?
>>
>>
> Just to be sure, again I'd like to note that ... the complex algorithm in
> -05 realizes this (wasClean=true iff received Close frame with "C"), but any
> of the proposal A-1, A-2, B I wrote don't. What A-2 and B can do is just
> avoiding RST hazard case.
>
>
>> # trying to figure out whether graceful shutdown at least during 'closing'
>> state would ever be helpful.
>>
>>
> I personally think since an application can have its own ack to take care
> of this, we don't have to have this feature as mandatory in WebSocket.
>
>
>> Thanks,
>> - Yutaka
>>
>>
>> hybi-bounces@ietf.org wrote on 02/15/2011 12:33:28 PM:
>>
>>
>> > On 2/15/11 1:30 PM, Brian wrote:
>> >
>> > > If you need, with websocket, to detect that the user's gone
>> > > away (such as for an IM system to show that they're offline), you can
>> > > do that on the server when you detect the connection is closed.  If
>> > > you're using xhr-polling or similar, a reasonably short timeout on the
>> > > server during which the user doesn't reconnect for more data should
>> > > suffice as a suitable "user has gone away" event.
>> >
>> > Agreed. And this is what we do in IM systems like XMPP (whether using
>> > the TCP binding or BOSH).
>> >
>> > Peter
>> >
>> > --
>> > Peter Saint-Andre
>> > https://stpeter.im/
>> >
>> >
>> >
>> > [attachment "smime.p7s" deleted by Yutaka Takeda/R&D/SCEA]
>> > _______________________________________________
>> > hybi mailing list
>> > hybi@ietf.org
>> > https://www.ietf.org/mailman/listinfo/hybi
>>
>> _______________________________________________
>> hybi mailing list
>> hybi@ietf.org
>> https://www.ietf.org/mailman/listinfo/hybi
>>
>>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>


-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--20cf3054a38fcb1a4d049c59f8cc
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<br><br><div class=3D"gmail_quote">On Tue, Feb 15, 2011 at 5:45 PM, Takeshi=
 Yoshino <span dir=3D"ltr">&lt;<a href=3D"mailto:tyoshino@google.com">tyosh=
ino@google.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"gmail_quote"><div class=3D"im">On Tue, Feb 15, 2011 at 13:45,=
  <span dir=3D"ltr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.co=
m" target=3D"_blank">Yutaka_Takeda@playstation.sony.com</a>&gt;</span> wrot=
e:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">



<br><font size=3D"2" face=3D"sans-serif">Okay, I admit my example was bad.<=
/font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Just to be clear, even with this c=
ode:</font>
<br>
<br><font size=3D"2" face=3D"Fixedsys">=A0 =A0 =A0 websocket.send(&quot;a-m=
essage-needs-to-reach-server&quot;)</font>
<br><font size=3D"2" face=3D"Fixedsys">=A0 =A0 =A0 websocket.close()</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">From your opinions, programmers sh=
ould
not expect that the message always reach the server. (granted)</font>
<br>
<br></blockquote><div><br></div></div><div>Yes, this point should be noted =
in the spec, or developers may misunderstand.</div></div></blockquote><div>=
<br></div><div>In the grizzly version, I actually just queue up the close f=
rame behind the others. =A0Is this not what should happen? =A0Should the cl=
ose frame jump to the front of the line?</div>
<div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;=
border-left:1px #ccc solid;padding-left:1ex;"><div class=3D"gmail_quote"><d=
iv class=3D"im"><div>=A0</div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">



<font size=3D"2" face=3D"sans-serif">Now, here&#39;s another question for y=
ou.</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">If onclose() callback is made on t=
he
websocket, would it be helpful if that callback (with wasClean=3Dtrue) guar=
antees</font>
<br><font size=3D"2" face=3D"sans-serif">that the message has been delivere=
d
to the server?</font>
<br>
<br></blockquote><div><br></div></div><div>Just to be sure, again I&#39;d l=
ike to note that ... the complex algorithm in -05 realizes this (wasClean=
=3Dtrue iff received Close frame with &quot;C&quot;), but any of the propos=
al A-1, A-2, B I wrote don&#39;t.=A0What A-2 and B can do is just avoiding =
RST hazard case.</div>
<div class=3D"im">


<div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;=
border-left:1px #ccc solid;padding-left:1ex"><font size=3D"2" face=3D"sans-=
serif"># trying to figure out whether graceful
shutdown at least during &#39;closing&#39; state would ever be helpful.</fo=
nt>
<br>
<br></blockquote><div><br></div></div><div>I personally think since an appl=
ication can have its own ack to take care of this, we don&#39;t have to hav=
e this feature as mandatory in WebSocket.</div><div class=3D"im"><div>=A0</=
div>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">


<font size=3D"2" face=3D"sans-serif">Thanks,</font>
<br><font size=3D"2" face=3D"sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=3D"2"><a href=3D"mailto:hybi-bounces@ietf.org" target=3D=
"_blank">hybi-bounces@ietf.org</a> wrote on 02/15/2011 12:33:28
PM:<div><div></div><div><br>
<br>
&gt; On 2/15/11 1:30 PM, Brian wrote:<br>
&gt; <br>
&gt; &gt; If you need, with websocket, to detect that the user&#39;s gone<b=
r>
&gt; &gt; away (such as for an IM system to show that they&#39;re offline),
you can<br>
&gt; &gt; do that on the server when you detect the connection is closed.
=A0If<br>
&gt; &gt; you&#39;re using xhr-polling or similar, a reasonably short timeo=
ut
on the<br>
&gt; &gt; server during which the user doesn&#39;t reconnect for more data
should<br>
&gt; &gt; suffice as a suitable &quot;user has gone away&quot; event.<br>
&gt; <br>
&gt; Agreed. And this is what we do in IM systems like XMPP (whether using<=
br>
&gt; the TCP binding or BOSH).<br>
&gt; <br>
&gt; Peter<br>
&gt; <br>
&gt; -- <br>
&gt; Peter Saint-Andre<br>
&gt; <a href=3D"https://stpeter.im/" target=3D"_blank">https://stpeter.im/<=
/a><br>
&gt; <br>
&gt; <br>
&gt; <br></div></div>
&gt; [attachment &quot;smime.p7s&quot; deleted by Yutaka Takeda/R&amp;D/SCE=
A]
<br><div>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; <a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><b=
r>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blan=
k">https://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></font></tt><br>_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
<br></blockquote></div></div><br>
<br>_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
<br></blockquote></div><br><br clear=3D"all"><br>-- <br>You can find me on =
the net at:<div><a href=3D"http://antwerkz.com" target=3D"_blank">http://an=
twerkz.com</a><br><a href=3D"http://www.linkedin.com/in/justinlee" target=
=3D"_blank">http://www.linkedin.com/in/justinlee</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--20cf3054a38fcb1a4d049c59f8cc--

From tyoshino@google.com  Tue Feb 15 15:53:13 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA5803A6C37 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 15:53:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.976
X-Spam-Level: 
X-Spam-Status: No, score=-104.976 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mdm2ms7ToJYI for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 15:53:12 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 6B75B3A6C9E for <hybi@ietf.org>; Tue, 15 Feb 2011 15:53:12 -0800 (PST)
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13]) by smtp-out.google.com with ESMTP id p1FNrc8Q005776 for <hybi@ietf.org>; Tue, 15 Feb 2011 15:53:38 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297814018; bh=VJmoAvNiu+nJVnFwqrWx0p/lGzk=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=bAZlq4eFqBTBlL5xcf9W36YGR1jHir4IGWK49DfWoxWzr8DK3if0SgvdtkEH0U2EH hYTMSQIyhlINvWE5gUUnQ==
Received: from iwn6 (iwn6.prod.google.com [10.241.68.70]) by hpaq13.eem.corp.google.com with ESMTP id p1FNpUGM021240 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 15:53:37 -0800
Received: by iwn6 with SMTP id 6so878892iwn.15 for <hybi@ietf.org>; Tue, 15 Feb 2011 15:53:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=NBc+e/Nlk3N+fhlXEXZQUrmiUM94AwUmStB+7g3ohZs=; b=uUf62ftPPfmE8K/c3Clje3I9NfoZmB+UyEV5EILyvS+Dpf/OzJWFn6qXtxLrzbfcg2 YEI7gIiZ1XK+dkR9NMMA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=IbSwvQVhQRzAxnC+3WySnn/XDWX5Xcjo3agz9pWw5tAf7kSjde4uEmN+K5NsUMEFli B+RsBlvr4TfK3uIPhD9Q==
Received: by 10.231.39.73 with SMTP id f9mr10237ibe.79.1297814016177; Tue, 15 Feb 2011 15:53:36 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Tue, 15 Feb 2011 15:53:16 -0800 (PST)
In-Reply-To: <AANLkTimpa0A8UbS-N+d2NsHzYyCibvq9TXyDF9yZaT14@mail.gmail.com>
References: <4D5AE318.9080308@stpeter.im> <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com> <AANLkTin+5mxtbD4GbNK1X2P3CEyLQngOB06qj9sN-Gjh@mail.gmail.com> <AANLkTimpa0A8UbS-N+d2NsHzYyCibvq9TXyDF9yZaT14@mail.gmail.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Tue, 15 Feb 2011 15:53:16 -0800
Message-ID: <AANLkTim51OKk-QUX=mmZN3ptOuPZ2WKsW_nzt1SzsgAD@mail.gmail.com>
To: Justin Lee <jlee@antwerkz.com>
Content-Type: multipart/alternative; boundary=0003255752fe6b3705049c5adf2d
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Feb 2011 23:53:14 -0000

--0003255752fe6b3705049c5adf2d
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Feb 15, 2011 at 14:49, Justin Lee <jlee@antwerkz.com> wrote:

>
>
> On Tue, Feb 15, 2011 at 5:45 PM, Takeshi Yoshino <tyoshino@google.com>wrote:
>
>> On Tue, Feb 15, 2011 at 13:45, <Yutaka_Takeda@playstation.sony.com>wrote:
>>
>>>
>>> Okay, I admit my example was bad.
>>>
>>> Just to be clear, even with this code:
>>>
>>>       websocket.send("a-message-needs-to-reach-server")
>>>       websocket.close()
>>>
>>> From your opinions, programmers should not expect that the message always
>>> reach the server. (granted)
>>>
>>>
>> Yes, this point should be noted in the spec, or developers may
>> misunderstand.
>>
>
> In the grizzly version, I actually just queue up the close frame behind the
> others.  Is this not what should happen?  Should the close frame jump to the
> front of the line?
>
>

At least I can say that is not incorrect behavior. Whether "Send something"
in *start the WebSocket closing handshake* algorithm should break in or just
queue behind the others is not specified in the spec, I think. IMO, we
should queue Close frame behind the others. If close() breaks in, preceding
send()s are cancelled. That's bad programming model though I can imagine
some implementation might have urgent_close() or something that breaks in if
they need. FYI, we queue a Close frame behind the others in pywebsocket,
too.

Here what we're talking about is how to let the client know if
"a-message-needs-to-reach-server" is received by the other peer or not by
using closing handshake. Even "a-message-needs-to-reach-server" is queued
before a Close frame, it's possible that it cannot make it to the other peer
for some network problem, etc.

--0003255752fe6b3705049c5adf2d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 15, 2011 at 14:49, Justin Lee <span dir=3D"ltr">&lt;<a href=3D"=
mailto:jlee@antwerkz.com">jlee@antwerkz.com</a>&gt;</span> wrote:<div class=
=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">

<br><br><div class=3D"gmail_quote"><div class=3D"im">On Tue, Feb 15, 2011 a=
t 5:45 PM, Takeshi Yoshino <span dir=3D"ltr">&lt;<a href=3D"mailto:tyoshino=
@google.com" target=3D"_blank">tyoshino@google.com</a>&gt;</span> wrote:<br=
><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1=
px #ccc solid;padding-left:1ex">


<div class=3D"gmail_quote"><div>On Tue, Feb 15, 2011 at 13:45,  <span dir=
=3D"ltr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com" target=
=3D"_blank">Yutaka_Takeda@playstation.sony.com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">



<br><font size=3D"2" face=3D"sans-serif">Okay, I admit my example was bad.<=
/font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Just to be clear, even with this c=
ode:</font>
<br>
<br><font size=3D"2" face=3D"Fixedsys">=A0 =A0 =A0 websocket.send(&quot;a-m=
essage-needs-to-reach-server&quot;)</font>
<br><font size=3D"2" face=3D"Fixedsys">=A0 =A0 =A0 websocket.close()</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">From your opinions, programmers sh=
ould
not expect that the message always reach the server. (granted)</font>
<br>
<br></blockquote><div><br></div></div><div>Yes, this point should be noted =
in the spec, or developers may misunderstand.</div></div></blockquote><div>=
<br></div></div><div>In the grizzly version, I actually just queue up the c=
lose frame behind the others. =A0Is this not what should happen? =A0Should =
the close frame jump to the front of the line?</div>

<div><div></div><div class=3D"h5">
<div>=A0</div></div></div></div></blockquote><div><br></div><div>At least=
=A0I can say that is not incorrect behavior. Whether &quot;Send something&q=
uot; in *start the WebSocket closing handshake* algorithm should break in o=
r just queue behind the others is not specified in the spec, I think. IMO, =
we should queue Close frame behind the others. If close() breaks in, preced=
ing send()s are cancelled. That&#39;s bad programming model though I can im=
agine some implementation might have urgent_close() or something that break=
s in if they need. FYI, we queue a Close frame behind the others in pywebso=
cket, too.</div>

<div><br></div><div>Here what we&#39;re talking about is how to let the cli=
ent know if &quot;a-message-needs-to-reach-server&quot; is received by the =
other peer or not by using closing handshake. Even &quot;a-message-needs-to=
-reach-server&quot; is queued before a Close frame, it&#39;s possible that =
it cannot make it to the other peer for some network problem, etc.</div>

<div><br></div></div>

--0003255752fe6b3705049c5adf2d--

From Yutaka_Takeda@PlayStation.Sony.Com  Tue Feb 15 16:04:27 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D46F13A6C37 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 16:04:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.668
X-Spam-Level: 
X-Spam-Status: No, score=-5.668 tagged_above=-999 required=5 tests=[AWL=-0.004, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i8zMhzWCcOFt for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 16:04:26 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id B19533A6A53 for <hybi@ietf.org>; Tue, 15 Feb 2011 16:04:26 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021516044604-583490 ; Tue, 15 Feb 2011 16:04:46 -0800 
In-Reply-To: <AANLkTinXR_kTQ2vFt8AqLWPJd1XYxMxuhbVwGgRGqKO0@mail.gmail.com>
To: ifette@google.com
MIME-Version: 1.0
X-KeepSent: 21F755C7:13DF9AAD-88257838:007EEEA2; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF21F755C7.13DF9AAD-ON88257838.007EEEA2-88257839.00007084@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Tue, 15 Feb 2011 16:04:47 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/15/2011 04:04:45 PM, Serialize complete at 02/15/2011 04:04:45 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 04:04:46 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 04:04:53 PM, Serialize complete at 02/15/2011 04:04:53 PM
Content-Type: multipart/alternative; boundary="=_alternative 0000708288257839_="
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 00:04:28 -0000

This is a multipart message in MIME format.
--=_alternative 0000708288257839_=
Content-Type: text/plain; charset="ISO-2022-JP"

Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com> wrote on 02/15/2011 
02:27:58 PM:

> What I'm currently looking at is this: (comments welcome)
> 
>          <t>The Close message contains an opcode of 0x01.</t>
>           <t>The Close message contains no body (the body has zero 
> length).</t>
>           <t>The application MUST NOT send any more data messages 
> after sending
>           a close message.</t>
>           <t>If an endpoint receives a Close message and that endpoint 
did not
>           previously send a Close message, the endpoint MUST send a 
Close
>           message in response. It SHOULD do so as soon as is practical.
>           </t>
>           <t>After both sending and receiving a close message, an 
endpoint
>           considers the websocket connection closed, and
>           SHOULD close the underlying TCP connection.</t>
>           <t>If a client and server both send a Close message at thesame 
time,
>           both endpoints will have sent and received a Close messageand 
should
>           consider the websocket connection closed and close the 
underlying
>           TCP connection.</t>

I would replace corresponding texts with something along the line of the 
following for more completeness:

(1) The endpoint SHOULD close write channel of the TCP connection 
    immediately after Close message is sent. (e.g. shutdown(SHUT_WR))

(2) After both sending and receiving a Close message, both endpoints
    SHOULD wait for EoS(End of Stream; i.e. recv() returning 0) before
    closing TCP socket and discard any data received after the Close
    message.

(3) After both sending and receiving a Close message and the endpoint
    has detected EoS, then the WebSocket connection is said to have been
    closed _cleanly_.

Justification:
- (1) is to ensure that no more data will be written to the 
  underlying TCP socket after the Close message, and to indicate
  that sender has reached the EoS at TCP level.
- (2) is to prevent the endpoint from generating spurious RST
  due to a bug at the remote endpoint injecting data after Close frame.
- Presence of Close frame helps intermediaries to detect normal closure
  of WebSocket connection.

Best.
- Yutaka

--=_alternative 0000708288257839_=
Content-Type: text/html; charset="ISO-2022-JP"


<br><tt><font size=2>Ian Fette ($B%$%"%s%U%'%C%F%#(B) &lt;ifette@google.com&gt;
wrote on 02/15/2011 02:27:58 PM:<br>
<br>
&gt; What I'm currently looking at is this: (comments welcome)</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;The Close message contains
an opcode of 0x01.&lt;/t&gt;</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;The
Close message contains no body (the body has zero <br>
&gt; length).&lt;/t&gt;</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;The
application MUST NOT send any more data messages <br>
&gt; after sending</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;a close
message.&lt;/t&gt;</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;If
an endpoint receives a Close message and that endpoint did not</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;previously
send a Close message, the endpoint MUST send a Close</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;message
in response. It SHOULD do so as soon as is practical.</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;/t&gt;</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;After
both sending and receiving a close message, an endpoint</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;considers
the websocket connection closed, and</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;SHOULD
close the underlying TCP connection.&lt;/t&gt;</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;If
a client and server both send a Close message at thesame time,</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;both
endpoints will have sent and received a Close messageand should</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;consider
the websocket connection closed and close the underlying</font></tt>
<br><tt><font size=2>&gt; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TCP connection.&lt;/t&gt;</font></tt>
<br>
<br><tt><font size=2>I would replace corresponding texts with something
along the line of the </font></tt>
<br><tt><font size=2>following for more completeness:</font></tt>
<br>
<br><tt><font size=2>(1) The endpoint SHOULD close write channel of the
TCP connection </font></tt>
<br><tt><font size=2>&nbsp; &nbsp; immediately after Close message is sent.
(e.g. shutdown(SHUT_WR))</font></tt>
<br>
<br><tt><font size=2>(2) After both sending and receiving a Close message,
both endpoints</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; SHOULD wait for EoS(End of Stream; i.e.
recv() returning 0) before</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; closing TCP socket and discard any data
received after the Close</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; message.</font></tt>
<br>
<br><tt><font size=2>(3) After both sending and receiving a Close message
and the endpoint</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; has detected EoS, then the WebSocket
connection is said to have been</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; closed _cleanly_.</font></tt>
<br>
<br><tt><font size=2>Justification:</font></tt>
<br><tt><font size=2>- (1) is to ensure that no more data will be written
to the </font></tt>
<br><tt><font size=2>&nbsp; underlying TCP socket after the Close message,
and to indicate</font></tt>
<br><tt><font size=2>&nbsp; that sender has reached the EoS at TCP level.</font></tt>
<br><tt><font size=2>- (2) is to prevent the endpoint from generating spurious
RST</font></tt>
<br><tt><font size=2>&nbsp; due to a bug at the remote endpoint injecting
data after Close frame.</font></tt>
<br><tt><font size=2>- Presence of Close frame helps intermediaries to
detect normal closure</font></tt>
<br><tt><font size=2>&nbsp; of WebSocket connection.</font></tt>
<br>
<br><tt><font size=2>Best.</font></tt>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
--=_alternative 0000708288257839_=--

From brofield@gmail.com  Tue Feb 15 16:06:25 2011
Return-Path: <brofield@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3BA273A6D71 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 16:06:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JOngNJ3NP49g for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 16:06:24 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 0159A3A6A53 for <hybi@ietf.org>; Tue, 15 Feb 2011 16:06:23 -0800 (PST)
Received: by qwi2 with SMTP id 2so656327qwi.31 for <hybi@ietf.org>; Tue, 15 Feb 2011 16:06:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=+IFvcrusdJX5Srr5Kl+C+ozC9L3QRvBreyrVJ7ujvRQ=; b=PCkxhEVkQirsLBX/Xfp8LeAbQHpPRNgENKDv2dOUCe/LuXfbyYTVGB+xR7whB39bM8 Ffgynqr8ckMfFJLKGHqo4WvB9klpkZ2X6LoSguDbehAmi+m9P73EJpMAFowJcVI4h7yW lQZMWSzTxo9bj+8qW/9SH/Ma50h0AvdJtx0IU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=QoJBoTNayXwuGDEZHwdyrJJ6GEGKhXjTd5Ehdc9V5pIuMFHT9USmbT+lE9v/PTDqri eW9LKrMBFbYIVZioUwC87n78VkXX4YPkZ5rv2RvkW5vrnEr9Nl5EFDkF7qB4mJTyp99k XB/o4EFBsGhmSYcLEnZnQw/UsV5t9IGtJkhrQ=
MIME-Version: 1.0
Received: by 10.224.61.3 with SMTP id r3mr31078qah.134.1297814810185; Tue, 15 Feb 2011 16:06:50 -0800 (PST)
Sender: brofield@gmail.com
Received: by 10.224.187.2 with HTTP; Tue, 15 Feb 2011 16:06:50 -0800 (PST)
In-Reply-To: <AANLkTinXR_kTQ2vFt8AqLWPJd1XYxMxuhbVwGgRGqKO0@mail.gmail.com>
References: <4D5AE318.9080308@stpeter.im> <OF9E69202E.36384265-ON88257838.00749E83-88257838.007782CA@playstation.sony.com> <AANLkTinXR_kTQ2vFt8AqLWPJd1XYxMxuhbVwGgRGqKO0@mail.gmail.com>
Date: Wed, 16 Feb 2011 09:06:50 +0900
X-Google-Sender-Auth: yCyiK9bBNmod-XT-ocItuo0wA0Y
Message-ID: <AANLkTim1+gnSqG==GQt4nJ1RZ-AX=+AU3RvsPHqZ6AiL@mail.gmail.com>
From: Brodie Thiesfield <brodie@jellycan.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org, Yutaka_Takeda@playstation.sony.com
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 00:06:25 -0000

2011/2/16 Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com>:
> I am trying to get out a -06 that resolves some of the CLOSE issues, but
> currently I'm getting caught up by a few other things at work today.
> What I'm currently looking at is this: (comments welcome)
>          <t>The Close message contains an opcode of 0x01.</t>
>           <t>The Close message contains no body (the body has zero
> length).</t>
>           <t>The application MUST NOT send any more data messages after
> sending
>           a close message.</t>
>           <t>If an endpoint receives a Close message and that endpoint did
> not
>           previously send a Close message, the endpoint MUST send a Close
>           message in response. It SHOULD do so as soon as is practical.
>           </t>
>           <t>After both sending and receiving a close message, an endpoint
>           considers the websocket connection closed, and
>           SHOULD close the underlying TCP connection.</t>
>           <t>If a client and server both send a Close message at the same
> time,
>           both endpoints will have sent and received a Close message and
> should
>           consider the websocket connection closed and close the underlying
>           TCP connection.</t>

I would like to see support in the close message for a status
code/reason to show the reason for an abnormal close. The goal is
purely to provide useful information for interop troubleshooting.

At the moment the spec has a number of cases where the connection is
just dropped with no information provided to the peer as to why.
Although from the normal operation of the server this may be optimal,
it is going to make integration testing hell. There needs to be some
way to find out why the remote server is dropping the connection.

I propose that the close message contain a status code and an optional
message. Further, I propose that the peer that following a successful
handshake, the peer that is about to abort the connection SHOULD send
a close message with a valid status code and optionally a more
detailed human readable message. This is valid for both client and
server aborts (i.e. the client is aborting because of an invalid
opcode/incorrectly formatted server message).

An example of the text that I am suggesting, modifying the relevant
bits of what you supplied.

----
The Close message contains an opcode of 0x01.The Close message
contains a body made up of a status code and an optional
human-readable message following the format:

  status = [123] [0-9] [0-9]
  msg    = SP CHAR+
  close  = status msg

The status code ranges are 1xx normal, 2xx message sender error, 3xx
message receiver error.

The application MUST NOT send any more data messages after sending a
close message.
----

If a reply Close message is required as per Ian's text, then I would
modify it as:
----
If an endpoint receives a Close message and that endpoint did not
previously send a Close message, the endpoint MUST send a Close
message with a 100 status (normal close) in response. It SHOULD do so
as soon as is practical.
----

The text on aborts would be changed to note that an abort is actually
a Close with abnormal status + close of transport. If a close message
requires a close reply then the aborting peer would need to wait
around to receive that message (or at least drain the socket to avoid
TCP problems).

Suggested status codes (trying to not get too detailed):

  1xx  Normal close range
    100  Normal close

  2xx  Message sender error range
    200  Message sender general error
    201  Invalid opcode
    202  Invalid framing (e.g. RSV bits used but not negotiated,
fragmented control msg)
    203  Invalid encoding (e.g. invalid UTF-8)

  3xx  Message receiver error range
    300  Message receiver internal error
    301  Overloaded / service unavailable
    302  Message too long (i.e. longer than this server/intermediatary supports)

Regards,
Brodie

From Yutaka_Takeda@PlayStation.Sony.Com  Tue Feb 15 16:10:18 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E78F23A6D71; Tue, 15 Feb 2011 16:10:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.667
X-Spam-Level: 
X-Spam-Status: No, score=-5.667 tagged_above=-999 required=5 tests=[AWL=-0.003, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0KEOHjTpydYR; Tue, 15 Feb 2011 16:10:10 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 543BA3A6C66; Tue, 15 Feb 2011 16:10:09 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021516102765-583713 ; Tue, 15 Feb 2011 16:10:27 -0800 
In-Reply-To: <OF21F755C7.13DF9AAD-ON88257838.007EEEA2-88257839.00007084@playstation.sony.com>
To: ifette@google.com
MIME-Version: 1.0
X-KeepSent: 35ACDF07:73860E04-88257839:000091DB; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF35ACDF07.73860E04-ON88257839.000091DB-88257839.0000F650@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Tue, 15 Feb 2011 16:10:29 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/15/2011 04:10:27 PM, Serialize complete at 02/15/2011 04:10:27 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 04:10:27 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 04:10:36 PM, Serialize complete at 02/15/2011 04:10:36 PM
Content-Type: multipart/alternative; boundary="=_alternative 0000F64E88257839_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 00:10:18 -0000

This is a multipart message in MIME format.
--=_alternative 0000F64E88257839_=
Content-Type: text/plain; charset="ISO-2022-JP"

Typo correction: The "SHOULD" in my text need to be "MUST" because both 
endpoints 
communicate using EoS in the proposed close handshake:

(1) The endpoint MUST close write channel of the TCP connection 
    immediately after Close message is sent. (e.g. shutdown(SHUT_WR)) 

(2) After both sending and receiving a Close message, both endpoints 
    MUST wait for EoS(End of Stream; i.e. recv() returning 0) before 
    closing TCP socket and discard any data received after the Close 
    message. 

(3) After both sending and receiving a Close message and the endpoint 
    has detected EoS, then the WebSocket connection is said to have been 
    closed _cleanly_. 

--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060




Yutaka Takeda/R&D/SCEA@Playstation 
Sent by: hybi-bounces@ietf.org
02/15/2011 04:05 PM

To
ifette@google.com
cc
hybi@ietf.org
Subject
Re: [hybi] Clarify the role of closing handshake







Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com> wrote on 02/15/2011 
02:27:58 PM:

> What I'm currently looking at is this: (comments welcome) 
> 
>          <t>The Close message contains an opcode of 0x01.</t> 
>           <t>The Close message contains no body (the body has zero 
> length).</t> 
>           <t>The application MUST NOT send any more data messages 
> after sending 
>           a close message.</t> 
>           <t>If an endpoint receives a Close message and that endpoint 
did not 
>           previously send a Close message, the endpoint MUST send a 
Close 
>           message in response. It SHOULD do so as soon as is practical. 
>           </t> 
>           <t>After both sending and receiving a close message, an 
endpoint 
>           considers the websocket connection closed, and 
>           SHOULD close the underlying TCP connection.</t> 
>           <t>If a client and server both send a Close message at thesame 
time, 
>           both endpoints will have sent and received a Close messageand 
should 
>           consider the websocket connection closed and close the 
underlying 
>           TCP connection.</t> 

I would replace corresponding texts with something along the line of the 
following for more completeness: 

(1) The endpoint SHOULD close write channel of the TCP connection 
    immediately after Close message is sent. (e.g. shutdown(SHUT_WR)) 

(2) After both sending and receiving a Close message, both endpoints 
    SHOULD wait for EoS(End of Stream; i.e. recv() returning 0) before 
    closing TCP socket and discard any data received after the Close 
    message. 

(3) After both sending and receiving a Close message and the endpoint 
    has detected EoS, then the WebSocket connection is said to have been 
    closed _cleanly_. 

Justification: 
- (1) is to ensure that no more data will be written to the 
  underlying TCP socket after the Close message, and to indicate 
  that sender has reached the EoS at TCP level. 
- (2) is to prevent the endpoint from generating spurious RST 
  due to a bug at the remote endpoint injecting data after Close frame. 
- Presence of Close frame helps intermediaries to detect normal closure 
  of WebSocket connection. 

Best. 
- Yutaka _______________________________________________
hybi mailing list
hybi@ietf.org
https://www.ietf.org/mailman/listinfo/hybi


--=_alternative 0000F64E88257839_=
Content-Type: text/html; charset="ISO-2022-JP"


<br><font size=2 face="sans-serif">Typo correction: The &quot;SHOULD&quot;
in my text need to be &quot;MUST&quot; because both endpoints </font>
<br><font size=2 face="sans-serif">communicate using EoS in the proposed
close handshake:</font>
<br>
<br><tt><font size=2>(1) The endpoint MUST close write channel of the TCP
connection <br>
 &nbsp; &nbsp;immediately after Close message is sent. (e.g. shutdown(SHUT_WR))</font></tt><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
(2) After both sending and receiving a Close message, both endpoints</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; &nbsp;MUST wait for EoS(End of Stream; i.e. recv() returning 0)
before</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; &nbsp;closing TCP socket and discard any data received after the
Close</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; &nbsp;message.</font></tt><font size=3 face="sans-serif"> <br>
</font><tt><font size=2><br>
(3) After both sending and receiving a Close message and the endpoint</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; &nbsp;has detected EoS, then the WebSocket connection is said to
have been</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; &nbsp;closed _cleanly_.</font></tt><font size=3 face="sans-serif">
</font>
<br>
<br><font size=2 face="sans-serif">--<br>
Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
Office: 650 655 7484 &nbsp; Fax: 650 655 8060<br>
</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Yutaka Takeda/R&amp;D/SCEA@Playstation</b>
</font>
<br><font size=1 face="sans-serif">Sent by: hybi-bounces@ietf.org</font>
<p><font size=1 face="sans-serif">02/15/2011 04:05 PM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">ifette@google.com</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">hybi@ietf.org</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Re: [hybi] Clarify the role of closing
handshake</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><tt><font size=2><br>
Ian Fette ($B%$%"%s%U%'%C%F%#(B) &lt;ifette@google.com&gt; wrote on
02/15/2011 02:27:58 PM:<br>
<br>
&gt; What I'm currently looking at is this: (comments welcome)</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; <br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;The Close message contains
an opcode of 0x01.&lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;The Close message contains
no body (the body has zero <br>
&gt; length).&lt;/t&gt;</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;The application MUST NOT
send any more data messages <br>
&gt; after sending</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; a close message.&lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;If an endpoint receives
a Close message and that endpoint did not</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; previously send a Close message,
the endpoint MUST send a Close</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; message in response. It SHOULD
do so as soon as is practical.</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;After both sending and
receiving a close message, an endpoint</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; considers the websocket connection
closed, and</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SHOULD close the underlying TCP
connection.&lt;/t&gt;</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;If a client and server
both send a Close message at thesame time,</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; both endpoints will have sent and
received a Close messageand should</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; consider the websocket connection
closed and close the underlying</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TCP connection.&lt;/t&gt;</font></tt><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
I would replace corresponding texts with something along the line of the
<br>
following for more completeness:</font></tt><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
(1) The endpoint SHOULD close write channel of the TCP connection <br>
 &nbsp; &nbsp;immediately after Close message is sent. (e.g. shutdown(SHUT_WR))</font></tt><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
(2) After both sending and receiving a Close message, both endpoints</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; &nbsp;SHOULD wait for EoS(End of Stream; i.e. recv() returning
0) before</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; &nbsp;closing TCP socket and discard any data received after the
Close</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; &nbsp;message.</font></tt><font size=3 face="sans-serif"> <br>
</font><tt><font size=2><br>
(3) After both sending and receiving a Close message and the endpoint</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; &nbsp;has detected EoS, then the WebSocket connection is said to
have been</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; &nbsp;closed _cleanly_.</font></tt><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
Justification:</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
- (1) is to ensure that no more data will be written to the <br>
 &nbsp;underlying TCP socket after the Close message, and to indicate</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp;that sender has reached the EoS at TCP level.</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
- (2) is to prevent the endpoint from generating spurious RST</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp;due to a bug at the remote endpoint injecting data after Close frame.</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
- Presence of Close frame helps intermediaries to detect normal closure</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp;of WebSocket connection.</font></tt><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
Best.</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
- Yutaka</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2>_______________________________________________<br>
hybi mailing list<br>
hybi@ietf.org<br>
https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
<br>
--=_alternative 0000F64E88257839_=--

From tyoshino@google.com  Tue Feb 15 16:21:41 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9DF093A6C75 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 16:21:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.592
X-Spam-Level: 
X-Spam-Status: No, score=-104.592 tagged_above=-999 required=5 tests=[AWL=-0.969, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_33=0.6, MIME_BASE64_TEXT=1.753, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFT5conSFWjK for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 16:21:40 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id DDA473A6C37 for <hybi@ietf.org>; Tue, 15 Feb 2011 16:21:39 -0800 (PST)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p1G0M5Fr007393 for <hybi@ietf.org>; Tue, 15 Feb 2011 16:22:05 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297815725; bh=5hgEOJGAP4iZtMJcRqs0W7b9Agg=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Jvzy6FFQFVI/5Epuy72jiQte3AW6p/uYOUcgGqMsj8i+egX+KJjzoUM2xgjTeUWrZ X2EJiA0sBboZoUAGRbq2w==
Received: from iym1 (iym1.prod.google.com [10.241.52.1]) by wpaz37.hot.corp.google.com with ESMTP id p1G0Lgps011074 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 16:22:04 -0800
Received: by iym1 with SMTP id 1so683921iym.17 for <hybi@ietf.org>; Tue, 15 Feb 2011 16:22:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=jkQ6Kdcejp4P3UUPL/8JlNNnb70qR9gHc7zqm85uLx4=; b=QlsZJH1qrZxKjeVG5/sLRweNNdTdDfjVXxMPZjg1DPfQpFUHksrbp4jwhtFwjUHKbU V7NDMuhGp+E4lYliJTQg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=tQuYt4w4/MMgvug+6/71F4Xli3a7k5y0JBoUiE+tGPsSui0HX//lmUBUEDGDofqKSf y6mKal+sSS/YUonqv2Wg==
Received: by 10.231.171.197 with SMTP id i5mr33482ibz.54.1297815724216; Tue, 15 Feb 2011 16:22:04 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Tue, 15 Feb 2011 16:21:44 -0800 (PST)
In-Reply-To: <OF35ACDF07.73860E04-ON88257839.000091DB-88257839.0000F650@playstation.sony.com>
References: <OF21F755C7.13DF9AAD-ON88257838.007EEEA2-88257839.00007084@playstation.sony.com> <OF35ACDF07.73860E04-ON88257839.000091DB-88257839.0000F650@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Tue, 15 Feb 2011 16:21:44 -0800
Message-ID: <AANLkTimhJ+F85NrAjt8TwDjDpyH0j30YcfAxppNKEvwF@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=001636c9243639d2a0049c5b45cc
X-System-Of-Record: true
Cc: hybi@ietf.org, hybi-bounces@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 00:21:41 -0000

--001636c9243639d2a0049c5b45cc
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit

In case you missed this part of my post citing Ian's thought.

http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html

<http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html>
>
> I think the net result is that ideally .close() should map to sending a
> FIN, aka using shutdown(SHUT_WR). Unfortunately this is not always
> possible -- people cited numerous examples of cases where we can't rely on
> TCP semantics in practice -- so we probably want to simulate this at the
> WebSocket layer or the application layer. Since the JS API exposes a
> .close() method, we should probably expose it at the WebSocket layer.


What do you think about this? I think it's nice to put your method just for
implementor's information together with Gabriel's idea in case we decide to
adopt Gabriel's idea, but reluctant to put it as mandatory protocol because
of this.

Takeshi


On Tue, Feb 15, 2011 at 16:10, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> Typo correction: The "SHOULD" in my text need to be "MUST" because both
> endpoints
> communicate using EoS in the proposed close handshake:
>
> (1) The endpoint MUST close write channel of the TCP connection
>    immediately after Close message is sent. (e.g. shutdown(SHUT_WR))
>
>
> (2) After both sending and receiving a Close message, both endpoints
>
>    MUST wait for EoS(End of Stream; i.e. recv() returning 0) before
>    closing TCP socket and discard any data received after the Close
>
>    message.
>
> (3) After both sending and receiving a Close message and the endpoint
>    has detected EoS, then the WebSocket connection is said to have been
>    closed _cleanly_.
>
> --
> Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
> Office: 650 655 7484   Fax: 650 655 8060
>
>
>
>  *Yutaka Takeda/R&D/SCEA@Playstation*
> Sent by: hybi-bounces@ietf.org
>
> 02/15/2011 04:05 PM
>   To
> ifette@google.com
> cc
> hybi@ietf.org
> Subject
> Re: [hybi] Clarify the role of closing handshake
>
>
>
>
>
> Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com> wrote on 02/15/2011 02:27:58 PM:
>
> > What I'm currently looking at is this: (comments welcome)
> >
> >          <t>The Close message contains an opcode of 0x01.</t>
> >           <t>The Close message contains no body (the body has zero
> > length).</t>
> >           <t>The application MUST NOT send any more data messages
> > after sending
> >           a close message.</t>
> >           <t>If an endpoint receives a Close message and that endpoint
> did not
> >           previously send a Close message, the endpoint MUST send a Close
> >           message in response. It SHOULD do so as soon as is practical.
> >           </t>
> >           <t>After both sending and receiving a close message, an
> endpoint
> >           considers the websocket connection closed, and
> >           SHOULD close the underlying TCP connection.</t>
> >           <t>If a client and server both send a Close message at thesame
> time,
> >           both endpoints will have sent and received a Close messageand
> should
> >           consider the websocket connection closed and close the
> underlying
> >           TCP connection.</t>
>
> I would replace corresponding texts with something along the line of the
> following for more completeness:
>
> (1) The endpoint SHOULD close write channel of the TCP connection
>    immediately after Close message is sent. (e.g. shutdown(SHUT_WR))
>
> (2) After both sending and receiving a Close message, both endpoints
>    SHOULD wait for EoS(End of Stream; i.e. recv() returning 0) before
>    closing TCP socket and discard any data received after the Close
>    message.
>
> (3) After both sending and receiving a Close message and the endpoint
>    has detected EoS, then the WebSocket connection is said to have been
>    closed _cleanly_.
>
> Justification:
> - (1) is to ensure that no more data will be written to the
>  underlying TCP socket after the Close message, and to indicate
>  that sender has reached the EoS at TCP level.
> - (2) is to prevent the endpoint from generating spurious RST
>  due to a bug at the remote endpoint injecting data after Close frame.
> - Presence of Close frame helps intermediaries to detect normal closure
>  of WebSocket connection.
>
> Best.
>
> - Yutaka _______________________________________________
>
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>

--001636c9243639d2a0049c5b45cc
Content-Type: text/html; charset=ISO-2022-JP
Content-Transfer-Encoding: base64

SW4gY2FzZSB5b3UgbWlzc2VkIHRoaXMgcGFydCBvZiBteSBwb3N0IGNpdGluZyBJYW4mIzM5O3Mg
dGhvdWdodC48ZGl2Pjxicj48L2Rpdj48ZGl2PjxhIGhyZWY9Imh0dHA6Ly93d3cuaWV0Zi5vcmcv
bWFpbC1hcmNoaXZlL3dlYi9oeWJpL2N1cnJlbnQvbXNnMDE1MjYuaHRtbCI+aHR0cDovL3d3dy5p
ZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2h5YmkvY3VycmVudC9tc2cwMTUyNi5odG1sPC9hPjwv
ZGl2PgoKPGRpdj48YnI+PC9kaXY+PGRpdj48YSBocmVmPSJodHRwOi8vd3d3LmlldGYub3JnL21h
aWwtYXJjaGl2ZS93ZWIvaHliaS9jdXJyZW50L21zZzAxNTI2Lmh0bWwiPjwvYT48YmxvY2txdW90
ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW4tdG9wOiAwcHg7IG1hcmdpbi1yaWdo
dDogMHB4OyBtYXJnaW4tYm90dG9tOiAwcHg7IG1hcmdpbi1sZWZ0OiAwLjhleDsgYm9yZGVyLWxl
ZnQtd2lkdGg6IDFweDsgYm9yZGVyLWxlZnQtY29sb3I6IHJnYigyMDQsIDIwNCwgMjA0KTsgYm9y
ZGVyLWxlZnQtc3R5bGU6IHNvbGlkOyBwYWRkaW5nLWxlZnQ6IDFleDsgIj4KCkkgdGhpbmsgdGhl
IG5ldCByZXN1bHQgaXMgdGhhdCBpZGVhbGx5IC5jbG9zZSgpIHNob3VsZCBtYXAgdG8gc2VuZGlu
ZyBhJm5ic3A7PGJyPkZJTiwgYWthIHVzaW5nIHNodXRkb3duKFNIVVRfV1IpLiBVbmZvcnR1bmF0
ZWx5IHRoaXMgaXMgbm90IGFsd2F5cyZuYnNwOzxicj5wb3NzaWJsZSAtLSBwZW9wbGUgY2l0ZWQg
bnVtZXJvdXMgZXhhbXBsZXMgb2YgY2FzZXMgd2hlcmUgd2UgY2FuJiMzOTt0IHJlbHkgb24mbmJz
cDs8YnI+CgpUQ1Agc2VtYW50aWNzIGluIHByYWN0aWNlIC0tIHNvIHdlIHByb2JhYmx5IHdhbnQg
dG8gc2ltdWxhdGUgdGhpcyBhdCB0aGUmbmJzcDs8YnI+V2ViU29ja2V0IGxheWVyIG9yIHRoZSBh
cHBsaWNhdGlvbiBsYXllci4gU2luY2UgdGhlIEpTIEFQSSBleHBvc2VzIGEmbmJzcDs8YnI+LmNs
b3NlKCkgbWV0aG9kLCB3ZSBzaG91bGQgcHJvYmFibHkgZXhwb3NlIGl0IGF0IHRoZSBXZWJTb2Nr
ZXQgbGF5ZXIuPC9ibG9ja3F1b3RlPgoKPGRpdj48YnI+PC9kaXY+PGRpdj5XaGF0IGRvIHlvdSB0
aGluayBhYm91dCB0aGlzPyBJIHRoaW5rIGl0JiMzOTtzIG5pY2UgdG8gcHV0IHlvdXIgbWV0aG9k
IGp1c3QgZm9yIGltcGxlbWVudG9yJiMzOTtzIGluZm9ybWF0aW9uIHRvZ2V0aGVyIHdpdGggR2Fi
cmllbCYjMzk7cyBpZGVhIGluIGNhc2Ugd2UgZGVjaWRlIHRvIGFkb3B0IEdhYnJpZWwmIzM5O3Mg
aWRlYSwgYnV0IHJlbHVjdGFudCB0byBwdXQgaXQgYXMgbWFuZGF0b3J5IHByb3RvY29sIGJlY2F1
c2Ugb2YgdGhpcy48L2Rpdj4KCjxkaXY+PGJyPjwvZGl2PlRha2VzaGk8YnI+Cjxicj48YnI+PGRp
diBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFR1ZSwgRmViIDE1LCAyMDExIGF0IDE2OjEwLCAgPHNw
YW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86WXV0YWthX1Rha2VkYUBwbGF5c3RhdGlv
bi5zb255LmNvbSI+WXV0YWthX1Rha2VkYUBwbGF5c3RhdGlvbi5zb255LmNvbTwvYT4mZ3Q7PC9z
cGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFy
Z2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFl
eDsiPgoKCjxicj48Zm9udCBzaXplPSIyIiBmYWNlPSJzYW5zLXNlcmlmIj5UeXBvIGNvcnJlY3Rp
b246IFRoZSAmcXVvdDtTSE9VTEQmcXVvdDsKaW4gbXkgdGV4dCBuZWVkIHRvIGJlICZxdW90O01V
U1QmcXVvdDsgYmVjYXVzZSBib3RoIGVuZHBvaW50cyA8L2ZvbnQ+Cjxicj48Zm9udCBzaXplPSIy
IiBmYWNlPSJzYW5zLXNlcmlmIj5jb21tdW5pY2F0ZSB1c2luZyBFb1MgaW4gdGhlIHByb3Bvc2Vk
CmNsb3NlIGhhbmRzaGFrZTo8L2ZvbnQ+Cjxicj4KPGJyPjx0dD48Zm9udCBzaXplPSIyIj4oMSkg
VGhlIGVuZHBvaW50IE1VU1QgY2xvc2Ugd3JpdGUgY2hhbm5lbCBvZiB0aGUgVENQCmNvbm5lY3Rp
b24gPGJyPjxkaXYgY2xhc3M9ImltIj4KICZuYnNwOyAmbmJzcDtpbW1lZGlhdGVseSBhZnRlciBD
bG9zZSBtZXNzYWdlIGlzIHNlbnQuIChlLmcuIHNodXRkb3duKFNIVVRfV1IpKTwvZGl2PjwvZm9u
dD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPgo8YnI+CjwvZm9udD48ZGl2
IGNsYXNzPSJpbSI+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KKDIpIEFmdGVyIGJvdGggc2VuZGlu
ZyBhbmQgcmVjZWl2aW5nIGEgQ2xvc2UgbWVzc2FnZSwgYm90aCBlbmRwb2ludHM8L2ZvbnQ+PC90
dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPC9mb250PjwvZGl2Pjx0dD48Zm9u
dCBzaXplPSIyIj48YnI+CiAmbmJzcDsgJm5ic3A7TVVTVCB3YWl0IGZvciBFb1MoRW5kIG9mIFN0
cmVhbTsgaS5lLiByZWN2KCkgcmV0dXJuaW5nIDApCmJlZm9yZTwvZm9udD48L3R0Pjxmb250IHNp
emU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPiA8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj48
ZGl2IGNsYXNzPSJpbSI+CiAmbmJzcDsgJm5ic3A7Y2xvc2luZyBUQ1Agc29ja2V0IGFuZCBkaXNj
YXJkIGFueSBkYXRhIHJlY2VpdmVkIGFmdGVyIHRoZQpDbG9zZTwvZGl2PjwvZm9udD48L3R0Pjxm
b250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPiA8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIi
Pjxicj4KICZuYnNwOyAmbmJzcDttZXNzYWdlLjwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZh
Y2U9InNhbnMtc2VyaWYiPiA8YnI+CjwvZm9udD48ZGl2IGNsYXNzPSJpbSI+PHR0Pjxmb250IHNp
emU9IjIiPjxicj4KKDMpIEFmdGVyIGJvdGggc2VuZGluZyBhbmQgcmVjZWl2aW5nIGEgQ2xvc2Ug
bWVzc2FnZSBhbmQgdGhlIGVuZHBvaW50PC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0i
c2Fucy1zZXJpZiI+CjwvZm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgogJm5ic3A7ICZuYnNw
O2hhcyBkZXRlY3RlZCBFb1MsIHRoZW4gdGhlIFdlYlNvY2tldCBjb25uZWN0aW9uIGlzIHNhaWQg
dG8KaGF2ZSBiZWVuPC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+
IDwvZm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgogJm5ic3A7ICZuYnNwO2Nsb3NlZCBfY2xl
YW5seV8uPC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+CjwvZm9u
dD4KPGJyPgo8YnI+PC9kaXY+PGRpdiBjbGFzcz0iaW0iPjxmb250IHNpemU9IjIiIGZhY2U9InNh
bnMtc2VyaWYiPi0tPGJyPgpZdXRha2EgVGFrZWRhIC0gVVMgUiZhbXA7RCBTb255IENvbXB1dGVy
IEVudGVydGFpbm1lbnQsIEluYy48YnI+Ck9mZmljZTogPGEgaHJlZj0idGVsOjY1MCUyMDY1NSUy
MDc0ODQiIHRhcmdldD0iX2JsYW5rIj42NTAgNjU1IDc0ODQ8L2E+ICZuYnNwOyBGYXg6IDxhIGhy
ZWY9InRlbDo2NTAlMjA2NTUlMjA4MDYwIiB0YXJnZXQ9Il9ibGFuayI+NjUwIDY1NSA4MDYwPC9h
Pjxicj4KPC9mb250Pgo8YnI+Cjxicj4KPGJyPgo8L2Rpdj48cD48L3A+PHRhYmxlIHdpZHRoPSIx
MDAlIj4KPHRib2R5Pjx0ciB2YWxpZ249InRvcCI+Cjx0ZCB3aWR0aD0iNDAlIj48Zm9udCBzaXpl
PSIxIiBmYWNlPSJzYW5zLXNlcmlmIj48Yj5ZdXRha2EgVGFrZWRhL1ImYW1wO0QvU0NFQUBQbGF5
c3RhdGlvbjwvYj4KPC9mb250Pgo8YnI+PGRpdiBjbGFzcz0iaW0iPjxmb250IHNpemU9IjEiIGZh
Y2U9InNhbnMtc2VyaWYiPlNlbnQgYnk6IDxhIGhyZWY9Im1haWx0bzpoeWJpLWJvdW5jZXNAaWV0
Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5oeWJpLWJvdW5jZXNAaWV0Zi5vcmc8L2E+PC9mb250Pgo8
L2Rpdj48cD48Zm9udCBzaXplPSIxIiBmYWNlPSJzYW5zLXNlcmlmIj4wMi8xNS8yMDExIDA0OjA1
IFBNPC9mb250Pgo8L3A+PC90ZD48dGQgd2lkdGg9IjU5JSI+Cjx0YWJsZSB3aWR0aD0iMTAwJSI+
Cjx0Ym9keT48dHIgdmFsaWduPSJ0b3AiPgo8dGQ+CjxkaXYgYWxpZ249InJpZ2h0Ij48Zm9udCBz
aXplPSIxIiBmYWNlPSJzYW5zLXNlcmlmIj5UbzwvZm9udD48L2Rpdj4KPC90ZD48dGQ+PGZvbnQg
c2l6ZT0iMSIgZmFjZT0ic2Fucy1zZXJpZiI+PGEgaHJlZj0ibWFpbHRvOmlmZXR0ZUBnb29nbGUu
Y29tIiB0YXJnZXQ9Il9ibGFuayI+aWZldHRlQGdvb2dsZS5jb208L2E+PC9mb250Pgo8L3RkPjwv
dHI+PHRyIHZhbGlnbj0idG9wIj4KPHRkPgo8ZGl2IGFsaWduPSJyaWdodCI+PGZvbnQgc2l6ZT0i
MSIgZmFjZT0ic2Fucy1zZXJpZiI+Y2M8L2ZvbnQ+PC9kaXY+CjwvdGQ+PHRkPjxmb250IHNpemU9
IjEiIGZhY2U9InNhbnMtc2VyaWYiPjxhIGhyZWY9Im1haWx0bzpoeWJpQGlldGYub3JnIiB0YXJn
ZXQ9Il9ibGFuayI+aHliaUBpZXRmLm9yZzwvYT48L2ZvbnQ+CjwvdGQ+PC90cj48dHIgdmFsaWdu
PSJ0b3AiPgo8dGQ+CjxkaXYgYWxpZ249InJpZ2h0Ij48Zm9udCBzaXplPSIxIiBmYWNlPSJzYW5z
LXNlcmlmIj5TdWJqZWN0PC9mb250PjwvZGl2Pgo8L3RkPjx0ZD48Zm9udCBzaXplPSIxIiBmYWNl
PSJzYW5zLXNlcmlmIj5SZTogW2h5YmldIENsYXJpZnkgdGhlIHJvbGUgb2YgY2xvc2luZwpoYW5k
c2hha2U8L2ZvbnQ+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT4KPGJyPgo8dGFibGU+Cjx0Ym9k
eT48dHIgdmFsaWduPSJ0b3AiPgo8dGQ+CjwvdGQ+PHRkPjwvdGQ+PC90cj48L3Rib2R5PjwvdGFi
bGU+Cjxicj48L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPgo8YnI+Cjxicj4KPGJyPjxkaXY+PGRp
dj48L2Rpdj48ZGl2IGNsYXNzPSJoNSI+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KSWFuIEZldHRl
ICgbJEIlJCUiJXMlVSUnJUMlRiUjGyhCKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlmZXR0ZUBnb29n
bGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+aWZldHRlQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZSBv
bgowMi8xNS8yMDExIDAyOjI3OjU4IFBNOjxicj4KPGJyPgomZ3Q7IFdoYXQgSSYjMzk7bSBjdXJy
ZW50bHkgbG9va2luZyBhdCBpcyB0aGlzOiAoY29tbWVudHMgd2VsY29tZSk8L2ZvbnQ+PC90dD48
Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPC9mb250Pjx0dD48Zm9udCBzaXplPSIy
Ij48YnI+CiZndDsgPGJyPgomZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsm
bHQ7dCZndDtUaGUgQ2xvc2UgbWVzc2FnZSBjb250YWlucwphbiBvcGNvZGUgb2YgMHgwMS4mbHQ7
L3QmZ3Q7PC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+CjwvZm9u
dD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgomZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw
OyAmbmJzcDsgJmx0O3QmZ3Q7VGhlIENsb3NlIG1lc3NhZ2UgY29udGFpbnMKbm8gYm9keSAodGhl
IGJvZHkgaGFzIHplcm8gPGJyPgomZ3Q7IGxlbmd0aCkuJmx0Oy90Jmd0OzwvZm9udD48L3R0Pjxm
b250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPiA8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIi
Pjxicj4KJmd0OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZsdDt0Jmd0O1Ro
ZSBhcHBsaWNhdGlvbiBNVVNUIE5PVApzZW5kIGFueSBtb3JlIGRhdGEgbWVzc2FnZXMgPGJyPgom
Z3Q7IGFmdGVyIHNlbmRpbmc8L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNl
cmlmIj4gPC9mb250Pjx0dD48Zm9udCBzaXplPSIyIj48YnI+CiZndDsgJm5ic3A7ICZuYnNwOyAm
bmJzcDsgJm5ic3A7ICZuYnNwOyBhIGNsb3NlIG1lc3NhZ2UuJmx0Oy90Jmd0OzwvZm9udD48L3R0
Pjxmb250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9
IjIiPjxicj4KJmd0OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZsdDt0Jmd0
O0lmIGFuIGVuZHBvaW50IHJlY2VpdmVzCmEgQ2xvc2UgbWVzc2FnZSBhbmQgdGhhdCBlbmRwb2lu
dCBkaWQgbm90PC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+Cjwv
Zm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgomZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu
YnNwOyAmbmJzcDsgcHJldmlvdXNseSBzZW5kIGEgQ2xvc2UgbWVzc2FnZSwKdGhlIGVuZHBvaW50
IE1VU1Qgc2VuZCBhIENsb3NlPC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1z
ZXJpZiI+CjwvZm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgomZ3Q7ICZuYnNwOyAmbmJzcDsg
Jm5ic3A7ICZuYnNwOyAmbmJzcDsgbWVzc2FnZSBpbiByZXNwb25zZS4gSXQgU0hPVUxECmRvIHNv
IGFzIHNvb24gYXMgaXMgcHJhY3RpY2FsLjwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9
InNhbnMtc2VyaWYiPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KJmd0OyAmbmJzcDsg
Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZsdDsvdCZndDs8L2ZvbnQ+PC90dD48Zm9udCBz
aXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPC9mb250Pjx0dD48Zm9udCBzaXplPSIyIj48YnI+
CiZndDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbHQ7dCZndDtBZnRlciBi
b3RoIHNlbmRpbmcgYW5kCnJlY2VpdmluZyBhIGNsb3NlIG1lc3NhZ2UsIGFuIGVuZHBvaW50PC9m
b250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+CjwvZm9udD48dHQ+PGZv
bnQgc2l6ZT0iMiI+PGJyPgomZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg
Y29uc2lkZXJzIHRoZSB3ZWJzb2NrZXQgY29ubmVjdGlvbgpjbG9zZWQsIGFuZDwvZm9udD48L3R0
Pjxmb250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPiA8L2ZvbnQ+PHR0Pjxmb250IHNpemU9
IjIiPjxicj4KJmd0OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IFNIT1VMRCBj
bG9zZSB0aGUgdW5kZXJseWluZyBUQ1AKY29ubmVjdGlvbi4mbHQ7L3QmZ3Q7PC9mb250PjwvdHQ+
PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+IDwvZm9udD48dHQ+PGZvbnQgc2l6ZT0i
MiI+PGJyPgomZ3Q7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJmx0O3QmZ3Q7
SWYgYSBjbGllbnQgYW5kIHNlcnZlcgpib3RoIHNlbmQgYSBDbG9zZSBtZXNzYWdlIGF0IHRoZXNh
bWUgdGltZSw8L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPC9m
b250Pjx0dD48Zm9udCBzaXplPSIyIj48YnI+CiZndDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i
c3A7ICZuYnNwOyBib3RoIGVuZHBvaW50cyB3aWxsIGhhdmUgc2VudCBhbmQKcmVjZWl2ZWQgYSBD
bG9zZSBtZXNzYWdlYW5kIHNob3VsZDwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9InNh
bnMtc2VyaWYiPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KJmd0OyAmbmJzcDsgJm5i
c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IGNvbnNpZGVyIHRoZSB3ZWJzb2NrZXQgY29ubmVjdGlv
bgpjbG9zZWQgYW5kIGNsb3NlIHRoZSB1bmRlcmx5aW5nPC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0i
MyIgZmFjZT0ic2Fucy1zZXJpZiI+CjwvZm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgomZ3Q7
ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgVENQIGNvbm5lY3Rpb24uJmx0Oy90
Jmd0OzwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPgo8YnI+Cjwv
Zm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgpJIHdvdWxkIHJlcGxhY2UgY29ycmVzcG9uZGlu
ZyB0ZXh0cyB3aXRoIHNvbWV0aGluZyBhbG9uZyB0aGUgbGluZSBvZiB0aGUKPGJyPgpmb2xsb3dp
bmcgZm9yIG1vcmUgY29tcGxldGVuZXNzOjwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9
InNhbnMtc2VyaWYiPgo8YnI+CjwvZm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgooMSkgVGhl
IGVuZHBvaW50IFNIT1VMRCBjbG9zZSB3cml0ZSBjaGFubmVsIG9mIHRoZSBUQ1AgY29ubmVjdGlv
biA8YnI+CiAmbmJzcDsgJm5ic3A7aW1tZWRpYXRlbHkgYWZ0ZXIgQ2xvc2UgbWVzc2FnZSBpcyBz
ZW50LiAoZS5nLiBzaHV0ZG93bihTSFVUX1dSKSk8L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBm
YWNlPSJzYW5zLXNlcmlmIj4KPGJyPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KKDIp
IEFmdGVyIGJvdGggc2VuZGluZyBhbmQgcmVjZWl2aW5nIGEgQ2xvc2UgbWVzc2FnZSwgYm90aCBl
bmRwb2ludHM8L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPC9m
b250Pjx0dD48Zm9udCBzaXplPSIyIj48YnI+CiAmbmJzcDsgJm5ic3A7U0hPVUxEIHdhaXQgZm9y
IEVvUyhFbmQgb2YgU3RyZWFtOyBpLmUuIHJlY3YoKSByZXR1cm5pbmcKMCkgYmVmb3JlPC9mb250
PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+IDwvZm9udD48dHQ+PGZvbnQg
c2l6ZT0iMiI+PGJyPgogJm5ic3A7ICZuYnNwO2Nsb3NpbmcgVENQIHNvY2tldCBhbmQgZGlzY2Fy
ZCBhbnkgZGF0YSByZWNlaXZlZCBhZnRlciB0aGUKQ2xvc2U8L2ZvbnQ+PC90dD48Zm9udCBzaXpl
PSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4gPC9mb250Pjx0dD48Zm9udCBzaXplPSIyIj48YnI+CiAm
bmJzcDsgJm5ic3A7bWVzc2FnZS48L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5z
LXNlcmlmIj4gPGJyPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KKDMpIEFmdGVyIGJv
dGggc2VuZGluZyBhbmQgcmVjZWl2aW5nIGEgQ2xvc2UgbWVzc2FnZSBhbmQgdGhlIGVuZHBvaW50
PC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+CjwvZm9udD48dHQ+
PGZvbnQgc2l6ZT0iMiI+PGJyPgogJm5ic3A7ICZuYnNwO2hhcyBkZXRlY3RlZCBFb1MsIHRoZW4g
dGhlIFdlYlNvY2tldCBjb25uZWN0aW9uIGlzIHNhaWQgdG8KaGF2ZSBiZWVuPC9mb250PjwvdHQ+
PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+IDwvZm9udD48dHQ+PGZvbnQgc2l6ZT0i
MiI+PGJyPgogJm5ic3A7ICZuYnNwO2Nsb3NlZCBfY2xlYW5seV8uPC9mb250PjwvdHQ+PGZvbnQg
c2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+Cjxicj4KPC9mb250Pjx0dD48Zm9udCBzaXplPSIy
Ij48YnI+Ckp1c3RpZmljYXRpb246PC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fu
cy1zZXJpZiI+IDwvZm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+PGJyPgotICgxKSBpcyB0byBlbnN1
cmUgdGhhdCBubyBtb3JlIGRhdGEgd2lsbCBiZSB3cml0dGVuIHRvIHRoZSA8YnI+CiAmbmJzcDt1
bmRlcmx5aW5nIFRDUCBzb2NrZXQgYWZ0ZXIgdGhlIENsb3NlIG1lc3NhZ2UsIGFuZCB0byBpbmRp
Y2F0ZTwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPgo8L2ZvbnQ+
PHR0Pjxmb250IHNpemU9IjIiPjxicj4KICZuYnNwO3RoYXQgc2VuZGVyIGhhcyByZWFjaGVkIHRo
ZSBFb1MgYXQgVENQIGxldmVsLjwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9InNhbnMt
c2VyaWYiPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KLSAoMikgaXMgdG8gcHJldmVu
dCB0aGUgZW5kcG9pbnQgZnJvbSBnZW5lcmF0aW5nIHNwdXJpb3VzIFJTVDwvZm9udD48L3R0Pjxm
b250IHNpemU9IjMiIGZhY2U9InNhbnMtc2VyaWYiPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIi
Pjxicj4KICZuYnNwO2R1ZSB0byBhIGJ1ZyBhdCB0aGUgcmVtb3RlIGVuZHBvaW50IGluamVjdGlu
ZyBkYXRhIGFmdGVyIENsb3NlIGZyYW1lLjwvZm9udD48L3R0Pjxmb250IHNpemU9IjMiIGZhY2U9
InNhbnMtc2VyaWYiPgo8L2ZvbnQ+PHR0Pjxmb250IHNpemU9IjIiPjxicj4KLSBQcmVzZW5jZSBv
ZiBDbG9zZSBmcmFtZSBoZWxwcyBpbnRlcm1lZGlhcmllcyB0byBkZXRlY3Qgbm9ybWFsIGNsb3N1
cmU8L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPC9mb250Pjx0
dD48Zm9udCBzaXplPSIyIj48YnI+CiAmbmJzcDtvZiBXZWJTb2NrZXQgY29ubmVjdGlvbi48L2Zv
bnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNlPSJzYW5zLXNlcmlmIj4KPGJyPgo8L2ZvbnQ+PHR0
Pjxmb250IHNpemU9IjIiPjxicj4KQmVzdC48L2ZvbnQ+PC90dD48Zm9udCBzaXplPSIzIiBmYWNl
PSJzYW5zLXNlcmlmIj4gPC9mb250PjwvZGl2PjwvZGl2Pjx0dD48Zm9udCBzaXplPSIyIj48YnI+
Ci0gWXV0YWthPC9mb250PjwvdHQ+PGZvbnQgc2l6ZT0iMyIgZmFjZT0ic2Fucy1zZXJpZiI+IDwv
Zm9udD48dHQ+PGZvbnQgc2l6ZT0iMiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX188ZGl2IGNsYXNzPSJpbSI+PGJyPgpoeWJpIG1haWxpbmcgbGlzdDxicj4K
PGEgaHJlZj0ibWFpbHRvOmh5YmlAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5oeWJpQGlldGYu
b3JnPC9hPjxicj4KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m
by9oeWJpIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0
aW5mby9oeWJpPC9hPjxicj4KPC9kaXY+PC9mb250PjwvdHQ+Cjxicj48YnI+X19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+Cmh5YmkgbWFpbGluZyBsaXN0
PGJyPgo8YSBocmVmPSJtYWlsdG86aHliaUBpZXRmLm9yZyI+aHliaUBpZXRmLm9yZzwvYT48YnI+
CjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaHliaSIgdGFy
Z2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaHliaTwv
YT48YnI+Cjxicj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pgo=
--001636c9243639d2a0049c5b45cc--

From tyoshino@google.com  Tue Feb 15 17:35:34 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 557153A6B6F for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 17:35:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.553
X-Spam-Level: 
X-Spam-Status: No, score=-105.553 tagged_above=-999 required=5 tests=[AWL=0.423, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1G2e7yv0FdsN for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 17:35:33 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 290803A684E for <hybi@ietf.org>; Tue, 15 Feb 2011 17:35:32 -0800 (PST)
Received: from wpaz21.hot.corp.google.com (wpaz21.hot.corp.google.com [172.24.198.85]) by smtp-out.google.com with ESMTP id p1G1Zxwe024040 for <hybi@ietf.org>; Tue, 15 Feb 2011 17:35:59 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297820159; bh=Fc1xKFi0fva63MqnBRiUe0N/KBg=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=EU2/myCHcib5fgs+qKatEkl5Fju8kYEIlW+94COgGosApRtJ4gmwbIyN8+OV5Yojn /50OqdqTHQRG1RPiPVN+A==
Received: from iyj8 (iyj8.prod.google.com [10.241.51.72]) by wpaz21.hot.corp.google.com with ESMTP id p1G1ZqJ8000673 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 17:35:58 -0800
Received: by iyj8 with SMTP id 8so848125iyj.40 for <hybi@ietf.org>; Tue, 15 Feb 2011 17:35:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=SPuElBNkXq2oZ1hf2l6uwc5ud/U9Fl8/RanltRVazzs=; b=fd7b7b/0p2bkBRiyVBvHv/CsFxBPC+Z02mCoEd/GC7O9WRKcopC2HicriJQkPzEIpN rEMHEzslLZS83FLv76Kw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=a02/QKmfKnHXr6BbP511qe2PFPLmmRBuXmdiP3Vl1txhBkJM/bL235RKiUs2BZ/9ZH yP7IAcLRTNVCVBTfPAQQ==
Received: by 10.231.35.204 with SMTP id q12mr81050ibd.4.1297820158121; Tue, 15 Feb 2011 17:35:58 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Tue, 15 Feb 2011 17:35:38 -0800 (PST)
In-Reply-To: <OF161FAA38.F9E0465F-ON88257837.007F80AD-88257838.00015665@playstation.sony.com>
References: <AANLkTimizRk+73rHJcw16JdWwM8Ax9dhpUqNxEdPLyL4@mail.gmail.com> <OF161FAA38.F9E0465F-ON88257837.007F80AD-88257838.00015665@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Tue, 15 Feb 2011 17:35:38 -0800
Message-ID: <AANLkTinsk6Osf1WbwZMdh_zN7XewA_Bu-bnjzjZXVDbc@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=00221504907781d693049c5c4d04
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 01:35:34 -0000

--00221504907781d693049c5c4d04
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Feb 14, 2011 at 16:14, <Yutaka_Takeda@playstation.sony.com> wrote:

> > In a bit different context but I see that
>
 > Jamie is also saying so in http://www.ietf.org/mail-
> > archive/web/hybi/current/msg01044.html. On what platform this really
> > occurs for example? Just curious. Linux socket allows us to recv
> > data PSH-ed before RST, then ECONNRESET is returned, so I missed this
> point.
>
> Yes, my linux, too it lets receiver to read data received before RST.
> My windows, though, does not seem to let receiver to read the data and
> recv()
> returned 'ECONNRESET' right away.
>
> # If we need some experiment, I can help.
>
> Thanks for the information

> IIRC, there was discussion in designing -00 closing handshake that
> > we should avoid underlying transport layer's semantics in realizing
> > WebSocket layer event. To follow this philosophy, we could replace
> > the last FIN with Close frame. i.e. we again ask both sides send a
> > Close frame so that both sides can safely invoke close(2) after
> > seeing Close frame.
>
> In browser usage, can we actually wait for Close frame from the peer
> after sending Close frame (=app already closed.) ?
> When user jumps to another page,


Though it depends on design as you say, network stack may continue to take
care of those abandoned socket (send 2xx Close and wait for Close). I'm fine
with making draining (either your idea based on SHUT_WR or my idea using
Close frame) optional so that people who takes this just a kind of waste of
resource/time.


> or close browser,


I think sudden close like this can be grouped with network trouble.


> is WS-layer able
> to wait for Close frame to begin with? It just occurred to me...
> (I have no knowledge in browser design/policy.)
>
>

--00221504907781d693049c5c4d04
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div><div class=3D"gmail_quote">On Mon, Feb 14, 2011 at 16:14,  <span dir=
=3D"ltr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_T=
akeda@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex;">

<div class=3D"im"><span class=3D"Apple-style-span" style=3D"font-family: mo=
nospace; ">&gt; In a bit different context but I see that=A0</span></div></=
blockquote><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bor=
der-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im"><tt><font size=3D"2">
&gt; Jamie is also saying so in=A0<a href=3D"http://www.ietf.org/mail-" tar=
get=3D"_blank">http://www.ietf.org/mail-</a><br>
&gt; archive/web/hybi/current/msg01044.html. On what platform this really<b=
r>
&gt; occurs for example? Just curious.=A0Linux socket allows us to recv
<br>
&gt; data PSH-ed before RST, then ECONNRESET is returned, so I missed this
point.</font></tt>
<br>
<br></div><tt><font size=3D"2">Yes, my linux, too it lets receiver to read =
data received
before RST.</font></tt>
<br><tt><font size=3D"2">My windows, though, does not seem to let receiver
to read the data and recv()</font></tt>
<br><tt><font size=3D"2">returned &#39;ECONNRESET&#39; right away.</font></=
tt>
<br>
<br><tt><font size=3D"2"># If we need some experiment, I can help.</font></=
tt>
<br><div class=3D"im">
<br></div></blockquote><div>Thanks for the information</div><div><br></div>=
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;"><div class=3D"im"><tt><font size=3D"2">&gt;=
 IIRC, there was discussion in designing -00 closing
handshake that <br>
&gt; we should avoid underlying transport layer&#39;s semantics in realizin=
g
<br>
&gt; WebSocket layer event. To follow this philosophy, we could replace
<br>
&gt; the last FIN with Close frame. i.e. we again ask both sides send a
<br>
&gt; Close frame so that both sides can safely invoke close(2) after <br>
&gt; seeing Close frame.</font></tt>
<br>
<br></div><tt><font size=3D"2">In browser usage, can we actually wait for C=
lose frame
from the peer</font></tt>
<br><tt><font size=3D"2">after sending Close frame (=3Dapp already closed.)=
 ?</font></tt>
<br><tt><font size=3D"2">When user jumps to another page, </font></tt></blo=
ckquote><div><br></div><div>Though it depends on design as you say, network=
 stack may continue to take care of those abandoned socket (send 2xx Close =
and wait for Close). I&#39;m fine with making draining (either your idea ba=
sed on SHUT_WR or my idea using Close frame) optional so that people who ta=
kes this just a kind of waste of resource/time.</div>

<div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;=
border-left:1px #ccc solid;padding-left:1ex;"><tt><font size=3D"2">or close=
 browser,
</font></tt></blockquote><div><br></div><div>I think sudden close like this=
 can be grouped with network trouble.</div><div>=A0</div><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex;">

<tt><font size=3D"2">is WS-layer able</font></tt>
<br><tt><font size=3D"2">to wait for Close frame to begin with? It just occ=
urred
to me...</font></tt>
<br><tt><font size=3D"2">(I have no knowledge in browser design/policy.)</f=
ont></tt>
<br><br></blockquote><div><br></div></div></div>

--00221504907781d693049c5c4d04--

From Yutaka_Takeda@PlayStation.Sony.Com  Tue Feb 15 17:40:48 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AEF33A6B6F; Tue, 15 Feb 2011 17:40:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.667
X-Spam-Level: 
X-Spam-Status: No, score=-5.667 tagged_above=-999 required=5 tests=[AWL=-0.003, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hCXXJ+ZV+xmG; Tue, 15 Feb 2011 17:40:46 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 4D4083A684E; Tue, 15 Feb 2011 17:40:45 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021517410589-587611 ; Tue, 15 Feb 2011 17:41:05 -0800 
In-Reply-To: <AANLkTimhJ+F85NrAjt8TwDjDpyH0j30YcfAxppNKEvwF@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
MIME-Version: 1.0
X-KeepSent: 626368BC:D580B3D5-88257839:0005354B; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF626368BC.D580B3D5-ON88257839.0005354B-88257839.000942C4@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Tue, 15 Feb 2011 17:41:08 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/15/2011 05:41:05 PM, Serialize complete at 02/15/2011 05:41:05 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 05:41:05 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/15/2011 05:41:14 PM, Serialize complete at 02/15/2011 05:41:14 PM
Content-Type: multipart/alternative; boundary="=_alternative 000942C188257839_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 01:40:48 -0000

This is a multipart message in MIME format.
--=_alternative 000942C188257839_=
Content-Type: text/plain; charset="ISO-2022-JP"

Hi Takeshi and all:

Although the Ian Hickson's message did not explain why TCP FIN 
(shutdown(SHUT_WR)) was 
not always possible, it made me realize that I have completely missed 
cases where we have 
intermediary nodes (e.g. proxy) along the path which terminate TCP layer. 
(We can not terminate
TCP connection before end-to-end WS-layer close handshake.)

Thank you for the heads-up, and please accept my apologies for any 
confusion I may have caused.

Ian Fette's text for -06 looks good to me now. If we are to exchange Close 
frames as a normal
close handshake, then spurious RST issue should also be resolved in the 
normal sequence.
In abnormal case, the RST issue may prevent the last bit including Close 
frame also from reaching
the destination, which we need to be aware.

Best regards,

- Yutaka






Takeshi Yoshino <tyoshino@google.com> 
Sent by: hybi-bounces@ietf.org
02/15/2011 04:22 PM

To
Yutaka Takeda/R&D/SCEA@Playstation
cc
hybi@ietf.org, hybi-bounces@ietf.org
Subject
Re: [hybi] Clarify the role of closing handshake






In case you missed this part of my post citing Ian's thought.

http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html


I think the net result is that ideally .close() should map to sending a 
FIN, aka using shutdown(SHUT_WR). Unfortunately this is not always 
possible -- people cited numerous examples of cases where we can't rely on 

TCP semantics in practice -- so we probably want to simulate this at the 
WebSocket layer or the application layer. Since the JS API exposes a 
.close() method, we should probably expose it at the WebSocket layer.

What do you think about this? I think it's nice to put your method just 
for implementor's information together with Gabriel's idea in case we 
decide to adopt Gabriel's idea, but reluctant to put it as mandatory 
protocol because of this.

Takeshi


On Tue, Feb 15, 2011 at 16:10, <Yutaka_Takeda@playstation.sony.com> wrote:

Typo correction: The "SHOULD" in my text need to be "MUST" because both 
endpoints 
communicate using EoS in the proposed close handshake: 

(1) The endpoint MUST close write channel of the TCP connection 
   immediately after Close message is sent. (e.g. shutdown(SHUT_WR))


(2) After both sending and receiving a Close message, both endpoints 

   MUST wait for EoS(End of Stream; i.e. recv() returning 0) before 
   closing TCP socket and discard any data received after the Close

   message. 

(3) After both sending and receiving a Close message and the endpoint 
   has detected EoS, then the WebSocket connection is said to have been 
   closed _cleanly_. 

--
Yutaka Takeda - US R&D Sony Computer Entertainment, Inc.
Office: 650 655 7484   Fax: 650 655 8060




Yutaka Takeda/R&D/SCEA@Playstation 
Sent by: hybi-bounces@ietf.org 
02/15/2011 04:05 PM 


To
ifette@google.com 
cc
hybi@ietf.org 
Subject
Re: [hybi] Clarify the role of closing handshake









Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com> wrote on 02/15/2011 
02:27:58 PM:

> What I'm currently looking at is this: (comments welcome) 
> 
>          <t>The Close message contains an opcode of 0x01.</t> 
>           <t>The Close message contains no body (the body has zero 
> length).</t> 
>           <t>The application MUST NOT send any more data messages 
> after sending 
>           a close message.</t> 
>           <t>If an endpoint receives a Close message and that endpoint 
did not 
>           previously send a Close message, the endpoint MUST send a 
Close 
>           message in response. It SHOULD do so as soon as is practical. 
>           </t> 
>           <t>After both sending and receiving a close message, an 
endpoint 
>           considers the websocket connection closed, and 
>           SHOULD close the underlying TCP connection.</t> 
>           <t>If a client and server both send a Close message at thesame 
time, 
>           both endpoints will have sent and received a Close messageand 
should 
>           consider the websocket connection closed and close the 
underlying 
>           TCP connection.</t> 

I would replace corresponding texts with something along the line of the 
following for more completeness: 

(1) The endpoint SHOULD close write channel of the TCP connection 
   immediately after Close message is sent. (e.g. shutdown(SHUT_WR)) 

(2) After both sending and receiving a Close message, both endpoints 
   SHOULD wait for EoS(End of Stream; i.e. recv() returning 0) before 
   closing TCP socket and discard any data received after the Close 
   message. 

(3) After both sending and receiving a Close message and the endpoint 
   has detected EoS, then the WebSocket connection is said to have been 
   closed _cleanly_. 

Justification: 
- (1) is to ensure that no more data will be written to the 
 underlying TCP socket after the Close message, and to indicate 
 that sender has reached the EoS at TCP level. 
- (2) is to prevent the endpoint from generating spurious RST 
 due to a bug at the remote endpoint injecting data after Close frame. 
- Presence of Close frame helps intermediaries to detect normal closure 
 of WebSocket connection. 

Best. 

- Yutaka _______________________________________________

hybi mailing list
hybi@ietf.org
https://www.ietf.org/mailman/listinfo/hybi


_______________________________________________
hybi mailing list
hybi@ietf.org
https://www.ietf.org/mailman/listinfo/hybi

_______________________________________________
hybi mailing list
hybi@ietf.org
https://www.ietf.org/mailman/listinfo/hybi


--=_alternative 000942C188257839_=
Content-Type: text/html; charset="ISO-2022-JP"


<br><font size=2 face="sans-serif">Hi Takeshi and all:</font>
<br>
<br><font size=2 face="sans-serif">Although the Ian Hickson's message did
not explain why TCP FIN (shutdown(SHUT_WR)) was </font>
<br><font size=2 face="sans-serif">not always possible, it made me realize
that I have completely missed cases where we have </font>
<br><font size=2 face="sans-serif">intermediary nodes (e.g. proxy) along
the path which terminate TCP layer. (We can not terminate</font>
<br><font size=2 face="sans-serif">TCP connection before end-to-end WS-layer
close handshake.)</font>
<br>
<br><font size=2 face="sans-serif">Thank you for the heads-up, and please
accept my apologies for any confusion I may have caused.</font>
<br>
<br><font size=2 face="sans-serif">Ian Fette's text for -06 looks good
to me now. If we are to exchange Close frames as a normal</font>
<br><font size=2 face="sans-serif">close handshake, then spurious RST issue
should also be resolved in the normal sequence.</font>
<br><font size=2 face="sans-serif">In abnormal case, the RST issue may
prevent the last bit including Close frame also from reaching</font>
<br><font size=2 face="sans-serif">the destination, which we need to be
aware.</font>
<br>
<br><font size=2 face="sans-serif">Best regards,</font>
<br>
<br><font size=2 face="sans-serif">- Yutaka</font>
<br>
<br>
<br>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Takeshi Yoshino &lt;tyoshino@google.com&gt;</b>
</font>
<br><font size=1 face="sans-serif">Sent by: hybi-bounces@ietf.org</font>
<p><font size=1 face="sans-serif">02/15/2011 04:22 PM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">Yutaka Takeda/R&amp;D/SCEA@Playstation</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">hybi@ietf.org, hybi-bounces@ietf.org</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Re: [hybi] Clarify the role of closing
handshake</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=3 face="sans-serif">In case you missed this part of my post
citing Ian's thought.</font>
<br>
<br><a href="http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html"><font size=3 color=blue face="sans-serif"><u>http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html</u></font></a>
<br>
<br><a href="http://www.ietf.org/mail-archive/web/hybi/current/msg01526.html"></a>
<br><font size=3 face="sans-serif">I think the net result is that ideally
.close() should map to sending a <br>
FIN, aka using shutdown(SHUT_WR). Unfortunately this is not always <br>
possible -- people cited numerous examples of cases where we can't rely
on <br>
TCP semantics in practice -- so we probably want to simulate this at the
<br>
WebSocket layer or the application layer. Since the JS API exposes a <br>
.close() method, we should probably expose it at the WebSocket layer.</font>
<br>
<br><font size=3 face="sans-serif">What do you think about this? I think
it's nice to put your method just for implementor's information together
with Gabriel's idea in case we decide to adopt Gabriel's idea, but reluctant
to put it as mandatory protocol because of this.</font>
<br>
<br><font size=3 face="sans-serif">Takeshi<br>
<br>
</font>
<br><font size=3 face="sans-serif">On Tue, Feb 15, 2011 at 16:10, &lt;</font><a href=mailto:Yutaka_Takeda@playstation.sony.com><font size=3 color=blue face="sans-serif"><u>Yutaka_Takeda@playstation.sony.com</u></font></a><font size=3 face="sans-serif">&gt;
wrote:</font>
<br><font size=2 face="sans-serif"><br>
Typo correction: The &quot;SHOULD&quot; in my text need to be &quot;MUST&quot;
because both endpoints <br>
communicate using EoS in the proposed close handshake:</font><font size=3 face="sans-serif">
<br>
</font><tt><font size=2><br>
(1) The endpoint MUST close write channel of the TCP connection </font></tt>
<br><tt><font size=2>&nbsp; &nbsp;immediately after Close message is sent.
(e.g. shutdown(SHUT_WR))</font></tt>
<br>
<br><tt><font size=2><br>
(2) After both sending and receiving a Close message, both endpoints</font></tt><font size=3 face="sans-serif">
</font>
<br><tt><font size=2><br>
 &nbsp; MUST wait for EoS(End of Stream; i.e. recv() returning 0) before</font></tt><font size=3 face="sans-serif">
</font>
<br><tt><font size=2>&nbsp; &nbsp;closing TCP socket and discard any data
received after the Close</font></tt>
<br><tt><font size=2><br>
 &nbsp; message.</font></tt><font size=3 face="sans-serif"> </font>
<br><tt><font size=2><br>
(3) After both sending and receiving a Close message and the endpoint</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; has detected EoS, then the WebSocket connection is said to have
been</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; closed _cleanly_.</font></tt><font size=3 face="sans-serif"> <br>
</font>
<br><font size=2 face="sans-serif">--<br>
Yutaka Takeda - US R&amp;D Sony Computer Entertainment, Inc.<br>
Office: </font><a href=tel:650%20655%207484 target=_blank><font size=2 color=blue face="sans-serif"><u>650
655 7484</u></font></a><font size=2 face="sans-serif"> &nbsp; Fax: </font><a href=tel:650%20655%208060 target=_blank><font size=2 color=blue face="sans-serif"><u>650
655 8060</u></font></a><font size=3 face="sans-serif"><br>
<br>
<br>
</font>
<p>
<table width=100%>
<tr valign=top>
<td width=47%><font size=1 face="sans-serif"><b>Yutaka Takeda/R&amp;D/SCEA@Playstation</b>
</font>
<br><font size=1 face="sans-serif">Sent by: </font><a href="mailto:hybi-bounces@ietf.org" target=_blank><font size=1 color=blue face="sans-serif"><u>hybi-bounces@ietf.org</u></font></a><font size=3 face="sans-serif">
</font>
<p><font size=1 face="sans-serif">02/15/2011 04:05 PM</font><font size=3 face="sans-serif">
</font>
<td width=52%>
<br>
<table width=100%>
<tr valign=top>
<td width=14%>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td width=85%><a href=mailto:ifette@google.com target=_blank><font size=1 color=blue face="sans-serif"><u>ifette@google.com</u></font></a><font size=3 face="sans-serif">
</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><a href=mailto:hybi@ietf.org target=_blank><font size=1 color=blue face="sans-serif"><u>hybi@ietf.org</u></font></a><font size=3 face="sans-serif">
</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Re: [hybi] Clarify the role of closing
handshake</font></table>
<br>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br><font size=3 face="sans-serif"><br>
<br>
</font>
<br><tt><font size=2><br>
Ian Fette ($B%$%"%s%U%'%C%F%#(B) &lt;</font></tt><a href=mailto:ifette@google.com target=_blank><tt><font size=2 color=blue><u>ifette@google.com</u></font></tt></a><tt><font size=2>&gt;
wrote on 02/15/2011 02:27:58 PM:<br>
<br>
&gt; What I'm currently looking at is this: (comments welcome)</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; <br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;t&gt;The Close message contains
an opcode of 0x01.&lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;The Close message contains
no body (the body has zero <br>
&gt; length).&lt;/t&gt;</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;The application MUST NOT
send any more data messages <br>
&gt; after sending</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; a close message.&lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;If an endpoint receives
a Close message and that endpoint did not</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; previously send a Close message,
the endpoint MUST send a Close</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; message in response. It SHOULD
do so as soon as is practical.</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;After both sending and
receiving a close message, an endpoint</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; considers the websocket connection
closed, and</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SHOULD close the underlying TCP
connection.&lt;/t&gt;</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;t&gt;If a client and server
both send a Close message at thesame time,</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; both endpoints will have sent and
received a Close messageand should</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; consider the websocket connection
closed and close the underlying</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TCP connection.&lt;/t&gt;</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
<br>
I would replace corresponding texts with something along the line of the
<br>
following for more completeness:</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
<br>
(1) The endpoint SHOULD close write channel of the TCP connection <br>
 &nbsp; immediately after Close message is sent. (e.g. shutdown(SHUT_WR))</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
<br>
(2) After both sending and receiving a Close message, both endpoints</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; SHOULD wait for EoS(End of Stream; i.e. recv() returning 0) before</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; closing TCP socket and discard any data received after the Close</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; message.</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
<br>
(3) After both sending and receiving a Close message and the endpoint</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 &nbsp; has detected EoS, then the WebSocket connection is said to have
been</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
 &nbsp; closed _cleanly_.</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
<br>
Justification:</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
- (1) is to ensure that no more data will be written to the <br>
 underlying TCP socket after the Close message, and to indicate</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 that sender has reached the EoS at TCP level.</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
- (2) is to prevent the endpoint from generating spurious RST</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 due to a bug at the remote endpoint injecting data after Close frame.</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
- Presence of Close frame helps intermediaries to detect normal closure</font></tt><font size=3 face="sans-serif">
</font><tt><font size=2><br>
 of WebSocket connection.</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2><br>
<br>
Best.</font></tt><font size=3 face="sans-serif"> </font>
<br><tt><font size=2><br>
- Yutaka</font></tt><font size=3 face="sans-serif"> </font><tt><font size=2>_______________________________________________</font></tt>
<br><tt><font size=2><br>
hybi mailing list</font></tt><tt><font size=2 color=blue><u><br>
</u></font></tt><a href=mailto:hybi@ietf.org target=_blank><tt><font size=2 color=blue><u>hybi@ietf.org</u></font></tt></a><tt><font size=2 color=blue><u><br>
</u></font></tt><a href=https://www.ietf.org/mailman/listinfo/hybi target=_blank><tt><font size=2 color=blue><u>https://www.ietf.org/mailman/listinfo/hybi</u></font></tt></a>
<br><font size=3 face="sans-serif"><br>
<br>
_______________________________________________<br>
hybi mailing list</font><font size=3 color=blue face="sans-serif"><u><br>
</u></font><a href=mailto:hybi@ietf.org><font size=3 color=blue face="sans-serif"><u>hybi@ietf.org</u></font></a><font size=3 color=blue face="sans-serif"><u><br>
</u></font><a href=https://www.ietf.org/mailman/listinfo/hybi target=_blank><font size=3 color=blue face="sans-serif"><u>https://www.ietf.org/mailman/listinfo/hybi</u></font></a><font size=3 face="sans-serif"><br>
</font>
<br><tt><font size=2>_______________________________________________<br>
hybi mailing list<br>
hybi@ietf.org<br>
https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
<br>
--=_alternative 000942C188257839_=--

From sm@elandsys.com  Tue Feb 15 18:29:29 2011
Return-Path: <sm@elandsys.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B1C8D3A6C26 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:29:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -100.185
X-Spam-Level: 
X-Spam-Status: No, score=-100.185 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0DdIeNOv13pJ for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:29:27 -0800 (PST)
Received: from mail.elandsys.com (mail.elandsys.com [208.69.177.125]) by core3.amsl.com (Postfix) with ESMTP id 10BAC3A6C21 for <hybi@ietf.org>; Tue, 15 Feb 2011 18:29:27 -0800 (PST)
Received: from sm-THINK.elandsys.com (host86-174-73-195.range86-174.btcentralplus.com [86.174.73.195]) (authenticated bits=0) by mail.elandsys.com (8.13.8/8.13.8) with ESMTP id p1G2TgZ8003481 for <hybi@ietf.org>; Tue, 15 Feb 2011 18:29:49 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=simple/simple; d=elandsys.com; s=mail; t=1297823390; bh=6SLi9DOczcu8CcH51lNWlO2L9uw=; h=Message-Id:Date:To:From:Subject:Mime-Version:Content-Type; b=E3qJ4DcDQsbt01WJIC3rwHyLSV3ydhXWYL4x9yEZ/h4TjTusqbmD37HFwgI7FpJoi 0JxNNa5+cM5wCSqwlMitWy5eH11Nl3uE6XVSTuOKwX/i+fApqTbiNYeR6MFpKgP3zL 221mjZq1p3pff6wJThj+q+M/dfy+pr9f58XT2jnM=
Message-Id: <6.2.5.6.2.20110215181735.0d49dd40@elandnews.com>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6
Date: Tue, 15 Feb 2011 18:29:33 -0800
To: hybi@ietf.org
From: S Moonesamy <sm+ietf@elandsys.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Subject: [hybi] hybi-bounces@ietf.org
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 02:29:29 -0000

Hello,

Some subscribers to this mailing list have been adding a Cc to 
hybi-bounces@ietf.org.  That email address is used for 
bounces.  Please do not send emails to hybi-bounces@ietf.org.

Regards,
S. Moonesamy
Hybi WG Secretary


From tyoshino@google.com  Tue Feb 15 18:34:16 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 22FFB3A6C21 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:34:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.596
X-Spam-Level: 
X-Spam-Status: No, score=-105.596 tagged_above=-999 required=5 tests=[AWL=0.380, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DWbsu+zPQ0Xw for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:34:15 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id D5E4F3A6B6A for <hybi@ietf.org>; Tue, 15 Feb 2011 18:34:14 -0800 (PST)
Received: from kpbe14.cbf.corp.google.com (kpbe14.cbf.corp.google.com [172.25.105.78]) by smtp-out.google.com with ESMTP id p1G2YfsE004810 for <hybi@ietf.org>; Tue, 15 Feb 2011 18:34:41 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297823681; bh=xItgjbUIg65F3w8iAD33Zn0ZQwA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=njdaTikfAQi9S+i/j6vxTJ0S8H48XHjrOXrhS0U15sVibbr0TG5W/Fx75+o9oDISo wiVJ6hgJvmS3HPHNLJDnA==
Received: from iyj8 (iyj8.prod.google.com [10.241.51.72]) by kpbe14.cbf.corp.google.com with ESMTP id p1G2Yebn032312 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Tue, 15 Feb 2011 18:34:40 -0800
Received: by iyj8 with SMTP id 8so793736iyj.26 for <hybi@ietf.org>; Tue, 15 Feb 2011 18:34:40 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=dkaClaAs+PMjIt6KOIozqSnXOsX/AmSUewuR59aNvVo=; b=rtbz9yrgf/tg1sDIHd4vEypTR+G+LUWjDaithDGjJWiWwVMyPKFgM+UIUjqZ1yhhPU ZoA6ZbQNyh8d10Alv6cw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=T92LrviCKzlFJru7822UVO65akAnuvCmeC97LYI7UM0Hr8dLAOdZ5e52SdZsLBB+4h JXvjm7d6I9TAqO0bcgyg==
Received: by 10.231.171.197 with SMTP id i5mr17121ibz.54.1297823680014; Tue, 15 Feb 2011 18:34:40 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Tue, 15 Feb 2011 18:34:19 -0800 (PST)
In-Reply-To: <OF626368BC.D580B3D5-ON88257839.0005354B-88257839.000942C4@playstation.sony.com>
References: <AANLkTimhJ+F85NrAjt8TwDjDpyH0j30YcfAxppNKEvwF@mail.gmail.com> <OF626368BC.D580B3D5-ON88257839.0005354B-88257839.000942C4@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Tue, 15 Feb 2011 18:34:19 -0800
Message-ID: <AANLkTimA2-oQfddPra2og3wnG0h0eM3GcOt27gqaTZVK@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: multipart/alternative; boundary=001636c924366da92e049c5d1ffe
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 02:34:16 -0000

--001636c924366da92e049c5d1ffe
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Feb 15, 2011 at 17:41, <Yutaka_Takeda@playstation.sony.com> wrote:

> Although the Ian Hickson's message did not explain why TCP FIN
> (shutdown(SHUT_WR)) was
> not always possible, it made me realize that I have completely missed cases
> where we have


FYI,
http://www.ietf.org/mail-archive/web/hybi/current/msg01147.html by Maciej
http://www.ietf.org/mail-archive/web/hybi/current/msg01173.html by Jamie
etc.


>
> intermediary nodes (e.g. proxy) along the path which terminate TCP layer.
> (We can not terminate
> TCP connection before end-to-end WS-layer close handshake.)
>
> Thank you for the heads-up, and please accept my apologies for any
> confusion I may have caused.
>
> Ian Fette's text for -06 looks good to me now. If we are to exchange Close
> frames as a normal
> close handshake, then spurious RST issue should also be resolved in the
> normal sequence.
> In abnormal case, the RST issue may prevent the last bit including Close
> frame also from reaching
> the destination, which we need to be aware.
>
>
Good. Thanks,

Gabriel, are you fine with Ian Fette's text for -06?
According to Maciej's message
http://www.ietf.org/mail-archive/web/hybi/current/msg01181.html and others
on the thread, it looks like there was consensus that we should have some
method to deal with RST hazard.

You can still terminate TCP for abandoned WebSocket immediately for some
case where it makes sense though that will be taken as abnormal case above
in Yutaka's message. Making "wait for a Close frame in response" SHOULD is
another option.

Takeshi

--001636c924366da92e049c5d1ffe
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>On Tue, Feb 15, 2011 at 17:41,  <span dir=3D"ltr">&lt;<a href=3D"mailt=
o:Yutaka_Takeda@playstation.sony.com" target=3D"_blank">Yutaka_Takeda@plays=
tation.sony.com</a>&gt;</span> wrote:</div><div class=3D"gmail_quote"><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #cc=
c solid;padding-left:1ex">


<font size=3D"2" face=3D"sans-serif">Although the Ian Hickson&#39;s message=
 did
not explain why TCP FIN (shutdown(SHUT_WR)) was </font>
<br><font size=3D"2" face=3D"sans-serif">not always possible, it made me re=
alize
that I have completely missed cases where we have </font></blockquote><div>=
<br></div><div>FYI,</div><div><a href=3D"http://www.ietf.org/mail-archive/w=
eb/hybi/current/msg01147.html" target=3D"_blank">http://www.ietf.org/mail-a=
rchive/web/hybi/current/msg01147.html</a>=A0by Maciej</div>


<div><a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg01173.=
html" target=3D"_blank">http://www.ietf.org/mail-archive/web/hybi/current/m=
sg01173.html</a>=A0by Jamie</div><div>etc.</div><div>=A0</div><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex">



<br><font size=3D"2" face=3D"sans-serif">intermediary nodes (e.g. proxy) al=
ong
the path which terminate TCP layer. (We can not terminate</font>
<br><font size=3D"2" face=3D"sans-serif">TCP connection before end-to-end W=
S-layer
close handshake.)</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Thank you for the heads-up, and pl=
ease
accept my apologies for any confusion I may have caused.</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Ian Fette&#39;s text for -06 looks=
 good
to me now. If we are to exchange Close frames as a normal</font>
<br><font size=3D"2" face=3D"sans-serif">close handshake, then spurious RST=
 issue
should also be resolved in the normal sequence.</font>
<br><font size=3D"2" face=3D"sans-serif">In abnormal case, the RST issue ma=
y
prevent the last bit including Close frame also from reaching</font>
<br><font size=3D"2" face=3D"sans-serif">the destination, which we need to =
be
aware.</font>
<br>
<br></blockquote><div><br></div><div>Good. Thanks,</div><div><br></div><div=
>Gabriel, are you fine with Ian Fette&#39;s text for -06?</div><div>Accordi=
ng to Maciej&#39;s message=A0<a href=3D"http://www.ietf.org/mail-archive/we=
b/hybi/current/msg01181.html">http://www.ietf.org/mail-archive/web/hybi/cur=
rent/msg01181.html</a>=A0and others on the thread,=A0it looks like there wa=
s consensus that we should have some method to deal with RST hazard.</div>

<div><br></div><div><div>You can still terminate TCP for abandoned WebSocke=
t immediately for some case where it makes sense though that will be taken =
as abnormal case above in Yutaka&#39;s message. Making &quot;wait for a Clo=
se frame in response&quot; SHOULD is another option.</div>

</div><div><br></div><div>Takeshi</div></div>

--001636c924366da92e049c5d1ffe--

From trac@tools.ietf.org  Tue Feb 15 18:35:33 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED1453A6C26 for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:35:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.656
X-Spam-Level: 
X-Spam-Status: No, score=-101.656 tagged_above=-999 required=5 tests=[AWL=-0.921, BAYES_00=-2.599, FRT_LOLITA1=1.865, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hJqOev+hmWvw for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:35:33 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 44C463A6C21 for <hybi@ietf.org>; Tue, 15 Feb 2011 18:35:33 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PpXFH-00043k-UF; Tue, 15 Feb 2011 18:35:59 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: sm+ietf@elandsys.com
X-Trac-Project: hybi
Date: Wed, 16 Feb 2011 02:35:59 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/41
Message-ID: <059.f762b4dde4d9971f23da8c744849c3e8@tools.ietf.org>
X-Trac-Ticket-ID: 41
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: sm+ietf@elandsys.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: [hybi]  thewebsocketprotocol #41 (new): Use URI/IRI terminology
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 02:35:34 -0000

#41: Use URI/IRI terminology

 This issue was reported by Julian Reschke.

 http://tools.ietf.org/html/draft-ietf-hybi-
 thewebsocketprotocol-05#section-3

 The spec should use terminology consistent with RFC 3986/7, that it, use
 "URI" and/or "IRI". According to 10.1 it appears to be a URI.

 Also, it should be checked whether sections 3.1/3.2 add anything over the
 relevant parts of RFC 3986. If they do, we need to understand what. If
 they do not, the sections should either be removed, or simplified to just
 reference RFC 3986.

-- 
----------------------------------+-----------------------------------------
 Reporter:  sm+ietf@â€¦             |       Owner:     
     Type:  defect                |      Status:  new
 Priority:  major                 |   Milestone:     
Component:  thewebsocketprotocol  |     Version:     
 Severity:  -                     |    Keywords:     
----------------------------------+-----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/41>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Tue Feb 15 18:37:56 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B290D3A6C2F for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:37:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.569
X-Spam-Level: 
X-Spam-Status: No, score=-102.569 tagged_above=-999 required=5 tests=[AWL=0.031, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WnKj-jcxMNPw for <hybi@core3.amsl.com>; Tue, 15 Feb 2011 18:37:56 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id F21D53A6C2D for <hybi@ietf.org>; Tue, 15 Feb 2011 18:37:55 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PpXHb-0000np-7q; Tue, 15 Feb 2011 18:38:23 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: sm+ietf@elandsys.com
X-Trac-Project: hybi
Date: Wed, 16 Feb 2011 02:38:23 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/42
Message-ID: <059.f0bd958c502484df5afae54610748904@tools.ietf.org>
X-Trac-Ticket-ID: 42
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: sm+ietf@elandsys.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: [hybi]  thewebsocketprotocol #42 (new): HTML spec reference
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 02:37:56 -0000

#42: HTML spec reference

 This issue was reported by Julian Reschke.

 We currently have a normative reference to an unstable spec for this.

 Recommendation: when referring to HTML for definition of HTML contructs
 (such as forms), simply refer to either HTML 4.01 or the latest W3C HTNL5
 WD.

 When referring to HTML for the purpose of websockets acknowledgments,
 simply inline an appropriate URI into the Acknowledgements section.

-- 
----------------------------------+-----------------------------------------
 Reporter:  sm+ietf@â€¦             |       Owner:     
     Type:  defect                |      Status:  new
 Priority:  major                 |   Milestone:     
Component:  thewebsocketprotocol  |     Version:     
 Severity:  -                     |    Keywords:     
----------------------------------+-----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/42>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From Gabriel.Montenegro@microsoft.com  Wed Feb 16 07:57:42 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 502743A6CC7 for <hybi@core3.amsl.com>; Wed, 16 Feb 2011 07:57:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.438
X-Spam-Level: 
X-Spam-Status: No, score=-10.438 tagged_above=-999 required=5 tests=[AWL=0.160, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 04oQ8zsz8qVk for <hybi@core3.amsl.com>; Wed, 16 Feb 2011 07:57:35 -0800 (PST)
Received: from smtp.microsoft.com (mail2.microsoft.com [131.107.115.215]) by core3.amsl.com (Postfix) with ESMTP id 0469E3A6C3C for <hybi@ietf.org>; Wed, 16 Feb 2011 07:57:34 -0800 (PST)
Received: from TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) by TK5-EXGWY-E802.partners.extranet.microsoft.com (10.251.56.168) with Microsoft SMTP Server (TLS) id 8.2.176.0; Wed, 16 Feb 2011 07:58:02 -0800
Received: from TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com (157.54.71.39) by TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) with Microsoft SMTP Server (TLS) id 14.1.270.2; Wed, 16 Feb 2011 07:58:03 -0800
Received: from TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com ([169.254.5.102]) by TK5EX14MLTW651.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.39]) with mapi; Wed, 16 Feb 2011 07:58:03 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Takeshi Yoshino <tyoshino@google.com>
Thread-Topic: [hybi] Clarify the role of closing handshake
Thread-Index: AQHLyLZQD4/LNEvRdUK4csWEI+DaLJP6cYsAgAABlOCAAI+qgIAAoGMAgABJG4CAASvVgIAAOECAgAAF0ICAADMNAIAAEuuAgARUZAD//4iRsIAA2P0A//97msCAAcPdAIAAAZ8AgAAAtwCAABQXAIAAC+cAgAAbDYCAAAGXgIAAAyUAgAAWLwCAAA7cgIAAWY+g
Date: Wed, 16 Feb 2011 15:57:57 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1B418@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTimhJ+F85NrAjt8TwDjDpyH0j30YcfAxppNKEvwF@mail.gmail.com> <OF626368BC.D580B3D5-ON88257839.0005354B-88257839.000942C4@playstation.sony.com> <AANLkTimA2-oQfddPra2og3wnG0h0eM3GcOt27gqaTZVK@mail.gmail.com>
In-Reply-To: <AANLkTimA2-oQfddPra2og3wnG0h0eM3GcOt27gqaTZVK@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1B418TK5EX14MBXW605w_"
MIME-Version: 1.0
Cc: "hybi@ietf.org" <hybi@ietf.org>, "Yutaka_Takeda@playstation.sony.com" <Yutaka_Takeda@playstation.sony.com>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 15:57:42 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1B418TK5EX14MBXW605w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi Takeshi,

I'm currently on vacation with very limited connectivity and time on the ne=
t. I'll look at this again next week.

It seems like Ian's proposed text still has the data draining in it. I thou=
ght a few of us were converging towards some of the text proposed previousl=
y by you (without the data draining). TCP RST issues are not WS protocol an=
d could be taken care of by some implementation advice as previously sugges=
ted. I'd really question our complicating the WS protocol for anything that=
 is not absolutely necessary.

Thanks,

Gabriel

From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of Tak=
eshi Yoshino
Sent: Tuesday, February 15, 2011 18:34
To: Yutaka_Takeda@playstation.sony.com; Gabriel Montenegro
Cc: hybi@ietf.org
Subject: Re: [hybi] Clarify the role of closing handshake

On Tue, Feb 15, 2011 at 17:41, <Yutaka_Takeda@playstation.sony.com<mailto:Y=
utaka_Takeda@playstation.sony.com>> wrote:
Although the Ian Hickson's message did not explain why TCP FIN (shutdown(SH=
UT_WR)) was
not always possible, it made me realize that I have completely missed cases=
 where we have

FYI,
http://www.ietf.org/mail-archive/web/hybi/current/msg01147.html by Maciej
http://www.ietf.org/mail-archive/web/hybi/current/msg01173.html by Jamie
etc.


intermediary nodes (e.g. proxy) along the path which terminate TCP layer. (=
We can not terminate
TCP connection before end-to-end WS-layer close handshake.)

Thank you for the heads-up, and please accept my apologies for any confusio=
n I may have caused.

Ian Fette's text for -06 looks good to me now. If we are to exchange Close =
frames as a normal
close handshake, then spurious RST issue should also be resolved in the nor=
mal sequence.
In abnormal case, the RST issue may prevent the last bit including Close fr=
ame also from reaching
the destination, which we need to be aware.

Good. Thanks,

Gabriel, are you fine with Ian Fette's text for -06?
According to Maciej's message http://www.ietf.org/mail-archive/web/hybi/cur=
rent/msg01181.html and others on the thread, it looks like there was consen=
sus that we should have some method to deal with RST hazard.

You can still terminate TCP for abandoned WebSocket immediately for some ca=
se where it makes sense though that will be taken as abnormal case above in=
 Yutaka's message. Making "wait for a Close frame in response" SHOULD is an=
other option.

Takeshi

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1B418TK5EX14MBXW605w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV=3D"Content-Type" CONTENT=
=3D"text/html; charset=3Dus-ascii"><meta name=3DGenerator content=3D"Micros=
oft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue vli=
nk=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span style=3D'f=
ont-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Takesh=
i,<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11.0p=
t;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></span=
></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Cali=
bri","sans-serif";color:#1F497D'>I&#8217;m currently on vacation with very =
limited connectivity and time on the net. I&#8217;ll look at this again nex=
t week.<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:=
11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p><=
/span></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:=
"Calibri","sans-serif";color:#1F497D'>It seems like Ian&#8217;s proposed te=
xt still has the data draining in it. I thought a few of us were converging=
 towards some of the text proposed previously by you (without the data drai=
ning). TCP RST issues are not WS protocol and could be taken care of by som=
e implementation advice as previously suggested. I&#8217;d really question =
our complicating the WS protocol for anything that is not absolutely necess=
ary. <o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11=
.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p></s=
pan></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"C=
alibri","sans-serif";color:#1F497D'>Thanks,<o:p></o:p></span></p><p class=
=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:"Calibri","sans-se=
rif";color:#1F497D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'=
>Gabriel<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size=
:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p>&nbsp;</o:p>=
</span></p><div style=3D'border:none;border-left:solid blue 1.5pt;padding:0=
in 0in 0in 4.0pt'><div><div style=3D'border:none;border-top:solid #B5C4DF 1=
.0pt;padding:3.0pt 0in 0in 0in'><p class=3DMsoNormal><b><span style=3D'font=
-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style=
=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> hybi-bounces@ietf.=
org [mailto:hybi-bounces@ietf.org] <b>On Behalf Of </b>Takeshi Yoshino<br><=
b>Sent:</b> Tuesday, February 15, 2011 18:34<br><b>To:</b> Yutaka_Takeda@pl=
aystation.sony.com; Gabriel Montenegro<br><b>Cc:</b> hybi@ietf.org<br><b>Su=
bject:</b> Re: [hybi] Clarify the role of closing handshake<o:p></o:p></spa=
n></p></div></div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><div><p class=
=3DMsoNormal>On Tue, Feb 15, 2011 at 17:41, &lt;<a href=3D"mailto:Yutaka_Ta=
keda@playstation.sony.com" target=3D"_blank">Yutaka_Takeda@playstation.sony=
.com</a>&gt; wrote:<o:p></o:p></p></div><div><blockquote style=3D'border:no=
ne;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.=
8pt;margin-right:0in'><p class=3DMsoNormal><span style=3D'font-size:10.0pt;=
font-family:"Arial","sans-serif"'>Although the Ian Hickson's message did no=
t explain why TCP FIN (shutdown(SHUT_WR)) was </span><br><span style=3D'fon=
t-size:10.0pt;font-family:"Arial","sans-serif"'>not always possible, it mad=
e me realize that I have completely missed cases where we have </span><o:p>=
</o:p></p></blockquote><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div=
><div><p class=3DMsoNormal>FYI,<o:p></o:p></p></div><div><p class=3DMsoNorm=
al><a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg01147.ht=
ml" target=3D"_blank">http://www.ietf.org/mail-archive/web/hybi/current/msg=
01147.html</a>&nbsp;by Maciej<o:p></o:p></p></div><div><p class=3DMsoNormal=
><a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg01173.html=
" target=3D"_blank">http://www.ietf.org/mail-archive/web/hybi/current/msg01=
173.html</a>&nbsp;by Jamie<o:p></o:p></p></div><div><p class=3DMsoNormal>et=
c.<o:p></o:p></p></div><div><p class=3DMsoNormal>&nbsp;<o:p></o:p></p></div=
><blockquote style=3D'border:none;border-left:solid #CCCCCC 1.0pt;padding:0=
in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=3DMsoNormal s=
tyle=3D'margin-bottom:12.0pt'><br><span style=3D'font-size:10.0pt;font-fami=
ly:"Arial","sans-serif"'>intermediary nodes (e.g. proxy) along the path whi=
ch terminate TCP layer. (We can not terminate</span> <br><span style=3D'fon=
t-size:10.0pt;font-family:"Arial","sans-serif"'>TCP connection before end-t=
o-end WS-layer close handshake.)</span> <br><br><span style=3D'font-size:10=
.0pt;font-family:"Arial","sans-serif"'>Thank you for the heads-up, and plea=
se accept my apologies for any confusion I may have caused.</span> <br><br>=
<span style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>Ian Fette=
's text for -06 looks good to me now. If we are to exchange Close frames as=
 a normal</span> <br><span style=3D'font-size:10.0pt;font-family:"Arial","s=
ans-serif"'>close handshake, then spurious RST issue should also be resolve=
d in the normal sequence.</span> <br><span style=3D'font-size:10.0pt;font-f=
amily:"Arial","sans-serif"'>In abnormal case, the RST issue may prevent the=
 last bit including Close frame also from reaching</span> <br><span style=
=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>the destination, whi=
ch we need to be aware.</span> <o:p></o:p></p></blockquote><div><p class=3D=
MsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Good. Thanks=
,<o:p></o:p></p></div><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div>=
<div><p class=3DMsoNormal>Gabriel, are you fine with Ian Fette's text for -=
06?<o:p></o:p></p></div><div><p class=3DMsoNormal>According to Maciej's mes=
sage&nbsp;<a href=3D"http://www.ietf.org/mail-archive/web/hybi/current/msg0=
1181.html">http://www.ietf.org/mail-archive/web/hybi/current/msg01181.html<=
/a>&nbsp;and others on the thread,&nbsp;it looks like there was consensus t=
hat we should have some method to deal with RST hazard.<o:p></o:p></p></div=
><div><p class=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><div><p class=3D=
MsoNormal>You can still terminate TCP for abandoned WebSocket immediately f=
or some case where it makes sense though that will be taken as abnormal cas=
e above in Yutaka's message. Making &quot;wait for a Close frame in respons=
e&quot; SHOULD is another option.<o:p></o:p></p></div></div><div><p class=
=3DMsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=3DMsoNormal>Takeshi<o=
:p></o:p></p></div></div></div></div></body></html>=

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126E1B418TK5EX14MBXW605w_--

From Yutaka_Takeda@PlayStation.Sony.Com  Wed Feb 16 12:48:54 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 827273A6D89 for <hybi@core3.amsl.com>; Wed, 16 Feb 2011 12:48:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.367
X-Spam-Level: 
X-Spam-Status: No, score=-5.367 tagged_above=-999 required=5 tests=[AWL=-0.303, BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_12=0.6, J_CHICKENPOX_31=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lHxeBL7ipHE5 for <hybi@core3.amsl.com>; Wed, 16 Feb 2011 12:48:47 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 78C423A6D2A for <hybi@ietf.org>; Wed, 16 Feb 2011 12:48:47 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021612491112-619273 ; Wed, 16 Feb 2011 12:49:11 -0800 
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126E1B418@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
MIME-Version: 1.0
X-KeepSent: 5DB67627:054FD79A-88257839:006CC369; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF5DB67627.054FD79A-ON88257839.006CC369-88257839.00725C37@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Wed, 16 Feb 2011 12:49:06 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/16/2011 12:49:10 PM, Serialize complete at 02/16/2011 12:49:10 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/16/2011 12:49:11 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/16/2011 12:49:17 PM, Serialize complete at 02/16/2011 12:49:17 PM
Content-Type: multipart/alternative; boundary="=_alternative 00725C3488257839_="
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Clarify the role of closing handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Feb 2011 20:48:54 -0000

This is a multipart message in MIME format.
--=_alternative 00725C3488257839_=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="ISO-8859-1"

I can see Gabriel and a few others' point in which WS application=20
programmers cannot rely
on WebSocket's data draining for delivery critical data anyway with a=20
number of reasons which=20
includes poor implementation of a browser, lack of consistency in behavior =

across browsers,=20
unexpected user actions, network or server failures, etc, and abandon the=20
draining by WS-layer
for more simplicity.

What bothers me, however, though is that immediate TCP socket closure can=20
cause RST
which can be avoided in the normal close handshake currently proposed.

I would imagine one WS application would be some kind of streaming where a =

client is consistently
receiving data from a server while allowing client to control the stream=20
(switch channels,=20
fastfoward, rewind, etc.). When the client needs to go away, the RST would =

be generated
at high chances as there would more likely be some data in the TCP kernel=20
buffer. I certainly do=20
not want to see RST from the client at least in such normal operation for=20
trouble shooting or for more=20
robust sanity checking in our system development/deployment. (RST does not =

tell nothing!)

Some people have expressed a desire to have some reason code in Close=20
frame to identify=20
problems (I have no objection to it, but to some extent where it does not=20
reveal too much information
on the wire.) Again. this Close frame also may not reach the other end due =

to the RST hazard.

I have no problem with implementing the close handshake currently proposed =

and
I do not think at all that it is that complicated for my non-browser=20
WS-layer library. (I just do not know
exactly if this applies to the implementation for browsers.) We can also=20
consider using=20
wasClear equivalent  to take some action (re-connect, report the incident=20
to a server, logging, etc.), too.


- Yutaka


hybi-bounces@ietf.org wrote on 02/16/2011 07:57:57 AM:

> Hi Takeshi,
>=20
> I?m currently on vacation with very limited connectivity and time on
> the net. I?ll look at this again next week.
>=20
> It seems like Ian?s proposed text still has the data draining in it.
> I thought a few of us were converging towards some of the text=20
> proposed previously by you (without the data draining). TCP RST=20
> issues are not WS protocol and could be taken care of by some=20
> implementation advice as previously suggested. I?d really question=20
> our complicating the WS protocol for anything that is not absolutely
> necessary.=20
>=20
> Thanks,
>=20
> Gabriel
>=20
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of=20
> Takeshi Yoshino
> Sent: Tuesday, February 15, 2011 18:34
> To: Yutaka=5FTakeda@playstation.sony.com; Gabriel Montenegro
> Cc: hybi@ietf.org
> Subject: Re: [hybi] Clarify the role of closing handshake
>=20
> On Tue, Feb 15, 2011 at 17:41, <Yutaka=5FTakeda@playstation.sony.com>=20
wrote:
> Although the Ian Hickson's message did not explain why TCP FIN=20
> (shutdown(SHUT=5FWR)) was=20
> not always possible, it made me realize that I have completely=20
> missed cases where we have=20
>=20
> FYI,
> http://www.ietf.org/mail-archive/web/hybi/current/msg01147.html by=20
Maciej
> http://www.ietf.org/mail-archive/web/hybi/current/msg01173.html by Jamie
> etc.
>=20
>=20
> intermediary nodes (e.g. proxy) along the path which terminate TCP=20
> layer. (We can not terminate=20
> TCP connection before end-to-end WS-layer close handshake.)=20
>=20
> Thank you for the heads-up, and please accept my apologies for any=20
> confusion I may have caused.=20
>=20
> Ian Fette's text for -06 looks good to me now. If we are to exchange
> Close frames as a normal=20
> close handshake, then spurious RST issue should also be resolved in=20
> the normal sequence.=20
> In abnormal case, the RST issue may prevent the last bit including=20
> Close frame also from reaching=20
> the destination, which we need to be aware.=20
>=20
> Good. Thanks,
>=20
> Gabriel, are you fine with Ian Fette's text for -06?
> According to Maciej's message http://www.ietf.org/mail-
> archive/web/hybi/current/msg01181.html and others on the thread, it=20
> looks like there was consensus that we should have some method to=20
> deal with RST hazard.
>=20
> You can still terminate TCP for abandoned WebSocket immediately for=20
> some case where it makes sense though that will be taken as abnormal
> case above in Yutaka's message. Making "wait for a Close frame in=20
> response" SHOULD is another option.
>=20
> Takeshi=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 00725C3488257839_=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="ISO-8859-1"


<br><font size=3D2 face=3D"sans-serif">I can see Gabriel and a few others'
point in which WS application programmers cannot rely</font>
<br><font size=3D2 face=3D"sans-serif">on WebSocket's data draining for del=
ivery
critical data anyway with a number of reasons which </font>
<br><font size=3D2 face=3D"sans-serif">includes poor implementation of a br=
owser,
lack of consistency in behavior across browsers, </font>
<br><font size=3D2 face=3D"sans-serif">unexpected user actions, network or
server failures, etc, and abandon the draining by WS-layer</font>
<br><font size=3D2 face=3D"sans-serif">for more simplicity.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">What bothers me, however, though is
that immediate TCP socket closure can cause RST</font>
<br><font size=3D2 face=3D"sans-serif">which can be avoided in the normal c=
lose
handshake currently proposed.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">I would imagine one WS application w=
ould
be some kind of streaming where a client is consistently</font>
<br><font size=3D2 face=3D"sans-serif">receiving data from a server while a=
llowing
client to control the stream (switch channels, </font>
<br><font size=3D2 face=3D"sans-serif">fastfoward, rewind, etc.). When the
client needs to go away, the RST would be generated</font>
<br><font size=3D2 face=3D"sans-serif">at high chances as there would more
likely be some data in the TCP kernel buffer. I certainly do </font>
<br><font size=3D2 face=3D"sans-serif">not want to see RST from the client
at least in such normal operation for trouble shooting or for more </font>
<br><font size=3D2 face=3D"sans-serif">robust sanity checking in our system
development/deployment. (RST does not tell nothing!)</font>
<br>
<br><font size=3D2 face=3D"sans-serif">Some people have expressed a desire
to have some reason code in Close frame to identify </font>
<br><font size=3D2 face=3D"sans-serif">problems (I have no objection to it,
but to some extent where it does not reveal too much information</font>
<br><font size=3D2 face=3D"sans-serif">on the wire.) Again. this Close frame
also may not reach the other end due to the RST hazard.</font>
<br>
<br><font size=3D2 face=3D"sans-serif">I have no problem with implementing
the close handshake currently proposed and</font>
<br><font size=3D2 face=3D"sans-serif">I do not think at all that it is that
complicated for my non-browser WS-layer library. (I just do not know</font>
<br><font size=3D2 face=3D"sans-serif">exactly if this applies to the imple=
mentation
for browsers.) We can also consider using </font>
<br><font size=3D2 face=3D"sans-serif">wasClear equivalent &nbsp;to take so=
me
action (re-connect, report the incident to a server, logging, etc.), too.</=
font>
<br>
<br>
<br><font size=3D2 face=3D"sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=3D2>hybi-bounces@ietf.org wrote on 02/16/2011 07:57:57
AM:<br>
<br>
&gt; Hi Takeshi,</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; I&#8217;m currently on vacation with very limit=
ed
connectivity and time on<br>
&gt; the net. I&#8217;ll look at this again next week.</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; It seems like Ian&#8217;s proposed text still h=
as
the data draining in it.<br>
&gt; I thought a few of us were converging towards some of the text <br>
&gt; proposed previously by you (without the data draining). TCP RST <br>
&gt; issues are not WS protocol and could be taken care of by some <br>
&gt; implementation advice as previously suggested. I&#8217;d really questi=
on
<br>
&gt; our complicating the WS protocol for anything that is not absolutely<b=
r>
&gt; necessary. </font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Thanks,</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Gabriel</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; From: hybi-bounces@ietf.org [mailto:hybi-bounce=
s@ietf.org]
On Behalf Of <br>
&gt; Takeshi Yoshino<br>
&gt; Sent: Tuesday, February 15, 2011 18:34<br>
&gt; To: Yutaka=5FTakeda@playstation.sony.com; Gabriel Montenegro<br>
&gt; Cc: hybi@ietf.org<br>
&gt; Subject: Re: [hybi] Clarify the role of closing handshake</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; On Tue, Feb 15, 2011 at 17:41, &lt;Yutaka=5FTak=
eda@playstation.sony.com&gt;
wrote:</font></tt>
<br><tt><font size=3D2>&gt; Although the Ian Hickson's message did not expl=
ain
why TCP FIN <br>
&gt; (shutdown(SHUT=5FWR)) was <br>
&gt; not always possible, it made me realize that I have completely <br>
&gt; missed cases where we have </font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; FYI,</font></tt>
<br><tt><font size=3D2>&gt; http://www.ietf.org/mail-archive/web/hybi/curre=
nt/msg01147.html
by Maciej</font></tt>
<br><tt><font size=3D2>&gt; http://www.ietf.org/mail-archive/web/hybi/curre=
nt/msg01173.html
by Jamie</font></tt>
<br><tt><font size=3D2>&gt; etc.</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; <br>
&gt; intermediary nodes (e.g. proxy) along the path which terminate TCP
<br>
&gt; layer. (We can not terminate <br>
&gt; TCP connection before end-to-end WS-layer close handshake.) <br>
&gt; <br>
&gt; Thank you for the heads-up, and please accept my apologies for any
<br>
&gt; confusion I may have caused. <br>
&gt; <br>
&gt; Ian Fette's text for -06 looks good to me now. If we are to exchange<b=
r>
&gt; Close frames as a normal <br>
&gt; close handshake, then spurious RST issue should also be resolved in
<br>
&gt; the normal sequence. <br>
&gt; In abnormal case, the RST issue may prevent the last bit including
<br>
&gt; Close frame also from reaching <br>
&gt; the destination, which we need to be aware. </font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Good. Thanks,</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Gabriel, are you fine with Ian Fette's text for
-06?</font></tt>
<br><tt><font size=3D2>&gt; According to Maciej's message http://www.ietf.o=
rg/mail-<br>
&gt; archive/web/hybi/current/msg01181.html and others on the thread, it
<br>
&gt; looks like there was consensus that we should have some method to
<br>
&gt; deal with RST hazard.</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; You can still terminate TCP for abandoned WebSo=
cket
immediately for <br>
&gt; some case where it makes sense though that will be taken as abnormal<b=
r>
&gt; case above in Yutaka's message. Making &quot;wait for a Close frame
in <br>
&gt; response&quot; SHOULD is another option.</font></tt>
<br><tt><font size=3D2>&gt; &nbsp;</font></tt>
<br><tt><font size=3D2>&gt; Takeshi=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 00725C3488257839_=--

From tyoshino@google.com  Wed Feb 16 18:20:15 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4FF443A6D72 for <hybi@core3.amsl.com>; Wed, 16 Feb 2011 18:20:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.226
X-Spam-Level: 
X-Spam-Status: No, score=-105.226 tagged_above=-999 required=5 tests=[AWL=0.750, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zgxKaOgVu88A for <hybi@core3.amsl.com>; Wed, 16 Feb 2011 18:20:14 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 1C5CC3A6CE5 for <hybi@ietf.org>; Wed, 16 Feb 2011 18:20:13 -0800 (PST)
Received: from kpbe16.cbf.corp.google.com (kpbe16.cbf.corp.google.com [172.25.105.80]) by smtp-out.google.com with ESMTP id p1H2Kgk8018040 for <hybi@ietf.org>; Wed, 16 Feb 2011 18:20:42 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1297909242; bh=xP5RGGX3XqJS9fyXLIEY7Z5f3yw=; h=MIME-Version:From:Date:Message-ID:Subject:To:Content-Type; b=vFSGrOycHPYiwq37fGH/Di3h2RRUo2UIjhkBxHSMCtj6SCWjQwyy9YZNKcqvAVK8m wxgNKBJzcOw/D1kBE25Lw==
Received: from iyb39 (iyb39.prod.google.com [10.241.49.103]) by kpbe16.cbf.corp.google.com with ESMTP id p1H2JNmL014221 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 16 Feb 2011 18:20:41 -0800
Received: by iyb39 with SMTP id 39so2361844iyb.15 for <hybi@ietf.org>; Wed, 16 Feb 2011 18:20:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:from:date:message-id:subject:to :content-type; bh=YeCYQfmc8BDbQBZRDTbnb2qnNddaVj+L4xf8Z8u4918=; b=hn+te+j1YelNGRq+wzEE4MGrVC4ZDA27wI4Wx5djJsYd4AFMVdPuBp96bS68nvy6Mj PdpO/xlvYithHeMgTw7Q==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:from:date:message-id:subject:to:content-type; b=K+9nmGH9WadizwAEL4A13coYW9QCAqYMPhIOa8gW3edTtoBMBJWSDhB0REkbdghlZy RuToWJExpeNkBUpTL0KA==
Received: by 10.231.39.73 with SMTP id f9mr1146242ibe.79.1297909241135; Wed, 16 Feb 2011 18:20:41 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Wed, 16 Feb 2011 18:20:18 -0800 (PST)
From: Takeshi Yoshino <tyoshino@google.com>
Date: Wed, 16 Feb 2011 18:20:18 -0800
Message-ID: <AANLkTimyGWacfoVFon1TsQzqmsEcKy9tNsmKhCnJhgWM@mail.gmail.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=0003255752fe44c2ab049c710b7c
X-System-Of-Record: true
Subject: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Feb 2011 02:20:15 -0000

--0003255752fe44c2ab049c710b7c
Content-Type: text/plain; charset=ISO-8859-1

It's still under discussion if it's really necessary (see "Clarify the role
of closing handshake" thread), but RST suppression was one of the original
objectives of Close frame. Close frame assures no more data is coming on the
underlying channel to allow the endpoint to close(2) safely.

deflate-stream extension in -05 applies deflate on whole octets of a frame
including the header. If we simply use zlib's flush, we can spoil this
function of Close frame. There can be some data remain not processed/recv-ed
even after getting a Close frame uncompressed.

e.g.
(if Z_SYNC_FLUSH is used) possibly a few octets containing EoB symbol, 3-bit
header, padding, and then BTYPE=00 block "00 00 ff ff".
(if Z_FINISH is used) possibly one octet containing EoB symbol.

Endpoints need to drain these octets to prevent RST. This should be noted.

Takeshi

--0003255752fe44c2ab049c710b7c
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>It&#39;s still under discussion if it&#39;s really necessary (see &quo=
t;Clarify the role of closing handshake&quot; thread), but RST suppression =
was one of the original objectives of Close frame. Close frame assures=A0no=
 more data is coming on the underlying channel to allow the endpoint to clo=
se(2) safely.</div>

<div><br></div><div>deflate-stream extension in -05 applies deflate on whol=
e octets of a frame including the header. If we simply use zlib&#39;s flush=
, we=A0can spoil this function of Close frame. There can be some data remai=
n not processed/recv-ed even after getting a Close frame=A0uncompressed.</d=
iv>

<div><br></div><div>e.g.</div><div>(if Z_SYNC_FLUSH is used) possibly a few=
 octets containing EoB symbol, 3-bit header, padding, and then BTYPE=3D00 b=
lock &quot;00 00 ff ff&quot;.</div><div>(if Z_FINISH is used) possibly one =
octet containing EoB symbol.</div>

<div><br></div><div>Endpoints need to drain these octets to prevent RST. Th=
is should be noted.</div><br clear=3D"all">Takeshi<br>

--0003255752fe44c2ab049c710b7c--

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 17 16:33:27 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD00A3A6DDE; Thu, 17 Feb 2011 16:33:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.95
X-Spam-Level: 
X-Spam-Status: No, score=-5.95 tagged_above=-999 required=5 tests=[AWL=0.314,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V4MFioKT94qZ; Thu, 17 Feb 2011 16:33:26 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id CBB183A6C34; Thu, 17 Feb 2011 16:33:23 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011021716334884-676944 ; Thu, 17 Feb 2011 16:33:48 -0800 
In-Reply-To: <AANLkTimyGWacfoVFon1TsQzqmsEcKy9tNsmKhCnJhgWM@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
MIME-Version: 1.0
X-KeepSent: C19D8FEF:225C2E75-8825783A:00827B4C; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFC19D8FEF.225C2E75-ON8825783A.00827B4C-8825783B.00031959@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 17 Feb 2011 16:33:50 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/17/2011 04:33:48 PM, Serialize complete at 02/17/2011 04:33:48 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/17/2011 04:33:48 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/17/2011 04:33:59 PM, Serialize complete at 02/17/2011 04:33:59 PM
Content-Type: multipart/alternative; boundary="=_alternative 000319578825783B_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Feb 2011 00:33:28 -0000

This is a multipart message in MIME format.
--=_alternative 000319578825783B_=
Content-Type: text/plain; charset="US-ASCII"

Hi Takeshi,

Good point. There is indeed a legitmate case where trailing bytes is 
present after 
Close frame.

It is important to note that after endpoint sent and received Close frame, 
it is considered 
that WebSocket layer close handshake has been complete ('wasClear' gets 
set to 1, 
etc.).

What Takeshi pointed out is a good motivation for WS-layer to perform 
graceful 
shutdown at TCP layer as well. After Close frame has been exchanged 
successfully, 
the endpoint must start shutting down the local TCP connection with 
shutdown(SHUT_WR), and discard the trailing bytes, if any received, and 
then finally 
close the socket on receipt of EoS.

This works for any trailing bytes that could be caused by artifact of 
another deflate 
algorithm that may be introduced in the future, or just by a bug.


- Yutaka


hybi-bounces@ietf.org wrote on 02/16/2011 06:20:18 PM:

> It's still under discussion if it's really necessary (see "Clarify 
> the role of closing handshake" thread), but RST suppression was one 
> of the original objectives of Close frame. Close frame assures no 
> more data is coming on the underlying channel to allow the endpoint 
> to close(2) safely.
> 
> deflate-stream extension in -05 applies deflate on whole octets of a
> frame including the header. If we simply use zlib's flush, we can 
> spoil this function of Close frame. There can be some data remain 
> not processed/recv-ed even after getting a Close frame uncompressed.
> 
> e.g.
> (if Z_SYNC_FLUSH is used) possibly a few octets containing EoB 
> symbol, 3-bit header, padding, and then BTYPE=00 block "00 00 ff ff".
> (if Z_FINISH is used) possibly one octet containing EoB symbol.
> 
> Endpoints need to drain these octets to prevent RST. This should be 
noted.
> 
> Takeshi_______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 000319578825783B_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Hi Takeshi,</font>
<br>
<br><font size=2 face="sans-serif">Good point. There is indeed a legitmate
case where trailing bytes is present after </font>
<br><font size=2 face="sans-serif">Close frame.</font>
<br>
<br><font size=2 face="sans-serif">It is important to note that after endpoint
sent and received Close frame, it is considered </font>
<br><font size=2 face="sans-serif">that WebSocket layer close handshake
has been complete ('wasClear' gets set to 1, </font>
<br><font size=2 face="sans-serif">etc.).</font>
<br>
<br><font size=2 face="sans-serif">What Takeshi pointed out is a good motivation
for WS-layer to perform graceful </font>
<br><font size=2 face="sans-serif">shutdown at TCP layer as well. After
Close frame has been exchanged successfully, </font>
<br><font size=2 face="sans-serif">the endpoint must start shutting down
the local TCP connection with </font>
<br><font size=2 face="sans-serif">shutdown(SHUT_WR), and discard the trailing
bytes, if any received, and then finally </font>
<br><font size=2 face="sans-serif">close the socket on receipt of EoS.</font>
<br>
<br><font size=2 face="sans-serif">This works for any trailing bytes that
could be caused by artifact of another deflate </font>
<br><font size=2 face="sans-serif">algorithm that may be introduced in
the future, or just by a bug.</font>
<br>
<br>
<br><font size=2 face="sans-serif">- Yutaka</font>
<br>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/16/2011 06:20:18
PM:<br>
<br>
&gt; It's still under discussion if it's really necessary (see &quot;Clarify
<br>
&gt; the role of closing handshake&quot; thread), but RST suppression was
one <br>
&gt; of the original objectives of Close frame. Close frame assures&nbsp;no
<br>
&gt; more data is coming on the underlying channel to allow the endpoint
<br>
&gt; to close(2) safely.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; deflate-stream extension in -05 applies deflate on whole octets of
a<br>
&gt; frame including the header. If we simply use zlib's flush, we&nbsp;can
<br>
&gt; spoil this function of Close frame. There can be some data remain
<br>
&gt; not processed/recv-ed even after getting a Close frame&nbsp;uncompressed.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; e.g.</font></tt>
<br><tt><font size=2>&gt; (if Z_SYNC_FLUSH is used) possibly a few octets
containing EoB <br>
&gt; symbol, 3-bit header, padding, and then BTYPE=00 block &quot;00 00
ff ff&quot;.</font></tt>
<br><tt><font size=2>&gt; (if Z_FINISH is used) possibly one octet containing
EoB symbol.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Endpoints need to drain these octets to prevent RST. This should be
noted.</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Takeshi_______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 000319578825783B_=--

From ifette@google.com  Sat Feb 19 18:40:08 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 099EE3A6D85 for <hybi@core3.amsl.com>; Sat, 19 Feb 2011 18:40:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.176
X-Spam-Level: 
X-Spam-Status: No, score=-104.176 tagged_above=-999 required=5 tests=[AWL=1.500, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TEoE5sca92lf for <hybi@core3.amsl.com>; Sat, 19 Feb 2011 18:40:05 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 7CEA13A6CBA for <hybi@ietf.org>; Sat, 19 Feb 2011 18:40:03 -0800 (PST)
Received: from kpbe16.cbf.corp.google.com (kpbe16.cbf.corp.google.com [172.25.105.80]) by smtp-out.google.com with ESMTP id p1K2ee7T021341 for <hybi@ietf.org>; Sat, 19 Feb 2011 18:40:40 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298169641; bh=lrPRUJ5olSzK5MAILI9JInBrJWM=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=tfOBsKjsYQw6Jg+SKcJOkzLG8pWRAWTDfgXxHr0iNADJBa9Q/fGnXTZvUBdbQgDoW sMudjUX+cCcT3ssaUE0rQ==
Received: from iwc10 (iwc10.prod.google.com [10.241.65.138]) by kpbe16.cbf.corp.google.com with ESMTP id p1K2ecwR029574 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Sat, 19 Feb 2011 18:40:39 -0800
Received: by iwc10 with SMTP id 10so1506798iwc.10 for <hybi@ietf.org>; Sat, 19 Feb 2011 18:40:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=XCXMsbyzA50rL9UxzZbI+56vqb1H7aD10H4ACNEP9Y8=; b=l5N/rAS0Nrxtu8wuEeYeNpo3gFfa3aRDKidhheL96Iy19BSxuCR612+/CzIzcMuOYg xkyc7NzDHDnILTjDZuAQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=LRdwnFjqbsyK7RuNRuOmViTRDrH4VHnVkMM3zHzIUHW990poyfh25HKnV4uAOPkLAA ORT2T94kkUEx3Y8XPJ1g==
MIME-Version: 1.0
Received: by 10.231.30.71 with SMTP id t7mr1798722ibc.153.1298169638713; Sat, 19 Feb 2011 18:40:38 -0800 (PST)
Received: by 10.231.37.133 with HTTP; Sat, 19 Feb 2011 18:40:38 -0800 (PST)
In-Reply-To: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>
Date: Sat, 19 Feb 2011 18:40:38 -0800
Message-ID: <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=00221532c7a02c78d2049cadac57
X-System-Of-Record: true
Cc: hybi@ietf.org, ifette+ietf@google.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Feb 2011 02:40:08 -0000

--00221532c7a02c78d2049cadac57
Content-Type: text/plain; charset=UTF-8

as per the first page of the draft, the proper forum is hybi@ietf.org. reply
inline.

On Sat, Feb 19, 2011 at 11:01 AM, Silvio Ventres
<silvio.ventres@gmail.com>wrote:

> Hello, Ian.
>
> Please let know if there exists a forum for discussion of these points.
> At this point, it seems the WebSocket has been designed with very
> vague goals, while the spec draft has been written to encompass
> additional goals, which can only be guessed, and are not explicitly
> specified anywhere, such as prevention of some usage scenarios or
> stream fragmentation.
>
> The comments follow section numbers:
>
> 1.6: quote: "fields starting with |Sec-| cannot be set by an attacker
> from a Web browser, even when using |XMLHttpRequest|."
> "Sec-" are _only_ filtered for XHR as specified in XHR spec, not any
> HTTP specs per se.
>
>
No other browser APIs allow these to be sent, and browser vendors would
consider that to be a bug. XHR is the closest thing to sending an arbitrary
request from a browser, and this forbids Sec- headers.


> 1.6: quote: "fail to establish a connection when data from other
> protocols, especially HTTP, is sent to a WebSocket server, for example
> as might happen if an HTML |form| were submitted to a
>   WebSocket server.  This is primarily achieved by requiring that the
> server prove that it read the handshake"
> What does the "server prove that it read the handshake" mean? How does
> the server "prove" anything? If the server sends any response to the
> HTML <form> request, that's all the response that was expected anyway,
> so who cares about "proof" ?
>

By making a computation involving data in the handshake, the server "proves"
that it actually parsed, at least in some minimal version, the request, as
opposed to returning a canned response. The intent was to ensure the client
is communicating with a WebSocket server, not an arbitrary
server/intermediary/... that may be confused and returning a response
without actually understanding WebSockets.


>
> 1.6: quote: "This protocol is intended to fail to establish a connection
> with
>   servers of pre-existing protocols like SMTP or HTTP, while allowing
>   HTTP servers to opt-in to supporting this protocol if desired.  This
>   is achieved by having a strict and elaborate handshake, and by
>   limiting the data that can be inserted into the connection before the
>   handshake is finished (thus limiting how much the server can be
>   influenced)."
>
> What are the malicious scenarios that you are defending from here ?
> Seems like the "intention to fail" establishing connection is there as
> a "good to have" thing, without elaborating as to why it's a good
> idea.
> Moreover, the "strict and elaborate" handshake does not seem to be
> necessary anymore, as the data frame format differs significantly in
> the latest versions of the draft from plaintext-based SMTP and HTTP,
> and thus WS clients will be incompatible with non-WS services with or
> without the handshake.
>
>
Please see the literally hundreds of emails on this mailing list, especially
those from adam barth, about how intermediaries can be confused by
attacker-controlled data to the effect of poisoning the cache of deployed
intermediaries. This is not something that the WG is going to revisit.


> 4.1: "..masked to avoid confusing network intermediaries, such as
> intercepting proxies."
> 4.2: "MUST NOT make it simple for a server to predict the masking-key
> for a subsequent frame."
> Wait. Can it be decided what the masking-key is there for? Is it to
> avoid confusing proxies? Or making life harder for servers?
> Why would you want to "NOT make it simple for a server to predict the
> masking-key" ?
> The masking key may as well have been chosen statically at compile
> time, or fixed in spec, in same way
> as the "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" nonce was.
> Or just removed completely, as it doesn't serve any clearly defined
> purpose.
>
>
If the next key is predictable, then the server can cause the client to send
data with a predictable value on-the-wire, which is exactly what masking is
designed to prevent. Again, I would encourage you to read the history of
this mailing list for further details on masking.


> 4.2: "..unpredictability of the masking-nonce is essential.."
> What is masking-nonce? Why is unpredictability essential?
>
>
see above


> "..prevent the author of malicious application data from selecting.."
> 4.2: If talking about the masking-key, it's transmitted along with the
> data every time, how does that prevent anyone from decoding the data?
> Sending encoded data + key is same as sending plaintext in the first
> place, why add this complexity?
>

it's not to prevent people from decoding the data. It is to prevent an
attacker from controlling the bytes on the wire and potentially sending data
that could cause an intermediary to misinterpret the data for ill effect.


> While at that, what or who is "author of malicious application data"
> and what is meant by "selecting" ?
>

again, read the mailing list, but in brief, user goes to webpage controlled
by attacker (or an ad supplied by attacker), attacker supplies javascript
that, upon request from the attacker's server, sends data to the attacker's
server. If the attacker can control the format of this data on the wire,
there exists a threat that this data can be used to trick intermediaries for
ill effect.


>
> 4.4:
>  TCP already handles fragmentation. Why add additional layer of
> fragmentation?
>

Because the frame includes the length of the frame, and without
fragmentation one would have to know the length of the message before being
able to send any part of the message. With fragmentation, a server can begin
sending a message whilst the message is being generated.

Again, please see the mailing list archives.


> If the reasoning is "to allow application to use imcomplete received
> data instead of blocking waiting for for completion",
> then the additional fragmentation doesn't add any benefit. Moreover,
> the WS fragments might _not_ align with TCP fragments,
> leading to delays in processing, while WS parser waits for the
> completion of "WS-non-fragmented" data which was fragmented
> by TCP. If the reasoning was, at some point, "to allow connection
> through proxies", then, again, by using CONNECT, the proxy
> doesn't care about the request length.
>
> 5.1.2: "If the user agent already has a WebSocket connection.."
> What is meant by "has a WebSocket connection" ? Is the connection in
> handshake state? In TCP CONNECTING state?
> Seems like it's implied that there is no limit to _established_
> connections, just limit on connections in CONNECTING
> or handshake state. This should be clarified.
>

I will clarify this. It is intended that there only be one connection in
CONNECTING state.


>
> Regarding the handshake and security in general, what is the
> Sec-WebSocket-Key made to prevent?
> Non-WebSocket servers answering WebSocket clients?
>
>
Yes


> It won't work anyway, because of the response requirement to contain
> echoes of custom headers and 101 status code.
>

Getting something to echo a request is not a significant bar to satisfy
various members of the working group. Performing computation on that data
ensures that the endpoint is WS aware, especially given that some of the
data required for the computation is not sent, but instead exists  only in
the protocol spec.


> But, by adding this complexity, you're practically removing embedded
> and low-computing-power devices from being able to
> act as WS servers.
>

This was already discussed ad-nauseum, again I refer you to the archives of
the list. Many of us do care about power, but believe that this is not a
sufficient barrier.


> Section 5.2 actually talks about a server which only purpose is
> processing the complex handshake. Why do you want to
> force people to add such front-end-servers instead of connecting to
> the real ws-server directly?
>
>
In reality, many people in large deployments do have frontends/load
balancers that terminate the connection. The spec does not require this
though.


> 5.2.2.3.3 "The nonce MUST be randomly selected randomly for each
> connection"
> Aside from the double-"randomly", why is the randomness so important here ?
> What is it made to prevent?
>

Double randomly is a typo :) As for why it's important, as I said earlier in
the response, if the server is controlled by an attacker and the server can
predict the next nonce, the server can instruct the client to send data
that, when masked with that predicted nonce, will have an appearance on the
wire that could confuse the intermediary for ill effect.


> Non-WS client getting data from the WS server?
> They wouldn't be able to parse the response anyway. And if they would,
> how is that different from a buggy "WS-conforming" client?
> The keys/nonces don't solve any real problems, they just add
> complexity to the handshake.
>
>
> Thank you for reading.
> Hope the draft can be mended to fix this, and the protocol simplified
> to conform to the goals declared.
>
> --
>  silvio
>

--00221532c7a02c78d2049cadac57
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

as per the first page of the draft, the proper forum is <a href=3D"mailto:h=
ybi@ietf.org">hybi@ietf.org</a>. reply inline.<br><br><div class=3D"gmail_q=
uote">On Sat, Feb 19, 2011 at 11:01 AM, Silvio Ventres <span dir=3D"ltr">&l=
t;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ventres@gmail.com</a>&=
gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">Hello, Ian.<br>
<br>
Please let know if there exists a forum for discussion of these points.<br>
At this point, it seems the WebSocket has been designed with very<br>
vague goals, while the spec draft has been written to encompass<br>
additional goals, which can only be guessed, and are not explicitly<br>
specified anywhere, such as prevention of some usage scenarios or<br>
stream fragmentation.<br>
<br>
The comments follow section numbers:<br>
<br>
1.6: quote: &quot;fields starting with |Sec-| cannot be set by an attacker<=
br>
from a Web browser, even when using |XMLHttpRequest|.&quot;<br>
&quot;Sec-&quot; are _only_ filtered for XHR as specified in XHR spec, not =
any<br>
HTTP specs per se.<br>
<br></blockquote><div><br></div><div>No other browser APIs allow these to b=
e sent, and browser vendors would consider that to be a bug. XHR is the clo=
sest thing to sending an arbitrary request from a browser, and this forbids=
 Sec- headers.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
1.6: quote: &quot;fail to establish a connection when data from other<br>
protocols, especially HTTP, is sent to a WebSocket server, for example<br>
as might happen if an HTML |form| were submitted to a<br>
 =C2=A0 WebSocket server. =C2=A0This is primarily achieved by requiring tha=
t the<br>
server prove that it read the handshake&quot;<br>
What does the &quot;server prove that it read the handshake&quot; mean? How=
 does<br>
the server &quot;prove&quot; anything? If the server sends any response to =
the<br>
HTML &lt;form&gt; request, that&#39;s all the response that was expected an=
yway,<br>
so who cares about &quot;proof&quot; ?<br></blockquote><div><br></div><div>=
By making a computation involving data in the handshake, the server &quot;p=
roves&quot; that it actually parsed, at least in some minimal version, the =
request, as opposed to returning a canned response. The intent was to ensur=
e the client is communicating with a WebSocket server, not an arbitrary ser=
ver/intermediary/... that may be confused and returning a response without =
actually understanding WebSockets.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
1.6: quote: &quot;This protocol is intended to fail to establish a connecti=
on with<br>
 =C2=A0 servers of pre-existing protocols like SMTP or HTTP, while allowing=
<br>
 =C2=A0 HTTP servers to opt-in to supporting this protocol if desired. =C2=
=A0This<br>
 =C2=A0 is achieved by having a strict and elaborate handshake, and by<br>
 =C2=A0 limiting the data that can be inserted into the connection before t=
he<br>
 =C2=A0 handshake is finished (thus limiting how much the server can be<br>
 =C2=A0 influenced).&quot;<br>
<br>
What are the malicious scenarios that you are defending from here ?<br>
Seems like the &quot;intention to fail&quot; establishing connection is the=
re as<br>
a &quot;good to have&quot; thing, without elaborating as to why it&#39;s a =
good<br>
idea.<br>
Moreover, the &quot;strict and elaborate&quot; handshake does not seem to b=
e<br>
necessary anymore, as the data frame format differs significantly in<br>
the latest versions of the draft from plaintext-based SMTP and HTTP,<br>
and thus WS clients will be incompatible with non-WS services with or<br>
without the handshake.<br><br></blockquote><div><br></div><div>Please see t=
he literally hundreds of emails on this mailing list, especially those from=
 adam barth, about how intermediaries can be confused by attacker-controlle=
d data to the effect of poisoning the cache of deployed intermediaries. Thi=
s is not something that the WG is going to revisit.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
4.1: &quot;..masked to avoid confusing network intermediaries, such as<br>
intercepting proxies.&quot;<br>
4.2: &quot;MUST NOT make it simple for a server to predict the masking-key<=
br>
for a subsequent frame.&quot;<br>
Wait. Can it be decided what the masking-key is there for? Is it to<br>
avoid confusing proxies? Or making life harder for servers?<br>
Why would you want to &quot;NOT make it simple for a server to predict the<=
br>
masking-key&quot; ?<br>
The masking key may as well have been chosen statically at compile<br>
time, or fixed in spec, in same way<br>
as the &quot;258EAFA5-E914-47DA-95CA-C5AB0DC85B11&quot; nonce was.<br>
Or just removed completely, as it doesn&#39;t serve any clearly defined pur=
pose.<br>
<br></blockquote><div><br></div><div>If the next key is predictable, then t=
he server can cause the client to send data with a predictable value on-the=
-wire, which is exactly what masking is designed to prevent. Again, I would=
 encourage you to read the history of this mailing list for further details=
 on masking.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
4.2: &quot;..unpredictability of the masking-nonce is essential..&quot;<br>
What is masking-nonce? Why is unpredictability essential?<br>
<br></blockquote><div>=C2=A0</div><div>see above</div><div>=C2=A0</div><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c=
cc solid;padding-left:1ex;">
&quot;..prevent the author of malicious application data from selecting..&q=
uot;<br>
4.2: If talking about the masking-key, it&#39;s transmitted along with the<=
br>
data every time, how does that prevent anyone from decoding the data?<br>
Sending encoded data + key is same as sending plaintext in the first<br>
place, why add this complexity?<br></blockquote><div><br></div><div>it&#39;=
s not to prevent people from decoding the data. It is to prevent an attacke=
r from controlling the bytes on the wire and potentially sending data that =
could cause an intermediary to misinterpret the data for ill effect.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
While at that, what or who is &quot;author of malicious application data&qu=
ot;<br>
and what is meant by &quot;selecting&quot; ?<br></blockquote><div><br></div=
><div>again, read the mailing list, but in brief, user goes to webpage cont=
rolled by attacker (or an ad supplied by attacker), attacker supplies javas=
cript that, upon request from the attacker&#39;s server, sends data to the =
attacker&#39;s server. If the attacker can control the format of this data =
on the wire, there exists a threat that this data can be used to trick inte=
rmediaries for ill effect.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
4.4:<br>
=C2=A0TCP already handles fragmentation. Why add additional layer of fragme=
ntation?<br></blockquote><div><br></div><div>Because the frame includes the=
 length of the frame, and without fragmentation one would have to know the =
length of the message before being able to send any part of the message. Wi=
th fragmentation, a server can begin sending a message whilst the message i=
s being generated.</div>
<div><br></div><div>Again, please see the mailing list archives.</div><div>=
=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo=
rder-left:1px #ccc solid;padding-left:1ex;">
If the reasoning is &quot;to allow application to use imcomplete received<b=
r>
data instead of blocking waiting for for completion&quot;,<br>
then the additional fragmentation doesn&#39;t add any benefit. Moreover,<br=
>
the WS fragments might _not_ align with TCP fragments,<br>
leading to delays in processing, while WS parser waits for the<br>
completion of &quot;WS-non-fragmented&quot; data which was fragmented<br>
by TCP. If the reasoning was, at some point, &quot;to allow connection<br>
through proxies&quot;, then, again, by using CONNECT, the proxy<br>
doesn&#39;t care about the request length.<br>
<br>
5.1.2: &quot;If the user agent already has a WebSocket connection..&quot;<b=
r>
What is meant by &quot;has a WebSocket connection&quot; ? Is the connection=
 in<br>
handshake state? In TCP CONNECTING state?<br>
Seems like it&#39;s implied that there is no limit to _established_<br>
connections, just limit on connections in CONNECTING<br>
or handshake state. This should be clarified.<br></blockquote><div><br></di=
v><div>I will clarify this. It is intended that there only be one connectio=
n in CONNECTING state.</div><div>=C2=A0</div><blockquote class=3D"gmail_quo=
te" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;=
">

<br>
Regarding the handshake and security in general, what is the<br>
Sec-WebSocket-Key made to prevent?<br>
Non-WebSocket servers answering WebSocket clients?<br>
<br></blockquote><div><br></div><div>Yes</div><div>=C2=A0</div><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex;">
It won&#39;t work anyway, because of the response requirement to contain<br=
>
echoes of custom headers and 101 status code.<br></blockquote><div><br></di=
v><div>Getting something to echo a request is not a significant bar to sati=
sfy various members of the working group. Performing computation on that da=
ta ensures that the endpoint is WS aware, especially given that some of the=
 data required for the computation is not sent, but instead exists =C2=A0on=
ly in the protocol spec.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
But, by adding this complexity, you&#39;re practically removing embedded<br=
>
and low-computing-power devices from being able to<br>
act as WS servers.<br></blockquote><div><br></div><div>This was already dis=
cussed ad-nauseum, again I refer you to the archives of the list. Many of u=
s do care about power, but believe that this is not a sufficient barrier.</=
div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
Section 5.2 actually talks about a server which only purpose is<br>
processing the complex handshake. Why do you want to<br>
force people to add such front-end-servers instead of connecting to<br>
the real ws-server directly?<br>
<br></blockquote><div><br></div><div>In reality, many people in large deplo=
yments do have frontends/load balancers that terminate the connection. The =
spec does not require this though.</div><div>=C2=A0</div><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex;">

5.2.2.3.3 &quot;The nonce MUST be randomly selected randomly for each conne=
ction&quot;<br>
Aside from the double-&quot;randomly&quot;, why is the randomness so import=
ant here ?<br>
What is it made to prevent?<br></blockquote><div><br></div><div>Double rand=
omly is a typo :) As for why it&#39;s important, as I said earlier in the r=
esponse, if the server is controlled by an attacker and the server can pred=
ict the next nonce, the server can instruct the client to send data that, w=
hen masked with that predicted nonce, will have an appearance on the wire t=
hat could confuse the intermediary for ill effect.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
Non-WS client getting data from the WS server?<br>
They wouldn&#39;t be able to parse the response anyway. And if they would,<=
br>
how is that different from a buggy &quot;WS-conforming&quot; client?<br>
The keys/nonces don&#39;t solve any real problems, they just add<br>
complexity to the handshake.<br>
<br>
<br>
Thank you for reading.<br>
Hope the draft can be mended to fix this, and the protocol simplified<br>
to conform to the goals declared.<br>
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font></blockquote></div><br>

--00221532c7a02c78d2049cadac57--

From andy.warmcat.com@googlemail.com  Sat Feb 19 21:47:01 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 89FD33A70A9 for <hybi@core3.amsl.com>; Sat, 19 Feb 2011 21:47:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZqN4VvAc7Bfl for <hybi@core3.amsl.com>; Sat, 19 Feb 2011 21:47:00 -0800 (PST)
Received: from mail-ww0-f42.google.com (mail-ww0-f42.google.com [74.125.82.42]) by core3.amsl.com (Postfix) with ESMTP id E981A3A6E47 for <hybi@ietf.org>; Sat, 19 Feb 2011 21:46:59 -0800 (PST)
Received: by wwi17 with SMTP id 17so1951617wwi.1 for <hybi@ietf.org>; Sat, 19 Feb 2011 21:47:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=vgfajVC8NA8EqBwXd/OepHFRYZF5DHRsa6noZPjkFQc=; b=ZRGp4xEh4Zw7uMsO1lFWlucy+RDbVpuRk1ivL8LfhKew1d6Uoy9P+3LtZGS9eg22Ko PAbWcqhS1QM+ZFJBmcE08Nm1fV32W8pOLO7zbWzAeA2+IN+nlN1BMzBT90lkWb5o1MAU 5UtgWnbb7ULZyxcIK0enho8octhwzzuXocFuk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=FTwJffpgiooAD3fwd4u+QqNPnVxG4Z24C7MGr5UafLOI/3Pujoz/ZEPm9cf6EzdyFN KdfZFt1hkQ8OI0IgiOG8nw+FEbVa3iAnlZ32/ldsodq48wdaMr0Z7LqBwGeL4uLiTX/+ iyi24+cK7drDK/BG4riueayWLW0bq7Q90xbxo=
Received: by 10.227.128.82 with SMTP id j18mr24055wbs.138.1298180857130; Sat, 19 Feb 2011 21:47:37 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id u9sm1159349wbg.18.2011.02.19.21.47.35 (version=SSLv3 cipher=OTHER); Sat, 19 Feb 2011 21:47:35 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D60AAF6.6090701@warmcat.com>
Date: Sun, 20 Feb 2011 05:47:34 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: ifette@google.com
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
In-Reply-To: <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org, ifette+ietf@google.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Feb 2011 05:47:01 -0000

On 02/20/2011 02:40 AM, Somebody in the thread at some point said:

Hi -

>     But, by adding this complexity, you're practically removing embedded
>     and low-computing-power devices from being able to
>     act as WS servers.
>
> This was already discussed ad-nauseum, again I refer you to the archives
> of the list. Many of us do care about power, but believe that this is
> not a sufficient barrier.

This is a serious issue and in -04 it really was too much for the 
weakest embedded devices to keep up; there was a SHA-1 per frame in that.

However Silvio if you look at -05, although it still breaks zerocopy and 
that's annoying, actually the load is really reduced at both the client 
and server side.  It just boils down to an extra 4 bytes per frame on 
the wire and visiting the buffer with an xor action.  It slows a device 
down and reduces simultaneous peers it can handle, but it probably 
doesn't actually kill it any more unless it was close to the edge of 
being able to cope anyway or an extreme case.  (Further, an embedded 
client can just - illegally - insist to choose 00000000 frame key all 
the time and then just pays for the extra 4 bytes; in my case the client 
is on a local USB Ethernet link and there are no intermediaries).

There was a lot of politics about the munging decision and the 
background was that two major browser vendors had disabled websockets by 
default due to Adam Barth's claims generating "security noise" and 
people like CNET writing articles about "security" issues in websockets. 
  Munging the frame answered those concerns in a way that asking more 
questions about exactly what the Barth had discovered and asking for 
stuff to repeat his nondeterministic and unrepeatable (by others; he 
refused to repeat them himself) experiments or to identify these alleged 
vulnerable proxies (NONE have been identified AFAIK leading me at least 
to suspect they do not exist) did not.

>     Non-WS client getting data from the WS server?
>     They wouldn't be able to parse the response anyway. And if they would,
>     how is that different from a buggy "WS-conforming" client?
>     The keys/nonces don't solve any real problems, they just add
>     complexity to the handshake.

They are solving problems but in the frame key / munging case, that 
problem is not a technical one but had to be addressed anyway (or 
practically, websockets effort would wither up and die via lack of 
browser support).

-Andy

From w@1wt.eu  Sat Feb 19 23:22:28 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D17453A6CB6 for <hybi@core3.amsl.com>; Sat, 19 Feb 2011 23:22:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.043
X-Spam-Level: 
X-Spam-Status: No, score=-2.043 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jb17fznvDpwy for <hybi@core3.amsl.com>; Sat, 19 Feb 2011 23:22:28 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id BB1453A6ABF for <hybi@ietf.org>; Sat, 19 Feb 2011 23:22:27 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1K7MsDH024041; Sun, 20 Feb 2011 08:22:54 +0100
Date: Sun, 20 Feb 2011 08:22:54 +0100
From: Willy Tarreau <w@1wt.eu>
To: "Ian Fette (????????????????????????)" <ifette@google.com>
Message-ID: <20110220072254.GG17159@1wt.eu>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org, ifette+ietf@google.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Feb 2011 07:22:28 -0000

Hi Ian,

On Sat, Feb 19, 2011 at 06:40:38PM -0800, Ian Fette (????????????????????????) wrote:
> as per the first page of the draft, the proper forum is hybi@ietf.org. reply
> inline.

I think that the fact that some people don't get the reasons for some
choices when reading the draft means we should add a short FAQ at the
end, basically with Silvio's questions and your responses. It will limit
the risk of misinterpretations, and will ensure that implementors won't
get bored by algorithms they don't care about and try to simplify them.

Regards,
Willy


From mcmanus@ducksong.com  Sun Feb 20 05:11:47 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 18E413A6B62 for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 05:11:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y5mSL-pt46se for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 05:11:46 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 12CF13A6F97 for <hybi@ietf.org>; Sun, 20 Feb 2011 05:11:45 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 4EBB41043E; Sun, 20 Feb 2011 08:06:18 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id C289E10157; Sun, 20 Feb 2011 08:06:14 -0500 (EST)
From: Patrick McManus <mcmanus@ducksong.com>
To: Willy Tarreau <w@1wt.eu>
In-Reply-To: <20110220072254.GG17159@1wt.eu>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <20110220072254.GG17159@1wt.eu>
Content-Type: text/plain; charset="UTF-8"
Date: Sun, 20 Feb 2011 08:06:08 -0500
Message-ID: <1298207168.2498.112.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Cc: ifette+ietf@google.com, hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Feb 2011 13:11:47 -0000

On Sun, 2011-02-20 at 08:22 +0100, Willy Tarreau wrote:
> Hi Ian,
> 
> On Sat, Feb 19, 2011 at 06:40:38PM -0800, Ian Fette (????????????????????????) wrote:
> > as per the first page of the draft, the proper forum is hybi@ietf.org. reply
> > inline.
> 
> I think that the fact that some people don't get the reasons for some
> choices when reading the draft means we should add a short FAQ at the
> end, basically with Silvio's questions and your responses. It will limit
> the risk of misinterpretations, and will ensure that implementors won't
> get bored by algorithms they don't care about and try to simplify them.

please make that a different document if needed and let the protocol
document just describe the protocol as simply as possible and be
published as soon as possible.






From silvio.ventres@gmail.com  Sun Feb 20 16:57:17 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D58D73A6CC3 for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 16:57:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.099
X-Spam-Level: 
X-Spam-Status: No, score=-3.099 tagged_above=-999 required=5 tests=[AWL=0.500,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GmXGe2tBk-dD for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 16:57:16 -0800 (PST)
Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by core3.amsl.com (Postfix) with ESMTP id AABBB3A6E5B for <hybi@ietf.org>; Sun, 20 Feb 2011 16:57:15 -0800 (PST)
Received: by vws16 with SMTP id 16so490512vws.27 for <hybi@ietf.org>; Sun, 20 Feb 2011 16:57:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=8i/73r1iUZX+IrkQM0FNEEsmOYsimpQ1HQXTAb6DogQ=; b=sUbiCWsmQlBKcbuVCCkAsUi6sVcUVkHfgBOWAwfXttDPnftlYbR7tgdOxHdK5lRhPi erxIh58WrTFkeXyhi8ud+kuPVg6iPZinrlAa0uscxs1GLMA99oMKON1GQ9P84eRZhp2z 28JnHoJplUhf9m8l5ie1b9yw7nHbN6WCNWMvQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=qc9hh6keuF3cZRW1/5S19bzS7OI+/vFhj25OODX89Uta4qy8TKibpX0xkBTbFKfa2q yS+72zyzP5Nhluf7qxCaBF/2bsqVDkdPA13Fj6+fzhhkRNuJH0HqSE2dxah2QWqnm4ZY r5gybkbK76f11C+s3obF0UtlELtubF8axi9pA=
MIME-Version: 1.0
Received: by 10.52.164.36 with SMTP id yn4mr979024vdb.201.1298249875570; Sun, 20 Feb 2011 16:57:55 -0800 (PST)
Received: by 10.52.158.165 with HTTP; Sun, 20 Feb 2011 16:57:55 -0800 (PST)
In-Reply-To: <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>
Date: Mon, 21 Feb 2011 02:57:55 +0200
Message-ID: <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 00:57:18 -0000

2011/2/20 Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com>:
> as per the first page of the draft, the proper forum is hybi@ietf.org. reply
> inline.

As "hybi" doesn't seem likely to stand for any meaningful
working-group or mailing-list name, it's hard to guess that it's a
mailing list intuitively.
A reasonable alias, such as, websocket-wg@ietf.org would do great
here, redirecting to hybi if needed.

>> 1.6: quote: "fields starting with |Sec-| cannot be set by an attacker
>> from a Web browser, even when using |XMLHttpRequest|."
>> "Sec-" are _only_ filtered for XHR as specified in XHR spec, not any
>> HTTP specs per se.
>>
>
> No other browser APIs allow these to be sent, and browser vendors would
> consider that to be a bug. XHR is the closest thing to sending an arbitrary
> request from a browser, and this forbids Sec- headers.

The point is that the "even when using" should be changed to just
"when using", as the "even" in reality means "only".
Better yet, reference the XHR spec as the source of the protection, as
it's not easily found by google search for, e.g. "Sec- headers".

Regarding general browser behavior, if a browser includes a plugin
that allows user to send requests with custom headers, nothing
precludes it to do so, and allowing Sec- headers to be set is not a
bug in any way. To reiterate, Sec- headers are ONLY disallowed by the
XHR spec, and not any other document.


>> 1.6: quote: "fail to establish a connection when data from other
>> protocols, especially HTTP, is sent to a WebSocket server, for example
>> as might happen if an HTML |form| were submitted to a
>>   WebSocket server.  This is primarily achieved by requiring that the
>> server prove that it read the handshake"
>> What does the "server prove that it read the handshake" mean? How does
>> the server "prove" anything? If the server sends any response to the
>> HTML <form> request, that's all the response that was expected anyway,
>> so who cares about "proof" ?
>
> By making a computation involving data in the handshake, the server "proves"
> that it actually parsed, at least in some minimal version, the request, as
> opposed to returning a canned response. The intent was to ensure the client
> is communicating with a WebSocket server, not an arbitrary
> server/intermediary/... that may be confused and returning a response
> without actually understanding WebSockets.

Again, the client is required to verify that the server returns
Sec-Websocket* headers.
If some "arbitrary server/intermediary/..." actually echoes the
Sec-Websocket* headers correctly, and answers with the 101 response
code,
it's fair to assume that it was made deliberately to do that.
What kind of server do you foresee echoing the WS headers correctly,
returning 101 response code and NOT being a WS or WS-compatible
server?

Moreover, why is the reasoning for the goal of non-compliance with
SMTP/HTTP not explained anywhere?
Can understand that you would want to limit WS clients from sending
spam through SMTP, so write it somewhere.
HTTP XHR can theoretically be used to send mail through SMTP. Is it in reality?
Does HTTP include weird "pseudo-security" measures to prevent
"pseudo-risky" scenarios?
The sky is not falling. If you're adding security measures, please
explain what are the scenarios that you are protecting from.

>> 1.6: quote: "This protocol is intended to fail to establish a connection
>> with
>>   servers of pre-existing protocols like SMTP or HTTP, while allowing
>>   HTTP servers to opt-in to supporting this protocol if desired.  This
>>   is achieved by having a strict and elaborate handshake, and by
>>   limiting the data that can be inserted into the connection before the
>>   handshake is finished (thus limiting how much the server can be
>>   influenced)."
>>
>> What are the malicious scenarios that you are defending from here ?
>> Seems like the "intention to fail" establishing connection is there as
>> a "good to have" thing, without elaborating as to why it's a good
>> idea.
>> Moreover, the "strict and elaborate" handshake does not seem to be
>> necessary anymore, as the data frame format differs significantly in
>> the latest versions of the draft from plaintext-based SMTP and HTTP,
>> and thus WS clients will be incompatible with non-WS services with or
>> without the handshake.
>>
>
> Please see the literally hundreds of emails on this mailing list, especially
> those from adam barth, about how intermediaries can be confused by
> attacker-controlled data to the effect of poisoning the cache of deployed
> intermediaries. This is not something that the WG is going to revisit.

Can you please give a short summary regarding the attack scenarios in
question? This summary should probably go either inside the same spec
doc or into a separate rfc to explain the reasoning behind the
protocol.


>> 4.1: "..masked to avoid confusing network intermediaries, such as
>> intercepting proxies."
>> 4.2: "MUST NOT make it simple for a server to predict the masking-key
>> for a subsequent frame."
>> Wait. Can it be decided what the masking-key is there for? Is it to
>> avoid confusing proxies? Or making life harder for servers?
>> Why would you want to "NOT make it simple for a server to predict the
>> masking-key" ?
>> The masking key may as well have been chosen statically at compile
>> time, or fixed in spec, in same way
>> as the "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" nonce was.
>> Or just removed completely, as it doesn't serve any clearly defined
>> purpose.
>>
>
> If the next key is predictable, then the server can cause the client to send
> data with a predictable value on-the-wire, which is exactly what masking is
> designed to prevent. Again, I would encourage you to read the history of
> this mailing list for further details on masking.

With XHR the server can _already_ force the client to send predictable
value on-the-wire.
Are there any real security problems caused by that? How are/were they
dealt with?
If some intermediaries are broken by such "malicious data" then any
XHR request can be used to break them.
Isn't it a bit too obscure of an attack vector?


>> 4.2: "..unpredictability of the masking-nonce is essential.."
>> What is masking-nonce? Why is unpredictability essential?
>>
>
> see above

The "masking-nonce" keyword is not used in the document up till 4.2.
Is that the same as "masking-key" ?

>> "..prevent the author of malicious application data from selecting.."
>> 4.2: If talking about the masking-key, it's transmitted along with the
>> data every time, how does that prevent anyone from decoding the data?
>> Sending encoded data + key is same as sending plaintext in the first
>> place, why add this complexity?
>
> it's not to prevent people from decoding the data. It is to prevent an
> attacker from controlling the bytes on the wire and potentially sending data
> that could cause an intermediary to misinterpret the data for ill effect.

What kind of effect are you talking about?
To actually _connect_, before receiving any data, a server would have
to support the WS protocol. There isn't even a way to start sending
data unless the server answers the handshake.
Now let's go from the other side, assume the server actually _wants_
to support WS protocol. Now, instead of answering a short _static_
handshake, and then sending and receiving data in the most natural
way, the developer has to code the XOR mechanism and connect a random
number generator. Why? Why the hate for service and client developers?


>> While at that, what or who is "author of malicious application data"
>> and what is meant by "selecting" ?
>
> again, read the mailing list, but in brief, user goes to webpage controlled
> by attacker (or an ad supplied by attacker), attacker supplies javascript
> that, upon request from the attacker's server, sends data to the attacker's
> server. If the attacker can control the format of this data on the wire,
> there exists a threat that this data can be used to trick intermediaries for
> ill effect.

If the attacker wants the user to send some data to the attacker's
server, it can be done with XHR. How did XHR deal with this scenario?
Were there any dire consequences as an outcome of XHR's simplicity?
Moreover, a simple "link" tag, or any "src" attribute can be used to
send arbitrary data.
And these are used in the wild.
It is not the place of WS to fix this problem one-sidedly, if it
actually exists. If the problem can be shown to actually be real, then
the information should be used to discuss the problem with
HTTP/HTML/XHR maintainers so as to create a real solution.


>> 4.4:
>>  TCP already handles fragmentation. Why add additional layer of
>> fragmentation?
>
> Because the frame includes the length of the frame, and without
> fragmentation one would have to know the length of the message before being
> able to send any part of the message. With fragmentation, a server can begin
> sending a message whilst the message is being generated.
> Again, please see the mailing list archives.

Server cannot begin transmission of the message until the user has
called the send() function.
When user has called the send() function, the length of data to be
sent becomes known.
The message is sent regardless of its length, with the stream being
fragmented/reassembled by TCP.
If the user/server _actually_ wanted to send data in chunks, he would
run send() several times with the chunks to send.
Is WS making the decision about the transmission blocks on behalf of
the user? Why?
What happens when a user wants to send a huge amount of data in one block?
What part of the API supports this fragmentation ability and how is it
exported to the user?


>> It won't work anyway, because of the response requirement to contain
>> echoes of custom headers and 101 status code.
>
> Getting something to echo a request is not a significant bar to satisfy
> various members of the working group. Performing computation on that data
> ensures that the endpoint is WS aware, especially given that some of the
> data required for the computation is not sent, but instead exists  only in
> the protocol spec.

It's not only echoing a request, but also returning the 101 response code.
If you want additional proof that it's a WS server, make server always
return smth like:
"101 This Magic Phrase is here to verify this is an actual WS server"
instead of simple 101 code, although the "101" response code is not
something that most servers answer most clients with, especially while
echoing the Sec-Websocket headers...

The computation part does NOT actually increase security in comparison
with the echo+101 static-handshake part.
If a server does echo+101, it's probably a WS server or something that
wants to look as WS server, in which case it's probably gonna do
whatever else WS servers do, whether there is computation step
involved or not.


>> But, by adding this complexity, you're practically removing embedded
>> and low-computing-power devices from being able to
>> act as WS servers.
>
> This was already discussed ad-nauseum, again I refer you to the archives of
> the list. Many of us do care about power, but believe that this is not a
> sufficient barrier.

Well, this "barrier" doesn't actually increase security, but adds a
burden on devices implementing the protocol. Is that what is meant by
"sufficient" ?

While at that, why not add a nice "security" fix: make sure
intermediaries don't touch the message in-flight. Hash the total
contents of the message when sending, save it, and request an echo of
that hash in the reply. Compare them when receiving the reply, thus
you will verify the message was not changed. Great feature. Oh, even
better, have the other part always quote the last message received
with messages sent. This way, not only will you be able to verify
whether your packets get delivered correctly, but also see what was
changed in case there was change! Let's go even farther: maybe your
packets have been maliciously delayed, to play part in some kind of
timing attack! Let's have the transmitted packets include the time of
transmission, and reply packets include the time of last packet
reception. This way you'll also be able to prevent replays! Anyone
wants to continue?


>> Section 5.2 actually talks about a server which only purpose is
>> processing the complex handshake. Why do you want to
>> force people to add such front-end-servers instead of connecting to
>> the real ws-server directly?
>>
>
> In reality, many people in large deployments do have frontends/load
> balancers that terminate the connection. The spec does not require this
> though.


You are talking about creating a _separate_ server just to take care
of the computational burden of the handshake!
That is a lot of complexity added to servers that are already quite
busy with the load-balancing jobs.
The spec does not require this, but it acknowledges that the burden
might be too much for busy servers, and operators might wish to
offload it somewhere.


>> 5.2.2.3.3 "The nonce MUST be randomly selected randomly for each
>> connection"
>> Aside from the double-"randomly", why is the randomness so important here
>> ?
>> What is it made to prevent?
>
> Double randomly is a typo :) As for why it's important, as I said earlier in
> the response, if the server is controlled by an attacker and the server can
> predict the next nonce, the server can instruct the client to send data
> that, when masked with that predicted nonce, will have an appearance on the
> wire that could confuse the intermediary for ill effect.

As mentioned before, the "ill effect" is ill-defined (please excuse the pun).
The same "ill effect" can be caused by using standard HTML with or without XHR.


All in all, with due respect to the ingenuity of solutions, the
security features in the current WS spec don't seem like they were
developed
by people with any real experience in security field. The best thing
to do is remove the features that provide questionable defense. In
case any contributors feel like there are security problems, define
exactly the attack scenarios or problematic cases and analyze them for
impact, and, in case problems are found to be real and fall in scope
of the WS protocol, rather than HTTP or HTML proper, find solutions,
possibly with help of security specialists from the community, or at
least be reviewed by one. Bruce Schneier might be a good candidate.

--
 silvio

From silvio.ventres@gmail.com  Sun Feb 20 17:15:23 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4A9BA3A6D4D for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:15:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.349
X-Spam-Level: 
X-Spam-Status: No, score=-3.349 tagged_above=-999 required=5 tests=[AWL=0.250,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QiAmcC9vCdoY for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:15:22 -0800 (PST)
Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by core3.amsl.com (Postfix) with ESMTP id 468983A6CC3 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:15:22 -0800 (PST)
Received: by vws16 with SMTP id 16so497438vws.27 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:16:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=lP/QM41CCa5yp+Xosrfi3ZJwLRtWuqiHmdiERKViaBE=; b=nfOMV1oQdGYToeTwvyv6NsvtufFcxJYiq8KMxPQkHsufrew9e0dESepUwVPzGp5C8Q vUw739IXt/6WI0OvQVLIcgsZcbJYjbbMuuviIq2l1cG38NjWZUjQQDkcY+C1Ul+cLiiU FIRQJLczfmcAFnC88zqgQ4yYjr9J28ITaxuEY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=Oxs0Yk+QzVyINLJ9LbH19ASmyOD/c2VAFeFUeJBCq+q/0wkVgXlp9OVCTZa7FPjgF2 lz0w8AW2EuON6JWFiw+ZTEJZ2czbxLjSHXrxSHWOlmuhbE0DPZ5qxAB4UkfAov/OYBQ9 5H3MuBVb9r9yQ6Xb8bAcgaLC7mcbWrOKY3STc=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr987207vdb.281.1298250962191; Sun, 20 Feb 2011 17:16:02 -0800 (PST)
Received: by 10.52.158.165 with HTTP; Sun, 20 Feb 2011 17:16:02 -0800 (PST)
In-Reply-To: <4D60AAF6.6090701@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <4D60AAF6.6090701@warmcat.com>
Date: Mon, 21 Feb 2011 03:16:02 +0200
Message-ID: <AANLkTi=WD+SxFSMbgO5rx5e0eP3ajUCZ2vf6PrAtNkcM@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: ifette+ietf@google.com, hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 01:15:23 -0000

>> =A0 =A0But, by adding this complexity, you're practically removing embed=
ded
>> =A0 =A0and low-computing-power devices from being able to
>> =A0 =A0act as WS servers.
>>
>> This was already discussed ad-nauseum, again I refer you to the archives
>> of the list. Many of us do care about power, but believe that this is
>> not a sufficient barrier.
>
> This is a serious issue and in -04 it really was too much for the weakest
> embedded devices to keep up; there was a SHA-1 per frame in that.

The tool is great. SHA-1 is a wonderful hash. MD-5 is not any less
wonderful, although less secure.
The SHA-1 was changed to MD-5. Did anyone analyze the impact of that?
If there's no difference whether it's
MD5 or SHA-1, why not use CRC? What is the reason of using a hash in
the first place?


> However Silvio if you look at -05, although it still breaks zerocopy and
> that's annoying, actually the load is really reduced at both the client a=
nd
> server side. =A0It just boils down to an extra 4 bytes per frame on the w=
ire
> and visiting the buffer with an xor action. =A0It slows a device down and
> reduces simultaneous peers it can handle, but it probably doesn't actuall=
y
> kill it any more unless it was close to the edge of being able to cope
> anyway or an extreme case. =A0(Further, an embedded client can just -
> illegally - insist to choose 00000000 frame key all the time and then jus=
t
> pays for the extra 4 bytes; in my case the client is on a local USB Ether=
net
> link and there are no intermediaries).


Exactly the point! Since there's no way to check the actualy client
implementation,
and no penalty for using a static masking-key, many clients will
probably do just that.
Then, what's the point in requiring it? If there's a real reason for
this masking, then a better solution
can and should be found. If there's no reason, the feature should be remove=
d.


> There was a lot of politics about the munging decision and the background
> was that two major browser vendors had disabled websockets by default due=
 to
> Adam Barth's claims generating "security noise" and people like CNET writ=
ing
> articles about "security" issues in websockets. =A0Munging the frame answ=
ered
> those concerns in a way that asking more questions about exactly what the
> Barth had discovered and asking for stuff to repeat his nondeterministic =
and
> unrepeatable (by others; he refused to repeat them himself) experiments o=
r
> to identify these alleged vulnerable proxies (NONE have been identified
> AFAIK leading me at least to suspect they do not exist) did not.

This doesn't seem like a good protocol design practice...


>> =A0 =A0Non-WS client getting data from the WS server?
>> =A0 =A0They wouldn't be able to parse the response anyway. And if they w=
ould,
>> =A0 =A0how is that different from a buggy "WS-conforming" client?
>> =A0 =A0The keys/nonces don't solve any real problems, they just add
>> =A0 =A0complexity to the handshake.
>
> They are solving problems but in the frame key / munging case, that probl=
em
> is not a technical one but had to be addressed anyway (or practically,
> websockets effort would wither up and die via lack of browser support).

The problem can also be solved by getting a security expert on board.
That should alleviate FUD distributed by security amateurs.
Moreover, masking the contents removes a HUGE benefit of debugability,
being able to see the traffic in plaintext, that part which made HTTP
so successful.

--
 silvio

From ifette@google.com  Sun Feb 20 17:18:58 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3B97F3A6D6F for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:18:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.304
X-Spam-Level: 
X-Spam-Status: No, score=-105.304 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6curGk9DVteo for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:18:55 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 47E243A6CC3 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:18:55 -0800 (PST)
Received: from wpaz5.hot.corp.google.com (wpaz5.hot.corp.google.com [172.24.198.69]) by smtp-out.google.com with ESMTP id p1L1JZsG014814 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:19:35 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298251175; bh=EOYKkWqRr+3CHliaT4Ln3Jk3ywE=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=FfE8WSAU/edWEyMudB0vTOBRhcVWltwtKIZsE/FAtkH99y6rSJAOpmPOiyPmcggHe sDjXqmnpKsicWiWhG4APg==
Received: from iyb12 (iyb12.prod.google.com [10.241.49.76]) by wpaz5.hot.corp.google.com with ESMTP id p1L1JXBF006079 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Sun, 20 Feb 2011 17:19:34 -0800
Received: by iyb12 with SMTP id 12so849515iyb.1 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:19:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=0dfKzp9HMU4HlC5NRoEbMcICKIYcbTMosacLcqMoQg0=; b=iuZLD5oD9vmk5KzpbxqnbTfZPz0XZ/BYrcHSb0FE+NbiCcTIoOBYt0zrZy6VTYOprx VE0vZ7NwW9u7e0mJYROA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=aGJOQpId9MmVeUsl6pLJ1++Ovm9KO7md5qAwHCPclHluLkjTeilvmt3Bo2OFpt7gFQ gQMXhVCSu4prnQ54O+xg==
MIME-Version: 1.0
Received: by 10.231.200.139 with SMTP id ew11mr704950ibb.128.1298251173279; Sun, 20 Feb 2011 17:19:33 -0800 (PST)
Received: by 10.231.37.133 with HTTP; Sun, 20 Feb 2011 17:19:33 -0800 (PST)
Received: by 10.231.37.133 with HTTP; Sun, 20 Feb 2011 17:19:33 -0800 (PST)
In-Reply-To: <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>
Date: Sun, 20 Feb 2011 17:19:33 -0800
Message-ID: <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=90e6ba61537a033974049cc0a89f
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 01:18:58 -0000

--90e6ba61537a033974049cc0a89f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Again, please read the archives. I already responded to your email in
reasonable detail, but the truth is that I have little desire to rehash
arguments we have already moved beyond on the list.
On Feb 20, 2011 4:57 PM, "Silvio Ventres" <silvio.ventres@gmail.com> wrote:
> 2011/2/20 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=
=83=E3=83=86=E3=82=A3) <ifette@google.com>:
>> as per the first page of the draft, the proper forum is hybi@ietf.org.
reply
>> inline.
>
> As "hybi" doesn't seem likely to stand for any meaningful
> working-group or mailing-list name, it's hard to guess that it's a
> mailing list intuitively.
> A reasonable alias, such as, websocket-wg@ietf.org would do great
> here, redirecting to hybi if needed.
>
>>> 1.6: quote: "fields starting with |Sec-| cannot be set by an attacker
>>> from a Web browser, even when using |XMLHttpRequest|."
>>> "Sec-" are _only_ filtered for XHR as specified in XHR spec, not any
>>> HTTP specs per se.
>>>
>>
>> No other browser APIs allow these to be sent, and browser vendors would
>> consider that to be a bug. XHR is the closest thing to sending an
arbitrary
>> request from a browser, and this forbids Sec- headers.
>
> The point is that the "even when using" should be changed to just
> "when using", as the "even" in reality means "only".
> Better yet, reference the XHR spec as the source of the protection, as
> it's not easily found by google search for, e.g. "Sec- headers".
>
> Regarding general browser behavior, if a browser includes a plugin
> that allows user to send requests with custom headers, nothing
> precludes it to do so, and allowing Sec- headers to be set is not a
> bug in any way. To reiterate, Sec- headers are ONLY disallowed by the
> XHR spec, and not any other document.
>
>
>>> 1.6: quote: "fail to establish a connection when data from other
>>> protocols, especially HTTP, is sent to a WebSocket server, for example
>>> as might happen if an HTML |form| were submitted to a
>>> WebSocket server. This is primarily achieved by requiring that the
>>> server prove that it read the handshake"
>>> What does the "server prove that it read the handshake" mean? How does
>>> the server "prove" anything? If the server sends any response to the
>>> HTML <form> request, that's all the response that was expected anyway,
>>> so who cares about "proof" ?
>>
>> By making a computation involving data in the handshake, the server
"proves"
>> that it actually parsed, at least in some minimal version, the request,
as
>> opposed to returning a canned response. The intent was to ensure the
client
>> is communicating with a WebSocket server, not an arbitrary
>> server/intermediary/... that may be confused and returning a response
>> without actually understanding WebSockets.
>
> Again, the client is required to verify that the server returns
> Sec-Websocket* headers.
> If some "arbitrary server/intermediary/..." actually echoes the
> Sec-Websocket* headers correctly, and answers with the 101 response
> code,
> it's fair to assume that it was made deliberately to do that.
> What kind of server do you foresee echoing the WS headers correctly,
> returning 101 response code and NOT being a WS or WS-compatible
> server?
>
> Moreover, why is the reasoning for the goal of non-compliance with
> SMTP/HTTP not explained anywhere?
> Can understand that you would want to limit WS clients from sending
> spam through SMTP, so write it somewhere.
> HTTP XHR can theoretically be used to send mail through SMTP. Is it in
reality?
> Does HTTP include weird "pseudo-security" measures to prevent
> "pseudo-risky" scenarios?
> The sky is not falling. If you're adding security measures, please
> explain what are the scenarios that you are protecting from.
>
>>> 1.6: quote: "This protocol is intended to fail to establish a connectio=
n
>>> with
>>> servers of pre-existing protocols like SMTP or HTTP, while allowing
>>> HTTP servers to opt-in to supporting this protocol if desired. This
>>> is achieved by having a strict and elaborate handshake, and by
>>> limiting the data that can be inserted into the connection before the
>>> handshake is finished (thus limiting how much the server can be
>>> influenced)."
>>>
>>> What are the malicious scenarios that you are defending from here ?
>>> Seems like the "intention to fail" establishing connection is there as
>>> a "good to have" thing, without elaborating as to why it's a good
>>> idea.
>>> Moreover, the "strict and elaborate" handshake does not seem to be
>>> necessary anymore, as the data frame format differs significantly in
>>> the latest versions of the draft from plaintext-based SMTP and HTTP,
>>> and thus WS clients will be incompatible with non-WS services with or
>>> without the handshake.
>>>
>>
>> Please see the literally hundreds of emails on this mailing list,
especially
>> those from adam barth, about how intermediaries can be confused by
>> attacker-controlled data to the effect of poisoning the cache of deploye=
d
>> intermediaries. This is not something that the WG is going to revisit.
>
> Can you please give a short summary regarding the attack scenarios in
> question? This summary should probably go either inside the same spec
> doc or into a separate rfc to explain the reasoning behind the
> protocol.
>
>
>>> 4.1: "..masked to avoid confusing network intermediaries, such as
>>> intercepting proxies."
>>> 4.2: "MUST NOT make it simple for a server to predict the masking-key
>>> for a subsequent frame."
>>> Wait. Can it be decided what the masking-key is there for? Is it to
>>> avoid confusing proxies? Or making life harder for servers?
>>> Why would you want to "NOT make it simple for a server to predict the
>>> masking-key" ?
>>> The masking key may as well have been chosen statically at compile
>>> time, or fixed in spec, in same way
>>> as the "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" nonce was.
>>> Or just removed completely, as it doesn't serve any clearly defined
>>> purpose.
>>>
>>
>> If the next key is predictable, then the server can cause the client to
send
>> data with a predictable value on-the-wire, which is exactly what masking
is
>> designed to prevent. Again, I would encourage you to read the history of
>> this mailing list for further details on masking.
>
> With XHR the server can _already_ force the client to send predictable
> value on-the-wire.
> Are there any real security problems caused by that? How are/were they
> dealt with?
> If some intermediaries are broken by such "malicious data" then any
> XHR request can be used to break them.
> Isn't it a bit too obscure of an attack vector?
>
>
>>> 4.2: "..unpredictability of the masking-nonce is essential.."
>>> What is masking-nonce? Why is unpredictability essential?
>>>
>>
>> see above
>
> The "masking-nonce" keyword is not used in the document up till 4.2.
> Is that the same as "masking-key" ?
>
>>> "..prevent the author of malicious application data from selecting.."
>>> 4.2: If talking about the masking-key, it's transmitted along with the
>>> data every time, how does that prevent anyone from decoding the data?
>>> Sending encoded data + key is same as sending plaintext in the first
>>> place, why add this complexity?
>>
>> it's not to prevent people from decoding the data. It is to prevent an
>> attacker from controlling the bytes on the wire and potentially sending
data
>> that could cause an intermediary to misinterpret the data for ill effect=
.
>
> What kind of effect are you talking about?
> To actually _connect_, before receiving any data, a server would have
> to support the WS protocol. There isn't even a way to start sending
> data unless the server answers the handshake.
> Now let's go from the other side, assume the server actually _wants_
> to support WS protocol. Now, instead of answering a short _static_
> handshake, and then sending and receiving data in the most natural
> way, the developer has to code the XOR mechanism and connect a random
> number generator. Why? Why the hate for service and client developers?
>
>
>>> While at that, what or who is "author of malicious application data"
>>> and what is meant by "selecting" ?
>>
>> again, read the mailing list, but in brief, user goes to webpage
controlled
>> by attacker (or an ad supplied by attacker), attacker supplies javascrip=
t
>> that, upon request from the attacker's server, sends data to the
attacker's
>> server. If the attacker can control the format of this data on the wire,
>> there exists a threat that this data can be used to trick intermediaries
for
>> ill effect.
>
> If the attacker wants the user to send some data to the attacker's
> server, it can be done with XHR. How did XHR deal with this scenario?
> Were there any dire consequences as an outcome of XHR's simplicity?
> Moreover, a simple "link" tag, or any "src" attribute can be used to
> send arbitrary data.
> And these are used in the wild.
> It is not the place of WS to fix this problem one-sidedly, if it
> actually exists. If the problem can be shown to actually be real, then
> the information should be used to discuss the problem with
> HTTP/HTML/XHR maintainers so as to create a real solution.
>
>
>>> 4.4:
>>> TCP already handles fragmentation. Why add additional layer of
>>> fragmentation?
>>
>> Because the frame includes the length of the frame, and without
>> fragmentation one would have to know the length of the message before
being
>> able to send any part of the message. With fragmentation, a server can
begin
>> sending a message whilst the message is being generated.
>> Again, please see the mailing list archives.
>
> Server cannot begin transmission of the message until the user has
> called the send() function.
> When user has called the send() function, the length of data to be
> sent becomes known.
> The message is sent regardless of its length, with the stream being
> fragmented/reassembled by TCP.
> If the user/server _actually_ wanted to send data in chunks, he would
> run send() several times with the chunks to send.
> Is WS making the decision about the transmission blocks on behalf of
> the user? Why?
> What happens when a user wants to send a huge amount of data in one block=
?
> What part of the API supports this fragmentation ability and how is it
> exported to the user?
>
>
>>> It won't work anyway, because of the response requirement to contain
>>> echoes of custom headers and 101 status code.
>>
>> Getting something to echo a request is not a significant bar to satisfy
>> various members of the working group. Performing computation on that dat=
a
>> ensures that the endpoint is WS aware, especially given that some of the
>> data required for the computation is not sent, but instead exists only i=
n
>> the protocol spec.
>
> It's not only echoing a request, but also returning the 101 response code=
.
> If you want additional proof that it's a WS server, make server always
> return smth like:
> "101 This Magic Phrase is here to verify this is an actual WS server"
> instead of simple 101 code, although the "101" response code is not
> something that most servers answer most clients with, especially while
> echoing the Sec-Websocket headers...
>
> The computation part does NOT actually increase security in comparison
> with the echo+101 static-handshake part.
> If a server does echo+101, it's probably a WS server or something that
> wants to look as WS server, in which case it's probably gonna do
> whatever else WS servers do, whether there is computation step
> involved or not.
>
>
>>> But, by adding this complexity, you're practically removing embedded
>>> and low-computing-power devices from being able to
>>> act as WS servers.
>>
>> This was already discussed ad-nauseum, again I refer you to the archives
of
>> the list. Many of us do care about power, but believe that this is not a
>> sufficient barrier.
>
> Well, this "barrier" doesn't actually increase security, but adds a
> burden on devices implementing the protocol. Is that what is meant by
> "sufficient" ?
>
> While at that, why not add a nice "security" fix: make sure
> intermediaries don't touch the message in-flight. Hash the total
> contents of the message when sending, save it, and request an echo of
> that hash in the reply. Compare them when receiving the reply, thus
> you will verify the message was not changed. Great feature. Oh, even
> better, have the other part always quote the last message received
> with messages sent. This way, not only will you be able to verify
> whether your packets get delivered correctly, but also see what was
> changed in case there was change! Let's go even farther: maybe your
> packets have been maliciously delayed, to play part in some kind of
> timing attack! Let's have the transmitted packets include the time of
> transmission, and reply packets include the time of last packet
> reception. This way you'll also be able to prevent replays! Anyone
> wants to continue?
>
>
>>> Section 5.2 actually talks about a server which only purpose is
>>> processing the complex handshake. Why do you want to
>>> force people to add such front-end-servers instead of connecting to
>>> the real ws-server directly?
>>>
>>
>> In reality, many people in large deployments do have frontends/load
>> balancers that terminate the connection. The spec does not require this
>> though.
>
>
> You are talking about creating a _separate_ server just to take care
> of the computational burden of the handshake!
> That is a lot of complexity added to servers that are already quite
> busy with the load-balancing jobs.
> The spec does not require this, but it acknowledges that the burden
> might be too much for busy servers, and operators might wish to
> offload it somewhere.
>
>
>>> 5.2.2.3.3 "The nonce MUST be randomly selected randomly for each
>>> connection"
>>> Aside from the double-"randomly", why is the randomness so important
here
>>> ?
>>> What is it made to prevent?
>>
>> Double randomly is a typo :) As for why it's important, as I said earlie=
r
in
>> the response, if the server is controlled by an attacker and the server
can
>> predict the next nonce, the server can instruct the client to send data
>> that, when masked with that predicted nonce, will have an appearance on
the
>> wire that could confuse the intermediary for ill effect.
>
> As mentioned before, the "ill effect" is ill-defined (please excuse the
pun).
> The same "ill effect" can be caused by using standard HTML with or withou=
t
XHR.
>
>
> All in all, with due respect to the ingenuity of solutions, the
> security features in the current WS spec don't seem like they were
> developed
> by people with any real experience in security field. The best thing
> to do is remove the features that provide questionable defense. In
> case any contributors feel like there are security problems, define
> exactly the attack scenarios or problematic cases and analyze them for
> impact, and, in case problems are found to be real and fall in scope
> of the WS protocol, rather than HTTP or HTML proper, find solutions,
> possibly with help of security specialists from the community, or at
> least be reviewed by one. Bruce Schneier might be a good candidate.
>
> --
> silvio

--90e6ba61537a033974049cc0a89f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p>Again, please read the archives. I already responded to your email in re=
asonable detail, but the truth is that I have little desire to rehash argum=
ents we have already moved beyond on the list.</p>
<div class=3D"gmail_quote">On Feb 20, 2011 4:57 PM, &quot;Silvio Ventres&qu=
ot; &lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ventres@gmail.co=
m</a>&gt; wrote:<br type=3D"attribution">&gt; 2011/2/20 Ian Fette (=E3=82=
=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=E3=83=86=E3=82=A3) &lt;<a =
href=3D"mailto:ifette@google.com">ifette@google.com</a>&gt;:<br>
&gt;&gt; as per the first page of the draft, the proper forum is <a href=3D=
"mailto:hybi@ietf.org">hybi@ietf.org</a>. reply<br>&gt;&gt; inline.<br>&gt;=
 <br>&gt; As &quot;hybi&quot; doesn&#39;t seem likely to stand for any mean=
ingful<br>
&gt; working-group or mailing-list name, it&#39;s hard to guess that it&#39=
;s a<br>&gt; mailing list intuitively.<br>&gt; A reasonable alias, such as,=
 <a href=3D"mailto:websocket-wg@ietf.org">websocket-wg@ietf.org</a> would d=
o great<br>
&gt; here, redirecting to hybi if needed.<br>&gt; <br>&gt;&gt;&gt; 1.6: quo=
te: &quot;fields starting with |Sec-| cannot be set by an attacker<br>&gt;&=
gt;&gt; from a Web browser, even when using |XMLHttpRequest|.&quot;<br>
&gt;&gt;&gt; &quot;Sec-&quot; are _only_ filtered for XHR as specified in X=
HR spec, not any<br>&gt;&gt;&gt; HTTP specs per se.<br>&gt;&gt;&gt;<br>&gt;=
&gt;<br>&gt;&gt; No other browser APIs allow these to be sent, and browser =
vendors would<br>
&gt;&gt; consider that to be a bug. XHR is the closest thing to sending an =
arbitrary<br>&gt;&gt; request from a browser, and this forbids Sec- headers=
.<br>&gt; <br>&gt; The point is that the &quot;even when using&quot; should=
 be changed to just<br>
&gt; &quot;when using&quot;, as the &quot;even&quot; in reality means &quot=
;only&quot;.<br>&gt; Better yet, reference the XHR spec as the source of th=
e protection, as<br>&gt; it&#39;s not easily found by google search for, e.=
g. &quot;Sec- headers&quot;.<br>
&gt; <br>&gt; Regarding general browser behavior, if a browser includes a p=
lugin<br>&gt; that allows user to send requests with custom headers, nothin=
g<br>&gt; precludes it to do so, and allowing Sec- headers to be set is not=
 a<br>
&gt; bug in any way. To reiterate, Sec- headers are ONLY disallowed by the<=
br>&gt; XHR spec, and not any other document.<br>&gt; <br>&gt; <br>&gt;&gt;=
&gt; 1.6: quote: &quot;fail to establish a connection when data from other<=
br>
&gt;&gt;&gt; protocols, especially HTTP, is sent to a WebSocket server, for=
 example<br>&gt;&gt;&gt; as might happen if an HTML |form| were submitted t=
o a<br>&gt;&gt;&gt;   WebSocket server.  This is primarily achieved by requ=
iring that the<br>
&gt;&gt;&gt; server prove that it read the handshake&quot;<br>&gt;&gt;&gt; =
What does the &quot;server prove that it read the handshake&quot; mean? How=
 does<br>&gt;&gt;&gt; the server &quot;prove&quot; anything? If the server =
sends any response to the<br>
&gt;&gt;&gt; HTML &lt;form&gt; request, that&#39;s all the response that wa=
s expected anyway,<br>&gt;&gt;&gt; so who cares about &quot;proof&quot; ?<b=
r>&gt;&gt;<br>&gt;&gt; By making a computation involving data in the handsh=
ake, the server &quot;proves&quot;<br>
&gt;&gt; that it actually parsed, at least in some minimal version, the req=
uest, as<br>&gt;&gt; opposed to returning a canned response. The intent was=
 to ensure the client<br>&gt;&gt; is communicating with a WebSocket server,=
 not an arbitrary<br>
&gt;&gt; server/intermediary/... that may be confused and returning a respo=
nse<br>&gt;&gt; without actually understanding WebSockets.<br>&gt; <br>&gt;=
 Again, the client is required to verify that the server returns<br>&gt; Se=
c-Websocket* headers.<br>
&gt; If some &quot;arbitrary server/intermediary/...&quot; actually echoes =
the<br>&gt; Sec-Websocket* headers correctly, and answers with the 101 resp=
onse<br>&gt; code,<br>&gt; it&#39;s fair to assume that it was made deliber=
ately to do that.<br>
&gt; What kind of server do you foresee echoing the WS headers correctly,<b=
r>&gt; returning 101 response code and NOT being a WS or WS-compatible<br>&=
gt; server?<br>&gt; <br>&gt; Moreover, why is the reasoning for the goal of=
 non-compliance with<br>
&gt; SMTP/HTTP not explained anywhere?<br>&gt; Can understand that you woul=
d want to limit WS clients from sending<br>&gt; spam through SMTP, so write=
 it somewhere.<br>&gt; HTTP XHR can theoretically be used to send mail thro=
ugh SMTP. Is it in reality?<br>
&gt; Does HTTP include weird &quot;pseudo-security&quot; measures to preven=
t<br>&gt; &quot;pseudo-risky&quot; scenarios?<br>&gt; The sky is not fallin=
g. If you&#39;re adding security measures, please<br>&gt; explain what are =
the scenarios that you are protecting from.<br>
&gt; <br>&gt;&gt;&gt; 1.6: quote: &quot;This protocol is intended to fail t=
o establish a connection<br>&gt;&gt;&gt; with<br>&gt;&gt;&gt;   servers of =
pre-existing protocols like SMTP or HTTP, while allowing<br>&gt;&gt;&gt;   =
HTTP servers to opt-in to supporting this protocol if desired.  This<br>
&gt;&gt;&gt;   is achieved by having a strict and elaborate handshake, and =
by<br>&gt;&gt;&gt;   limiting the data that can be inserted into the connec=
tion before the<br>&gt;&gt;&gt;   handshake is finished (thus limiting how =
much the server can be<br>
&gt;&gt;&gt;   influenced).&quot;<br>&gt;&gt;&gt;<br>&gt;&gt;&gt; What are =
the malicious scenarios that you are defending from here ?<br>&gt;&gt;&gt; =
Seems like the &quot;intention to fail&quot; establishing connection is the=
re as<br>
&gt;&gt;&gt; a &quot;good to have&quot; thing, without elaborating as to wh=
y it&#39;s a good<br>&gt;&gt;&gt; idea.<br>&gt;&gt;&gt; Moreover, the &quot=
;strict and elaborate&quot; handshake does not seem to be<br>&gt;&gt;&gt; n=
ecessary anymore, as the data frame format differs significantly in<br>
&gt;&gt;&gt; the latest versions of the draft from plaintext-based SMTP and=
 HTTP,<br>&gt;&gt;&gt; and thus WS clients will be incompatible with non-WS=
 services with or<br>&gt;&gt;&gt; without the handshake.<br>&gt;&gt;&gt;<br=
>
&gt;&gt;<br>&gt;&gt; Please see the literally hundreds of emails on this ma=
iling list, especially<br>&gt;&gt; those from adam barth, about how interme=
diaries can be confused by<br>&gt;&gt; attacker-controlled data to the effe=
ct of poisoning the cache of deployed<br>
&gt;&gt; intermediaries. This is not something that the WG is going to revi=
sit.<br>&gt; <br>&gt; Can you please give a short summary regarding the att=
ack scenarios in<br>&gt; question? This summary should probably go either i=
nside the same spec<br>
&gt; doc or into a separate rfc to explain the reasoning behind the<br>&gt;=
 protocol.<br>&gt; <br>&gt; <br>&gt;&gt;&gt; 4.1: &quot;..masked to avoid c=
onfusing network intermediaries, such as<br>&gt;&gt;&gt; intercepting proxi=
es.&quot;<br>
&gt;&gt;&gt; 4.2: &quot;MUST NOT make it simple for a server to predict the=
 masking-key<br>&gt;&gt;&gt; for a subsequent frame.&quot;<br>&gt;&gt;&gt; =
Wait. Can it be decided what the masking-key is there for? Is it to<br>
&gt;&gt;&gt; avoid confusing proxies? Or making life harder for servers?<br=
>&gt;&gt;&gt; Why would you want to &quot;NOT make it simple for a server t=
o predict the<br>&gt;&gt;&gt; masking-key&quot; ?<br>&gt;&gt;&gt; The maski=
ng key may as well have been chosen statically at compile<br>
&gt;&gt;&gt; time, or fixed in spec, in same way<br>&gt;&gt;&gt; as the &qu=
ot;258EAFA5-E914-47DA-95CA-C5AB0DC85B11&quot; nonce was.<br>&gt;&gt;&gt; Or=
 just removed completely, as it doesn&#39;t serve any clearly defined<br>
&gt;&gt;&gt; purpose.<br>&gt;&gt;&gt;<br>&gt;&gt;<br>&gt;&gt; If the next k=
ey is predictable, then the server can cause the client to send<br>&gt;&gt;=
 data with a predictable value on-the-wire, which is exactly what masking i=
s<br>
&gt;&gt; designed to prevent. Again, I would encourage you to read the hist=
ory of<br>&gt;&gt; this mailing list for further details on masking.<br>&gt=
; <br>&gt; With XHR the server can _already_ force the client to send predi=
ctable<br>
&gt; value on-the-wire.<br>&gt; Are there any real security problems caused=
 by that? How are/were they<br>&gt; dealt with?<br>&gt; If some intermediar=
ies are broken by such &quot;malicious data&quot; then any<br>&gt; XHR requ=
est can be used to break them.<br>
&gt; Isn&#39;t it a bit too obscure of an attack vector?<br>&gt; <br>&gt; <=
br>&gt;&gt;&gt; 4.2: &quot;..unpredictability of the masking-nonce is essen=
tial..&quot;<br>&gt;&gt;&gt; What is masking-nonce? Why is unpredictability=
 essential?<br>
&gt;&gt;&gt;<br>&gt;&gt;<br>&gt;&gt; see above<br>&gt; <br>&gt; The &quot;m=
asking-nonce&quot; keyword is not used in the document up till 4.2.<br>&gt;=
 Is that the same as &quot;masking-key&quot; ?<br>&gt; <br>&gt;&gt;&gt; &qu=
ot;..prevent the author of malicious application data from selecting..&quot=
;<br>
&gt;&gt;&gt; 4.2: If talking about the masking-key, it&#39;s transmitted al=
ong with the<br>&gt;&gt;&gt; data every time, how does that prevent anyone =
from decoding the data?<br>&gt;&gt;&gt; Sending encoded data + key is same =
as sending plaintext in the first<br>
&gt;&gt;&gt; place, why add this complexity?<br>&gt;&gt;<br>&gt;&gt; it&#39=
;s not to prevent people from decoding the data. It is to prevent an<br>&gt=
;&gt; attacker from controlling the bytes on the wire and potentially sendi=
ng data<br>
&gt;&gt; that could cause an intermediary to misinterpret the data for ill =
effect.<br>&gt; <br>&gt; What kind of effect are you talking about?<br>&gt;=
 To actually _connect_, before receiving any data, a server would have<br>
&gt; to support the WS protocol. There isn&#39;t even a way to start sendin=
g<br>&gt; data unless the server answers the handshake.<br>&gt; Now let&#39=
;s go from the other side, assume the server actually _wants_<br>&gt; to su=
pport WS protocol. Now, instead of answering a short _static_<br>
&gt; handshake, and then sending and receiving data in the most natural<br>=
&gt; way, the developer has to code the XOR mechanism and connect a random<=
br>&gt; number generator. Why? Why the hate for service and client develope=
rs?<br>
&gt; <br>&gt; <br>&gt;&gt;&gt; While at that, what or who is &quot;author o=
f malicious application data&quot;<br>&gt;&gt;&gt; and what is meant by &qu=
ot;selecting&quot; ?<br>&gt;&gt;<br>&gt;&gt; again, read the mailing list, =
but in brief, user goes to webpage controlled<br>
&gt;&gt; by attacker (or an ad supplied by attacker), attacker supplies jav=
ascript<br>&gt;&gt; that, upon request from the attacker&#39;s server, send=
s data to the attacker&#39;s<br>&gt;&gt; server. If the attacker can contro=
l the format of this data on the wire,<br>
&gt;&gt; there exists a threat that this data can be used to trick intermed=
iaries for<br>&gt;&gt; ill effect.<br>&gt; <br>&gt; If the attacker wants t=
he user to send some data to the attacker&#39;s<br>&gt; server, it can be d=
one with XHR. How did XHR deal with this scenario?<br>
&gt; Were there any dire consequences as an outcome of XHR&#39;s simplicity=
?<br>&gt; Moreover, a simple &quot;link&quot; tag, or any &quot;src&quot; a=
ttribute can be used to<br>&gt; send arbitrary data.<br>&gt; And these are =
used in the wild.<br>
&gt; It is not the place of WS to fix this problem one-sidedly, if it<br>&g=
t; actually exists. If the problem can be shown to actually be real, then<b=
r>&gt; the information should be used to discuss the problem with<br>&gt; H=
TTP/HTML/XHR maintainers so as to create a real solution.<br>
&gt; <br>&gt; <br>&gt;&gt;&gt; 4.4:<br>&gt;&gt;&gt;  TCP already handles fr=
agmentation. Why add additional layer of<br>&gt;&gt;&gt; fragmentation?<br>=
&gt;&gt;<br>&gt;&gt; Because the frame includes the length of the frame, an=
d without<br>
&gt;&gt; fragmentation one would have to know the length of the message bef=
ore being<br>&gt;&gt; able to send any part of the message. With fragmentat=
ion, a server can begin<br>&gt;&gt; sending a message whilst the message is=
 being generated.<br>
&gt;&gt; Again, please see the mailing list archives.<br>&gt; <br>&gt; Serv=
er cannot begin transmission of the message until the user has<br>&gt; call=
ed the send() function.<br>&gt; When user has called the send() function, t=
he length of data to be<br>
&gt; sent becomes known.<br>&gt; The message is sent regardless of its leng=
th, with the stream being<br>&gt; fragmented/reassembled by TCP.<br>&gt; If=
 the user/server _actually_ wanted to send data in chunks, he would<br>
&gt; run send() several times with the chunks to send.<br>&gt; Is WS making=
 the decision about the transmission blocks on behalf of<br>&gt; the user? =
Why?<br>&gt; What happens when a user wants to send a huge amount of data i=
n one block?<br>
&gt; What part of the API supports this fragmentation ability and how is it=
<br>&gt; exported to the user?<br>&gt; <br>&gt; <br>&gt;&gt;&gt; It won&#39=
;t work anyway, because of the response requirement to contain<br>&gt;&gt;&=
gt; echoes of custom headers and 101 status code.<br>
&gt;&gt;<br>&gt;&gt; Getting something to echo a request is not a significa=
nt bar to satisfy<br>&gt;&gt; various members of the working group. Perform=
ing computation on that data<br>&gt;&gt; ensures that the endpoint is WS aw=
are, especially given that some of the<br>
&gt;&gt; data required for the computation is not sent, but instead exists =
 only in<br>&gt;&gt; the protocol spec.<br>&gt; <br>&gt; It&#39;s not only =
echoing a request, but also returning the 101 response code.<br>&gt; If you=
 want additional proof that it&#39;s a WS server, make server always<br>
&gt; return smth like:<br>&gt; &quot;101 This Magic Phrase is here to verif=
y this is an actual WS server&quot;<br>&gt; instead of simple 101 code, alt=
hough the &quot;101&quot; response code is not<br>&gt; something that most =
servers answer most clients with, especially while<br>
&gt; echoing the Sec-Websocket headers...<br>&gt; <br>&gt; The computation =
part does NOT actually increase security in comparison<br>&gt; with the ech=
o+101 static-handshake part.<br>&gt; If a server does echo+101, it&#39;s pr=
obably a WS server or something that<br>
&gt; wants to look as WS server, in which case it&#39;s probably gonna do<b=
r>&gt; whatever else WS servers do, whether there is computation step<br>&g=
t; involved or not.<br>&gt; <br>&gt; <br>&gt;&gt;&gt; But, by adding this c=
omplexity, you&#39;re practically removing embedded<br>
&gt;&gt;&gt; and low-computing-power devices from being able to<br>&gt;&gt;=
&gt; act as WS servers.<br>&gt;&gt;<br>&gt;&gt; This was already discussed =
ad-nauseum, again I refer you to the archives of<br>&gt;&gt; the list. Many=
 of us do care about power, but believe that this is not a<br>
&gt;&gt; sufficient barrier.<br>&gt; <br>&gt; Well, this &quot;barrier&quot=
; doesn&#39;t actually increase security, but adds a<br>&gt; burden on devi=
ces implementing the protocol. Is that what is meant by<br>&gt; &quot;suffi=
cient&quot; ?<br>
&gt; <br>&gt; While at that, why not add a nice &quot;security&quot; fix: m=
ake sure<br>&gt; intermediaries don&#39;t touch the message in-flight. Hash=
 the total<br>&gt; contents of the message when sending, save it, and reque=
st an echo of<br>
&gt; that hash in the reply. Compare them when receiving the reply, thus<br=
>&gt; you will verify the message was not changed. Great feature. Oh, even<=
br>&gt; better, have the other part always quote the last message received<=
br>
&gt; with messages sent. This way, not only will you be able to verify<br>&=
gt; whether your packets get delivered correctly, but also see what was<br>=
&gt; changed in case there was change! Let&#39;s go even farther: maybe you=
r<br>
&gt; packets have been maliciously delayed, to play part in some kind of<br=
>&gt; timing attack! Let&#39;s have the transmitted packets include the tim=
e of<br>&gt; transmission, and reply packets include the time of last packe=
t<br>
&gt; reception. This way you&#39;ll also be able to prevent replays! Anyone=
<br>&gt; wants to continue?<br>&gt; <br>&gt; <br>&gt;&gt;&gt; Section 5.2 a=
ctually talks about a server which only purpose is<br>&gt;&gt;&gt; processi=
ng the complex handshake. Why do you want to<br>
&gt;&gt;&gt; force people to add such front-end-servers instead of connecti=
ng to<br>&gt;&gt;&gt; the real ws-server directly?<br>&gt;&gt;&gt;<br>&gt;&=
gt;<br>&gt;&gt; In reality, many people in large deployments do have fronte=
nds/load<br>
&gt;&gt; balancers that terminate the connection. The spec does not require=
 this<br>&gt;&gt; though.<br>&gt; <br>&gt; <br>&gt; You are talking about c=
reating a _separate_ server just to take care<br>&gt; of the computational =
burden of the handshake!<br>
&gt; That is a lot of complexity added to servers that are already quite<br=
>&gt; busy with the load-balancing jobs.<br>&gt; The spec does not require =
this, but it acknowledges that the burden<br>&gt; might be too much for bus=
y servers, and operators might wish to<br>
&gt; offload it somewhere.<br>&gt; <br>&gt; <br>&gt;&gt;&gt; 5.2.2.3.3 &quo=
t;The nonce MUST be randomly selected randomly for each<br>&gt;&gt;&gt; con=
nection&quot;<br>&gt;&gt;&gt; Aside from the double-&quot;randomly&quot;, w=
hy is the randomness so important here<br>
&gt;&gt;&gt; ?<br>&gt;&gt;&gt; What is it made to prevent?<br>&gt;&gt;<br>&=
gt;&gt; Double randomly is a typo :) As for why it&#39;s important, as I sa=
id earlier in<br>&gt;&gt; the response, if the server is controlled by an a=
ttacker and the server can<br>
&gt;&gt; predict the next nonce, the server can instruct the client to send=
 data<br>&gt;&gt; that, when masked with that predicted nonce, will have an=
 appearance on the<br>&gt;&gt; wire that could confuse the intermediary for=
 ill effect.<br>
&gt; <br>&gt; As mentioned before, the &quot;ill effect&quot; is ill-define=
d (please excuse the pun).<br>&gt; The same &quot;ill effect&quot; can be c=
aused by using standard HTML with or without XHR.<br>&gt; <br>&gt; <br>
&gt; All in all, with due respect to the ingenuity of solutions, the<br>&gt=
; security features in the current WS spec don&#39;t seem like they were<br=
>&gt; developed<br>&gt; by people with any real experience in security fiel=
d. The best thing<br>
&gt; to do is remove the features that provide questionable defense. In<br>=
&gt; case any contributors feel like there are security problems, define<br=
>&gt; exactly the attack scenarios or problematic cases and analyze them fo=
r<br>
&gt; impact, and, in case problems are found to be real and fall in scope<b=
r>&gt; of the WS protocol, rather than HTTP or HTML proper, find solutions,=
<br>&gt; possibly with help of security specialists from the community, or =
at<br>
&gt; least be reviewed by one. Bruce Schneier might be a good candidate.<br=
>&gt; <br>&gt; --<br>&gt;  silvio<br></div>

--90e6ba61537a033974049cc0a89f--

From silvio.ventres@gmail.com  Sun Feb 20 17:19:19 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5608F3A6F76 for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:19:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.432
X-Spam-Level: 
X-Spam-Status: No, score=-3.432 tagged_above=-999 required=5 tests=[AWL=0.167,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5WoSJ0NqKUrz for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:19:18 -0800 (PST)
Received: from mail-vw0-f54.google.com (mail-vw0-f54.google.com [209.85.212.54]) by core3.amsl.com (Postfix) with ESMTP id 7EA043A6CC3 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:19:18 -0800 (PST)
Received: by vws16 with SMTP id 16so499066vws.27 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:19:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=68fpBXeXrS008/cdjcjXcToh8WKxi4XQ8+M3xb4dinM=; b=UK1vFYgvcmo79pgI+tiP6cdxd2rqf7y2hJe0cI5V79c0dodBEg+hgnpHxRPXmzo/Ue +THGAmCwgptHjSCZIGx2U3keON+NyIY+R/MeKs68vYd20vpGThVPm5EfcjULo8QtklK6 7LeJcIe7VqRdFU6vzmSISoSz1Ok54BM2ucpsE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=gEdCfQTaAYo6XAwRjCxZDt597X08eVueXVdbmNRSAOAuWT356uoVIa/Z8OVtYc4rPG eqKR+rGH+GhTaAH3pAuoqrzVIgR4qH25w/Ppt7L5e4kNp/DvUz7MZd/RPjnMk/pwAeNk mlid34bRCQxnLQjWUUhonSae65r5KXKFYLnII=
MIME-Version: 1.0
Received: by 10.52.158.6 with SMTP id wq6mr1002829vdb.1.1298251198524; Sun, 20 Feb 2011 17:19:58 -0800 (PST)
Received: by 10.52.158.165 with HTTP; Sun, 20 Feb 2011 17:19:58 -0800 (PST)
In-Reply-To: <20110220072254.GG17159@1wt.eu>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <20110220072254.GG17159@1wt.eu>
Date: Mon, 21 Feb 2011 03:19:58 +0200
Message-ID: <AANLkTi=A0=kgYeHJHzn0kbYRRUDNrC8U-jX6vrk7TgM9@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 01:19:19 -0000

On Sun, Feb 20, 2011 at 9:22 AM, Willy Tarreau <w@1wt.eu> wrote:
> Hi Ian,
>
> On Sat, Feb 19, 2011 at 06:40:38PM -0800, Ian Fette (????????????????????????) wrote:
>> as per the first page of the draft, the proper forum is hybi@ietf.org. reply
>> inline.
>
> I think that the fact that some people don't get the reasons for some
> choices when reading the draft means we should add a short FAQ at the
> end, basically with Silvio's questions and your responses. It will limit
> the risk of misinterpretations, and will ensure that implementors won't
> get bored by algorithms they don't care about and try to simplify them.

Exactly!
The security goals in the document are not specified at all.
And, given some of Adam Barth's comments on security may be correct,
the way to deal with those is to distill them into well-defined attack
scenarios,
analyze the impact and scope, possibly find a fix and then add it.

--
 silvio

From silvio.ventres@gmail.com  Sun Feb 20 17:50:18 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D06773A6EAC for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:50:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.474
X-Spam-Level: 
X-Spam-Status: No, score=-3.474 tagged_above=-999 required=5 tests=[AWL=0.125,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DFrapjyOBSrV for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 17:50:16 -0800 (PST)
Received: from mail-vw0-f42.google.com (mail-vw0-f42.google.com [209.85.212.42]) by core3.amsl.com (Postfix) with ESMTP id 2E4DA3A6F7A for <hybi@ietf.org>; Sun, 20 Feb 2011 17:50:15 -0800 (PST)
Received: by vws10 with SMTP id 10so1148534vws.15 for <hybi@ietf.org>; Sun, 20 Feb 2011 17:50:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=9DmOTKQXGxBX5F5VkT9J4E5m+AOT46uLCl3mqtEIORY=; b=SUM+PNbfP1ZxzE7HMr4/FCWru29f2lwwibPXVeZLmWWluV47AEN4KqMfSY2JS1dO3V N9pvYmE9w7XQdudd9Qd3EDdGTgOLF7vlTo7h7rNhKS8b1FLan0mUfmjtowf8PuVqVrzY Hra8B1xaYtxrqQ1E68mIKQryMHWckcwlrCwec=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=abcu5gm76x9D/4PV2CS/40WT+gfS9/qbQ1nSMobKNpBRwimC7ism9F+xNMbkrOlph8 Y8gQQuAFXzFV5Iv9jk7WPNKtIstBm0XvaZ2iFxLoIcNpOwd/uca6uN3OYQNl6comXHUX gYSgmLj2RA7mLSFC0/ba6Mi5lIlhYke1o/5go=
MIME-Version: 1.0
Received: by 10.52.164.36 with SMTP id yn4mr1018433vdb.201.1298253055802; Sun, 20 Feb 2011 17:50:55 -0800 (PST)
Received: by 10.52.158.165 with HTTP; Sun, 20 Feb 2011 17:50:55 -0800 (PST)
In-Reply-To: <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>
Date: Mon, 21 Feb 2011 03:50:55 +0200
Message-ID: <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 01:50:18 -0000

Hello.

Please do not consider this a personal disfavor, as, with all due
respect, your previous reply seemed slightly dismissive, implying that
the questions have been answered in the archives. Please excuse the
reposting of the questions, as this is the only way to start a
discussion.

After thorough reading of the archive, this is a request for comments
regarding the following recommendations and questions to be answered
or commented upon.

1. What attack scenario is the computation part of the handshake? Why
requirement of echo+"101" response is not considered enough to remove
compatibility with non-WS services?
Recommendation: remove the complex computation procedure from the
specification, leaving just the requirement of header-echo and "101"
response, possibly adding a predefined static string to be included in
the "101" response to identify WS server as such, f.e. "101 WS Server
Magic String".

2. Remove misleading "even" word in the section 1.6 of the
specification and add clarification that only XmlHttpRequest
specification actually forbids requests with custom headers starting
with "Sec-".

3. Clarify the reasoning behind removing compatibility with SMTP/HTTP
protocols, as mentioned in section 1.6, and the exact attack scenarios
that the protocol strives to prevent.
Recommendation: if the reasoning cannot be clarified, remove the
incompatibility goal and relevant features from the spec.

4. Clarify the attack scenarios being prevented in section 4.1 and 4.2.
Recommendation: unless the attack scenarios can be shown to have real
impact and being specific to WS as compared to standard HTML link, src
or XmlHttpRequest methods, remove the goal statement in 4.1 and 4.2 as
well as relevant prevention features.
Recommendation: in any case, change or clarify wording of "author of
malicious application data" and "selecting data".

5. Clarify the goal of the masking-key feature and its randomization
procedure and analyze it's impact on protocol debug capability.
Recommendation: unless shown that the masking feature actually
prevents a real attack scenario, remove the feature to simplify
protocol debug and development.

6. Clarify the goal of fragmentation feature and provide a clear use case.
Recommendation: in case no clear benefit to either client or server
performance can be shown, or the benefit is connected to considerable
impact on user control of the transfer timing, the feature should be
removed.


Thank you.

As advised in RFC 2026, section 6.5.1, this email is being CC'd to the
HyBi WG chairs.

--
 silvio


2011/2/21 Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com>:
> Again, please read the archives. I already responded to your email in
> reasonable detail, but the truth is that I have little desire to rehash
> arguments we have already moved beyond on the list.
>
> On Feb 20, 2011 4:57 PM, "Silvio Ventres" <silvio.ventres@gmail.com> wrote:
>> 2011/2/20 Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com>:
>>> as per the first page of the draft, the proper forum is hybi@ietf.org.
>>> reply
>>> inline.
>>
>> As "hybi" doesn't seem likely to stand for any meaningful
>> working-group or mailing-list name, it's hard to guess that it's a
>> mailing list intuitively.
>> A reasonable alias, such as, websocket-wg@ietf.org would do great
>> here, redirecting to hybi if needed.
>>
>>>> 1.6: quote: "fields starting with |Sec-| cannot be set by an attacker
>>>> from a Web browser, even when using |XMLHttpRequest|."
>>>> "Sec-" are _only_ filtered for XHR as specified in XHR spec, not any
>>>> HTTP specs per se.
>>>>
>>>
>>> No other browser APIs allow these to be sent, and browser vendors would
>>> consider that to be a bug. XHR is the closest thing to sending an
>>> arbitrary
>>> request from a browser, and this forbids Sec- headers.
>>
>> The point is that the "even when using" should be changed to just
>> "when using", as the "even" in reality means "only".
>> Better yet, reference the XHR spec as the source of the protection, as
>> it's not easily found by google search for, e.g. "Sec- headers".
>>
>> Regarding general browser behavior, if a browser includes a plugin
>> that allows user to send requests with custom headers, nothing
>> precludes it to do so, and allowing Sec- headers to be set is not a
>> bug in any way. To reiterate, Sec- headers are ONLY disallowed by the
>> XHR spec, and not any other document.
>>
>>
>>>> 1.6: quote: "fail to establish a connection when data from other
>>>> protocols, especially HTTP, is sent to a WebSocket server, for example
>>>> as might happen if an HTML |form| were submitted to a
>>>> WebSocket server. This is primarily achieved by requiring that the
>>>> server prove that it read the handshake"
>>>> What does the "server prove that it read the handshake" mean? How does
>>>> the server "prove" anything? If the server sends any response to the
>>>> HTML <form> request, that's all the response that was expected anyway,
>>>> so who cares about "proof" ?
>>>
>>> By making a computation involving data in the handshake, the server
>>> "proves"
>>> that it actually parsed, at least in some minimal version, the request,
>>> as
>>> opposed to returning a canned response. The intent was to ensure the
>>> client
>>> is communicating with a WebSocket server, not an arbitrary
>>> server/intermediary/... that may be confused and returning a response
>>> without actually understanding WebSockets.
>>
>> Again, the client is required to verify that the server returns
>> Sec-Websocket* headers.
>> If some "arbitrary server/intermediary/..." actually echoes the
>> Sec-Websocket* headers correctly, and answers with the 101 response
>> code,
>> it's fair to assume that it was made deliberately to do that.
>> What kind of server do you foresee echoing the WS headers correctly,
>> returning 101 response code and NOT being a WS or WS-compatible
>> server?
>>
>> Moreover, why is the reasoning for the goal of non-compliance with
>> SMTP/HTTP not explained anywhere?
>> Can understand that you would want to limit WS clients from sending
>> spam through SMTP, so write it somewhere.
>> HTTP XHR can theoretically be used to send mail through SMTP. Is it in
>> reality?
>> Does HTTP include weird "pseudo-security" measures to prevent
>> "pseudo-risky" scenarios?
>> The sky is not falling. If you're adding security measures, please
>> explain what are the scenarios that you are protecting from.
>>
>>>> 1.6: quote: "This protocol is intended to fail to establish a connection
>>>> with
>>>> servers of pre-existing protocols like SMTP or HTTP, while allowing
>>>> HTTP servers to opt-in to supporting this protocol if desired. This
>>>> is achieved by having a strict and elaborate handshake, and by
>>>> limiting the data that can be inserted into the connection before the
>>>> handshake is finished (thus limiting how much the server can be
>>>> influenced)."
>>>>
>>>> What are the malicious scenarios that you are defending from here ?
>>>> Seems like the "intention to fail" establishing connection is there as
>>>> a "good to have" thing, without elaborating as to why it's a good
>>>> idea.
>>>> Moreover, the "strict and elaborate" handshake does not seem to be
>>>> necessary anymore, as the data frame format differs significantly in
>>>> the latest versions of the draft from plaintext-based SMTP and HTTP,
>>>> and thus WS clients will be incompatible with non-WS services with or
>>>> without the handshake.
>>>>
>>>
>>> Please see the literally hundreds of emails on this mailing list,
>>> especially
>>> those from adam barth, about how intermediaries can be confused by
>>> attacker-controlled data to the effect of poisoning the cache of deployed
>>> intermediaries. This is not something that the WG is going to revisit.
>>
>> Can you please give a short summary regarding the attack scenarios in
>> question? This summary should probably go either inside the same spec
>> doc or into a separate rfc to explain the reasoning behind the
>> protocol.
>>
>>
>>>> 4.1: "..masked to avoid confusing network intermediaries, such as
>>>> intercepting proxies."
>>>> 4.2: "MUST NOT make it simple for a server to predict the masking-key
>>>> for a subsequent frame."
>>>> Wait. Can it be decided what the masking-key is there for? Is it to
>>>> avoid confusing proxies? Or making life harder for servers?
>>>> Why would you want to "NOT make it simple for a server to predict the
>>>> masking-key" ?
>>>> The masking key may as well have been chosen statically at compile
>>>> time, or fixed in spec, in same way
>>>> as the "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" nonce was.
>>>> Or just removed completely, as it doesn't serve any clearly defined
>>>> purpose.
>>>>
>>>
>>> If the next key is predictable, then the server can cause the client to
>>> send
>>> data with a predictable value on-the-wire, which is exactly what masking
>>> is
>>> designed to prevent. Again, I would encourage you to read the history of
>>> this mailing list for further details on masking.
>>
>> With XHR the server can _already_ force the client to send predictable
>> value on-the-wire.
>> Are there any real security problems caused by that? How are/were they
>> dealt with?
>> If some intermediaries are broken by such "malicious data" then any
>> XHR request can be used to break them.
>> Isn't it a bit too obscure of an attack vector?
>>
>>
>>>> 4.2: "..unpredictability of the masking-nonce is essential.."
>>>> What is masking-nonce? Why is unpredictability essential?
>>>>
>>>
>>> see above
>>
>> The "masking-nonce" keyword is not used in the document up till 4.2.
>> Is that the same as "masking-key" ?
>>
>>>> "..prevent the author of malicious application data from selecting.."
>>>> 4.2: If talking about the masking-key, it's transmitted along with the
>>>> data every time, how does that prevent anyone from decoding the data?
>>>> Sending encoded data + key is same as sending plaintext in the first
>>>> place, why add this complexity?
>>>
>>> it's not to prevent people from decoding the data. It is to prevent an
>>> attacker from controlling the bytes on the wire and potentially sending
>>> data
>>> that could cause an intermediary to misinterpret the data for ill effect.
>>
>> What kind of effect are you talking about?
>> To actually _connect_, before receiving any data, a server would have
>> to support the WS protocol. There isn't even a way to start sending
>> data unless the server answers the handshake.
>> Now let's go from the other side, assume the server actually _wants_
>> to support WS protocol. Now, instead of answering a short _static_
>> handshake, and then sending and receiving data in the most natural
>> way, the developer has to code the XOR mechanism and connect a random
>> number generator. Why? Why the hate for service and client developers?
>>
>>
>>>> While at that, what or who is "author of malicious application data"
>>>> and what is meant by "selecting" ?
>>>
>>> again, read the mailing list, but in brief, user goes to webpage
>>> controlled
>>> by attacker (or an ad supplied by attacker), attacker supplies javascript
>>> that, upon request from the attacker's server, sends data to the
>>> attacker's
>>> server. If the attacker can control the format of this data on the wire,
>>> there exists a threat that this data can be used to trick intermediaries
>>> for
>>> ill effect.
>>
>> If the attacker wants the user to send some data to the attacker's
>> server, it can be done with XHR. How did XHR deal with this scenario?
>> Were there any dire consequences as an outcome of XHR's simplicity?
>> Moreover, a simple "link" tag, or any "src" attribute can be used to
>> send arbitrary data.
>> And these are used in the wild.
>> It is not the place of WS to fix this problem one-sidedly, if it
>> actually exists. If the problem can be shown to actually be real, then
>> the information should be used to discuss the problem with
>> HTTP/HTML/XHR maintainers so as to create a real solution.
>>
>>
>>>> 4.4:
>>>> TCP already handles fragmentation. Why add additional layer of
>>>> fragmentation?
>>>
>>> Because the frame includes the length of the frame, and without
>>> fragmentation one would have to know the length of the message before
>>> being
>>> able to send any part of the message. With fragmentation, a server can
>>> begin
>>> sending a message whilst the message is being generated.
>>> Again, please see the mailing list archives.
>>
>> Server cannot begin transmission of the message until the user has
>> called the send() function.
>> When user has called the send() function, the length of data to be
>> sent becomes known.
>> The message is sent regardless of its length, with the stream being
>> fragmented/reassembled by TCP.
>> If the user/server _actually_ wanted to send data in chunks, he would
>> run send() several times with the chunks to send.
>> Is WS making the decision about the transmission blocks on behalf of
>> the user? Why?
>> What happens when a user wants to send a huge amount of data in one block?
>> What part of the API supports this fragmentation ability and how is it
>> exported to the user?
>>
>>
>>>> It won't work anyway, because of the response requirement to contain
>>>> echoes of custom headers and 101 status code.
>>>
>>> Getting something to echo a request is not a significant bar to satisfy
>>> various members of the working group. Performing computation on that data
>>> ensures that the endpoint is WS aware, especially given that some of the
>>> data required for the computation is not sent, but instead exists only in
>>> the protocol spec.
>>
>> It's not only echoing a request, but also returning the 101 response code.
>> If you want additional proof that it's a WS server, make server always
>> return smth like:
>> "101 This Magic Phrase is here to verify this is an actual WS server"
>> instead of simple 101 code, although the "101" response code is not
>> something that most servers answer most clients with, especially while
>> echoing the Sec-Websocket headers...
>>
>> The computation part does NOT actually increase security in comparison
>> with the echo+101 static-handshake part.
>> If a server does echo+101, it's probably a WS server or something that
>> wants to look as WS server, in which case it's probably gonna do
>> whatever else WS servers do, whether there is computation step
>> involved or not.
>>
>>
>>>> But, by adding this complexity, you're practically removing embedded
>>>> and low-computing-power devices from being able to
>>>> act as WS servers.
>>>
>>> This was already discussed ad-nauseum, again I refer you to the archives
>>> of
>>> the list. Many of us do care about power, but believe that this is not a
>>> sufficient barrier.
>>
>> Well, this "barrier" doesn't actually increase security, but adds a
>> burden on devices implementing the protocol. Is that what is meant by
>> "sufficient" ?
>>
>> While at that, why not add a nice "security" fix: make sure
>> intermediaries don't touch the message in-flight. Hash the total
>> contents of the message when sending, save it, and request an echo of
>> that hash in the reply. Compare them when receiving the reply, thus
>> you will verify the message was not changed. Great feature. Oh, even
>> better, have the other part always quote the last message received
>> with messages sent. This way, not only will you be able to verify
>> whether your packets get delivered correctly, but also see what was
>> changed in case there was change! Let's go even farther: maybe your
>> packets have been maliciously delayed, to play part in some kind of
>> timing attack! Let's have the transmitted packets include the time of
>> transmission, and reply packets include the time of last packet
>> reception. This way you'll also be able to prevent replays! Anyone
>> wants to continue?
>>
>>
>>>> Section 5.2 actually talks about a server which only purpose is
>>>> processing the complex handshake. Why do you want to
>>>> force people to add such front-end-servers instead of connecting to
>>>> the real ws-server directly?
>>>>
>>>
>>> In reality, many people in large deployments do have frontends/load
>>> balancers that terminate the connection. The spec does not require this
>>> though.
>>
>>
>> You are talking about creating a _separate_ server just to take care
>> of the computational burden of the handshake!
>> That is a lot of complexity added to servers that are already quite
>> busy with the load-balancing jobs.
>> The spec does not require this, but it acknowledges that the burden
>> might be too much for busy servers, and operators might wish to
>> offload it somewhere.
>>
>>
>>>> 5.2.2.3.3 "The nonce MUST be randomly selected randomly for each
>>>> connection"
>>>> Aside from the double-"randomly", why is the randomness so important
>>>> here
>>>> ?
>>>> What is it made to prevent?
>>>
>>> Double randomly is a typo :) As for why it's important, as I said earlier
>>> in
>>> the response, if the server is controlled by an attacker and the server
>>> can
>>> predict the next nonce, the server can instruct the client to send data
>>> that, when masked with that predicted nonce, will have an appearance on
>>> the
>>> wire that could confuse the intermediary for ill effect.
>>
>> As mentioned before, the "ill effect" is ill-defined (please excuse the
>> pun).
>> The same "ill effect" can be caused by using standard HTML with or without
>> XHR.
>>
>>
>> All in all, with due respect to the ingenuity of solutions, the
>> security features in the current WS spec don't seem like they were
>> developed
>> by people with any real experience in security field. The best thing
>> to do is remove the features that provide questionable defense. In
>> case any contributors feel like there are security problems, define
>> exactly the attack scenarios or problematic cases and analyze them for
>> impact, and, in case problems are found to be real and fall in scope
>> of the WS protocol, rather than HTTP or HTML proper, find solutions,
>> possibly with help of security specialists from the community, or at
>> least be reviewed by one. Bruce Schneier might be a good candidate.
>>
>> --
>> silvio
>

From ifette@google.com  Sun Feb 20 20:56:41 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5CE5C3A6F05 for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 20:56:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.428
X-Spam-Level: 
X-Spam-Status: No, score=-105.428 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A1vYxjNVVjkD for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 20:56:37 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 6680D3A6F4E for <hybi@ietf.org>; Sun, 20 Feb 2011 20:56:36 -0800 (PST)
Received: from hpaq6.eem.corp.google.com (hpaq6.eem.corp.google.com [172.25.149.6]) by smtp-out.google.com with ESMTP id p1L4vGl3021697 for <hybi@ietf.org>; Sun, 20 Feb 2011 20:57:17 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298264237; bh=OfSb8xfE2HvFt+Y2SwHnwAqCrfY=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=yiT6oI2rubnO65RPmYxC7vzmZv96V2DHc9gKBXvCxIzIOz3vGuylt7PdvKgYCNPmR Mp7JUSzl/6ic0l23r7QDw==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by hpaq6.eem.corp.google.com with ESMTP id p1L4v274029570 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Sun, 20 Feb 2011 20:57:11 -0800
Received: by iwl42 with SMTP id 42so2622136iwl.4 for <hybi@ietf.org>; Sun, 20 Feb 2011 20:57:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=60Ty+yvNosAcH/KkvtpuRaeY87Pzateh33FfnfYx80Q=; b=ZuBROlvyRVVRNqXPv7aFjq2yCcfAsMiYYhipRMNx1PjsHZbq5toNVpGXtPVnl/DMM1 cbhj7g7mZk3iwK9Tu0+w==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=NQEm7ewUcXl/NqxJ+5o0xACEpjsSXsHo08UFwiLGcuCCAU9TaWjQBu9MVeoGnO4ugp 00Wv6RZwwCgaHAyHVKsA==
MIME-Version: 1.0
Received: by 10.231.30.71 with SMTP id t7mr829145ibc.153.1298264230592; Sun, 20 Feb 2011 20:57:10 -0800 (PST)
Received: by 10.231.37.133 with HTTP; Sun, 20 Feb 2011 20:57:10 -0800 (PST)
In-Reply-To: <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>
Date: Sun, 20 Feb 2011 20:57:10 -0800
Message-ID: <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=00221532c7a04a022e049cc3b215
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 04:56:41 -0000

--00221532c7a04a022e049cc3b215
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

reply inline

2011/2/20 Silvio Ventres <silvio.ventres@gmail.com>

> Hello.
>
> Please do not consider this a personal disfavor, as, with all due
> respect, your previous reply seemed slightly dismissive, implying that
> the questions have been answered in the archives. Please excuse the
> reposting of the questions, as this is the only way to start a
> discussion.
>
> After thorough reading of the archive, this is a request for comments
> regarding the following recommendations and questions to be answered
> or commented upon.
>
> 1. What attack scenario is the computation part of the handshake?


it was a design goal to ensure that the endpoint actually parsed the
handshake. By performing computation this is demonstrated to a satisfactory
level. Simply regurgitating a fixed response (your magic string) doesn't
show that the endpoint actually parsed anything.


> Why
> requirement of echo+"101" response is not considered enough to remove
> compatibility with non-WS services?
> Recommendation: remove the complex computation procedure from the
> specification, leaving just the requirement of header-echo and "101"
> response, possibly adding a predefined static string to be included in
> the "101" response to identify WS server as such, f.e. "101 WS Server
> Magic String".
>
> 2. Remove misleading "even" word in the section 1.6 of the
> specification and add clarification that only XmlHttpRequest
> specification actually forbids requests with custom headers starting
> with "Sec-".
>
>
i will address this


> 3. Clarify the reasoning behind removing compatibility with SMTP/HTTP
> protocols, as mentioned in section 1.6, and the exact attack scenarios
> that the protocol strives to prevent.
> Recommendation: if the reasoning cannot be clarified, remove the
> incompatibility goal and relevant features from the spec.
>
>
If merely by sending javascript to a browser (e.g. taking out an ad) I can
get it to open TCP connections to unsuspecting servers, that violates many
assumptions people make about security and network boundaries, and
essentially turns the browser into a proxy by which an attacker can attack =
a
local network that assumes connections are only being made by local devices=
,
not on behalf of remote devices. I am happy to add in some text to that
effect, but I thought that was clear already.



> 4. Clarify the attack scenarios being prevented in section 4.1 and 4.2.
> Recommendation: unless the attack scenarios can be shown to have real
> impact and being specific to WS as compared to standard HTML link, src
> or XmlHttpRequest methods, remove the goal statement in 4.1 and 4.2 as
> well as relevant prevention features.
> Recommendation: in any case, change or clarify wording of "author of
> malicious application data" and "selecting data".
>
> 5. Clarify the goal of the masking-key feature and its randomization
> procedure and analyze it's impact on protocol debug capability.
> Recommendation: unless shown that the masking feature actually
> prevents a real attack scenario, remove the feature to simplify
> protocol debug and development.
>
>
You clearly did not read the archives thoroughly enough :) This was the
source of much debate, and months of impasse. The chairs declared consensus
and we have moved on. Please do read the archives for more detail.


> 6. Clarify the goal of fragmentation feature and provide a clear use case=
.
> Recommendation: in case no clear benefit to either client or server
> performance can be shown, or the benefit is connected to considerable
> impact on user control of the transfer timing, the feature should be
> removed.
>
>
Use case:

Client makes a request to server, e.g. "Perform a search for foo". Server
wants to start sending back data before the entire results are available,
e.g. "results 1-2". Server wants to send the results as a single message, t=
o
maintain messaging semantics. By making use of fragmentation, server can
begin sending data before all of the data is available. If server couldn't
use fragmentation, it would have to wait for all the data to be available,
so that its length could be calculated. By sending the data as multiple
fragments, the server can begin sending the data as it is generated,
reducing total latency.

Fragmentation is also necessary for multiplexing, to avoid a large message
totally blocking the channel. Again, I encourage you to read the archives a=
s
this is another well discussed issue upon which consensus has been
declared.


>
> Thank you.
>
> As advised in RFC 2026, section 6.5.1, this email is being CC'd to the
> HyBi WG chairs.
>


I am perplexed. "(a) his or her own views have not been
   adequately considered by the Working Group, or (b) the Working Group
   has made an incorrect technical choice which places the quality
   and/or integrity of the Working Group's product(s) in significant
   jeopardy. "


Do you believe your views have not been adequately considered? As I have
said repeatedly, most of what you brought up was discussed to death, was th=
e
cause of months of impasse, and we moved past this and the chairs declared
consensus. Please do read the archives.

Clearly it's not (b) as if you read the archives, you would see that we are
finally making progress, and most of your suggestions have already been
discussed to death and found to be something that would not be implemented,
i.e. your suggestions would place the product in significant jeopardy.

At any rate, have a good weekend, and please do read more of the archives. =
I
can assure you that it takes me hours to just read the emails from one week=
,
so I sympathize with the effort it takes, but most of this has already been
discussed to death and consensus declared by the chairs.

-Ian


> --
>  silvio
>
>
> 2011/2/21 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=
=83=E3=83=86=E3=82=A3) <ifette@google.com>:
> > Again, please read the archives. I already responded to your email in
> > reasonable detail, but the truth is that I have little desire to rehash
> > arguments we have already moved beyond on the list.
> >
> > On Feb 20, 2011 4:57 PM, "Silvio Ventres" <silvio.ventres@gmail.com>
> wrote:
> >> 2011/2/20 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=
=83=83=E3=83=86=E3=82=A3) <ifette@google.com>:
> >>> as per the first page of the draft, the proper forum is hybi@ietf.org=
.
> >>> reply
> >>> inline.
> >>
> >> As "hybi" doesn't seem likely to stand for any meaningful
> >> working-group or mailing-list name, it's hard to guess that it's a
> >> mailing list intuitively.
> >> A reasonable alias, such as, websocket-wg@ietf.org would do great
> >> here, redirecting to hybi if needed.
> >>
> >>>> 1.6: quote: "fields starting with |Sec-| cannot be set by an attacke=
r
> >>>> from a Web browser, even when using |XMLHttpRequest|."
> >>>> "Sec-" are _only_ filtered for XHR as specified in XHR spec, not any
> >>>> HTTP specs per se.
> >>>>
> >>>
> >>> No other browser APIs allow these to be sent, and browser vendors wou=
ld
> >>> consider that to be a bug. XHR is the closest thing to sending an
> >>> arbitrary
> >>> request from a browser, and this forbids Sec- headers.
> >>
> >> The point is that the "even when using" should be changed to just
> >> "when using", as the "even" in reality means "only".
> >> Better yet, reference the XHR spec as the source of the protection, as
> >> it's not easily found by google search for, e.g. "Sec- headers".
> >>
> >> Regarding general browser behavior, if a browser includes a plugin
> >> that allows user to send requests with custom headers, nothing
> >> precludes it to do so, and allowing Sec- headers to be set is not a
> >> bug in any way. To reiterate, Sec- headers are ONLY disallowed by the
> >> XHR spec, and not any other document.
> >>
> >>
> >>>> 1.6: quote: "fail to establish a connection when data from other
> >>>> protocols, especially HTTP, is sent to a WebSocket server, for examp=
le
> >>>> as might happen if an HTML |form| were submitted to a
> >>>> WebSocket server. This is primarily achieved by requiring that the
> >>>> server prove that it read the handshake"
> >>>> What does the "server prove that it read the handshake" mean? How do=
es
> >>>> the server "prove" anything? If the server sends any response to the
> >>>> HTML <form> request, that's all the response that was expected anywa=
y,
> >>>> so who cares about "proof" ?
> >>>
> >>> By making a computation involving data in the handshake, the server
> >>> "proves"
> >>> that it actually parsed, at least in some minimal version, the reques=
t,
> >>> as
> >>> opposed to returning a canned response. The intent was to ensure the
> >>> client
> >>> is communicating with a WebSocket server, not an arbitrary
> >>> server/intermediary/... that may be confused and returning a response
> >>> without actually understanding WebSockets.
> >>
> >> Again, the client is required to verify that the server returns
> >> Sec-Websocket* headers.
> >> If some "arbitrary server/intermediary/..." actually echoes the
> >> Sec-Websocket* headers correctly, and answers with the 101 response
> >> code,
> >> it's fair to assume that it was made deliberately to do that.
> >> What kind of server do you foresee echoing the WS headers correctly,
> >> returning 101 response code and NOT being a WS or WS-compatible
> >> server?
> >>
> >> Moreover, why is the reasoning for the goal of non-compliance with
> >> SMTP/HTTP not explained anywhere?
> >> Can understand that you would want to limit WS clients from sending
> >> spam through SMTP, so write it somewhere.
> >> HTTP XHR can theoretically be used to send mail through SMTP. Is it in
> >> reality?
> >> Does HTTP include weird "pseudo-security" measures to prevent
> >> "pseudo-risky" scenarios?
> >> The sky is not falling. If you're adding security measures, please
> >> explain what are the scenarios that you are protecting from.
> >>
> >>>> 1.6: quote: "This protocol is intended to fail to establish a
> connection
> >>>> with
> >>>> servers of pre-existing protocols like SMTP or HTTP, while allowing
> >>>> HTTP servers to opt-in to supporting this protocol if desired. This
> >>>> is achieved by having a strict and elaborate handshake, and by
> >>>> limiting the data that can be inserted into the connection before th=
e
> >>>> handshake is finished (thus limiting how much the server can be
> >>>> influenced)."
> >>>>
> >>>> What are the malicious scenarios that you are defending from here ?
> >>>> Seems like the "intention to fail" establishing connection is there =
as
> >>>> a "good to have" thing, without elaborating as to why it's a good
> >>>> idea.
> >>>> Moreover, the "strict and elaborate" handshake does not seem to be
> >>>> necessary anymore, as the data frame format differs significantly in
> >>>> the latest versions of the draft from plaintext-based SMTP and HTTP,
> >>>> and thus WS clients will be incompatible with non-WS services with o=
r
> >>>> without the handshake.
> >>>>
> >>>
> >>> Please see the literally hundreds of emails on this mailing list,
> >>> especially
> >>> those from adam barth, about how intermediaries can be confused by
> >>> attacker-controlled data to the effect of poisoning the cache of
> deployed
> >>> intermediaries. This is not something that the WG is going to revisit=
.
> >>
> >> Can you please give a short summary regarding the attack scenarios in
> >> question? This summary should probably go either inside the same spec
> >> doc or into a separate rfc to explain the reasoning behind the
> >> protocol.
> >>
> >>
> >>>> 4.1: "..masked to avoid confusing network intermediaries, such as
> >>>> intercepting proxies."
> >>>> 4.2: "MUST NOT make it simple for a server to predict the masking-ke=
y
> >>>> for a subsequent frame."
> >>>> Wait. Can it be decided what the masking-key is there for? Is it to
> >>>> avoid confusing proxies? Or making life harder for servers?
> >>>> Why would you want to "NOT make it simple for a server to predict th=
e
> >>>> masking-key" ?
> >>>> The masking key may as well have been chosen statically at compile
> >>>> time, or fixed in spec, in same way
> >>>> as the "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" nonce was.
> >>>> Or just removed completely, as it doesn't serve any clearly defined
> >>>> purpose.
> >>>>
> >>>
> >>> If the next key is predictable, then the server can cause the client =
to
> >>> send
> >>> data with a predictable value on-the-wire, which is exactly what
> masking
> >>> is
> >>> designed to prevent. Again, I would encourage you to read the history
> of
> >>> this mailing list for further details on masking.
> >>
> >> With XHR the server can _already_ force the client to send predictable
> >> value on-the-wire.
> >> Are there any real security problems caused by that? How are/were they
> >> dealt with?
> >> If some intermediaries are broken by such "malicious data" then any
> >> XHR request can be used to break them.
> >> Isn't it a bit too obscure of an attack vector?
> >>
> >>
> >>>> 4.2: "..unpredictability of the masking-nonce is essential.."
> >>>> What is masking-nonce? Why is unpredictability essential?
> >>>>
> >>>
> >>> see above
> >>
> >> The "masking-nonce" keyword is not used in the document up till 4.2.
> >> Is that the same as "masking-key" ?
> >>
> >>>> "..prevent the author of malicious application data from selecting..=
"
> >>>> 4.2: If talking about the masking-key, it's transmitted along with t=
he
> >>>> data every time, how does that prevent anyone from decoding the data=
?
> >>>> Sending encoded data + key is same as sending plaintext in the first
> >>>> place, why add this complexity?
> >>>
> >>> it's not to prevent people from decoding the data. It is to prevent a=
n
> >>> attacker from controlling the bytes on the wire and potentially sendi=
ng
> >>> data
> >>> that could cause an intermediary to misinterpret the data for ill
> effect.
> >>
> >> What kind of effect are you talking about?
> >> To actually _connect_, before receiving any data, a server would have
> >> to support the WS protocol. There isn't even a way to start sending
> >> data unless the server answers the handshake.
> >> Now let's go from the other side, assume the server actually _wants_
> >> to support WS protocol. Now, instead of answering a short _static_
> >> handshake, and then sending and receiving data in the most natural
> >> way, the developer has to code the XOR mechanism and connect a random
> >> number generator. Why? Why the hate for service and client developers?
> >>
> >>
> >>>> While at that, what or who is "author of malicious application data"
> >>>> and what is meant by "selecting" ?
> >>>
> >>> again, read the mailing list, but in brief, user goes to webpage
> >>> controlled
> >>> by attacker (or an ad supplied by attacker), attacker supplies
> javascript
> >>> that, upon request from the attacker's server, sends data to the
> >>> attacker's
> >>> server. If the attacker can control the format of this data on the
> wire,
> >>> there exists a threat that this data can be used to trick
> intermediaries
> >>> for
> >>> ill effect.
> >>
> >> If the attacker wants the user to send some data to the attacker's
> >> server, it can be done with XHR. How did XHR deal with this scenario?
> >> Were there any dire consequences as an outcome of XHR's simplicity?
> >> Moreover, a simple "link" tag, or any "src" attribute can be used to
> >> send arbitrary data.
> >> And these are used in the wild.
> >> It is not the place of WS to fix this problem one-sidedly, if it
> >> actually exists. If the problem can be shown to actually be real, then
> >> the information should be used to discuss the problem with
> >> HTTP/HTML/XHR maintainers so as to create a real solution.
> >>
> >>
> >>>> 4.4:
> >>>> TCP already handles fragmentation. Why add additional layer of
> >>>> fragmentation?
> >>>
> >>> Because the frame includes the length of the frame, and without
> >>> fragmentation one would have to know the length of the message before
> >>> being
> >>> able to send any part of the message. With fragmentation, a server ca=
n
> >>> begin
> >>> sending a message whilst the message is being generated.
> >>> Again, please see the mailing list archives.
> >>
> >> Server cannot begin transmission of the message until the user has
> >> called the send() function.
> >> When user has called the send() function, the length of data to be
> >> sent becomes known.
> >> The message is sent regardless of its length, with the stream being
> >> fragmented/reassembled by TCP.
> >> If the user/server _actually_ wanted to send data in chunks, he would
> >> run send() several times with the chunks to send.
> >> Is WS making the decision about the transmission blocks on behalf of
> >> the user? Why?
> >> What happens when a user wants to send a huge amount of data in one
> block?
> >> What part of the API supports this fragmentation ability and how is it
> >> exported to the user?
> >>
> >>
> >>>> It won't work anyway, because of the response requirement to contain
> >>>> echoes of custom headers and 101 status code.
> >>>
> >>> Getting something to echo a request is not a significant bar to satis=
fy
> >>> various members of the working group. Performing computation on that
> data
> >>> ensures that the endpoint is WS aware, especially given that some of
> the
> >>> data required for the computation is not sent, but instead exists onl=
y
> in
> >>> the protocol spec.
> >>
> >> It's not only echoing a request, but also returning the 101 response
> code.
> >> If you want additional proof that it's a WS server, make server always
> >> return smth like:
> >> "101 This Magic Phrase is here to verify this is an actual WS server"
> >> instead of simple 101 code, although the "101" response code is not
> >> something that most servers answer most clients with, especially while
> >> echoing the Sec-Websocket headers...
> >>
> >> The computation part does NOT actually increase security in comparison
> >> with the echo+101 static-handshake part.
> >> If a server does echo+101, it's probably a WS server or something that
> >> wants to look as WS server, in which case it's probably gonna do
> >> whatever else WS servers do, whether there is computation step
> >> involved or not.
> >>
> >>
> >>>> But, by adding this complexity, you're practically removing embedded
> >>>> and low-computing-power devices from being able to
> >>>> act as WS servers.
> >>>
> >>> This was already discussed ad-nauseum, again I refer you to the
> archives
> >>> of
> >>> the list. Many of us do care about power, but believe that this is no=
t
> a
> >>> sufficient barrier.
> >>
> >> Well, this "barrier" doesn't actually increase security, but adds a
> >> burden on devices implementing the protocol. Is that what is meant by
> >> "sufficient" ?
> >>
> >> While at that, why not add a nice "security" fix: make sure
> >> intermediaries don't touch the message in-flight. Hash the total
> >> contents of the message when sending, save it, and request an echo of
> >> that hash in the reply. Compare them when receiving the reply, thus
> >> you will verify the message was not changed. Great feature. Oh, even
> >> better, have the other part always quote the last message received
> >> with messages sent. This way, not only will you be able to verify
> >> whether your packets get delivered correctly, but also see what was
> >> changed in case there was change! Let's go even farther: maybe your
> >> packets have been maliciously delayed, to play part in some kind of
> >> timing attack! Let's have the transmitted packets include the time of
> >> transmission, and reply packets include the time of last packet
> >> reception. This way you'll also be able to prevent replays! Anyone
> >> wants to continue?
> >>
> >>
> >>>> Section 5.2 actually talks about a server which only purpose is
> >>>> processing the complex handshake. Why do you want to
> >>>> force people to add such front-end-servers instead of connecting to
> >>>> the real ws-server directly?
> >>>>
> >>>
> >>> In reality, many people in large deployments do have frontends/load
> >>> balancers that terminate the connection. The spec does not require th=
is
> >>> though.
> >>
> >>
> >> You are talking about creating a _separate_ server just to take care
> >> of the computational burden of the handshake!
> >> That is a lot of complexity added to servers that are already quite
> >> busy with the load-balancing jobs.
> >> The spec does not require this, but it acknowledges that the burden
> >> might be too much for busy servers, and operators might wish to
> >> offload it somewhere.
> >>
> >>
> >>>> 5.2.2.3.3 "The nonce MUST be randomly selected randomly for each
> >>>> connection"
> >>>> Aside from the double-"randomly", why is the randomness so important
> >>>> here
> >>>> ?
> >>>> What is it made to prevent?
> >>>
> >>> Double randomly is a typo :) As for why it's important, as I said
> earlier
> >>> in
> >>> the response, if the server is controlled by an attacker and the serv=
er
> >>> can
> >>> predict the next nonce, the server can instruct the client to send da=
ta
> >>> that, when masked with that predicted nonce, will have an appearance =
on
> >>> the
> >>> wire that could confuse the intermediary for ill effect.
> >>
> >> As mentioned before, the "ill effect" is ill-defined (please excuse th=
e
> >> pun).
> >> The same "ill effect" can be caused by using standard HTML with or
> without
> >> XHR.
> >>
> >>
> >> All in all, with due respect to the ingenuity of solutions, the
> >> security features in the current WS spec don't seem like they were
> >> developed
> >> by people with any real experience in security field. The best thing
> >> to do is remove the features that provide questionable defense. In
> >> case any contributors feel like there are security problems, define
> >> exactly the attack scenarios or problematic cases and analyze them for
> >> impact, and, in case problems are found to be real and fall in scope
> >> of the WS protocol, rather than HTTP or HTML proper, find solutions,
> >> possibly with help of security specialists from the community, or at
> >> least be reviewed by one. Bruce Schneier might be a good candidate.
> >>
> >> --
> >> silvio
> >
>

--00221532c7a04a022e049cc3b215
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

reply inline<br><br><div class=3D"gmail_quote">2011/2/20 Silvio Ventres <sp=
an dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ventr=
es@gmail.com</a>&gt;</span><br><blockquote class=3D"gmail_quote" style=3D"m=
argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hello.<br>
<br>
Please do not consider this a personal disfavor, as, with all due<br>
respect, your previous reply seemed slightly dismissive, implying that<br>
the questions have been answered in the archives. Please excuse the<br>
reposting of the questions, as this is the only way to start a<br>
discussion.<br>
<br>
After thorough reading of the archive, this is a request for comments<br>
regarding the following recommendations and questions to be answered<br>
or commented upon.<br>
<br>
1. What attack scenario is the computation part of the handshake? </blockqu=
ote><div><br></div><div>it was a design goal to ensure that the endpoint ac=
tually parsed the handshake. By performing computation this is demonstrated=
 to a satisfactory level. Simply regurgitating a fixed response (your magic=
 string) doesn&#39;t show that the endpoint actually parsed anything.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">Why<br>
requirement of echo+&quot;101&quot; response is not considered enough to re=
move<br>
compatibility with non-WS services?<br>
Recommendation: remove the complex computation procedure from the<br>
specification, leaving just the requirement of header-echo and &quot;101&qu=
ot;<br>
response, possibly adding a predefined static string to be included in<br>
the &quot;101&quot; response to identify WS server as such, f.e. &quot;101 =
WS Server<br>
Magic String&quot;.<br>
<br>
2. Remove misleading &quot;even&quot; word in the section 1.6 of the<br>
specification and add clarification that only XmlHttpRequest<br>
specification actually forbids requests with custom headers starting<br>
with &quot;Sec-&quot;.<br>
<br></blockquote><div><br></div><div>i will address this</div><div>=C2=A0</=
div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef=
t:1px #ccc solid;padding-left:1ex;">
3. Clarify the reasoning behind removing compatibility with SMTP/HTTP<br>
protocols, as mentioned in section 1.6, and the exact attack scenarios<br>
that the protocol strives to prevent.<br>
Recommendation: if the reasoning cannot be clarified, remove the<br>
incompatibility goal and relevant features from the spec.<br>
<br></blockquote><div><br></div><div>If merely by sending javascript to a b=
rowser (e.g. taking out an ad) I can get it to open TCP connections to unsu=
specting servers, that violates many assumptions people make about security=
 and network boundaries, and essentially turns the browser into a proxy by =
which an attacker can attack a local network that assumes connections are o=
nly being made by local devices, not on behalf of remote devices. I am happ=
y to add in some text to that effect, but I thought that was clear already.=
</div>
<div><br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"=
margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
4. Clarify the attack scenarios being prevented in section 4.1 and 4.2.<br>
Recommendation: unless the attack scenarios can be shown to have real<br>
impact and being specific to WS as compared to standard HTML link, src<br>
or XmlHttpRequest methods, remove the goal statement in 4.1 and 4.2 as<br>
well as relevant prevention features.<br>
Recommendation: in any case, change or clarify wording of &quot;author of<b=
r>
malicious application data&quot; and &quot;selecting data&quot;.<br>
<br>
5. Clarify the goal of the masking-key feature and its randomization<br>
procedure and analyze it&#39;s impact on protocol debug capability.<br>
Recommendation: unless shown that the masking feature actually<br>
prevents a real attack scenario, remove the feature to simplify<br>
protocol debug and development.<br>
<br></blockquote><div><br></div><div>You clearly did not read the archives =
thoroughly enough :) This was the source of much debate, and months of impa=
sse. The chairs declared consensus and we have moved on. Please do read the=
 archives for more detail.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
6. Clarify the goal of fragmentation feature and provide a clear use case.<=
br>
Recommendation: in case no clear benefit to either client or server<br>
performance can be shown, or the benefit is connected to considerable<br>
impact on user control of the transfer timing, the feature should be<br>
removed.<br>
<br></blockquote><div><br></div><div>Use case:</div><div><br></div><div>Cli=
ent makes a request to server, e.g. &quot;Perform a search for foo&quot;. S=
erver wants to start sending back data before the entire results are availa=
ble, e.g. &quot;results 1-2&quot;. Server wants to send the results as a si=
ngle message, to maintain messaging semantics. By making use of fragmentati=
on, server can begin sending data before all of the data is available. If s=
erver couldn&#39;t use fragmentation, it would have to wait for all the dat=
a to be available, so that its length could be calculated. By sending the d=
ata as multiple fragments, the server can begin sending the data as it is g=
enerated, reducing total latency.</div>
<div><br></div><div>Fragmentation is also necessary for multiplexing, to av=
oid a large message totally blocking the channel. Again, I encourage you to=
 read the archives as this is another well discussed issue upon which conse=
nsus has been declared.=C2=A0</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
Thank you.<br>
<br>
As advised in RFC 2026, section 6.5.1, this email is being CC&#39;d to the<=
br>
HyBi WG chairs.<br></blockquote><div><br></div><div><br></div><div>I am per=
plexed. &quot;(a) his or her own views have not been</div><div>=C2=A0 =C2=
=A0adequately considered by the Working Group, or (b) the Working Group</di=
v><div>
=C2=A0 =C2=A0has made an incorrect technical choice which places the qualit=
y</div><div>=C2=A0 =C2=A0and/or integrity of the Working Group&#39;s produc=
t(s) in significant</div><div>=C2=A0 =C2=A0jeopardy. &quot;</div><div><br><=
/div><div><br></div><div>Do you believe your views have not been adequately=
 considered? As I have said repeatedly, most of what you brought up was dis=
cussed to death, was the cause of months of impasse, and we moved past this=
 and the chairs declared consensus. Please do read the archives.</div>
<div><br></div><div>Clearly it&#39;s not (b) as if you read the archives, y=
ou would see that we are finally making progress, and most of your suggesti=
ons have already been discussed to death and found to be something that wou=
ld not be implemented, i.e. your suggestions would place the product in sig=
nificant jeopardy.</div>
<div><br></div><div>At any rate, have a good weekend, and please do read mo=
re of the archives. I can assure you that it takes me hours to just read th=
e emails from one week, so I=C2=A0sympathize=C2=A0with the effort it takes,=
 but most of this has already been discussed to death and consensus declare=
d by the chairs.</div>
<div><br></div><div>-Ian</div><div><br></div><blockquote class=3D"gmail_quo=
te" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;=
">
<font color=3D"#888888"><br>
--<br>
=C2=A0silvio<br>
<br>
<br>
2011/2/21 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) &lt;<a href=3D"mailto:ifette@google.com">ifette@google.=
com</a>&gt;:<br>
</font><div><div></div><div class=3D"h5">&gt; Again, please read the archiv=
es. I already responded to your email in<br>
&gt; reasonable detail, but the truth is that I have little desire to rehas=
h<br>
&gt; arguments we have already moved beyond on the list.<br>
&gt;<br>
&gt; On Feb 20, 2011 4:57 PM, &quot;Silvio Ventres&quot; &lt;<a href=3D"mai=
lto:silvio.ventres@gmail.com">silvio.ventres@gmail.com</a>&gt; wrote:<br>
&gt;&gt; 2011/2/20 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=
=E3=83=83=E3=83=86=E3=82=A3) &lt;<a href=3D"mailto:ifette@google.com">ifett=
e@google.com</a>&gt;:<br>
&gt;&gt;&gt; as per the first page of the draft, the proper forum is <a hre=
f=3D"mailto:hybi@ietf.org">hybi@ietf.org</a>.<br>
&gt;&gt;&gt; reply<br>
&gt;&gt;&gt; inline.<br>
&gt;&gt;<br>
&gt;&gt; As &quot;hybi&quot; doesn&#39;t seem likely to stand for any meani=
ngful<br>
&gt;&gt; working-group or mailing-list name, it&#39;s hard to guess that it=
&#39;s a<br>
&gt;&gt; mailing list intuitively.<br>
&gt;&gt; A reasonable alias, such as, <a href=3D"mailto:websocket-wg@ietf.o=
rg">websocket-wg@ietf.org</a> would do great<br>
&gt;&gt; here, redirecting to hybi if needed.<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 1.6: quote: &quot;fields starting with |Sec-| cannot be se=
t by an attacker<br>
&gt;&gt;&gt;&gt; from a Web browser, even when using |XMLHttpRequest|.&quot=
;<br>
&gt;&gt;&gt;&gt; &quot;Sec-&quot; are _only_ filtered for XHR as specified =
in XHR spec, not any<br>
&gt;&gt;&gt;&gt; HTTP specs per se.<br>
&gt;&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; No other browser APIs allow these to be sent, and browser vend=
ors would<br>
&gt;&gt;&gt; consider that to be a bug. XHR is the closest thing to sending=
 an<br>
&gt;&gt;&gt; arbitrary<br>
&gt;&gt;&gt; request from a browser, and this forbids Sec- headers.<br>
&gt;&gt;<br>
&gt;&gt; The point is that the &quot;even when using&quot; should be change=
d to just<br>
&gt;&gt; &quot;when using&quot;, as the &quot;even&quot; in reality means &=
quot;only&quot;.<br>
&gt;&gt; Better yet, reference the XHR spec as the source of the protection=
, as<br>
&gt;&gt; it&#39;s not easily found by google search for, e.g. &quot;Sec- he=
aders&quot;.<br>
&gt;&gt;<br>
&gt;&gt; Regarding general browser behavior, if a browser includes a plugin=
<br>
&gt;&gt; that allows user to send requests with custom headers, nothing<br>
&gt;&gt; precludes it to do so, and allowing Sec- headers to be set is not =
a<br>
&gt;&gt; bug in any way. To reiterate, Sec- headers are ONLY disallowed by =
the<br>
&gt;&gt; XHR spec, and not any other document.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 1.6: quote: &quot;fail to establish a connection when data=
 from other<br>
&gt;&gt;&gt;&gt; protocols, especially HTTP, is sent to a WebSocket server,=
 for example<br>
&gt;&gt;&gt;&gt; as might happen if an HTML |form| were submitted to a<br>
&gt;&gt;&gt;&gt; WebSocket server. This is primarily achieved by requiring =
that the<br>
&gt;&gt;&gt;&gt; server prove that it read the handshake&quot;<br>
&gt;&gt;&gt;&gt; What does the &quot;server prove that it read the handshak=
e&quot; mean? How does<br>
&gt;&gt;&gt;&gt; the server &quot;prove&quot; anything? If the server sends=
 any response to the<br>
&gt;&gt;&gt;&gt; HTML &lt;form&gt; request, that&#39;s all the response tha=
t was expected anyway,<br>
&gt;&gt;&gt;&gt; so who cares about &quot;proof&quot; ?<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; By making a computation involving data in the handshake, the s=
erver<br>
&gt;&gt;&gt; &quot;proves&quot;<br>
&gt;&gt;&gt; that it actually parsed, at least in some minimal version, the=
 request,<br>
&gt;&gt;&gt; as<br>
&gt;&gt;&gt; opposed to returning a canned response. The intent was to ensu=
re the<br>
&gt;&gt;&gt; client<br>
&gt;&gt;&gt; is communicating with a WebSocket server, not an arbitrary<br>
&gt;&gt;&gt; server/intermediary/... that may be confused and returning a r=
esponse<br>
&gt;&gt;&gt; without actually understanding WebSockets.<br>
&gt;&gt;<br>
&gt;&gt; Again, the client is required to verify that the server returns<br=
>
&gt;&gt; Sec-Websocket* headers.<br>
&gt;&gt; If some &quot;arbitrary server/intermediary/...&quot; actually ech=
oes the<br>
&gt;&gt; Sec-Websocket* headers correctly, and answers with the 101 respons=
e<br>
&gt;&gt; code,<br>
&gt;&gt; it&#39;s fair to assume that it was made deliberately to do that.<=
br>
&gt;&gt; What kind of server do you foresee echoing the WS headers correctl=
y,<br>
&gt;&gt; returning 101 response code and NOT being a WS or WS-compatible<br=
>
&gt;&gt; server?<br>
&gt;&gt;<br>
&gt;&gt; Moreover, why is the reasoning for the goal of non-compliance with=
<br>
&gt;&gt; SMTP/HTTP not explained anywhere?<br>
&gt;&gt; Can understand that you would want to limit WS clients from sendin=
g<br>
&gt;&gt; spam through SMTP, so write it somewhere.<br>
&gt;&gt; HTTP XHR can theoretically be used to send mail through SMTP. Is i=
t in<br>
&gt;&gt; reality?<br>
&gt;&gt; Does HTTP include weird &quot;pseudo-security&quot; measures to pr=
event<br>
&gt;&gt; &quot;pseudo-risky&quot; scenarios?<br>
&gt;&gt; The sky is not falling. If you&#39;re adding security measures, pl=
ease<br>
&gt;&gt; explain what are the scenarios that you are protecting from.<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 1.6: quote: &quot;This protocol is intended to fail to est=
ablish a connection<br>
&gt;&gt;&gt;&gt; with<br>
&gt;&gt;&gt;&gt; servers of pre-existing protocols like SMTP or HTTP, while=
 allowing<br>
&gt;&gt;&gt;&gt; HTTP servers to opt-in to supporting this protocol if desi=
red. This<br>
&gt;&gt;&gt;&gt; is achieved by having a strict and elaborate handshake, an=
d by<br>
&gt;&gt;&gt;&gt; limiting the data that can be inserted into the connection=
 before the<br>
&gt;&gt;&gt;&gt; handshake is finished (thus limiting how much the server c=
an be<br>
&gt;&gt;&gt;&gt; influenced).&quot;<br>
&gt;&gt;&gt;&gt;<br>
&gt;&gt;&gt;&gt; What are the malicious scenarios that you are defending fr=
om here ?<br>
&gt;&gt;&gt;&gt; Seems like the &quot;intention to fail&quot; establishing =
connection is there as<br>
&gt;&gt;&gt;&gt; a &quot;good to have&quot; thing, without elaborating as t=
o why it&#39;s a good<br>
&gt;&gt;&gt;&gt; idea.<br>
&gt;&gt;&gt;&gt; Moreover, the &quot;strict and elaborate&quot; handshake d=
oes not seem to be<br>
&gt;&gt;&gt;&gt; necessary anymore, as the data frame format differs signif=
icantly in<br>
&gt;&gt;&gt;&gt; the latest versions of the draft from plaintext-based SMTP=
 and HTTP,<br>
&gt;&gt;&gt;&gt; and thus WS clients will be incompatible with non-WS servi=
ces with or<br>
&gt;&gt;&gt;&gt; without the handshake.<br>
&gt;&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Please see the literally hundreds of emails on this mailing li=
st,<br>
&gt;&gt;&gt; especially<br>
&gt;&gt;&gt; those from adam barth, about how intermediaries can be confuse=
d by<br>
&gt;&gt;&gt; attacker-controlled data to the effect of poisoning the cache =
of deployed<br>
&gt;&gt;&gt; intermediaries. This is not something that the WG is going to =
revisit.<br>
&gt;&gt;<br>
&gt;&gt; Can you please give a short summary regarding the attack scenarios=
 in<br>
&gt;&gt; question? This summary should probably go either inside the same s=
pec<br>
&gt;&gt; doc or into a separate rfc to explain the reasoning behind the<br>
&gt;&gt; protocol.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 4.1: &quot;..masked to avoid confusing network intermediar=
ies, such as<br>
&gt;&gt;&gt;&gt; intercepting proxies.&quot;<br>
&gt;&gt;&gt;&gt; 4.2: &quot;MUST NOT make it simple for a server to predict=
 the masking-key<br>
&gt;&gt;&gt;&gt; for a subsequent frame.&quot;<br>
&gt;&gt;&gt;&gt; Wait. Can it be decided what the masking-key is there for?=
 Is it to<br>
&gt;&gt;&gt;&gt; avoid confusing proxies? Or making life harder for servers=
?<br>
&gt;&gt;&gt;&gt; Why would you want to &quot;NOT make it simple for a serve=
r to predict the<br>
&gt;&gt;&gt;&gt; masking-key&quot; ?<br>
&gt;&gt;&gt;&gt; The masking key may as well have been chosen statically at=
 compile<br>
&gt;&gt;&gt;&gt; time, or fixed in spec, in same way<br>
&gt;&gt;&gt;&gt; as the &quot;258EAFA5-E914-47DA-95CA-C5AB0DC85B11&quot; no=
nce was.<br>
&gt;&gt;&gt;&gt; Or just removed completely, as it doesn&#39;t serve any cl=
early defined<br>
&gt;&gt;&gt;&gt; purpose.<br>
&gt;&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; If the next key is predictable, then the server can cause the =
client to<br>
&gt;&gt;&gt; send<br>
&gt;&gt;&gt; data with a predictable value on-the-wire, which is exactly wh=
at masking<br>
&gt;&gt;&gt; is<br>
&gt;&gt;&gt; designed to prevent. Again, I would encourage you to read the =
history of<br>
&gt;&gt;&gt; this mailing list for further details on masking.<br>
&gt;&gt;<br>
&gt;&gt; With XHR the server can _already_ force the client to send predict=
able<br>
&gt;&gt; value on-the-wire.<br>
&gt;&gt; Are there any real security problems caused by that? How are/were =
they<br>
&gt;&gt; dealt with?<br>
&gt;&gt; If some intermediaries are broken by such &quot;malicious data&quo=
t; then any<br>
&gt;&gt; XHR request can be used to break them.<br>
&gt;&gt; Isn&#39;t it a bit too obscure of an attack vector?<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 4.2: &quot;..unpredictability of the masking-nonce is esse=
ntial..&quot;<br>
&gt;&gt;&gt;&gt; What is masking-nonce? Why is unpredictability essential?<=
br>
&gt;&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; see above<br>
&gt;&gt;<br>
&gt;&gt; The &quot;masking-nonce&quot; keyword is not used in the document =
up till 4.2.<br>
&gt;&gt; Is that the same as &quot;masking-key&quot; ?<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; &quot;..prevent the author of malicious application data f=
rom selecting..&quot;<br>
&gt;&gt;&gt;&gt; 4.2: If talking about the masking-key, it&#39;s transmitte=
d along with the<br>
&gt;&gt;&gt;&gt; data every time, how does that prevent anyone from decodin=
g the data?<br>
&gt;&gt;&gt;&gt; Sending encoded data + key is same as sending plaintext in=
 the first<br>
&gt;&gt;&gt;&gt; place, why add this complexity?<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; it&#39;s not to prevent people from decoding the data. It is t=
o prevent an<br>
&gt;&gt;&gt; attacker from controlling the bytes on the wire and potentiall=
y sending<br>
&gt;&gt;&gt; data<br>
&gt;&gt;&gt; that could cause an intermediary to misinterpret the data for =
ill effect.<br>
&gt;&gt;<br>
&gt;&gt; What kind of effect are you talking about?<br>
&gt;&gt; To actually _connect_, before receiving any data, a server would h=
ave<br>
&gt;&gt; to support the WS protocol. There isn&#39;t even a way to start se=
nding<br>
&gt;&gt; data unless the server answers the handshake.<br>
&gt;&gt; Now let&#39;s go from the other side, assume the server actually _=
wants_<br>
&gt;&gt; to support WS protocol. Now, instead of answering a short _static_=
<br>
&gt;&gt; handshake, and then sending and receiving data in the most natural=
<br>
&gt;&gt; way, the developer has to code the XOR mechanism and connect a ran=
dom<br>
&gt;&gt; number generator. Why? Why the hate for service and client develop=
ers?<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; While at that, what or who is &quot;author of malicious ap=
plication data&quot;<br>
&gt;&gt;&gt;&gt; and what is meant by &quot;selecting&quot; ?<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; again, read the mailing list, but in brief, user goes to webpa=
ge<br>
&gt;&gt;&gt; controlled<br>
&gt;&gt;&gt; by attacker (or an ad supplied by attacker), attacker supplies=
 javascript<br>
&gt;&gt;&gt; that, upon request from the attacker&#39;s server, sends data =
to the<br>
&gt;&gt;&gt; attacker&#39;s<br>
&gt;&gt;&gt; server. If the attacker can control the format of this data on=
 the wire,<br>
&gt;&gt;&gt; there exists a threat that this data can be used to trick inte=
rmediaries<br>
&gt;&gt;&gt; for<br>
&gt;&gt;&gt; ill effect.<br>
&gt;&gt;<br>
&gt;&gt; If the attacker wants the user to send some data to the attacker&#=
39;s<br>
&gt;&gt; server, it can be done with XHR. How did XHR deal with this scenar=
io?<br>
&gt;&gt; Were there any dire consequences as an outcome of XHR&#39;s simpli=
city?<br>
&gt;&gt; Moreover, a simple &quot;link&quot; tag, or any &quot;src&quot; at=
tribute can be used to<br>
&gt;&gt; send arbitrary data.<br>
&gt;&gt; And these are used in the wild.<br>
&gt;&gt; It is not the place of WS to fix this problem one-sidedly, if it<b=
r>
&gt;&gt; actually exists. If the problem can be shown to actually be real, =
then<br>
&gt;&gt; the information should be used to discuss the problem with<br>
&gt;&gt; HTTP/HTML/XHR maintainers so as to create a real solution.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 4.4:<br>
&gt;&gt;&gt;&gt; TCP already handles fragmentation. Why add additional laye=
r of<br>
&gt;&gt;&gt;&gt; fragmentation?<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Because the frame includes the length of the frame, and withou=
t<br>
&gt;&gt;&gt; fragmentation one would have to know the length of the message=
 before<br>
&gt;&gt;&gt; being<br>
&gt;&gt;&gt; able to send any part of the message. With fragmentation, a se=
rver can<br>
&gt;&gt;&gt; begin<br>
&gt;&gt;&gt; sending a message whilst the message is being generated.<br>
&gt;&gt;&gt; Again, please see the mailing list archives.<br>
&gt;&gt;<br>
&gt;&gt; Server cannot begin transmission of the message until the user has=
<br>
&gt;&gt; called the send() function.<br>
&gt;&gt; When user has called the send() function, the length of data to be=
<br>
&gt;&gt; sent becomes known.<br>
&gt;&gt; The message is sent regardless of its length, with the stream bein=
g<br>
&gt;&gt; fragmented/reassembled by TCP.<br>
&gt;&gt; If the user/server _actually_ wanted to send data in chunks, he wo=
uld<br>
&gt;&gt; run send() several times with the chunks to send.<br>
&gt;&gt; Is WS making the decision about the transmission blocks on behalf =
of<br>
&gt;&gt; the user? Why?<br>
&gt;&gt; What happens when a user wants to send a huge amount of data in on=
e block?<br>
&gt;&gt; What part of the API supports this fragmentation ability and how i=
s it<br>
&gt;&gt; exported to the user?<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; It won&#39;t work anyway, because of the response requirem=
ent to contain<br>
&gt;&gt;&gt;&gt; echoes of custom headers and 101 status code.<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Getting something to echo a request is not a significant bar t=
o satisfy<br>
&gt;&gt;&gt; various members of the working group. Performing computation o=
n that data<br>
&gt;&gt;&gt; ensures that the endpoint is WS aware, especially given that s=
ome of the<br>
&gt;&gt;&gt; data required for the computation is not sent, but instead exi=
sts only in<br>
&gt;&gt;&gt; the protocol spec.<br>
&gt;&gt;<br>
&gt;&gt; It&#39;s not only echoing a request, but also returning the 101 re=
sponse code.<br>
&gt;&gt; If you want additional proof that it&#39;s a WS server, make serve=
r always<br>
&gt;&gt; return smth like:<br>
&gt;&gt; &quot;101 This Magic Phrase is here to verify this is an actual WS=
 server&quot;<br>
&gt;&gt; instead of simple 101 code, although the &quot;101&quot; response =
code is not<br>
&gt;&gt; something that most servers answer most clients with, especially w=
hile<br>
&gt;&gt; echoing the Sec-Websocket headers...<br>
&gt;&gt;<br>
&gt;&gt; The computation part does NOT actually increase security in compar=
ison<br>
&gt;&gt; with the echo+101 static-handshake part.<br>
&gt;&gt; If a server does echo+101, it&#39;s probably a WS server or someth=
ing that<br>
&gt;&gt; wants to look as WS server, in which case it&#39;s probably gonna =
do<br>
&gt;&gt; whatever else WS servers do, whether there is computation step<br>
&gt;&gt; involved or not.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; But, by adding this complexity, you&#39;re practically rem=
oving embedded<br>
&gt;&gt;&gt;&gt; and low-computing-power devices from being able to<br>
&gt;&gt;&gt;&gt; act as WS servers.<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; This was already discussed ad-nauseum, again I refer you to th=
e archives<br>
&gt;&gt;&gt; of<br>
&gt;&gt;&gt; the list. Many of us do care about power, but believe that thi=
s is not a<br>
&gt;&gt;&gt; sufficient barrier.<br>
&gt;&gt;<br>
&gt;&gt; Well, this &quot;barrier&quot; doesn&#39;t actually increase secur=
ity, but adds a<br>
&gt;&gt; burden on devices implementing the protocol. Is that what is meant=
 by<br>
&gt;&gt; &quot;sufficient&quot; ?<br>
&gt;&gt;<br>
&gt;&gt; While at that, why not add a nice &quot;security&quot; fix: make s=
ure<br>
&gt;&gt; intermediaries don&#39;t touch the message in-flight. Hash the tot=
al<br>
&gt;&gt; contents of the message when sending, save it, and request an echo=
 of<br>
&gt;&gt; that hash in the reply. Compare them when receiving the reply, thu=
s<br>
&gt;&gt; you will verify the message was not changed. Great feature. Oh, ev=
en<br>
&gt;&gt; better, have the other part always quote the last message received=
<br>
&gt;&gt; with messages sent. This way, not only will you be able to verify<=
br>
&gt;&gt; whether your packets get delivered correctly, but also see what wa=
s<br>
&gt;&gt; changed in case there was change! Let&#39;s go even farther: maybe=
 your<br>
&gt;&gt; packets have been maliciously delayed, to play part in some kind o=
f<br>
&gt;&gt; timing attack! Let&#39;s have the transmitted packets include the =
time of<br>
&gt;&gt; transmission, and reply packets include the time of last packet<br=
>
&gt;&gt; reception. This way you&#39;ll also be able to prevent replays! An=
yone<br>
&gt;&gt; wants to continue?<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; Section 5.2 actually talks about a server which only purpo=
se is<br>
&gt;&gt;&gt;&gt; processing the complex handshake. Why do you want to<br>
&gt;&gt;&gt;&gt; force people to add such front-end-servers instead of conn=
ecting to<br>
&gt;&gt;&gt;&gt; the real ws-server directly?<br>
&gt;&gt;&gt;&gt;<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; In reality, many people in large deployments do have frontends=
/load<br>
&gt;&gt;&gt; balancers that terminate the connection. The spec does not req=
uire this<br>
&gt;&gt;&gt; though.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; You are talking about creating a _separate_ server just to take ca=
re<br>
&gt;&gt; of the computational burden of the handshake!<br>
&gt;&gt; That is a lot of complexity added to servers that are already quit=
e<br>
&gt;&gt; busy with the load-balancing jobs.<br>
&gt;&gt; The spec does not require this, but it acknowledges that the burde=
n<br>
&gt;&gt; might be too much for busy servers, and operators might wish to<br=
>
&gt;&gt; offload it somewhere.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt;&gt;&gt; 5.2.2.3.3 &quot;The nonce MUST be randomly selected random=
ly for each<br>
&gt;&gt;&gt;&gt; connection&quot;<br>
&gt;&gt;&gt;&gt; Aside from the double-&quot;randomly&quot;, why is the ran=
domness so important<br>
&gt;&gt;&gt;&gt; here<br>
&gt;&gt;&gt;&gt; ?<br>
&gt;&gt;&gt;&gt; What is it made to prevent?<br>
&gt;&gt;&gt;<br>
&gt;&gt;&gt; Double randomly is a typo :) As for why it&#39;s important, as=
 I said earlier<br>
&gt;&gt;&gt; in<br>
&gt;&gt;&gt; the response, if the server is controlled by an attacker and t=
he server<br>
&gt;&gt;&gt; can<br>
&gt;&gt;&gt; predict the next nonce, the server can instruct the client to =
send data<br>
&gt;&gt;&gt; that, when masked with that predicted nonce, will have an appe=
arance on<br>
&gt;&gt;&gt; the<br>
&gt;&gt;&gt; wire that could confuse the intermediary for ill effect.<br>
&gt;&gt;<br>
&gt;&gt; As mentioned before, the &quot;ill effect&quot; is ill-defined (pl=
ease excuse the<br>
&gt;&gt; pun).<br>
&gt;&gt; The same &quot;ill effect&quot; can be caused by using standard HT=
ML with or without<br>
&gt;&gt; XHR.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; All in all, with due respect to the ingenuity of solutions, the<br=
>
&gt;&gt; security features in the current WS spec don&#39;t seem like they =
were<br>
&gt;&gt; developed<br>
&gt;&gt; by people with any real experience in security field. The best thi=
ng<br>
&gt;&gt; to do is remove the features that provide questionable defense. In=
<br>
&gt;&gt; case any contributors feel like there are security problems, defin=
e<br>
&gt;&gt; exactly the attack scenarios or problematic cases and analyze them=
 for<br>
&gt;&gt; impact, and, in case problems are found to be real and fall in sco=
pe<br>
&gt;&gt; of the WS protocol, rather than HTTP or HTML proper, find solution=
s,<br>
&gt;&gt; possibly with help of security specialists from the community, or =
at<br>
&gt;&gt; least be reviewed by one. Bruce Schneier might be a good candidate=
.<br>
&gt;&gt;<br>
&gt;&gt; --<br>
&gt;&gt; silvio<br>
&gt;<br>
</div></div></blockquote></div><br>

--00221532c7a04a022e049cc3b215--

From andy.warmcat.com@googlemail.com  Sun Feb 20 23:22:35 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A6BD03A6E0E for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 23:22:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n27kc4f7cUHl for <hybi@core3.amsl.com>; Sun, 20 Feb 2011 23:22:34 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id E15763A6D4F for <hybi@ietf.org>; Sun, 20 Feb 2011 23:22:33 -0800 (PST)
Received: by wwa36 with SMTP id 36so5947955wwa.13 for <hybi@ietf.org>; Sun, 20 Feb 2011 23:23:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=HZW6ClBNKZfmF06u8Ti8Cjx2IiqyrOGBp1m+icxOgaM=; b=iY5ydtMzbXreqTokYLAJ56ZVhJt5Elb9+E1QkxpxHhapCY2IQ9WFU0nNp/RvryutQM wFaVoHMalkUU8lABmopiyTHQq6zJvRE32plHX1W1ddkGCI+8R29W+poeoFZXzgp0VmJp 9o+BLlmXVsxHCv5S0Zp/bIkPHCuriR/83RDwc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=s003WqAqwaH18gzhh4xGI5GLU6v3HTx38a35Wv8d4XpjxCY1Omvkmo08ziZR8z7LSN sYPKCRzaeLgjg3DyNUBl0pqkT/ar48Bz8j2AvqnqbKTwkDTndJMqlSpKp65f/mgL9CtT hU204IjKmfnVJXeIUD/sxVmc2IRTjt9Y6gqn4=
Received: by 10.227.136.79 with SMTP id q15mr868698wbt.146.1298272994035; Sun, 20 Feb 2011 23:23:14 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id u9sm1988271wbg.18.2011.02.20.23.23.12 (version=SSLv3 cipher=OTHER); Sun, 20 Feb 2011 23:23:13 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6212E0.3050802@warmcat.com>
Date: Mon, 21 Feb 2011 07:23:12 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Silvio Ventres <silvio.ventres@gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<4D60AAF6.6090701@warmcat.com> <AANLkTi=WD+SxFSMbgO5rx5e0eP3ajUCZ2vf6PrAtNkcM@mail.gmail.com>
In-Reply-To: <AANLkTi=WD+SxFSMbgO5rx5e0eP3ajUCZ2vf6PrAtNkcM@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: ifette+ietf@google.com, hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 07:22:35 -0000

On 02/21/2011 01:16 AM, Somebody in the thread at some point said:

Hi -

>> This is a serious issue and in -04 it really was too much for the weakest
>> embedded devices to keep up; there was a SHA-1 per frame in that.
>
> The tool is great. SHA-1 is a wonderful hash. MD-5 is not any less
> wonderful, although less secure.
> The SHA-1 was changed to MD-5. Did anyone analyze the impact of that?
> If there's no difference whether it's
> MD5 or SHA-1, why not use CRC? What is the reason of using a hash in
> the first place?

For handshake, using SHA-1 is fine even on a very weak box because a 
weak box will very seldom see connections and usually only one or two at 
a time.  A little bit of latency making the connection is OK since it's 
no worse than if the box was geographically distant anyway.  And the 
handshake is doing something useful in terms of giving good confidence 
it's a real websocket server on the other end.

But you didn't see what I was telling you in the quote.  In the 
previous, -04 version of the standard for EVERY FRAME the client and 
server each had to compute a SHA-1, regardless of payload length.  A 
frame can be one byte of actual payload, can come very often, a server 
can see a huge number of them per second, etc.

In -05, the current version, that's gone and replaced with the 
simplified 4-byte frame key / XOR action you saw.  So from that 
perspective, the -05 scheme reflects sanity and moderation.

So although I think the whole munging thing is a farce, it's now so much 
better than what went before continuing to argue against it has to be 
balanced against ending up with no websockets at all due to the other 
points I mentioned.  (And indeed Opera have made it clear they won't 
track any further evolution in websockets and are waiting for it to lay 
its 1.0 egg or die.)

> This doesn't seem like a good protocol design practice...

It was doing OK before Adam Barth's paper, then the process has had to 
deal with what boils down to hysteria, "security posturing" and 
ass-covering.

> The problem can also be solved by getting a security expert on board.
> That should alleviate FUD distributed by security amateurs.
> Moreover, masking the contents removes a HUGE benefit of debugability,
> being able to see the traffic in plaintext, that part which made HTTP
> so successful.

I don't think it's relevant to the discussion but AIUI Barth does this 
for a living and is then a professional.  There were crypto experts 
involved but since the issue was not bounded by facts and reason, it 
just meant they tended towards the most extreme solutions to solve this 
unbounded problem like AES-based obfuscation.  That has been soundly 
rejected now so we are not in such a bad place.

Munging is a fact tied to bringing Mozilla back on board with 
re-enabling websockets by default (so Mozilla can say "Phew good job 
websockets fixed their problem! hey everyone it's SAFE to turn it back 
on now!") and we can all agree that action seriously impacts the future 
of websockets.  Pragmatically, the -05 weak munging is small enough 
impact it's not worth setting the effort back months or killing it to 
argue to get rid of it now.

-Andy

From salvatore.loreto@ericsson.com  Mon Feb 21 01:12:30 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 960363A6FFE for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 01:12:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level: 
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 94HrbgL7+5fh for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 01:12:29 -0800 (PST)
Received: from mailgw9.se.ericsson.net (mailgw9.se.ericsson.net [193.180.251.57]) by core3.amsl.com (Postfix) with ESMTP id 6C33D3A6F68 for <hybi@ietf.org>; Mon, 21 Feb 2011 01:12:29 -0800 (PST)
X-AuditID: c1b4fb39-b7b76ae00000276e-f1-4d622ca5ea1c
Received: from esessmw0191.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw9.se.ericsson.net (Symantec Mail Security) with SMTP id 42.FA.10094.5AC226D4; Mon, 21 Feb 2011 10:13:10 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0191.eemea.ericsson.se (153.88.115.85) with Microsoft SMTP Server id 8.2.234.1; Mon, 21 Feb 2011 10:13:09 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id 810272694	for <hybi@ietf.org>; Mon, 21 Feb 2011 11:13:09 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 4C4FD4F90F	for <hybi@ietf.org>; Mon, 21 Feb 2011 11:13:09 +0200 (EET)
Received: from n211.nomadiclab.com (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 0B9A84E704	for <hybi@ietf.org>; Mon, 21 Feb 2011 11:13:09 +0200 (EET)
Message-ID: <4D622CA4.9070408@ericsson.com>
Date: Mon, 21 Feb 2011 11:13:08 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
References: <1297443648.2401.143.camel@ds9.ducksong.com>
In-Reply-To: <1297443648.2401.143.camel@ds9.ducksong.com>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Subject: Re: [hybi] -05 suggested rewrite for Section 1.8
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 09:12:30 -0000

On 2/11/11 7:00 PM, Pat McManus @Mozilla wrote:
> Section 1.8: I suggest striking all of this text:
> "There are several options for establishing a WebSocket connection.
>
>     On the face of it, the simplest method would seem to be to use port
>     80 to get a direct connection to a WebSocket server.  Port 80
>     traffic, however, will often be intercepted by HTTP proxies, which
>     can lead to the connection failing to be established.
>
>     The most reliable method, therefore, is to use TLS encryption and
>     port 443 to connect directly to a WebSocket server.  This has the
>     advantage of being more secure; however, TLS encryption can be
>     computationally expensive."
>
> This doesn't actually help with interop, is only contextually true, and
> is the kind of statement that does not hold up well over time. The spec
> is simply better without the text because it isn't adding useful at the
> protocol level.
>
>

+1 on removing the text as suggested by Pat

/Sal


-- 
Salvatore Loreto
www.sloreto.com


From trac@tools.ietf.org  Mon Feb 21 03:20:11 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B6A9E3A70D2 for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 03:20:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.5
X-Spam-Level: 
X-Spam-Status: No, score=-102.5 tagged_above=-999 required=5 tests=[AWL=-0.052, BAYES_00=-2.599, NO_RELAYS=-0.001, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ueU6577Rp-MY for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 03:20:10 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id DE00C3A70CE for <hybi@ietf.org>; Mon, 21 Feb 2011 03:20:10 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PrTov-000596-DE; Mon, 21 Feb 2011 03:20:49 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: jat@google.com, salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Mon, 21 Feb 2011 11:20:49 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: https://wiki.tools.ietf.org/wg/hybi/trac/ticket/40#comment:2
Message-ID: <072.d163836b8d9574eb472fe38817256fc9@tools.ietf.org>
References: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
X-Trac-Ticket-ID: 40
In-Reply-To: <063.e489b6d352cc1192d00acf7f96150ea7@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: jat@google.com, salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] thewebsocketprotocol #40 (closed): Clarify binary/utf-8 mixed handling
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 11:20:12 -0000

#40: Clarify binary/utf-8 mixed handling

Changes (by salvatore.loreto@â€¦):

  * status:  new => closed
  * resolution:  => invalid


Old description:

> It can be confusing to mix binary and utf-8 frames in one tcp-like
> stream. For example, what will the current text-only JS Websocket API do
> if suddenly binary starts appearing?
> Additionally, when only partial frames may be available, it is expensive
> to verify that this is indeed a valid UTF-8 stream (protocol
> implementation needs to take into account multi-byte characters and end
> of current data payload).  If binary has been negotiated for this
> session, processing can be optimized accordingly.
>
> Proposal: allow negotiation to clarify if a stream will not mix binary
> and text in order to enable optimizing for the binary-only case.

New description:

 It can be confusing to mix binary and utf-8 frames in one tcp-like stream.
 For example, what will the current text-only JS Websocket API do if
 suddenly binary starts appearing?
 Additionally, when only partial frames may be available, it is expensive
 to verify that this is indeed a valid UTF-8 stream (protocol
 implementation needs to take into account multi-byte characters and end of
 current data payload).  If binary has been negotiated for this session,
 processing can be optimized accordingly.

 Proposal: allow negotiation to clarify if a stream will not mix binary and
 text in order to enable optimizing for the binary-only case.

--

Comment:

 closed... some clarification text will be added in 06

 see: http://www.ietf.org/mail-archive/web/hybi/current/msg06311.html

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |        Owner:         
     Type:  defect                    |       Status:  closed 
 Priority:  major                     |    Milestone:         
Component:  thewebsocketprotocol      |      Version:         
 Severity:  -                         |   Resolution:  invalid
 Keywords:                            |  
--------------------------------------+-------------------------------------

Ticket URL: <https://wiki.tools.ietf.org/wg/hybi/trac/ticket/40#comment:2>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From jlee@antwerkz.com  Mon Feb 21 14:22:33 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4CB4F3A717A for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 14:22:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.996
X-Spam-Level: 
X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[AWL=0.980,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqDlLXbGHqXx for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 14:22:32 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id ACFEF3A716D for <hybi@ietf.org>; Mon, 21 Feb 2011 14:22:31 -0800 (PST)
Received: by fxm15 with SMTP id 15so3001790fxm.31 for <hybi@ietf.org>; Mon, 21 Feb 2011 14:23:13 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.48.194 with SMTP id s2mr2475110faf.129.1298326993792; Mon, 21 Feb 2011 14:23:13 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Mon, 21 Feb 2011 14:23:13 -0800 (PST)
Date: Mon, 21 Feb 2011 17:23:13 -0500
Message-ID: <AANLkTik9b6akTvBDiy-8DUMptevsMsOyLO78BgMPXq9L@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=00151747932a446e82049cd24fec
Subject: [hybi] masked frames
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Feb 2011 22:22:33 -0000

--00151747932a446e82049cd24fec
Content-Type: text/plain; charset=ISO-8859-1

When the client sends the frames it has to mask the data.  But is the whole
frame masked?  or just the payload/application data?  In the case of the
former then, we'd send the 4 bytes for the mask, then the XORed bytes of the
entire frame including all the opcodes and frame length bytes as well, yes?
 In this case, masked or not, the frame structure won't change, it will just
have a envelope, so to speak, wrapping it on the wire.  Is that correct?

-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--00151747932a446e82049cd24fec
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

When the client sends the frames it has to mask the data. =A0But is the who=
le frame masked? =A0or just the payload/application data? =A0In the case of=
 the former then, we&#39;d send the 4 bytes for the mask, then the XORed by=
tes of the entire frame including all the opcodes and frame length bytes as=
 well, yes? =A0In this case, masked or not, the frame structure won&#39;t c=
hange, it will just have a envelope, so to speak, wrapping it on the wire. =
=A0Is that correct?<br clear=3D"all">
<br>-- <br>You can find me on the net at:<div><a href=3D"http://antwerkz.co=
m" target=3D"_blank">http://antwerkz.com</a><br><a href=3D"http://www.linke=
din.com/in/justinlee" target=3D"_blank">http://www.linkedin.com/in/justinle=
e</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--00151747932a446e82049cd24fec--

From salvatore.loreto@ericsson.com  Mon Feb 21 23:40:48 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 92EFA3A6826 for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 23:40:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level: 
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZVDW6tDyqd72 for <hybi@core3.amsl.com>; Mon, 21 Feb 2011 23:40:47 -0800 (PST)
Received: from mailgw9.se.ericsson.net (mailgw9.se.ericsson.net [193.180.251.57]) by core3.amsl.com (Postfix) with ESMTP id 4F10D3A6811 for <hybi@ietf.org>; Mon, 21 Feb 2011 23:40:46 -0800 (PST)
X-AuditID: c1b4fb39-b7b76ae00000276e-16-4d6368a98521
Received: from esessmw0247.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw9.se.ericsson.net (Symantec Mail Security) with SMTP id AD.E3.10094.9A8636D4; Tue, 22 Feb 2011 08:41:29 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0247.eemea.ericsson.se (153.88.115.94) with Microsoft SMTP Server id 8.2.234.1; Tue, 22 Feb 2011 08:41:29 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id F3FF925A5	for <hybi@ietf.org>; Tue, 22 Feb 2011 09:41:28 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id AD906508DE	for <hybi@ietf.org>; Tue, 22 Feb 2011 09:41:28 +0200 (EET)
Received: from Salvatore-Loretos-MacBook-Pro.local (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 49B7A508CF	for <hybi@ietf.org>; Tue, 22 Feb 2011 09:41:28 +0200 (EET)
Message-ID: <4D6368A7.4080405@ericsson.com>
Date: Tue, 22 Feb 2011 09:41:27 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
References: <1297443821.2401.147.camel@ds9.ducksong.com>
In-Reply-To: <1297443821.2401.147.camel@ds9.ducksong.com>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Subject: Re: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 07:40:48 -0000

On 2/11/11 7:03 PM, Pat McManus @Mozilla wrote:
> In client requirements (5.1), under handshake requirement #6:
> "The request MUST contain a "Connection" header whose value is equal to
> "Upgrade"."
> I believe that should be changed to "whose value contains the Upgrade
> token" instead of the "equal" language. As currently written it
> prohibits the client from concurrently using the Connection header for
> other valid HTTP/1.1 purposes too, and we want to make this HTTP/1.1
> compatible.
Hi Pat,

I agree we should be HTTP/1.1 compatible,
however I don't see what other "valid" HTTP/1.1 purpose would be in this 
context.
do you have any scenario in mind?

anyway what about changing from

OLD

    6.   The request MUST contain a "Connection" header whose value is
         equal to "Upgrade".

NEW

    6.   The request MUST contain a "Connection" header whose value
         SHOULD contain the "Upgrade" token.

in this way we are compatible to HTTP/1.1, we mandate the Upgrade toke
unless there is a valid reason for a different toke


> Similarly:
>
>   "If the response lacks a Connection header or the Connection header
> contains a value that is not an ASCII case-insensitive match for the
> value "Upgrade", the client MUST fail the WebSocket connection."
>
> Again, we require an upgrade token but its ok to have other values in
> there too..
can you explain how it is OK have other values?
> in order to be http compatible we must loosen this receive
> condition, and we ought to loosen the send one too.
cheers
/Sa

-- 
Salvatore Loreto
www.sloreto.com


From andy.warmcat.com@googlemail.com  Tue Feb 22 00:10:51 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 45F4E3A685A for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 00:10:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NSAicJq6g3b2 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 00:10:49 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 1E11E3A684E for <hybi@ietf.org>; Tue, 22 Feb 2011 00:10:46 -0800 (PST)
Received: by wyb42 with SMTP id 42so1138049wyb.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 00:11:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=9OTDQy88TNvAWh7IAg6Q5NSISNR9XRBwlvUnL3vUqws=; b=f/YlKopV2NwWR8g4/zdY8wpy2Nw1Y8/F+FriYnsiK5TWJugbxI6XXHGKS+3yWSNl4o mpaLpK3kcSc43zp71hGIktovE3tTbeVIgYuaU2daRP5puR2SZ6W/9jexFjNZ1hlb/9Mu JnVAML3cUqNVcOIfQI3n48RW/agh1ZGA2rSUM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=qMMdVIhUSrTRbXLRRHRSoLA6iGyXykeur83Zx0uxHACPuosPf9smcf0boDtktE9SwQ IqEQgNcORbvrOH3F69iGOEtx6X4HHuMs2QBjQHIZMY3I0WBQTYK9oAnS6xElEQaFz921 hL/4bXGu2izDEp09rvosSI4UZJzNDqk2skRmk=
Received: by 10.227.132.69 with SMTP id a5mr2030721wbt.123.1298362289506; Tue, 22 Feb 2011 00:11:29 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id w25sm4832812wbd.17.2011.02.22.00.11.27 (version=SSLv3 cipher=OTHER); Tue, 22 Feb 2011 00:11:27 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D636FAE.80709@warmcat.com>
Date: Tue, 22 Feb 2011 08:11:26 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Justin Lee <jlee@antwerkz.com>
References: <AANLkTik9b6akTvBDiy-8DUMptevsMsOyLO78BgMPXq9L@mail.gmail.com>
In-Reply-To: <AANLkTik9b6akTvBDiy-8DUMptevsMsOyLO78BgMPXq9L@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org
Subject: Re: [hybi] masked frames
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 08:10:52 -0000

On 02/21/2011 10:23 PM, Somebody in the thread at some point said:

Hi -

> When the client sends the frames it has to mask the data.  But is the
> whole frame masked?  or just the payload/application data?  In the case
> of the former then, we'd send the 4 bytes for the mask, then the XORed
> bytes of the entire frame including all the opcodes and frame length
> bytes as well, yes?  In this case, masked or not, the frame structure
> won't change, it will just have a envelope, so to speak, wrapping it on
> the wire.  Is that correct?

Yeah.  Considering frames from the client, only the 4-byte frame key is 
unmasked, then everything is XORed using it.

Frames from the server don't have the 4-byte frame key or any masking 
action, but are otherwise the same header structure in clear.

-Andy

From sdw@lig.net  Tue Feb 22 01:49:10 2011
Return-Path: <sdw@lig.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AE6F53A6774 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 01:49:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tGEiEKj-M6+c for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 01:49:09 -0800 (PST)
Received: from mail.lig.net (lig.net [64.69.38.223]) by core3.amsl.com (Postfix) with ESMTP id 408693A6832 for <hybi@ietf.org>; Tue, 22 Feb 2011 01:49:09 -0800 (PST)
Received: from sdwmbp.local (ligemail.lig.net [127.0.0.1]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: sdw) by mail.lig.net (Postfix) with ESMTP id 0A1BBAB5E31 for <hybi@ietf.org>; Tue, 22 Feb 2011 01:59:57 -0800 (PST)
Message-ID: <4D6386C7.7050601@lig.net>
Date: Tue, 22 Feb 2011 01:49:59 -0800
From: Stephen Williams <sdw@lig.net>
Organization: OptimaLogic, Inc.
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: hybi@ietf.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [hybi] Suggested improvements to WebSocket
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 09:49:10 -0000

Apologies for not joining and suggesting earlier.  Please point out any prior conversation of something like these points.

Mini-intro: I've studied a lot of existing protocols for a long time, and designed and built a number of my own.  I've designed 
rate-based, scalable, high-performance protocols for IM/presence, video streaming, and bulk de-duplicated backup.  I worked on the 
first IETF working group for presence/IM (which XMPP was part of) and the W3C XBC and EXI binary XML working groups.

How does content type and encoding interact with WebSockets?  Can each message be different?

As per the Design Philosophy in 1.6, these likely should be extensions.  However, I would argue that these are important, needed in 
enough circumstances, and general enough to be part of the specification.  Perhaps a raw vs. cooked model makes sense.

I'll suggest these as optional framing layers inside a WebSocket message, although some or all of this could be more integral to the 
overall framing.

Compression: Compression always needs to be supported whenever encryption of any kind is performed, as after such a transformation 
compression is not possible.  A compression type and version should be specified.  The content of a compressed message should be 
interpreted as if it had been received uncompressed.

Batching: Multiple messages may be combined into a batch of messages.  The batch, as a single WebSocket message, should be processed 
as if the contained messages had been received individually.

Encryption: WebSocket security measures may be enough.  However, for another layer of security, or perhaps for selective message 
access, an encryption message container should exist.  This specifies encryption type/parameters and identity of key.  The contents 
of an encrypted message are interpreted as if they weren't encrypted.

Channelization: A communication link should support a simple channelization capability, similar semantically to multiple parallel 
TCP connections, but implemented as multiplexed packets.  The mostly ignored IETF BEEP (originally BXXP) protocol has a nice 
channelization design.)  XMPP effectively has channelization, as does RabbitMQ, ZeroMQ, etc.

Rich Message passing (or some similar moniker): HTTP 1.0 is simple client/server: Half duplex, synchronous, request->response.  HTTP 
1.1 added asynchronous, pipelined messaging but the model was still request->response.  Only through inefficient and fragile hacks 
like Comet is this basic model overcome.  WebSockets, as defined now, provides a more sophisticated peer model that is 
request->response and response<-request.  However, the most general and complete logical model in widespread use is embodied in 
presence/IM systems like XMPP: They include logical, overlay concepts of: named endpoints (and sometimes sub-endpoints), 
authentication/identity of endpoints, logical routing of messages, and both basic logical communication models: point-to-point async 
message queues (an IM/chat message) and publish/subscribe (presence updates/subscription).  A system that includes all of these 
building blocks can implement most logical communication models as subsets.  WebSocket need not include much to allow various 
implementations of these concepts (perhaps via JMS, RabbitMQ, XMPP).  Not only would XMPP over WebSocket probably make sense, but 
WebSocket compatible API messaging should be able to be transported over XMPP.

The most important missing capability of WebSocket (and most current communication mechanisms):
Windowed, logical end-to-end flow control: Link level flow control (TCP) works well.  However, in any 3+ tier system, or any system 
where more than one link is involved in a communication chain, there are various inefficiencies and failures that can occur when 
there is no real end-to-end flow control.  The right way to implement this feature is to support a simple representation of "message 
processed request" / "message processed", including roll up of multiple notifications into a single request.  (Careful choice of how 
to report and coalesce message identification is needed.  Probably, a single concept can handle two or more types of situations: An 
ack of "N units processed" where each message implicitly or explicitly notes how many units (bytes, message count, etc.) it 
represents.)  For a more advanced implementaiton, as long as proper timestamps are included, transfer and processing rates can be 
estimated and the processing can be dynamically rate-based.  The core concepts: A sender, when queuing a message for a particular 
channel, periodically adds metadata that requests an ack that prior messages had been processed by the final endpoint.  (Whatever 
that means to the application involved.)  Each communication link passes on the request, with or without transformation mapping 
(needed at processing tiers where data is consumed and new data is created).  The final tier transmits back the acknowledgment which 
is propagated to the sender.  The goal of all of this is to control the amount of messages/data outstanding on a particular channel 
and to prevent excessive buffering or overrun in communication and processing tiers.  This optimizes network, buffering, and 
latency.  Note that the concept is explicitly about when a message is processed, not when it is communicated.  Although the latter 
might be helpful in optimizing recovery from a failure (and could also be supported), it does nothing to reliably and most 
efficiently get past synchronous client/server.

All of the complexity is in the application endpoints which are deciding when to send a message and when to ack its processing, plus 
how to recover from a lost connection or restarted endpoint.  A simple application can implement very simple versions of these.

Applications that need these features are not hard to find: uploading or downloading anything in bulk, especially live multi-media 
data or bulk data replication, pipelined application transactions, and interactive gaming.


Stephen
-- 
Stephen D. Williams sdw@lig.net stephendwilliams@gmail.com LinkedIn: http://sdw.st/in V:650-450-UNIX (8649) V:866.SDW.UNIX 
V:703.371.9362 F:703.995.0407 AIM:sdw Skype:StephenDWilliams Yahoo:sdwlignet Resume: http://sdw.st/gres Personal: http://sdw.st 
facebook.com/sdwlig twitter.com/scienteer


From andy.warmcat.com@googlemail.com  Tue Feb 22 02:08:54 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 09EC13A6841 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 02:08:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xTOkcTwpT8GO for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 02:08:50 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 87E0A3A6834 for <hybi@ietf.org>; Tue, 22 Feb 2011 02:08:50 -0800 (PST)
Received: by wyb42 with SMTP id 42so1233900wyb.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 02:09:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=IXvDViCSXDgOT1uR4YNyueiVsH5ZUBzWKnWrepzGGXs=; b=hHAGU2AvgI080/MXI80KaG5HmKhcTaBZOho9sEQJNQx+Kq7cm8aAy1Hu2x6pNA67pP TdZWgdDDUYfwWa+SVu4Z4Gta+bBgjv3380o7WLoc9mXNh7jsiRJayumqD6DTWXyMGFjP zoDP0KLbW/J+PRTXYTZVUW2V2e5pU6eG/1XyM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=AUcLb8wD+nlvc3E2faIaFfxwtoWbGIoemkfJGhSkxES8w1xRvpcWvBI9NHSJLv95Fq jKtTKTuOjS3lMxHKuoPEDgFmS0MP/V697d9ram6BxFSO3i4nXkbK7vgwcUWQBp0gARFR XTjkMcHhi+hHsZhuHrsLQQY728pv2uT8TNFEM=
Received: by 10.227.179.77 with SMTP id bp13mr1487491wbb.226.1298369373635; Tue, 22 Feb 2011 02:09:33 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id u9sm3107140wbg.6.2011.02.22.02.09.32 (version=SSLv3 cipher=OTHER); Tue, 22 Feb 2011 02:09:33 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D638B5C.9090206@warmcat.com>
Date: Tue, 22 Feb 2011 10:09:32 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Stephen Williams <sdw@lig.net>
References: <4D6386C7.7050601@lig.net>
In-Reply-To: <4D6386C7.7050601@lig.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org
Subject: Re: [hybi] Suggested improvements to WebSocket
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 10:08:54 -0000

On 02/22/2011 09:49 AM, Somebody in the thread at some point said:

Hi -

> As per the Design Philosophy in 1.6, these likely should be extensions.

Yeah or done as protocols or are already defined.

> Compression: Compression always needs to be supported whenever

Already supported: there is a compression extension defined.

> Batching: Multiple messages may be combined into a batch of messages.
> The batch, as a single WebSocket message, should be processed as if the
> contained messages had been received individually.

Already supported: Any peer or intermediary can decide to do that 
already since framed data is just streamed and interpreted bytewise; if 
it doesn't mind introducing a bit of latency it can batch stuff before 
spilling it.

> Encryption: WebSocket security measures may be enough. However, for

SSL is enough for most anything.  If you want more either select a funky 
SSL cypher, define an encryption extension that operates inside the SSL 
tunnel or define your protocol to encrypt the payload.

> Channelization: A communication link should support a simple

Muxing will come as an extension.

> subsets. WebSocket need not include much to allow various
> implementations of these concepts (perhaps via JMS, RabbitMQ, XMPP). Not
> only would XMPP over WebSocket probably make sense, but WebSocket
> compatible API messaging should be able to be transported over XMPP.

This is all the business of the protocols to define how they like on top 
of websockets.

> The most important missing capability of WebSocket (and most current
> communication mechanisms):
> Windowed, logical end-to-end flow control: Link level flow control (TCP)

It sounds like websockets already provides the basis and you just need 
to decide a protocol name and define that using the existing websockets 
transport to have all those features you want.  Without further delaying 
the actual websockets spec.

-Andy

From mcmanus@ducksong.com  Tue Feb 22 07:06:49 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C0EAC3A689C for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:06:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AvU7bMnSzdWm for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:06:48 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id A22793A689A for <hybi@ietf.org>; Tue, 22 Feb 2011 07:06:48 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 788C510157; Tue, 22 Feb 2011 10:07:31 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id E534010157; Tue, 22 Feb 2011 10:07:27 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: Salvatore Loreto <salvatore.loreto@ericsson.com>
In-Reply-To: <4D6368A7.4080405@ericsson.com>
References: <1297443821.2401.147.camel@ds9.ducksong.com> <4D6368A7.4080405@ericsson.com>
Content-Type: text/plain; charset="UTF-8"
Date: Tue, 22 Feb 2011 10:07:18 -0500
Message-ID: <1298387238.2498.133.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org
Subject: Re: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 15:06:49 -0000

On Tue, 2011-02-22 at 09:41 +0200, Salvatore Loreto wrote:
> On 2/11/11 7:03 PM, Pat McManus @Mozilla wrote:
> > In client requirements (5.1), under handshake requirement #6:
> > "The request MUST contain a "Connection" header whose value is equal to
> > "Upgrade"."
> > I believe that should be changed to "whose value contains the Upgrade
> > token" instead of the "equal" language. As currently written it
> > prohibits the client from concurrently using the Connection header for
> > other valid HTTP/1.1 purposes too, and we want to make this HTTP/1.1
> > compatible.
> Hi Pat,
> 
> I agree we should be HTTP/1.1 compatible,
> however I don't see what other "valid" HTTP/1.1 purpose would be in this 
> context.
> do you have any scenario in mind?
> 

one possibility for the request header:

Connection: Upgrade, keep-alive

(yes, k-a is redundant with http/1.1 but if recvd by a non 1.1 aware
server this allows recycling of the connection after the http error).. 

> anyway what about changing from
> 
> OLD
> 
>     6.   The request MUST contain a "Connection" header whose value is
>          equal to "Upgrade".
> 
> NEW
> 
>     6.   The request MUST contain a "Connection" header whose value
>          SHOULD contain the "Upgrade" token.
> 
> in this way we are compatible to HTTP/1.1, we mandate the Upgrade toke
> unless there is a valid reason for a different toke

I was thinking

    6.   The request MUST contain a "Connection" header whose value
          MUST include the "Upgrade" token.

> 
> 
> > Similarly:
> >
> >   "If the response lacks a Connection header or the Connection header
> > contains a value that is not an ASCII case-insensitive match for the
> > value "Upgrade", the client MUST fail the WebSocket connection."
> >
> > Again, we require an upgrade token but its ok to have other values in
> > there too..
> can you explain how it is OK have other values?

X-Defined-In-2012: Bar
Connection: Upgrade, X-Defined-In-2012

That's just how connection is defined - it is a list of other header
values that need to be stripped hop to hop. There is nothing gained by
breaking and saying it must equal one particular token; we can mandate
that it includes a particular token instead. Does that make sense?


-- 
http://www.getfirefox.com/



From jlee@antwerkz.com  Tue Feb 22 07:22:29 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 566233A68F8 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:22:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.486
X-Spam-Level: 
X-Spam-Status: No, score=-2.486 tagged_above=-999 required=5 tests=[AWL=0.490,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I76yvc9whkIh for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:22:27 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 087A03A690B for <hybi@ietf.org>; Tue, 22 Feb 2011 07:22:26 -0800 (PST)
Received: by fxm15 with SMTP id 15so3790608fxm.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 07:23:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.86.196 with SMTP id t4mr3604886fal.34.1298388190714; Tue, 22 Feb 2011 07:23:10 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Tue, 22 Feb 2011 07:23:10 -0800 (PST)
In-Reply-To: <4D636FAE.80709@warmcat.com>
References: <AANLkTik9b6akTvBDiy-8DUMptevsMsOyLO78BgMPXq9L@mail.gmail.com> <4D636FAE.80709@warmcat.com>
Date: Tue, 22 Feb 2011 10:23:10 -0500
Message-ID: <AANLkTi=yTNfkdZMnCoUG2OqcPBUwb5PALODToy8WMGxR@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=20cf30433f7ae35b5e049ce08e41
Subject: Re: [hybi] masked frames
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 15:22:29 -0000

--20cf30433f7ae35b5e049ce08e41
Content-Type: text/plain; charset=ISO-8859-1

Great.  That's what I built yesterday and i'm pushing upwards of 90k/frames
a sec to/from the server.  It wasn't quit the hit I was afraid it'd be.
 Thanks for the confirmation.

On Tue, Feb 22, 2011 at 3:11 AM, Andy Green <andy@warmcat.com> wrote:

> On 02/21/2011 10:23 PM, Somebody in the thread at some point said:
>
> Hi -
>
>
>  When the client sends the frames it has to mask the data.  But is the
>> whole frame masked?  or just the payload/application data?  In the case
>> of the former then, we'd send the 4 bytes for the mask, then the XORed
>> bytes of the entire frame including all the opcodes and frame length
>> bytes as well, yes?  In this case, masked or not, the frame structure
>> won't change, it will just have a envelope, so to speak, wrapping it on
>> the wire.  Is that correct?
>>
>
> Yeah.  Considering frames from the client, only the 4-byte frame key is
> unmasked, then everything is XORed using it.
>
> Frames from the server don't have the 4-byte frame key or any masking
> action, but are otherwise the same header structure in clear.
>
> -Andy
>



-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--20cf30433f7ae35b5e049ce08e41
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Great. =A0That&#39;s what I built yesterday and i&#39;m pushing upwards of =
90k/frames a sec to/from the server. =A0It wasn&#39;t quit the hit I was af=
raid it&#39;d be. =A0Thanks for the confirmation.<br><br><div class=3D"gmai=
l_quote">
On Tue, Feb 22, 2011 at 3:11 AM, Andy Green <span dir=3D"ltr">&lt;<a href=
=3D"mailto:andy@warmcat.com">andy@warmcat.com</a>&gt;</span> wrote:<br><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c=
cc solid;padding-left:1ex;">
On 02/21/2011 10:23 PM, Somebody in the thread at some point said:<br>
<br>
Hi -<div class=3D"im"><br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
When the client sends the frames it has to mask the data. =A0But is the<br>
whole frame masked? =A0or just the payload/application data? =A0In the case=
<br>
of the former then, we&#39;d send the 4 bytes for the mask, then the XORed<=
br>
bytes of the entire frame including all the opcodes and frame length<br>
bytes as well, yes? =A0In this case, masked or not, the frame structure<br>
won&#39;t change, it will just have a envelope, so to speak, wrapping it on=
<br>
the wire. =A0Is that correct?<br>
</blockquote>
<br></div>
Yeah. =A0Considering frames from the client, only the 4-byte frame key is u=
nmasked, then everything is XORed using it.<br>
<br>
Frames from the server don&#39;t have the 4-byte frame key or any masking a=
ction, but are otherwise the same header structure in clear.<br><font color=
=3D"#888888">
<br>
-Andy<br>
</font></blockquote></div><br><br clear=3D"all"><br>-- <br>You can find me =
on the net at:<div><a href=3D"http://antwerkz.com" target=3D"_blank">http:/=
/antwerkz.com</a><br><a href=3D"http://www.linkedin.com/in/justinlee" targe=
t=3D"_blank">http://www.linkedin.com/in/justinlee</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--20cf30433f7ae35b5e049ce08e41--

From w@1wt.eu  Tue Feb 22 07:25:42 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49B8A3A68F8 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:25:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.043
X-Spam-Level: 
X-Spam-Status: No, score=-2.043 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qjenwBAbguHc for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:25:41 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id E54A63A6907 for <hybi@ietf.org>; Tue, 22 Feb 2011 07:25:40 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1MFQIJi004451; Tue, 22 Feb 2011 16:26:18 +0100
Date: Tue, 22 Feb 2011 16:26:18 +0100
From: Willy Tarreau <w@1wt.eu>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Message-ID: <20110222152618.GA4237@1wt.eu>
References: <1297443821.2401.147.camel@ds9.ducksong.com> <4D6368A7.4080405@ericsson.com> <1298387238.2498.133.camel@ds9.ducksong.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1298387238.2498.133.camel@ds9.ducksong.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org
Subject: Re: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 15:25:42 -0000

Hi Pat,

On Tue, Feb 22, 2011 at 10:07:18AM -0500, Pat McManus @Mozilla wrote:
> On Tue, 2011-02-22 at 09:41 +0200, Salvatore Loreto wrote:
(...)
> > can you explain how it is OK have other values?
> 
> X-Defined-In-2012: Bar
> Connection: Upgrade, X-Defined-In-2012
> 
> That's just how connection is defined - it is a list of other header
> values that need to be stripped hop to hop. There is nothing gained by
> breaking and saying it must equal one particular token; we can mandate
> that it includes a particular token instead. Does that make sense?

I too agree that this is very important, especially when we don't yet know
what will be done for pipelining nor for the proxy-connection headers. It's
very possible that these issues will finally lead to additional tokens in
the Connection header.

Regards,
Willy


From andy.warmcat.com@googlemail.com  Tue Feb 22 07:26:05 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B2D53A690C for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:26:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DnUeqJXOL1oW for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:26:04 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 253153A68F8 for <hybi@ietf.org>; Tue, 22 Feb 2011 07:26:03 -0800 (PST)
Received: by wyb42 with SMTP id 42so1562513wyb.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 07:26:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=9CpdM/rohOkBCbGW930G0a41GB9VgNCY2BCMNaE/rHk=; b=dehCYRXIQmCRniOWTnhLWNKYw4sV+07EygaMv2nt+C0G2FrKYbwQwfT4qa+wEOmmcU t56yAGk6V0UQjWcuMU0XDw5Gu71OdeY4U404OCOpDsIpJ/ozSTX2RD7ZsV3+Q9ESHe8P 1HgPKtr6SzZUz0cPODLoadGzbiPTOxKXV4FH4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=OCbYPquD5SNBMVHr79oEWyJ8B9bzSgQQLgd2i1Py2sadc+TTtw5o1z7WFad92SkogA p1vwJszAnO3eiaC2tX6mT2oUWqrZtoJ0X3SBqZVMnk7nYK1fPCmbqzG2V8Vm9OllTE6O MRmAo3/nFXhncRxwcZgp62FH778OLVLK37yhs=
Received: by 10.227.152.131 with SMTP id g3mr2545061wbw.107.1298388407920; Tue, 22 Feb 2011 07:26:47 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id w25sm5114986wbd.17.2011.02.22.07.26.46 (version=SSLv3 cipher=OTHER); Tue, 22 Feb 2011 07:26:46 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D63D5B5.5050502@warmcat.com>
Date: Tue, 22 Feb 2011 15:26:45 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Justin Lee <jlee@antwerkz.com>
References: <AANLkTik9b6akTvBDiy-8DUMptevsMsOyLO78BgMPXq9L@mail.gmail.com>	<4D636FAE.80709@warmcat.com> <AANLkTi=yTNfkdZMnCoUG2OqcPBUwb5PALODToy8WMGxR@mail.gmail.com>
In-Reply-To: <AANLkTi=yTNfkdZMnCoUG2OqcPBUwb5PALODToy8WMGxR@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org
Subject: Re: [hybi] masked frames
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 15:26:05 -0000

On 02/22/2011 03:23 PM, Somebody in the thread at some point said:

> Great.  That's what I built yesterday and i'm pushing upwards of
> 90k/frames a sec to/from the server.  It wasn't quit the hit I was
> afraid it'd be.  Thanks for the confirmation.

FWIW if you're hurting for a different -05 peer consider

  http://git.warmcat.com/cgi-bin/cgit/libwebsockets/

It has stuff line ping applet and clients that can do -05.

-Andy


From salvatore.loreto@ericsson.com  Tue Feb 22 07:31:58 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 954263A690C for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:31:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level: 
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id flq92etSrHT5 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:31:57 -0800 (PST)
Received: from mailgw9.se.ericsson.net (mailgw9.se.ericsson.net [193.180.251.57]) by core3.amsl.com (Postfix) with ESMTP id 2CB3C3A6919 for <hybi@ietf.org>; Tue, 22 Feb 2011 07:31:56 -0800 (PST)
X-AuditID: c1b4fb39-b7b76ae00000276e-88-4d63d718deb6
Received: from esessmw0256.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw9.se.ericsson.net (Symantec Mail Security) with SMTP id 05.B0.10094.817D36D4; Tue, 22 Feb 2011 16:32:41 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0256.eemea.ericsson.se (153.88.115.97) with Microsoft SMTP Server id 8.2.234.1; Tue, 22 Feb 2011 16:32:40 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id ADB3725C5; Tue, 22 Feb 2011 17:32:40 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 77533508FF; Tue, 22 Feb 2011 17:32:40 +0200 (EET)
Received: from Salvatore-Loretos-MacBook-Pro.local (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id EEBD6508FC; Tue, 22 Feb 2011 17:32:39 +0200 (EET)
Message-ID: <4D63D717.3070900@ericsson.com>
Date: Tue, 22 Feb 2011 17:32:39 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
References: <1297443821.2401.147.camel@ds9.ducksong.com>	 <4D6368A7.4080405@ericsson.com> <1298387238.2498.133.camel@ds9.ducksong.com>
In-Reply-To: <1298387238.2498.133.camel@ds9.ducksong.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 15:31:58 -0000

On 2/22/11 5:07 PM, Pat McManus @Mozilla wrote:
> On Tue, 2011-02-22 at 09:41 +0200, Salvatore Loreto wrote:
>> On 2/11/11 7:03 PM, Pat McManus @Mozilla wrote:
>>> In client requirements (5.1), under handshake requirement #6:
>>> "The request MUST contain a "Connection" header whose value is equal to
>>> "Upgrade"."
>>> I believe that should be changed to "whose value contains the Upgrade
>>> token" instead of the "equal" language. As currently written it
>>> prohibits the client from concurrently using the Connection header for
>>> other valid HTTP/1.1 purposes too, and we want to make this HTTP/1.1
>>> compatible.
>> Hi Pat,
>>
>> I agree we should be HTTP/1.1 compatible,
>> however I don't see what other "valid" HTTP/1.1 purpose would be in this
>> context.
>> do you have any scenario in mind?
>>
> one possibility for the request header:
>
> Connection: Upgrade, keep-alive
>
> (yes, k-a is redundant with http/1.1 but if recvd by a non 1.1 aware
> server this allows recycling of the connection after the http error)..
>
>> anyway what about changing from
>>
>> OLD
>>
>>      6.   The request MUST contain a "Connection" header whose value is
>>           equal to "Upgrade".
>>
>> NEW
>>
>>      6.   The request MUST contain a "Connection" header whose value
>>           SHOULD contain the "Upgrade" token.
>>
>> in this way we are compatible to HTTP/1.1, we mandate the Upgrade toke
>> unless there is a valid reason for a different toke
> I was thinking
>
>      6.   The request MUST contain a "Connection" header whose value
>            MUST include the "Upgrade" token.

ahh... now I see!!!
sorry I didn't get  you were talking of the possibility to have 
"additional" tokens


>>
>>> Similarly:
>>>
>>>    "If the response lacks a Connection header or the Connection header
>>> contains a value that is not an ASCII case-insensitive match for the
>>> value "Upgrade", the client MUST fail the WebSocket connection."
>>>
>>> Again, we require an upgrade token but its ok to have other values in
>>> there too..
>> can you explain how it is OK have other values?
> X-Defined-In-2012: Bar
> Connection: Upgrade, X-Defined-In-2012
>
> That's just how connection is defined - it is a list of other header
> values that need to be stripped hop to hop. There is nothing gained by
> breaking and saying it must equal one particular token; we can mandate
> that it includes a particular token instead. Does that make sense?

it make a lot of sense.
thanks a lot for the clarification

/Sal

-- 
Salvatore Loreto
www.sloreto.com


From jlee@antwerkz.com  Tue Feb 22 07:38:01 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 594C33A6915 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:38:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.649
X-Spam-Level: 
X-Spam-Status: No, score=-2.649 tagged_above=-999 required=5 tests=[AWL=0.327,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IHLFwhkHQBte for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 07:38:00 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id D2B553A68FA for <hybi@ietf.org>; Tue, 22 Feb 2011 07:37:59 -0800 (PST)
Received: by fxm15 with SMTP id 15so3806688fxm.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 07:38:43 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.86.13 with SMTP id q13mr3665475fal.53.1298388961215; Tue, 22 Feb 2011 07:36:01 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Tue, 22 Feb 2011 07:36:01 -0800 (PST)
In-Reply-To: <4D63D5B5.5050502@warmcat.com>
References: <AANLkTik9b6akTvBDiy-8DUMptevsMsOyLO78BgMPXq9L@mail.gmail.com> <4D636FAE.80709@warmcat.com> <AANLkTi=yTNfkdZMnCoUG2OqcPBUwb5PALODToy8WMGxR@mail.gmail.com> <4D63D5B5.5050502@warmcat.com>
Date: Tue, 22 Feb 2011 10:36:01 -0500
Message-ID: <AANLkTikLocib44BsKO8WmetB+_77jP1RMPSSAvX7h3q0@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: Andy Green <andy@warmcat.com>
Content-Type: multipart/alternative; boundary=20cf30434204d0479e049ce0bc3c
Cc: hybi@ietf.org
Subject: Re: [hybi] masked frames
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 15:38:01 -0000

--20cf30434204d0479e049ce0bc3c
Content-Type: text/plain; charset=ISO-8859-1

I've actually been needing an external codebase to verify mine.  I'll check
that out.  Hopefully licensing issues won't get in the way of using
*something*.  Manually checking using browsers is tedious at best.  :)
 Thanks for the heads up.

On Tue, Feb 22, 2011 at 10:26 AM, Andy Green <andy@warmcat.com> wrote:

> On 02/22/2011 03:23 PM, Somebody in the thread at some point said:
>
>  Great.  That's what I built yesterday and i'm pushing upwards of
>> 90k/frames a sec to/from the server.  It wasn't quit the hit I was
>> afraid it'd be.  Thanks for the confirmation.
>>
>
> FWIW if you're hurting for a different -05 peer consider
>
>  http://git.warmcat.com/cgi-bin/cgit/libwebsockets/
>
> It has stuff line ping applet and clients that can do -05.
>
> -Andy
>
>


-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--20cf30434204d0479e049ce0bc3c
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I&#39;ve actually been needing an external codebase to verify mine. =A0I&#3=
9;ll check that out. =A0Hopefully licensing issues won&#39;t get in the way=
 of using *something*. =A0Manually checking using browsers is tedious at be=
st. =A0:) =A0Thanks for the heads up.<br>
<br><div class=3D"gmail_quote">On Tue, Feb 22, 2011 at 10:26 AM, Andy Green=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:andy@warmcat.com">andy@warmcat.com=
</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin=
:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">On 02/22/2011 03:23 PM, Somebody in the thread at some po=
int said:<br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
Great. =A0That&#39;s what I built yesterday and i&#39;m pushing upwards of<=
br>
90k/frames a sec to/from the server. =A0It wasn&#39;t quit the hit I was<br=
>
afraid it&#39;d be. =A0Thanks for the confirmation.<br>
</blockquote>
<br></div>
FWIW if you&#39;re hurting for a different -05 peer consider<br>
<br>
=A0<a href=3D"http://git.warmcat.com/cgi-bin/cgit/libwebsockets/" target=3D=
"_blank">http://git.warmcat.com/cgi-bin/cgit/libwebsockets/</a><br>
<br>
It has stuff line ping applet and clients that can do -05.<br><font color=
=3D"#888888">
<br>
-Andy<br>
<br>
</font></blockquote></div><br><br clear=3D"all"><br>-- <br>You can find me =
on the net at:<div><a href=3D"http://antwerkz.com" target=3D"_blank">http:/=
/antwerkz.com</a><br><a href=3D"http://www.linkedin.com/in/justinlee" targe=
t=3D"_blank">http://www.linkedin.com/in/justinlee</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--20cf30434204d0479e049ce0bc3c--

From ibc@aliax.net  Tue Feb 22 11:13:19 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA0DD3A67FC for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:13:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gr55t6tab9JH for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:13:19 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id D48C03A6813 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:13:18 -0800 (PST)
Received: by qwh6 with SMTP id 6so1656908qwh.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:14:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr2281159qcb.170.1298402043351; Tue, 22 Feb 2011 11:14:03 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Tue, 22 Feb 2011 11:14:03 -0800 (PST)
In-Reply-To: <1298387238.2498.133.camel@ds9.ducksong.com>
References: <1297443821.2401.147.camel@ds9.ducksong.com> <4D6368A7.4080405@ericsson.com> <1298387238.2498.133.camel@ds9.ducksong.com>
Date: Tue, 22 Feb 2011 20:14:03 +0100
Message-ID: <AANLkTinHRzfP-5BBHqRYPs5yzs7BYKpPaYJ1fFWxJDp+@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 19:13:19 -0000

2011/2/22 Pat McManus @Mozilla <mcmanus@ducksong.com>:
> That's just how connection is defined - it is a list of other header
> values that need to be stripped hop to hop. There is nothing gained by
> breaking and saying it must equal one particular token; we can mandate
> that it includes a particular token instead. Does that make sense?

I strongly agree. In some fragments the WebSocket draft still seems to
be written with the aim of describring a "new" protocol rather than a
extension to HTTP, but in fact WebSocket uses "Connection: upgrade"
and 101 response which are defined by RFC 2616.

Please, focus the WebSocket handshake as an extension to HTTP rather
than as a new protocol. An implementor of WebSocket must know HTTP
(IMHO).

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Tue Feb 22 11:20:35 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE3D63A68C8 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:20:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Epq3vx-sZMwx for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:20:35 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id 0CE253A6813 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:20:34 -0800 (PST)
Received: by qyk29 with SMTP id 29so2328597qyk.10 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:21:19 -0800 (PST)
MIME-Version: 1.0
Received: by 10.224.37.81 with SMTP id w17mr2613684qad.132.1298402479751; Tue, 22 Feb 2011 11:21:19 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Tue, 22 Feb 2011 11:21:19 -0800 (PST)
In-Reply-To: <AANLkTi=WD+SxFSMbgO5rx5e0eP3ajUCZ2vf6PrAtNkcM@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <4D60AAF6.6090701@warmcat.com> <AANLkTi=WD+SxFSMbgO5rx5e0eP3ajUCZ2vf6PrAtNkcM@mail.gmail.com>
Date: Tue, 22 Feb 2011 20:21:19 +0100
Message-ID: <AANLkTims-Xuv1Uf-EE7T6WtG_0HoPtE8=SNUwqSEmRLN@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org, ifette+ietf@google.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 19:20:35 -0000

2011/2/21 Silvio Ventres <silvio.ventres@gmail.com>:
> Moreover, masking the contents removes a HUGE benefit of debugability,
> being able to see the traffic in plaintext, that part which made HTTP
> so successful.

So right!

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From w@1wt.eu  Tue Feb 22 11:28:49 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF1B23A6884 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:28:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.893
X-Spam-Level: 
X-Spam-Status: No, score=-1.893 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wmXN3RRkTls3 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:28:49 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id A76233A6811 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:28:48 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1MJTQqU005731; Tue, 22 Feb 2011 20:29:26 +0100
Date: Tue, 22 Feb 2011 20:29:25 +0100
From: Willy Tarreau <w@1wt.eu>
To: =?iso-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
Message-ID: <20110222192925.GA5686@1wt.eu>
References: <1297443821.2401.147.camel@ds9.ducksong.com> <4D6368A7.4080405@ericsson.com> <1298387238.2498.133.camel@ds9.ducksong.com> <AANLkTinHRzfP-5BBHqRYPs5yzs7BYKpPaYJ1fFWxJDp+@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTinHRzfP-5BBHqRYPs5yzs7BYKpPaYJ1fFWxJDp+@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org
Subject: Re: [hybi] -05: Overly restrictive with "Connection"
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 19:28:50 -0000

On Tue, Feb 22, 2011 at 08:14:03PM +0100, Iñaki Baz Castillo wrote:
> Please, focus the WebSocket handshake as an extension to HTTP rather
> than as a new protocol.

I may be wrong, but I'm sure that both Ian as the editor and the Chairs
would appreciate that such requests come with proposed changes instead
of remaining just requests. Touching the draft seems to be a tough work
and it could probably be much less with more contributions.

Regards,
Willy


From ibc@aliax.net  Tue Feb 22 11:30:42 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ABEC03A6800 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:30:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Wo8n3aDjcHi for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:30:42 -0800 (PST)
Received: from mail-qw0-f66.google.com (mail-qw0-f66.google.com [209.85.216.66]) by core3.amsl.com (Postfix) with ESMTP id CCBA13A6884 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:30:41 -0800 (PST)
Received: by qwb7 with SMTP id 7so427816qwb.1 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:31:26 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.241.196 with SMTP id lf4mr2290840qcb.284.1298403086043; Tue, 22 Feb 2011 11:31:26 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Tue, 22 Feb 2011 11:31:25 -0800 (PST)
In-Reply-To: <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>
Date: Tue, 22 Feb 2011 20:31:25 +0100
Message-ID: <AANLkTik6Dom17cUB0UxBisQhbnKJmErTo53Ozj-Gcw5q@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: ifette@google.com
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 19:30:42 -0000

2011/2/21 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) <ifette@google.com>:
>> 1. What attack scenario is the computation part of the handshake?
>
> it was a design goal to ensure that the endpoint actually parsed the
> handshake. By performing computation this is demonstrated to a satisfacto=
ry
> level. Simply regurgitating a fixed response (your magic string) doesn't
> show that the endpoint actually parsed anything.

And what is the benefict of knowing that the server has parsed something?
If the server replies 101 with a "magic string", is it not enough to
ensure that the server wants to behave as a WebSocket server?
Anyone desiring to behave as a websocket server can perform such
computation, so...


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From w@1wt.eu  Tue Feb 22 11:43:15 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C0773A6877 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:43:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.843
X-Spam-Level: 
X-Spam-Status: No, score=-1.843 tagged_above=-999 required=5 tests=[AWL=-0.100, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iobYHLoqS1IC for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 11:43:14 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 17B083A67D2 for <hybi@ietf.org>; Tue, 22 Feb 2011 11:43:13 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1MJhnn7005849; Tue, 22 Feb 2011 20:43:49 +0100
Date: Tue, 22 Feb 2011 20:43:49 +0100
From: Willy Tarreau <w@1wt.eu>
To: =?iso-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
Message-ID: <20110222194349.GB5686@1wt.eu>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTik6Dom17cUB0UxBisQhbnKJmErTo53Ozj-Gcw5q@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTik6Dom17cUB0UxBisQhbnKJmErTo53Ozj-Gcw5q@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 19:43:15 -0000

On Tue, Feb 22, 2011 at 08:31:25PM +0100, Iñaki Baz Castillo wrote:
> 2011/2/21 Ian Fette (????????????????????????) <ifette@google.com>:
> >> 1. What attack scenario is the computation part of the handshake?
> >
> > it was a design goal to ensure that the endpoint actually parsed the
> > handshake. By performing computation this is demonstrated to a satisfactory
> > level. Simply regurgitating a fixed response (your magic string) doesn't
> > show that the endpoint actually parsed anything.
> 
> And what is the benefict of knowing that the server has parsed something?
> If the server replies 101 with a "magic string", is it not enough to
> ensure that the server wants to behave as a WebSocket server?
> Anyone desiring to behave as a websocket server can perform such
> computation, so...

Iñaki, please consult the archives. Many persons had different opinions
on various points related to the security around the handshake and the
masking, and reopening this can of worms is something terribly painful
for everyone. We managed to reach a rough consensus, nobody's fighting
anymore so let's not re-discuss the pros and cons of every choice, please.
Also, you may find that when reading everyone's opinion and experience,
you will change your mind multiple times along the learning of the various
cases, and there's nothing wrong with that, so it's an interesting exercise
anyway.

Thank you,
Willy


From ibc@aliax.net  Tue Feb 22 12:16:23 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CCAF3A6891 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 12:16:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a0ru4Nfha-vC for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 12:16:22 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 2C97B3A68A3 for <hybi@ietf.org>; Tue, 22 Feb 2011 12:16:21 -0800 (PST)
Received: by qwh6 with SMTP id 6so1706359qwh.31 for <hybi@ietf.org>; Tue, 22 Feb 2011 12:17:06 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.88.200 with SMTP id b8mr2333802qcm.246.1298405826397; Tue, 22 Feb 2011 12:17:06 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Tue, 22 Feb 2011 12:17:06 -0800 (PST)
In-Reply-To: <20110222194349.GB5686@1wt.eu>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTik6Dom17cUB0UxBisQhbnKJmErTo53Ozj-Gcw5q@mail.gmail.com> <20110222194349.GB5686@1wt.eu>
Date: Tue, 22 Feb 2011 21:17:06 +0100
Message-ID: <AANLkTikXKbesnH9WrQ_N0BkFkDuHKFvEB2vh0V2TeBC6@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 20:16:23 -0000

2011/2/22 Willy Tarreau <w@1wt.eu>:
> I=C3=B1aki, please consult the archives. Many persons had different opini=
ons
> on various points related to the security around the handshake and the
> masking, and reopening this can of worms is something terribly painful
> for everyone. We managed to reach a rough consensus, nobody's fighting
> anymore so let's not re-discuss the pros and cons of every choice, please=
.
> Also, you may find that when reading everyone's opinion and experience,
> you will change your mind multiple times along the learning of the variou=
s
> cases, and there's nothing wrong with that, so it's an interesting exerci=
se
> anyway.

Hi, as a suggestion it would be very useful if the draft itself, or a
FAQ section somewhere in a web, would describe the arguments so many
times discussed in the maillist. Checking the maillist archives is not
so easy for people recently interested in WebSocket protocol.

For example, I read the revision 05 of the new draft and I find no
reasons at all for the client-to-server masking, neither for the
complex handshake. Neither I find a simple Changelog section in the
draft so I don't know which exact changes have ocurred in the revision
101 of the draft!

You can redirect people to maillist archives but that will never be a
suitable solution for newcomers. Reasons must be documented, not just
discussed (IMHO). If Websocket becomes a RFC this year, we can not
expect that people reading it two years later would check the maillist
archives to understand the motivations of the protocol.

Please, don't take me wrong ;)
Cheers.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From w@1wt.eu  Tue Feb 22 12:28:28 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 622163A6938 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 12:28:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.818
X-Spam-Level: 
X-Spam-Status: No, score=-1.818 tagged_above=-999 required=5 tests=[AWL=-0.075, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cG6CDbHX0aYa for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 12:28:27 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id BB7EB3A68C6 for <hybi@ietf.org>; Tue, 22 Feb 2011 12:28:25 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1MKSbuB006340; Tue, 22 Feb 2011 21:28:37 +0100
Date: Tue, 22 Feb 2011 21:28:37 +0100
From: Willy Tarreau <w@1wt.eu>
To: =?iso-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
Message-ID: <20110222202837.GD5686@1wt.eu>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTik6Dom17cUB0UxBisQhbnKJmErTo53Ozj-Gcw5q@mail.gmail.com> <20110222194349.GB5686@1wt.eu> <AANLkTikXKbesnH9WrQ_N0BkFkDuHKFvEB2vh0V2TeBC6@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTikXKbesnH9WrQ_N0BkFkDuHKFvEB2vh0V2TeBC6@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 20:28:28 -0000

On Tue, Feb 22, 2011 at 09:17:06PM +0100, Iñaki Baz Castillo wrote:
> 2011/2/22 Willy Tarreau <w@1wt.eu>:
> > Iñaki, please consult the archives. Many persons had different opinions
> > on various points related to the security around the handshake and the
> > masking, and reopening this can of worms is something terribly painful
> > for everyone. We managed to reach a rough consensus, nobody's fighting
> > anymore so let's not re-discuss the pros and cons of every choice, please.
> > Also, you may find that when reading everyone's opinion and experience,
> > you will change your mind multiple times along the learning of the various
> > cases, and there's nothing wrong with that, so it's an interesting exercise
> > anyway.
> 
> Hi, as a suggestion it would be very useful if the draft itself, or a
> FAQ section somewhere in a web, would describe the arguments so many
> times discussed in the maillist. Checking the maillist archives is not
> so easy for people recently interested in WebSocket protocol.

I know, and I too asked if we could add a FAQ section to the draft, but
it seems like it's not the best place to put it. Rest assured I'm not
taking you wrong, I'm just trying to ensure we don't discourage our
editor with many "please do this/that" when there's still so much work
in the pipe !

Cheers,
Willy


From salvatore.loreto@ericsson.com  Tue Feb 22 12:55:39 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B764F3A6939 for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 12:55:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.449
X-Spam-Level: 
X-Spam-Status: No, score=-106.449 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7CVLr474HuJN for <hybi@core3.amsl.com>; Tue, 22 Feb 2011 12:55:38 -0800 (PST)
Received: from mailgw10.se.ericsson.net (mailgw10.se.ericsson.net [193.180.251.61]) by core3.amsl.com (Postfix) with ESMTP id 37C043A68F4 for <hybi@ietf.org>; Tue, 22 Feb 2011 12:55:37 -0800 (PST)
X-AuditID: c1b4fb3d-b7c78ae000005844-9b-4d6422f6dd26
Received: from esessmw0197.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw10.se.ericsson.net (Symantec Mail Security) with SMTP id 07.48.22596.6F2246D4; Tue, 22 Feb 2011 21:56:22 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0197.eemea.ericsson.se (153.88.115.88) with Microsoft SMTP Server id 8.2.234.1; Tue, 22 Feb 2011 21:56:21 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id 7E7682595; Tue, 22 Feb 2011 22:56:22 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 484AD50844; Tue, 22 Feb 2011 22:56:22 +0200 (EET)
Received: from Salvatore-Loretos-MacBook-Pro.local (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 7F25F504B1; Tue, 22 Feb 2011 22:56:21 +0200 (EET)
Message-ID: <4D6422F5.4080207@ericsson.com>
Date: Tue, 22 Feb 2011 22:56:21 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: =?UTF-8?B?ScOxYWtpIEJheiBDYXN0aWxsbw==?= <ibc@aliax.net>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTik6Dom17cUB0UxBisQhbnKJmErTo53Ozj-Gcw5q@mail.gmail.com>	<20110222194349.GB5686@1wt.eu> <AANLkTikXKbesnH9WrQ_N0BkFkDuHKFvEB2vh0V2TeBC6@mail.gmail.com>
In-Reply-To: <AANLkTikXKbesnH9WrQ_N0BkFkDuHKFvEB2vh0V2TeBC6@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Cc: "hybi@ietf.org" <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Feb 2011 20:55:39 -0000

On 2/22/11 10:17 PM, IÃ±aki Baz Castillo wrote:
> 2011/2/22 Willy Tarreau<w@1wt.eu>:
>> IÃ±aki, please consult the archives. Many persons had different opinions
>> on various points related to the security around the handshake and the
>> masking, and reopening this can of worms is something terribly painful
>> for everyone. We managed to reach a rough consensus, nobody's fighting
>> anymore so let's not re-discuss the pros and cons of every choice, please.
>> Also, you may find that when reading everyone's opinion and experience,
>> you will change your mind multiple times along the learning of the various
>> cases, and there's nothing wrong with that, so it's an interesting exercise
>> anyway.
> Hi, as a suggestion it would be very useful if the draft itself, or a
> FAQ section somewhere in a web, would describe the arguments so many
> times discussed in the maillist. Checking the maillist archives is not
> so easy for people recently interested in WebSocket protocol.
if we find volunteers to write down a FAQ we can host it on
http://trac.tools.ietf.org/wg/hybi/trac/wiki

people interested in contributing can contact me privately

> For example, I read the revision 05 of the new draft and I find no
> reasons at all for the client-to-server masking, neither for the
> complex handshake. Neither I find a simple Changelog section in the
> draft so I don't know which exact changes have ocurred in the revision
> 101 of the draft!

that is a good suggestion,
we will insert a Changelog section from the 06 version on...


cheers
/Sal

-- 
Salvatore Loreto
www.sloreto.com


> You can redirect people to maillist archives but that will never be a
> suitable solution for newcomers. Reasons must be documented, not just
> discussed (IMHO). If Websocket becomes a RFC this year, we can not
> expect that people reading it two years later would check the maillist
> archives to understand the motivations of the protocol.
>
> Please, don't take me wrong ;)
> Cheers.


From silvio.ventres@gmail.com  Wed Feb 23 11:34:57 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F0DB3A6A2E for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 11:34:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.999
X-Spam-Level: 
X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[AWL=-0.400, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fHyddmzHM5jE for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 11:34:55 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 569043A6A22 for <hybi@ietf.org>; Wed, 23 Feb 2011 11:34:55 -0800 (PST)
Received: by vxa40 with SMTP id 40so2647438vxa.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 11:35:42 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=FpPlysrWQsMZtUZrGjmSqe1RnDc4UFlUcWkzUJU96dQ=; b=uQIVkFqB14Lah6V1IckpTVoAev7GxfFmyWyBh35lU9j4kPbk7E0rU7VXF1cBL7HUcI WJuQvwlY1+aSYlgfiP0BcCqkg9vwzSoR7h0ZKFezCOohBmOFG8MerBp2NVN6qPYzOA84 gqjr1wuYPcut5AaO7c98e+VFCrYVP5FYQeyEI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=l/hHNb1Q4H+sxYdI5tsLnd7wFjcuo/GuQYb8ryrSV3rsQNv/cliA5BZF/jyaRT4JxF 4kgEXdHa1szaW5QOt29w05eNeO+V7ksQrZ6glMruWDrGrBM5axMhqi0/BCYTZom94BC6 FsmWOv/eD/iu2Nd0byxkohrMDOeuh/POBGV2Y=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr6847257vdb.281.1298489725447; Wed, 23 Feb 2011 11:35:25 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 11:35:25 -0800 (PST)
In-Reply-To: <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>
Date: Wed, 23 Feb 2011 21:35:25 +0200
Message-ID: <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com, Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 19:34:57 -0000

Hello, Ian, Andy.

It took quite a long time to read the archives more extensively, but
it seems an exhaustive read cannot be done, since there is not
information before hybi-merge in 2009.
In any case, as the Author of the draft, you are supposed to have been
pursuaded by the discussion and be able to answer questions regarding
the draft, instead of saying
"read the archives". The "archives" answer is a dangerous precedent
that creates a huge barrier to discussion entry for anyone not
involved in the discussion from the start.
You wouldn't tell someone that wants to ask for clarification of goals
behind some law to go read the whole history of the law and it's
discussions in the Congress to enter
into discussion about it. You are the unique person that should be
able to clearly summarize why any and all features of the standard
exist in its current iteration. This is
the responsibility of the Author, and it cannot be simply pushed away.

In any case, here is a preliminary analysis of the current state of affairs.
It's a bit of a long read, but is intended to clarify any and all
goals behind the possible and actual protocol implementations.

Please comment when time allows.

========================================================================================
Hypertext Bidirectional protocol state-of-affairs analysis draft
====

Let's start from the beginning so the goals of the protocol can be
clearly mapped out and defined well.

>From the point of view of benevolent application developer, access to
TCP-style send()/recv() functions
is the best possible way to interact with the various non-HTTP data
sources, especially chat-type services.
The Web Browser, then, takes the role of frontend for applications
that have full network access, with
standard limitations such as amount of connections in CONNECTING state etc.

This gives ability for the Web developer to implement innovative apps
such as chats directly connecting
to IRC servers, IM services with direct connection to each IM server -
Aol, GTalk, Jabber, VoIP-support
services directly talking to SIP/TCP peers, and, possibly, using the
new audio/video tags to interact with
media, even P2P and other file transfer protocols. With such
capability, possibilities for innovation are vast.

The problem here is, that the client "Web Surfer" is, mostly, naive
about whom to trust.
He might go to cnn.com to see the news, but also to *warez*.com to
download "free" apps.
He might also visit various blogs which source their ads externally,
and thus, unknowingly visit
google-analytics.com as well as ads.doubleclick.net and others.

Given full unrestricted access to TCP sockets, these data sources
might cause the browser application
to participate in various actions not condoned by the Web Surfer, such
as trying to send spam through SMTP,
or mounting cyber-attacks on various services. These actions in
general will be from now on called "attacks".

Given the empirical effectiveness of the same-origin policy, it should
be clarified that the attacks
are unlikely to target the same subdomain that serves the webpage html source.

Another clarification to be made is that, excluding
security-compromised servers, the malicious scripts
written to mount the attacks are unlikely to come from the actualy
subdomain, as compared to externally
sourced resources, such as ad mechanisms.

So, from the point of view of responsible party, the solutions are as follow:

1. Push responsibility to the user = Web Surfer:
   Disallow socket access unless user has acknowledged such with full
understanding of the consequences.

2. Push responsibility to the web developer:
   Prevent socket access from being initiated from externally-sourced scripts.

3. Push responsibility to the protocol-implementation developer:
   Mangle control and/or data packets to prevent compatibility with
other protocols.

The question then is whether 1+2 are enough to stop most of the
attacks, and if the web developer can be
trusted to issue socket calls. Indeed, there is a mechanism to verify
web developer's trust, which is
widely used in practice, HTTPS certificate verification.

The solution should thus implement one or more of the following precautions:

--
1. Prevent socket-based actions from targeting external hosts

Possible implementation:
   Java/Flash/Silverlight implement this, with external-hosted
crossdomain.xml exception list

Pros:
   This prevents most of the attacks, and is proven to work empirically

Cons:
   This solution prevents most of the services mentioned above,
disallowing external data source interaction


--
2. Prevent socket-based actions from external/untrusted sources from
being executed

Possible implementation:
   This might be implemented as an explicit <script
uses-socket-api=function_name> parameter in the <head>
   section, which would only allow the named function to access the
socket-api. If any function tries to
   use the socket-api, the name will be verified against the name
given in the header.
   Trusted/untrusted sources can be differentiated with HTTPS
certificate verification. Only verified
   hosts will be then able to use the "uses-socket-api" attribute.
This can be combined with white-lists
   maintained by the browser developers, such as the anti-phishing filters.

Pros:
   This allows web developer to protect socket calls from being
executed from unintended sources, such as
   comment fields, ads, analytics scripts and various other resources
loaded from external sources.
   With HTTPS Certificate verification, there is low chance of web
developer authoring malicious scripts.

Cons:
   This still leaves open the ability of the web developer himself to
write scripts that mount attacks,
   although it is mitigated by HTTPS Certificate verification.


--
2a. Provide ability for users to log socket accesses and a central
repository for CA complaints

Possible implementation:
   A button named "Report communications from this website" can be
provided to log access and initiate
   a process to verify claims with the Certificate Authority.

Pros:
   Allows proactive users to take part in removing bad websites from
"trusted" lists.

Cons:
   Mostly-manual process, expensive both for users and report-analysing parties.

--
3. Make user explicitly confirm any/dangerous socket-based action

Possible implementation:
   Push the burden of explanation on the web developer. Have a
"reason="Connecting to IRC server" type
   explanation for each socket call to a different host. Ask user
every time a connection is being made,
   providing explanation. Provide "Allow Always" or "Allow next 60min"
answers in addition to "Allow/Deny".
   Provide a clear "Stop communications" button to the user.

Pros:
   Limits undesired activity by making user explicitly acknowledge it.

Cons:
   Pushes the responsibility from web developer to the Web Surfer, who
might be clueless and press
   "Allow Always" just to not be bothered.


--
4. Use a specific connection-starting handshake, incompatible with any others.

Possible implementation:
   Make sure the data cannot be sent until an elaborate handshake is
completed, can be done with various
   challenges, such as magic strings, crypto-challenges, making sure
only a compatible WS-server will pass.

Pros:
   Limits undesired activity to handshake-implementing hosts, making
sure no non-WS services will be sent
   any user-specified data, limiting the attack vector to the
handshake itself, which is controlled by the
   WS implementation in browser.

Cons:
   The handshake makes development of services interconnecting with
non-HTTP/WS peers impossible in practice.
   Thus, instead of allowing wild innovation, the solution simply
replaces the COMET hacks currently in use.
   Depending on handshake complexity, may add unnecessary
computational burden on WS-compatible services.


--
5. Use a specific data-transfer protocol, incompatible with any others.

Possible implementation:
   Use any randomized obfuscation technique to remove correlation
between the plaintext data transferred and the
   data seen in the packet on the line. Methods such as XOR, crypto
ciphers, permutation tables can be used with
   a key randomized by an entity beyond control of the user api, such
as WS client implementation.

Pros:
   Limits undesired activity to WS-speaking hosts, in similar way to
solution number (4). In comparison,
   does not depend on handshake test, instead making sure that even if
test is passed, the transferred data
   cannot in principle be parsed meaningfully by the non-WS speaking services.


Cons:
   In the same way as number (4), prevents interoperation with non-WS
services thus limiting innovation in practice.
   Depending on obfuscation complexity, puts considerable burden on
WS-speaking hosts.
   Removes ability to debug protocol completely without special
support for protocol-debugging tools, thus
   making it more probable that debugging will not be done correctly
on WS services and clients and ensuring
   implementations with large amounts of bugs.


Please feel free to add to the list of these solutions, as well as
clarifications for the problem definitions above.

----------------

New Protocol proposal
---------------------

>From the standpoint of the above, it seems that certain-level SSL
Certificate-backed "trusted-sources-only" full
socket api can be provided without significant security risks
involved. The responsibility can be clearly mapped
to the Certificate owner, whose real-world details should be on-file
with the issuing CA.
This would allow all kinds of innovative services interoperating with
the multiple modern non-HTTP protocols.
The protocol would implement solutions (2) and (3) with optional (2a)
for user communication with CA's.


Web Sockets analysis based on above
-----------------------------------

(This part is per its current definition = version 5 of draft authored
by Ian Fette.)

The WS protocol implements solutions (4) and (5), although the goals
of the solutions are basically the same.
The reasoning behind (5) is, thus, not to remove interoperability with
non-WS protocols, but to prevent
confusion with legacy HTTP speaking hosts. This can be done by using
CONNECT header, as was shown by Adam Barth.
Thus, solution (5) has no real goal within WS, adding considerable
complexity to the protocol and removing debug
capability.
Thus, it is recommended to remove solution (5) from WS, and use
CONNECT header instead.

It is also hard to imagine a non-WS protocol that would be able to
answer a handshake with a WS-specific magic
string. The argument that a WS service "should prove header parsing"
has no real purpose. Parsing headers to
pass the initial handshake does NOT ensure the parsed information will
be used in further processing. Indeed,
a separate WS-compliant library can be used by most services to pass
the handshake and do whatever internal
processing that was designed by the service author.
Thus, it is recommended to remove the complex solution for (4) and use
a simple magic-string based handshake.


Thoughts on HTTP compatibility/incompatibility goal
---------------------------------------

Regarding HTTP implementation overall, while the goals included
incompatibility with HTTP, for some reason it
was decided to use HTTP-compatible initial handshake. The goal, it
seems, is to allow the HTTP port (80/443)
to be multiplexed between the actual HTTP server and a WS server.
Although the idea is fascinating, if WS is
really a different protocol, why isn't it allocated a new TCP port,
especially if the actual protocol is meant
to be incompatible? The theoretical goal might have been to use
persistent script interpreters to service both
HTTP and WS requests, but in practice, the WS servers are generally
answered by services running separately
from the generic HTTP server parts.


Thoughts on framing in application layer
----------------------------

The current API provides the client script an onmessage() event
callback to read received data.
Thus, let's consider the server sending 1MB of data to the web browser.
To reduce the latency, the server may send the data without waiting
for the whole 1MB buffer to
fill. In that case the client will be notified with several
onmessage() callbacks.

If the client has capability to work with the incomplete data, it will
be able to process the
data provided. In case the client does not have this capability there
is no point for the server
to send the data in parts.

When a client is expecting a large input from the server, it will do
its own input buffering and,
if implemented, will show the user incomplete data to reduce visible
latency. The information
regarding when the data is considered complete is something that
application developer should decide.

If the maximal transfer block is to be limited, then client's API
should be extended to allow
browser to do internal buffering, but the completion control should
not be taken from the application
developer.



==================================================

--
 silvio

From ifette@google.com  Wed Feb 23 11:54:45 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 857263A6A24 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 11:54:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.49
X-Spam-Level: 
X-Spam-Status: No, score=-106.49 tagged_above=-999 required=5 tests=[AWL=1.186, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, GB_I_LETTER=-2, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JH7BzuYHUMEJ for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 11:54:41 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id D35193A6940 for <hybi@ietf.org>; Wed, 23 Feb 2011 11:53:49 -0800 (PST)
Received: from hpaq11.eem.corp.google.com (hpaq11.eem.corp.google.com [172.25.149.11]) by smtp-out.google.com with ESMTP id p1NJsaEU013216 for <hybi@ietf.org>; Wed, 23 Feb 2011 11:54:36 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298490877; bh=vTKJccKg05zR95ylLXhdJ06Fulg=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=yyK2nBEtMnIG/HJ4St/BjF18vCZ7R+MS2c3mgUvyL8Q3thPZOEhaYnRFmzJ3ps3qO fT9ZY0RiBL5cJzpCwjnfA==
Received: from iyb26 (iyb26.prod.google.com [10.241.49.90]) by hpaq11.eem.corp.google.com with ESMTP id p1NJrW0e017133 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 11:54:34 -0800
Received: by iyb26 with SMTP id 26so3003764iyb.19 for <hybi@ietf.org>; Wed, 23 Feb 2011 11:54:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=VA209xfYLkgCpOAjst0ZywN6r8F32fmAfM1mZSnKggQ=; b=n7BDGlCwfcv98g+rgNydYEcJkOiuF3+DWgk+jm1Sc52NVKcpkb76NPGAtPjhj4pina /JRf3/nc7Wl2JQnT3mWQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=jLJR2OPWooGmcth9z9UQn4T3PxTOEgYQ6ddDTFZAzer1P+WJ5Q5GMxUPZSn845sOWt +Feq2HyakKodglgNgv8A==
MIME-Version: 1.0
Received: by 10.231.200.134 with SMTP id ew6mr3482122ibb.164.1298490867554; Wed, 23 Feb 2011 11:54:27 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Wed, 23 Feb 2011 11:54:27 -0800 (PST)
In-Reply-To: <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>
Date: Wed, 23 Feb 2011 11:54:27 -0800
Message-ID: <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=90e6ba181c28e799b2049cf87620
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 19:54:45 -0000

--90e6ba181c28e799b2049cf87620
Content-Type: text/plain; charset=UTF-8

On Wed, Feb 23, 2011 at 11:35 AM, Silvio Ventres
<silvio.ventres@gmail.com>wrote:

> Hello, Ian, Andy.
>
> It took quite a long time to read the archives more extensively, but
> it seems an exhaustive read cannot be done, since there is not
> information before hybi-merge in 2009.
> In any case, as the Author of the draft, you are supposed to have been
> pursuaded by the discussion and be able to answer questions regarding
> the draft, instead of saying
> "read the archives". The "archives" answer is a dangerous precedent
> that creates a huge barrier to discussion entry for anyone not
> involved in the discussion from the start.
> You wouldn't tell someone that wants to ask for clarification of goals
> behind some law to go read the whole history of the law and it's
> discussions in the Congress to enter
> into discussion about it.


Actually, that's exactly what happens when cases go to court. Some minimally
paid paralegal does a ton of research on the law, its intent as best as it
can be divined, its interpretation via various courts... letters to
congressmen asking them to explain all the history and rationale of a law
from a random lawyer tend not to get answered afaik :)


You are the unique person that should be
> able to clearly summarize why any and all features of the standard
> exist in its current iteration. This is
> the responsibility of the Author, and it cannot be simply pushed away.
>
>
That doesn't scale, sadly. I do agree that we want people to be able to
participate in the discussion, but if a new person shows up every week and
wants to re-open debate on things that took us months to move past, at some
point that's not a scalable solution.


> In any case, here is a preliminary analysis of the current state of
> affairs.
> It's a bit of a long read, but is intended to clarify any and all
> goals behind the possible and actual protocol implementations.
>
> Please comment when time allows.
>
>
> ========================================================================================
> Hypertext Bidirectional protocol state-of-affairs analysis draft
> ====
>
> Let's start from the beginning so the goals of the protocol can be
> clearly mapped out and defined well.
>
> From the point of view of benevolent application developer, access to
> TCP-style send()/recv() functions
> is the best possible way to interact with the various non-HTTP data
> sources, especially chat-type services.
> The Web Browser, then, takes the role of frontend for applications
> that have full network access, with
> standard limitations such as amount of connections in CONNECTING state etc.
>
> This gives ability for the Web developer to implement innovative apps
> such as chats directly connecting
> to IRC servers, IM services with direct connection to each IM server -
> Aol, GTalk, Jabber, VoIP-support
> services directly talking to SIP/TCP peers, and, possibly, using the
> new audio/video tags to interact with
> media, even P2P and other file transfer protocols. With such
> capability, possibilities for innovation are vast.
>
>
To a point. WebSockets is designed to be a web-safe version of TCP. There
are other groups (RTC) looking at more UDP-centric version.


> The problem here is, that the client "Web Surfer" is, mostly, naive
> about whom to trust.
> He might go to cnn.com to see the news, but also to *warez*.com to
> download "free" apps.
> He might also visit various blogs which source their ads externally,
> and thus, unknowingly visit
> google-analytics.com as well as ads.doubleclick.net and others.
>
> Given full unrestricted access to TCP sockets, these data sources
> might cause the browser application
> to participate in various actions not condoned by the Web Surfer, such
> as trying to send spam through SMTP,
> or mounting cyber-attacks on various services. These actions in
> general will be from now on called "attacks".
>
>
These are a subset of the possible attacks, but sure.


> Given the empirical effectiveness of the same-origin policy, it should
> be clarified that the attacks
> are unlikely to target the same subdomain that serves the webpage html
> source.
>
> Another clarification to be made is that, excluding
> security-compromised servers, the malicious scripts
> written to mount the attacks are unlikely to come from the actualy
> subdomain, as compared to externally
> sourced resources, such as ad mechanisms.
>
> So, from the point of view of responsible party, the solutions are as
> follow:
>
> 1. Push responsibility to the user = Web Surfer:
>   Disallow socket access unless user has acknowledged such with full
> understanding of the consequences.
>

2. Push responsibility to the web developer:
>   Prevent socket access from being initiated from externally-sourced
> scripts.
>
> 3. Push responsibility to the protocol-implementation developer:
>   Mangle control and/or data packets to prevent compatibility with
> other protocols.
>
> The question then is whether 1+2 are enough to stop most of the
> attacks, and if the web developer can be
> trusted to issue socket calls. Indeed, there is a mechanism to verify
> web developer's trust, which is
> widely used in practice, HTTPS certificate verification.
>
> The solution should thus implement one or more of the following
> precautions:
>
> --
> 1. Prevent socket-based actions from targeting external hosts
>
> Possible implementation:
>   Java/Flash/Silverlight implement this, with external-hosted
> crossdomain.xml exception list
>
> Pros:
>   This prevents most of the attacks, and is proven to work empirically
>
> Cons:
>   This solution prevents most of the services mentioned above,
> disallowing external data source interaction
>
>
As you note, the cons here are a bit heavy. I also don't want to give raw
socket access, as that opens up all sorts of attack vectors. WebSockets is
designed to be safer than raw sockets, and also easier for a web author to
use (message semantics, as opposed to just "oooh, I can now recv() 20
bytes!")


>
> --
> 2. Prevent socket-based actions from external/untrusted sources from
> being executed
>
> Possible implementation:
>   This might be implemented as an explicit <script
> uses-socket-api=function_name> parameter in the <head>
>   section, which would only allow the named function to access the
> socket-api. If any function tries to
>   use the socket-api, the name will be verified against the name
> given in the header.
>   Trusted/untrusted sources can be differentiated with HTTPS
> certificate verification. Only verified
>   hosts will be then able to use the "uses-socket-api" attribute.
> This can be combined with white-lists
>   maintained by the browser developers, such as the anti-phishing filters.
>
> Pros:
>   This allows web developer to protect socket calls from being
> executed from unintended sources, such as
>   comment fields, ads, analytics scripts and various other resources
> loaded from external sources.
>   With HTTPS Certificate verification, there is low chance of web
> developer authoring malicious scripts.
>
> Cons:
>   This still leaves open the ability of the web developer himself to
> write scripts that mount attacks,
>   although it is mitigated by HTTPS Certificate verification.
>
>
Again, I don't think we want to expose /raw/ sockets. You can do all sorts
of interesting attacks that way. I may want to let arbitrary origins send me
requests, but not have to worry about intermediaries / my own servers
confusing them for other requests.


>
> --
> 2a. Provide ability for users to log socket accesses and a central
> repository for CA complaints
>
> Possible implementation:
>   A button named "Report communications from this website" can be
> provided to log access and initiate
>   a process to verify claims with the Certificate Authority.
>
> Pros:
>   Allows proactive users to take part in removing bad websites from
> "trusted" lists.
>
> Cons:
>   Mostly-manual process, expensive both for users and report-analysing
> parties.
>
>
and we tend not to favor manual / reactive approaches :)


> --
> 3. Make user explicitly confirm any/dangerous socket-based action
>
> Possible implementation:
>   Push the burden of explanation on the web developer. Have a
> "reason="Connecting to IRC server" type
>   explanation for each socket call to a different host. Ask user
> every time a connection is being made,
>   providing explanation. Provide "Allow Always" or "Allow next 60min"
> answers in addition to "Allow/Deny".
>   Provide a clear "Stop communications" button to the user.
>
> Pros:
>   Limits undesired activity by making user explicitly acknowledge it.
>
> Cons:
>   Pushes the responsibility from web developer to the Web Surfer, who
> might be clueless and press
>   "Allow Always" just to not be bothered.
>
>
prompting the user is not going to be accepted by any user agent I can
imagine. "Do you want a pony? Sure, why not!"


>
> --
> 4. Use a specific connection-starting handshake, incompatible with any
> others.
>
> Possible implementation:
>   Make sure the data cannot be sent until an elaborate handshake is
> completed, can be done with various
>   challenges, such as magic strings, crypto-challenges, making sure
> only a compatible WS-server will pass.
>
> Pros:
>   Limits undesired activity to handshake-implementing hosts, making
> sure no non-WS services will be sent
>   any user-specified data, limiting the attack vector to the
> handshake itself, which is controlled by the
>   WS implementation in browser.
>
> Cons:
>   The handshake makes development of services interconnecting with
> non-HTTP/WS peers impossible in practice.
>   Thus, instead of allowing wild innovation, the solution simply
> replaces the COMET hacks currently in use.
>   Depending on handshake complexity, may add unnecessary
> computational burden on WS-compatible services.
>
>
> --
> 5. Use a specific data-transfer protocol, incompatible with any others.
>
> Possible implementation:
>   Use any randomized obfuscation technique to remove correlation
> between the plaintext data transferred and the
>   data seen in the packet on the line. Methods such as XOR, crypto
> ciphers, permutation tables can be used with
>   a key randomized by an entity beyond control of the user api, such
> as WS client implementation.
>
> Pros:
>   Limits undesired activity to WS-speaking hosts, in similar way to
> solution number (4). In comparison,
>   does not depend on handshake test, instead making sure that even if
> test is passed, the transferred data
>   cannot in principle be parsed meaningfully by the non-WS speaking
> services.
>
>
> Cons:
>   In the same way as number (4), prevents interoperation with non-WS
> services thus limiting innovation in practice.
>   Depending on obfuscation complexity, puts considerable burden on
> WS-speaking hosts.
>

what's in -05 is not complex


>   Removes ability to debug protocol completely without special
> support for protocol-debugging tools, thus
>   making it more probable that debugging will not be done correctly
> on WS services and clients and ensuring
>   implementations with large amounts of bugs.
>
>
it's relatively easy to debug, and/or write a wireshark plugin to help you


>
> Please feel free to add to the list of these solutions, as well as
> clarifications for the problem definitions above.
>
> ----------------
>
> New Protocol proposal
> ---------------------
>
> From the standpoint of the above, it seems that certain-level SSL
> Certificate-backed "trusted-sources-only" full
> socket api can be provided without significant security risks
> involved. The responsibility can be clearly mapped
> to the Certificate owner, whose real-world details should be on-file
> with the issuing CA.
> This would allow all kinds of innovative services interoperating with
> the multiple modern non-HTTP protocols.
> The protocol would implement solutions (2) and (3) with optional (2a)
> for user communication with CA's.
>
>
>
we considered SSL-only for a while but the group wanted to be able to use
unencrypted connections. (Long story, but e.g. if schools can't examine the
contents of a stream for porn/etc, you don't get to deploy in the schools.
as an example.)

Also, #3 would never fly with UAs. #2 goes against design goals of allowing
connections from untrusted sources.

> Web Sockets analysis based on above
> -----------------------------------
>
> (This part is per its current definition = version 5 of draft authored
> by Ian Fette.)
>
> The WS protocol implements solutions (4) and (5), although the goals
> of the solutions are basically the same.
> The reasoning behind (5) is, thus, not to remove interoperability with
> non-WS protocols, but to prevent
> confusion with legacy HTTP speaking hosts. This can be done by using
> CONNECT header, as was shown by Adam Barth.
> Thus, solution (5) has no real goal within WS, adding considerable
> complexity to the protocol and removing debug
> capability.
> Thus, it is recommended to remove solution (5) from WS, and use
> CONNECT header instead.
>
> It is also hard to imagine a non-WS protocol that would be able to
> answer a handshake with a WS-specific magic
> string. The argument that a WS service "should prove header parsing"
> has no real purpose. Parsing headers to
> pass the initial handshake does NOT ensure the parsed information will
> be used in further processing. Indeed,
> a separate WS-compliant library can be used by most services to pass
> the handshake and do whatever internal
> processing that was designed by the service author.
> Thus, it is recommended to remove the complex solution for (4) and use
> a simple magic-string based handshake.
>
>
> Thoughts on HTTP compatibility/incompatibility goal
> ---------------------------------------
>
> Regarding HTTP implementation overall, while the goals included
> incompatibility with HTTP, for some reason it
> was decided to use HTTP-compatible initial handshake. The goal, it
> seems, is to allow the HTTP port (80/443)
> to be multiplexed between the actual HTTP server and a WS server.
> Although the idea is fascinating, if WS is
> really a different protocol, why isn't it allocated a new TCP port,
> especially if the actual protocol is meant
> to be incompatible?



Because in practice, if you aren't using port 80 or 443, you cannot traverse
firewalls/proxies and you lose up to a third of all your connections.


> The theoretical goal might have been to use
> persistent script interpreters to service both
> HTTP and WS requests, but in practice, the WS servers are generally
> answered by services running separately
> from the generic HTTP server parts.
>
>
> Thoughts on framing in application layer
> ----------------------------
>
> The current API provides the client script an onmessage() event
> callback to read received data.
> Thus, let's consider the server sending 1MB of data to the web browser.
> To reduce the latency, the server may send the data without waiting
> for the whole 1MB buffer to
> fill. In that case the client will be notified with several
> onmessage() callbacks.
>
>
No, a server may send the message as multiple fragments which the
browser/client will reassemble into a single message, and issue an
onmessage() callback when the full message has been received.


> If the client has capability to work with the incomplete data, it will
> be able to process the
> data provided. In case the client does not have this capability there
> is no point for the server
> to send the data in parts.
>
> When a client is expecting a large input from the server, it will do
> its own input buffering and,
> if implemented, will show the user incomplete data to reduce visible
> latency. The information
> regarding when the data is considered complete is something that
> application developer should decide.
>
> If the maximal transfer block is to be limited, then client's API
> should be extended to allow
> browser to do internal buffering, but the completion control should
> not be taken from the application
> developer.
>
>
>
> ==================================================
>
> --
>  silvio
>

--90e6ba181c28e799b2049cf87620
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 11:35 AM, Silvio Ventres=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.v=
entres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hello, Ian, Andy.<br>
<br>
It took quite a long time to read the archives more extensively, but<br>
it seems an exhaustive read cannot be done, since there is not<br>
information before hybi-merge in 2009.<br>
In any case, as the Author of the draft, you are supposed to have been<br>
pursuaded by the discussion and be able to answer questions regarding<br>
the draft, instead of saying<br>
&quot;read the archives&quot;. The &quot;archives&quot; answer is a dangero=
us precedent<br>
that creates a huge barrier to discussion entry for anyone not<br>
involved in the discussion from the start.<br>
You wouldn&#39;t tell someone that wants to ask for clarification of goals<=
br>
behind some law to go read the whole history of the law and it&#39;s<br>
discussions in the Congress to enter<br>
into discussion about it.</blockquote><div><br></div><div>Actually, that&#3=
9;s exactly what happens when cases go to court. Some minimally paid parale=
gal does a ton of research on the law, its intent as best as it can be divi=
ned, its interpretation via various courts... letters to congressmen asking=
 them to explain all the history and rationale of a law from a random lawye=
r tend not to get answered afaik :)</div>
<div><br></div><div><br></div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"> You are the =
unique person that should be<br>
able to clearly summarize why any and all features of the standard<br>
exist in its current iteration. This is<br>
the responsibility of the Author, and it cannot be simply pushed away.<br>
<br></blockquote><div><br></div><div>That doesn&#39;t scale, sadly. I do ag=
ree that we want people to be able to participate in the discussion, but if=
 a new person shows up every week and wants to re-open debate on things tha=
t took us months to move past, at some point that&#39;s not a scalable solu=
tion.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
In any case, here is a preliminary analysis of the current state of affairs=
.<br>
It&#39;s a bit of a long read, but is intended to clarify any and all<br>
goals behind the possible and actual protocol implementations.<br>
<br>
Please comment when time allows.<br>
<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
Hypertext Bidirectional protocol state-of-affairs analysis draft<br>
=3D=3D=3D=3D<br>
<br>
Let&#39;s start from the beginning so the goals of the protocol can be<br>
clearly mapped out and defined well.<br>
<br>
>From the point of view of benevolent application developer, access to<br>
TCP-style send()/recv() functions<br>
is the best possible way to interact with the various non-HTTP data<br>
sources, especially chat-type services.<br>
The Web Browser, then, takes the role of frontend for applications<br>
that have full network access, with<br>
standard limitations such as amount of connections in CONNECTING state etc.=
<br>
<br>
This gives ability for the Web developer to implement innovative apps<br>
such as chats directly connecting<br>
to IRC servers, IM services with direct connection to each IM server -<br>
Aol, GTalk, Jabber, VoIP-support<br>
services directly talking to SIP/TCP peers, and, possibly, using the<br>
new audio/video tags to interact with<br>
media, even P2P and other file transfer protocols. With such<br>
capability, possibilities for innovation are vast.<br>
<br></blockquote><div><br></div><div>To a point. WebSockets is designed to =
be a web-safe version of TCP. There are other groups (RTC) looking at more =
UDP-centric version.</div><div>=C2=A0</div><blockquote class=3D"gmail_quote=
" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

The problem here is, that the client &quot;Web Surfer&quot; is, mostly, nai=
ve<br>
about whom to trust.<br>
He might go to <a href=3D"http://cnn.com" target=3D"_blank">cnn.com</a> to =
see the news, but also to *warez*.com to<br>
download &quot;free&quot; apps.<br>
He might also visit various blogs which source their ads externally,<br>
and thus, unknowingly visit<br>
<a href=3D"http://google-analytics.com" target=3D"_blank">google-analytics.=
com</a> as well as <a href=3D"http://ads.doubleclick.net" target=3D"_blank"=
>ads.doubleclick.net</a> and others.<br>
<br>
Given full unrestricted access to TCP sockets, these data sources<br>
might cause the browser application<br>
to participate in various actions not condoned by the Web Surfer, such<br>
as trying to send spam through SMTP,<br>
or mounting cyber-attacks on various services. These actions in<br>
general will be from now on called &quot;attacks&quot;.<br>
<br></blockquote><div><br></div><div>These are a subset of the possible att=
acks, but sure.</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" sty=
le=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Given the empirical effectiveness of the same-origin policy, it should<br>
be clarified that the attacks<br>
are unlikely to target the same subdomain that serves the webpage html sour=
ce.<br>
<br>
Another clarification to be made is that, excluding<br>
security-compromised servers, the malicious scripts<br>
written to mount the attacks are unlikely to come from the actualy<br>
subdomain, as compared to externally<br>
sourced resources, such as ad mechanisms.<br>
<br>
So, from the point of view of responsible party, the solutions are as follo=
w:<br>
<br>
1. Push responsibility to the user =3D Web Surfer:<br>
 =C2=A0 Disallow socket access unless user has acknowledged such with full<=
br>
understanding of the consequences.<br>=C2=A0</blockquote><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex;">
2. Push responsibility to the web developer:<br>
 =C2=A0 Prevent socket access from being initiated from externally-sourced =
scripts.<br>
<br>
3. Push responsibility to the protocol-implementation developer:<br>
 =C2=A0 Mangle control and/or data packets to prevent compatibility with<br=
>
other protocols.<br>
<br>
The question then is whether 1+2 are enough to stop most of the<br>
attacks, and if the web developer can be<br>
trusted to issue socket calls. Indeed, there is a mechanism to verify<br>
web developer&#39;s trust, which is<br>
widely used in practice, HTTPS certificate verification.<br>
<br>
The solution should thus implement one or more of the following precautions=
:<br>
<br>
--<br>
1. Prevent socket-based actions from targeting external hosts<br>
<br>
Possible implementation:<br>
 =C2=A0 Java/Flash/Silverlight implement this, with external-hosted<br>
crossdomain.xml exception list<br>
<br>
Pros:<br>
 =C2=A0 This prevents most of the attacks, and is proven to work empiricall=
y<br>
<br>
Cons:<br>
 =C2=A0 This solution prevents most of the services mentioned above,<br>
disallowing external data source interaction<br>
<br></blockquote><div><br></div><div>As you note, the cons here are a bit h=
eavy. I also don&#39;t want to give raw socket access, as that opens up all=
 sorts of attack vectors. WebSockets is designed to be safer than raw socke=
ts, and also easier for a web author to use (message semantics, as opposed =
to just &quot;oooh, I can now recv() 20 bytes!&quot;)</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
--<br>
2. Prevent socket-based actions from external/untrusted sources from<br>
being executed<br>
<br>
Possible implementation:<br>
 =C2=A0 This might be implemented as an explicit &lt;script<br>
uses-socket-api=3Dfunction_name&gt; parameter in the &lt;head&gt;<br>
 =C2=A0 section, which would only allow the named function to access the<br=
>
socket-api. If any function tries to<br>
 =C2=A0 use the socket-api, the name will be verified against the name<br>
given in the header.<br>
 =C2=A0 Trusted/untrusted sources can be differentiated with HTTPS<br>
certificate verification. Only verified<br>
 =C2=A0 hosts will be then able to use the &quot;uses-socket-api&quot; attr=
ibute.<br>
This can be combined with white-lists<br>
 =C2=A0 maintained by the browser developers, such as the anti-phishing fil=
ters.<br>
<br>
Pros:<br>
 =C2=A0 This allows web developer to protect socket calls from being<br>
executed from unintended sources, such as<br>
 =C2=A0 comment fields, ads, analytics scripts and various other resources<=
br>
loaded from external sources.<br>
 =C2=A0 With HTTPS Certificate verification, there is low chance of web<br>
developer authoring malicious scripts.<br>
<br>
Cons:<br>
 =C2=A0 This still leaves open the ability of the web developer himself to<=
br>
write scripts that mount attacks,<br>
 =C2=A0 although it is mitigated by HTTPS Certificate verification.<br>
<br></blockquote><div><br></div><div>Again, I don&#39;t think we want to ex=
pose /raw/ sockets. You can do all sorts of interesting attacks that way. I=
 may want to let arbitrary origins send me requests, but not have to worry =
about intermediaries / my own servers confusing them for other requests.</d=
iv>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
--<br>
2a. Provide ability for users to log socket accesses and a central<br>
repository for CA complaints<br>
<br>
Possible implementation:<br>
 =C2=A0 A button named &quot;Report communications from this website&quot; =
can be<br>
provided to log access and initiate<br>
 =C2=A0 a process to verify claims with the Certificate Authority.<br>
<br>
Pros:<br>
 =C2=A0 Allows proactive users to take part in removing bad websites from<b=
r>
&quot;trusted&quot; lists.<br>
<br>
Cons:<br>
 =C2=A0 Mostly-manual process, expensive both for users and report-analysin=
g parties.<br>
<br></blockquote><div><br></div><div>and we tend not to favor manual / reac=
tive approaches :)</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
--<br>
3. Make user explicitly confirm any/dangerous socket-based action<br>
<br>
Possible implementation:<br>
 =C2=A0 Push the burden of explanation on the web developer. Have a<br>
&quot;reason=3D&quot;Connecting to IRC server&quot; type<br>
 =C2=A0 explanation for each socket call to a different host. Ask user<br>
every time a connection is being made,<br>
 =C2=A0 providing explanation. Provide &quot;Allow Always&quot; or &quot;Al=
low next 60min&quot;<br>
answers in addition to &quot;Allow/Deny&quot;.<br>
 =C2=A0 Provide a clear &quot;Stop communications&quot; button to the user.=
<br>
<br>
Pros:<br>
 =C2=A0 Limits undesired activity by making user explicitly acknowledge it.=
<br>
<br>
Cons:<br>
 =C2=A0 Pushes the responsibility from web developer to the Web Surfer, who=
<br>
might be clueless and press<br>
 =C2=A0 &quot;Allow Always&quot; just to not be bothered.<br>
<br></blockquote><div><br></div><div>prompting the user is not going to be =
accepted by any user agent I can imagine. &quot;Do you want a pony? Sure, w=
hy not!&quot;</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<br>
--<br>
4. Use a specific connection-starting handshake, incompatible with any othe=
rs.<br>
<br>
Possible implementation:<br>
 =C2=A0 Make sure the data cannot be sent until an elaborate handshake is<b=
r>
completed, can be done with various<br>
 =C2=A0 challenges, such as magic strings, crypto-challenges, making sure<b=
r>
only a compatible WS-server will pass.<br>
<br>
Pros:<br>
 =C2=A0 Limits undesired activity to handshake-implementing hosts, making<b=
r>
sure no non-WS services will be sent<br>
 =C2=A0 any user-specified data, limiting the attack vector to the<br>
handshake itself, which is controlled by the<br>
 =C2=A0 WS implementation in browser.<br>
<br>
Cons:<br>
 =C2=A0 The handshake makes development of services interconnecting with<br=
>
non-HTTP/WS peers impossible in practice.<br>
 =C2=A0 Thus, instead of allowing wild innovation, the solution simply<br>
replaces the COMET hacks currently in use.<br>
 =C2=A0 Depending on handshake complexity, may add unnecessary<br>
computational burden on WS-compatible services.<br>
<br>
<br>
--<br>
5. Use a specific data-transfer protocol, incompatible with any others.<br>
<br>
Possible implementation:<br>
 =C2=A0 Use any randomized obfuscation technique to remove correlation<br>
between the plaintext data transferred and the<br>
 =C2=A0 data seen in the packet on the line. Methods such as XOR, crypto<br=
>
ciphers, permutation tables can be used with<br>
 =C2=A0 a key randomized by an entity beyond control of the user api, such<=
br>
as WS client implementation.<br>
<br>
Pros:<br>
 =C2=A0 Limits undesired activity to WS-speaking hosts, in similar way to<b=
r>
solution number (4). In comparison,<br>
 =C2=A0 does not depend on handshake test, instead making sure that even if=
<br>
test is passed, the transferred data<br>
 =C2=A0 cannot in principle be parsed meaningfully by the non-WS speaking s=
ervices.<br>
<br>
<br>
Cons:<br>
 =C2=A0 In the same way as number (4), prevents interoperation with non-WS<=
br>
services thus limiting innovation in practice.<br>
 =C2=A0 Depending on obfuscation complexity, puts considerable burden on<br=
>
WS-speaking hosts.<br></blockquote><div><br></div><div>what&#39;s in -05 is=
 not complex</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
 =C2=A0 Removes ability to debug protocol completely without special<br>
support for protocol-debugging tools, thus<br>
 =C2=A0 making it more probable that debugging will not be done correctly<b=
r>
on WS services and clients and ensuring<br>
 =C2=A0 implementations with large amounts of bugs.<br>
<br></blockquote><div><br></div><div>it&#39;s relatively easy to debug, and=
/or write a wireshark plugin to help you</div><div>=C2=A0</div><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex;">

<br>
Please feel free to add to the list of these solutions, as well as<br>
clarifications for the problem definitions above.<br>
<br>
----------------<br>
<br>
New Protocol proposal<br>
---------------------<br>
<br>
>From the standpoint of the above, it seems that certain-level SSL<br>
Certificate-backed &quot;trusted-sources-only&quot; full<br>
socket api can be provided without significant security risks<br>
involved. The responsibility can be clearly mapped<br>
to the Certificate owner, whose real-world details should be on-file<br>
with the issuing CA.<br>
This would allow all kinds of innovative services interoperating with<br>
the multiple modern non-HTTP protocols.<br>
The protocol would implement solutions (2) and (3) with optional (2a)<br>
for user communication with CA&#39;s.<br>
<br>
<br></blockquote><div><br></div><div>we considered SSL-only for a while but=
 the group wanted to be able to use unencrypted connections. (Long story, b=
ut e.g. if schools can&#39;t examine the contents of a stream for porn/etc,=
 you don&#39;t get to deploy in the schools. as an example.)</div>
<div>=C2=A0</div><div>Also, #3 would never fly with UAs. #2 goes against de=
sign goals of allowing connections from untrusted sources.</div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc soli=
d;padding-left:1ex;">

Web Sockets analysis based on above<br>
-----------------------------------<br>
<br>
(This part is per its current definition =3D version 5 of draft authored<br=
>
by Ian Fette.)<br>
<br>
The WS protocol implements solutions (4) and (5), although the goals<br>
of the solutions are basically the same.<br>
The reasoning behind (5) is, thus, not to remove interoperability with<br>
non-WS protocols, but to prevent<br>
confusion with legacy HTTP speaking hosts. This can be done by using<br>
CONNECT header, as was shown by Adam Barth.<br>
Thus, solution (5) has no real goal within WS, adding considerable<br>
complexity to the protocol and removing debug<br>
capability.<br>
Thus, it is recommended to remove solution (5) from WS, and use<br>
CONNECT header instead.<br>
<br>
It is also hard to imagine a non-WS protocol that would be able to<br>
answer a handshake with a WS-specific magic<br>
string. The argument that a WS service &quot;should prove header parsing&qu=
ot;<br>
has no real purpose. Parsing headers to<br>
pass the initial handshake does NOT ensure the parsed information will<br>
be used in further processing. Indeed,<br>
a separate WS-compliant library can be used by most services to pass<br>
the handshake and do whatever internal<br>
processing that was designed by the service author.<br>
Thus, it is recommended to remove the complex solution for (4) and use<br>
a simple magic-string based handshake.<br>
<br>
<br>
Thoughts on HTTP compatibility/incompatibility goal<br>
---------------------------------------<br>
<br>
Regarding HTTP implementation overall, while the goals included<br>
incompatibility with HTTP, for some reason it<br>
was decided to use HTTP-compatible initial handshake. The goal, it<br>
seems, is to allow the HTTP port (80/443)<br>
to be multiplexed between the actual HTTP server and a WS server.<br>
Although the idea is fascinating, if WS is<br>
really a different protocol, why isn&#39;t it allocated a new TCP port,<br>
especially if the actual protocol is meant<br>
to be incompatible?</blockquote><div><br></div><div><br></div><div>Because =
in practice, if you aren&#39;t using port 80 or 443, you cannot traverse fi=
rewalls/proxies and you lose up to a third of all your connections.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;"> The theoretical goal migh=
t have been to use<br>
persistent script interpreters to service both<br>
HTTP and WS requests, but in practice, the WS servers are generally<br>
answered by services running separately<br>
from the generic HTTP server parts.<br>
<br>
<br>
Thoughts on framing in application layer<br>
----------------------------<br>
<br>
The current API provides the client script an onmessage() event<br>
callback to read received data.<br>
Thus, let&#39;s consider the server sending 1MB of data to the web browser.=
<br>
To reduce the latency, the server may send the data without waiting<br>
for the whole 1MB buffer to<br>
fill. In that case the client will be notified with several<br>
onmessage() callbacks.<br>
<br></blockquote><div><br></div><div>No, a server may send the message as m=
ultiple fragments which the browser/client will reassemble into a single me=
ssage, and issue an onmessage() callback when the full message has been rec=
eived.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
If the client has capability to work with the incomplete data, it will<br>
be able to process the<br>
data provided. In case the client does not have this capability there<br>
is no point for the server<br>
to send the data in parts.<br>
<br>
When a client is expecting a large input from the server, it will do<br>
its own input buffering and,<br>
if implemented, will show the user incomplete data to reduce visible<br>
latency. The information<br>
regarding when the data is considered complete is something that<br>
application developer should decide.<br>
<br>
If the maximal transfer block is to be limited, then client&#39;s API<br>
should be extended to allow<br>
browser to do internal buffering, but the completion control should<br>
not be taken from the application<br>
developer.<br>
<br>
<br>
<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
<br>
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font></blockquote></div><br>

--90e6ba181c28e799b2049cf87620--

From silvio.ventres@gmail.com  Wed Feb 23 12:43:47 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C61873A68FE for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:43:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.432
X-Spam-Level: 
X-Spam-Status: No, score=-3.432 tagged_above=-999 required=5 tests=[AWL=0.167,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6h6V4VmqfTfM for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:43:46 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 751FA3A67B2 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:43:46 -0800 (PST)
Received: by vws6 with SMTP id 6so2548217vws.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:44:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=SMLlpxrdhuqp5mkI/1SwAViV/aCd0dav6oy2UAgZQ4w=; b=G959/36yQtNgpOtfhHyJNA4+IpkIxcXtR8NFoq/pS0eAtNxG8VaPr7Mclf5KrO1i53 JUdmMICtDKhVn9d6gxEnVliDBd9MvILYziGAwKaROxTMe92Ma4ufCjYaH4KiSyTQ+J49 e0NacGv/zKmGJ2pTcV4MNZSTUCNAfoe4e03Dg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=ssR2u5YSyv0PTYh9hmtG9PuU119fluHR9QKAODZbVqh+/xavXR8reqKwXrxzQLhCNr VATgXNd9MDriKpI/aaL/D880cPiPoU8b0FwAp7qn2R9bt81hKS5VidB9EApT5XL/RiPt 5jByq/VBBIcWArsS7+b3Ud1bg9IA5IQsqyoKE=
MIME-Version: 1.0
Received: by 10.52.166.7 with SMTP id zc7mr6992561vdb.241.1298493873853; Wed, 23 Feb 2011 12:44:33 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 12:44:33 -0800 (PST)
In-Reply-To: <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
Date: Wed, 23 Feb 2011 22:44:33 +0200
Message-ID: <AANLkTinr47xnYOj5Zq_Cyz53O+bwR3-VNzey0UT4wieb@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 20:43:47 -0000

> That doesn't scale, sadly. I do agree that we want people to be able to
> participate in the discussion, but if a new person shows up every week an=
d
> wants to re-open debate on things that took us months to move past, at so=
me
> point that's not a scalable solution.

The request is mostly: "Clarify why this is so" and not really a debate.
The debate start after the clarification ;)


> To a point. WebSockets is designed to be a web-safe version of TCP. There
> are other groups (RTC) looking at more UDP-centric version.

WebSockets as defined now is not a "web-safe version of TCP", whatever
that means, it's a custom protocol compatible only with itself, not
unlike FTP or SSH.


[.. some attacks vectors skipped ..]

> These are a subset of the possible attacks, but sure.

Well, if you have examples of other attack vectors, please list them.
Otherwise it seems that the defenses were built "for fun" without a
clear understanding what they're protecting from.

[.. solution disallowing access to external hosts skipped ..]

>> Cons:
>> =A0 This solution prevents most of the services mentioned above,
>> disallowing external data source interaction
>>
>
> As you note, the cons here are a bit heavy. I also don't want to give raw
> socket access, as that opens up all sorts of attack vectors. WebSockets i=
s
> designed to be safer than raw sockets, and also easier for a web author t=
o
> use (message semantics, as opposed to just "oooh, I can now recv() 20
> bytes!")

Yes, the cons are quite heavy, that's why this solution is not the best one=
.
On the other hand the "safer than raw sockets" is not exactly true: WS
does provide
generic access to send and receive data so there is no inherent difference =
here.

[.. solution pushing responsibility to webdev, disallowing external
scripts, skipped ..]

>> Cons:
>> =A0 This still leaves open the ability of the web developer himself to
>> write scripts that mount attacks,
>> =A0 although it is mitigated by HTTPS Certificate verification.
>>
>
> Again, I don't think we want to expose /raw/ sockets. You can do all sort=
s
> of interesting attacks that way. I may want to let arbitrary origins send=
 me
> requests, but not have to worry about intermediaries / my own servers
> confusing them for other requests.

What do you mean by "confusing" ? If some script _wants_ to talk to an
IRC server,
that's not a "confusion", that's actually an intent to talk to an IRC serve=
r.
If you don't want to worry about it, run scripts only from _trusted_
sources, identified
by Certificates given by a trusted Certificate Authority. Push
responsibility for the
actions to the CA.

[.. CA complaint procedure skipped ..]

>> Cons:
>> =A0 Mostly-manual process, expensive both for users and report-analysing
>> parties.
>>
>
> and we tend not to favor manual / reactive approaches :)

Well, this is something that is an optional instrument to help the CA
vetting procedures.
It is not required in any way.

[.. asking user for approval ..]

>> Cons:
>> =A0 Pushes the responsibility from web developer to the Web Surfer, who
>> might be clueless and press
>> =A0 "Allow Always" just to not be bothered.
>>
>
> prompting the user is not going to be accepted by any user agent I can
> imagine. "Do you want a pony? Sure, why not!"

Yes, explicit user acknowledgement is improbable to be implemented safely.

[.. skipped solutions (4) and (5) dealing with custom handshake and
custom protocol-obfuscation ..]

> what's in -05 is not complex

The handshake is quite complex. Instead of a simple MAGIC-STRING, it
uses a computationally intensive algorithm.
Instead of a plaintext data transfer, it uses XOR-encoded data transfer.

First, the solutions have same goals, there's no reason to use both,
one will do.
Second, the handshake solution is fully satisfied with MAGIC-STRING.
The "pseudo-goal" to "prove header-parsing" is unreal: an author that
doesn't want to parse the header, but wants to
seem compatible with WS, will just use an external library to pass handshak=
es.


>> =A0 Removes ability to debug protocol completely without special
>> support for protocol-debugging tools, thus
>> =A0 making it more probable that debugging will not be done correctly
>> on WS services and clients and ensuring
>> =A0 implementations with large amounts of bugs.
>>
>
> it's relatively easy to debug, and/or write a wireshark plugin to help yo=
u

Really?
So you never heard of people using curl, tcpdump or plain telnet/nc to debu=
g ?
The fact is, HTTP is so prevalent today _because_ it is so easy to debug.
This is a _major_ feature of HTTP and should not be underestimated.
Moreover, by removing this feature you make it _harder_ to write
bug-free WS-compatible servers, clients and applications .
And for what ? To use GET instead of CONNECT ?


> we considered SSL-only for a while but the group wanted to be able to use
> unencrypted connections. (Long story, but e.g. if schools can't examine t=
he
> contents of a stream for porn/etc, you don't get to deploy in the schools=
.
> as an example.)

The point was not that the socket calls use SSL, but that the
socket-API-using script is downloaded and authenticated via SSL.
And while at that, are you sure that the schools like the idea of
upgrading their filters to support the new _obfuscated_ stream?
The solution can be found if the problem is specified exactly.


[.. question regarding http compatibility/incompatibility ..]

> Because in practice, if you aren't using port 80 or 443, you cannot trave=
rse
> firewalls/proxies and you lose up to a third of all your connections.

So the protocol might include an optional parameter to connect call:
connect(,,,options=3D"HTTP-compliant") if you want to us it.
It doesn't have to be a mandatory part of the protocol.


> No, a server may send the message as multiple fragments which the
> browser/client will reassemble into a single message, and issue an
> onmessage() callback when the full message has been received.

So you're simply pushing the buffering from server to the client, with
the client never being shown the incomplete data ?
What's the benefit here then ? To reduce server memory usage ?

Then why not leave the fragmentation/assembly to the operating system?
Instead of the e.g. websocket_send() function creating separate
websocket packets, let it create only one packet.
Add websocket_send_initial(), websocket_send_partial() and
websocket_send_final() functions that the server can use.
Then divide a copied websocket_send() function into the send_initial()
and send_final() and make send_partial() point to a simple TCP send().

There's no need for a separate framing procedure. Packet start/end is enoug=
h.

--
 silvio

From andy.warmcat.com@googlemail.com  Wed Feb 23 12:47:39 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 95F203A69C8 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:47:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mTXasLemRpNg for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:47:38 -0800 (PST)
Received: from mail-ww0-f42.google.com (mail-ww0-f42.google.com [74.125.82.42]) by core3.amsl.com (Postfix) with ESMTP id 3F3A23A695F for <hybi@ietf.org>; Wed, 23 Feb 2011 12:47:38 -0800 (PST)
Received: by wwi17 with SMTP id 17so5882398wwi.1 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:48:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=lg6AmO3jDFR/kNDFb1hbiAbNtLjh8b0WQtopcTx593g=; b=aifA3DjeR98uZ/mS0BjSRYTTYENS5MRQhn/KFcp7F8pakaC3MrlsxCuJw8ErST1J74 h16e+IMP2gBDhgj4NeNTpjOy5BN3VArDmuNmtBhugox4tvbgBWZtc712OFA0boE5LDNb gPTI3P+CFa5toCRBbJKF5umgVq3G1OmiSPTp4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=IEl2FaoL3GNfLyDmbmfNW8BQJECFUJjYMzNOdKQrhR5lxADaIAYZAZ/G0QYvgkdW9H wL27hFLcbRRocO/fMpdyPI3lESPSsca7BcCbMGaQnEiiEFu28C+sZb1OSI2l+VsP39V1 jJcD3pzmMnsMcMLSkoMNXq54Ev9gQpmoUiIpg=
Received: by 10.227.72.129 with SMTP id m1mr4174478wbj.47.1298494105441; Wed, 23 Feb 2011 12:48:25 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id y29sm6336859wbd.16.2011.02.23.12.48.22 (version=SSLv3 cipher=OTHER); Wed, 23 Feb 2011 12:48:22 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D657294.20000@warmcat.com>
Date: Wed, 23 Feb 2011 20:48:20 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: ifette@google.com
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
In-Reply-To: <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 20:47:39 -0000

On 02/23/2011 07:54 PM, Somebody in the thread at some point said:

Hi -

>     It took quite a long time to read the archives more extensively, but
>     it seems an exhaustive read cannot be done, since there is not
>     information before hybi-merge in 2009.
>     In any case, as the Author of the draft, you are supposed to have been
>     pursuaded by the discussion and be able to answer questions regarding
>     the draft, instead of saying
>     "read the archives". The "archives" answer is a dangerous precedent

The status here at the moment is there are few pending arguments with 
05, it seems that it's quite close to "not displeasing anyone enough". 
So huge mails reassessing everything from scratch require a heart of oak 
to smile upon.

>     The current API provides the client script an onmessage() event
>     callback to read received data.
>     Thus, let's consider the server sending 1MB of data to the web browser.
>     To reduce the latency, the server may send the data without waiting
>     for the whole 1MB buffer to
>     fill. In that case the client will be notified with several
>     onmessage() callbacks.
>
> No, a server may send the message as multiple fragments which the
> browser/client will reassemble into a single message, and issue an
> onmessage() callback when the full message has been received.

To expand a bit because I didn't get how this worked at first either, 
this is the Continuation opcode / FIN bit scheme.  It's the mechanism 
for chopping a logical message (1MB in your example) into as many 
arbitrarily-sized sequential frames as you like but still be one logical 
message that doesn't complete - or notify Javascript land - until the 
last frame comes with FIN set.

The first, well, you can call it "subframe" must go with BINARY or TEXT 
and if it didn't have FIN set to end the message, subsequent subframes 
must come with CONTINUATION / FIN clear, and the last guy of the message 
is CONTINUATION with FIN set.

The scheme will enable low latency multuplexing and PING / PONG etc 
transparently independent of the size of the logical message flying around.

-Andy

From jat@google.com  Wed Feb 23 12:53:05 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 079653A6959 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:53:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.451
X-Spam-Level: 
X-Spam-Status: No, score=-104.451 tagged_above=-999 required=5 tests=[AWL=1.525, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F4ylQTT-PUUx for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:53:04 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id DC96A3A6957 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:53:03 -0800 (PST)
Received: from kpbe19.cbf.corp.google.com (kpbe19.cbf.corp.google.com [172.25.105.83]) by smtp-out.google.com with ESMTP id p1NKrn96016033 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:53:50 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298494430; bh=Hqezi04oaVUfSPNLxoVlVYdyHWQ=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=JGBTHMnjIUAV8mH2eTaVbKGJratjlCmuDPR1gb9D3tfslMonx0dEU/s89pYEDpB9+ izg80RgZB1rd/R//XwirA==
Received: from gye5 (gye5.prod.google.com [10.243.50.5]) by kpbe19.cbf.corp.google.com with ESMTP id p1NKre6h025942 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 12:53:48 -0800
Received: by gye5 with SMTP id 5so1624751gye.38 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:53:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=KYbkv90neoE2qDgFAcUroCkG9S9WnQGy4goPbAnCEcw=; b=VDs0tu7E4KRoxHFMqpzxx/8kEfQ3sv1JxIB1/5/HaKL3WXudVwyGBW1aw6kjOp12nE zC20d0ivA5gWcX2OkkyA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=ZtrvAZYWj7CAVLl841l8+jWfvt9plAEt+g4MRXjoyKxcWRHDCPSwkjhurzMMaGzWng CSIi+ajZ1OSptVpgHnqw==
Received: by 10.151.142.6 with SMTP id u6mr696480ybn.46.1298494428078; Wed, 23 Feb 2011 12:53:48 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Wed, 23 Feb 2011 12:53:28 -0800 (PST)
In-Reply-To: <4D657294.20000@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com>
From: John Tamplin <jat@google.com>
Date: Wed, 23 Feb 2011 15:53:28 -0500
Message-ID: <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: multipart/alternative; boundary=0015174bdd8020ede6049cf94b7c
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 20:53:05 -0000

--0015174bdd8020ede6049cf94b7c
Content-Type: text/plain; charset=UTF-8

On Wed, Feb 23, 2011 at 3:48 PM, Andy Green <andy@warmcat.com> wrote:

> To expand a bit because I didn't get how this worked at first either, this
> is the Continuation opcode / FIN bit scheme.  It's the mechanism for
> chopping a logical message (1MB in your example) into as many
> arbitrarily-sized sequential frames as you like but still be one logical
> message that doesn't complete - or notify Javascript land - until the last
> frame comes with FIN set.
>
> The first, well, you can call it "subframe" must go with BINARY or TEXT and
> if it didn't have FIN set to end the message, subsequent subframes must come
> with CONTINUATION / FIN clear, and the last guy of the message is
> CONTINUATION with FIN set.
>
> The scheme will enable low latency multuplexing and PING / PONG etc
> transparently independent of the size of the logical message flying around.


More importantly, fragmentation allows a server returning content of unknown
size (such as dynamically generated content or the result of compression)
without having to buffer the entire message.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--0015174bdd8020ede6049cf94b7c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 3:48 PM, Andy Green <spa=
n dir=3D"ltr">&lt;<a href=3D"mailto:andy@warmcat.com">andy@warmcat.com</a>&=
gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">To expand a bit because I didn&#39;t get how this worked =
at first either, this is the Continuation opcode / FIN bit scheme. =C2=A0It=
&#39;s the mechanism for chopping a logical message (1MB in your example) i=
nto as many arbitrarily-sized sequential frames as you like but still be on=
e logical message that doesn&#39;t complete - or notify Javascript land - u=
ntil the last frame comes with FIN set.</div>


<br>
The first, well, you can call it &quot;subframe&quot; must go with BINARY o=
r TEXT and if it didn&#39;t have FIN set to end the message, subsequent sub=
frames must come with CONTINUATION / FIN clear, and the last guy of the mes=
sage is CONTINUATION with FIN set.<br>


<br>
The scheme will enable low latency multuplexing and PING / PONG etc transpa=
rently independent of the size of the logical message flying around.</block=
quote><div><br></div><div>More importantly, fragmentation allows a server r=
eturning content of unknown size (such as dynamically generated content or =
the result of compression) without having to buffer the entire message.=C2=
=A0</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--0015174bdd8020ede6049cf94b7c--

From andy.warmcat.com@googlemail.com  Wed Feb 23 12:58:41 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D92CB3A6957 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:58:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wxXv6qhAA7vQ for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 12:58:39 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 422883A6965 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:58:38 -0800 (PST)
Received: by wyb42 with SMTP id 42so3094361wyb.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 12:59:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=hJdgX8+smeLOTwlelTVMZZGdRBburLdqgSKTGlle4cc=; b=xpyGWarUZsQmTizGK2455OGcrBskEiNp/s8iihj4fKB2JnKPrXMD4fK9EIM5N/aOpL ZMXLUFoQLm+nykiyIV2DJYWfxVvgUb31FSz+CSUukJS3a6y0L5BK8XP2wXY8WEzSAd8M li+ksgwd4ozgZfITCrW4Ea3hHAwQYshnsGYVE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=k3qswq6rT3/mhSACOO9q6/cXbI2HKY4hHL/xEZH8ieKSnTQsK0+ENJRcvD6jxnfG5z PtPfGFo8i3d+NbXew/CoMTJlKwq1sTR83fmdFX85GhUf81A/CgmUhgepDK9liLMkFb+1 in/zbdvPABl2o4MqNsL6+W9jlOC1MxiU3WAuc=
Received: by 10.227.153.21 with SMTP id i21mr4103437wbw.50.1298494765469; Wed, 23 Feb 2011 12:59:25 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id f27sm1932247wbf.19.2011.02.23.12.59.23 (version=SSLv3 cipher=OTHER); Wed, 23 Feb 2011 12:59:24 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D65752A.2020102@warmcat.com>
Date: Wed, 23 Feb 2011 20:59:22 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com>
In-Reply-To: <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 20:58:41 -0000

On 02/23/2011 08:53 PM, Somebody in the thread at some point said:

>     The scheme will enable low latency multuplexing and PING / PONG etc
>     transparently independent of the size of the logical message flying
>     around.
>
> More importantly, fragmentation allows a server returning content of
> unknown size (such as dynamically generated content or the result of
> compression) without having to buffer the entire message.

How is that going to work in the Browser / Javascript event context 
then?  AIUI you won't get a data ready callback until a frame comes with 
FIN, implying it must buffer the whole message in the browser, is that 
wrong to your understanding?

-Andy

From ifette@google.com  Wed Feb 23 13:01:08 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A6503A6A2E for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:01:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.727
X-Spam-Level: 
X-Spam-Status: No, score=-105.727 tagged_above=-999 required=5 tests=[AWL=-0.051, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JoOkxaZxvwf0 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:01:07 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 937963A6965 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:01:07 -0800 (PST)
Received: from wpaz17.hot.corp.google.com (wpaz17.hot.corp.google.com [172.24.198.81]) by smtp-out.google.com with ESMTP id p1NL1tYi025465 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:01:55 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298494915; bh=yVPPP1WYmhr/dE40NjXwlHGzZUE=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=Coc4/6ZV55sEEB6OVAKjDfBzukDaoVGreE4sD1sDWDdIScm+/akhLSChvFwws2TPM JK0vcIYouP8lmYOnsGdSQ==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by wpaz17.hot.corp.google.com with ESMTP id p1NL1rB4026079 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 13:01:54 -0800
Received: by iwl42 with SMTP id 42so5661929iwl.17 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:01:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=bXM6XiEs8SgQXXSLPQ6b14UINKqsrjq1wH1+AUqGXcw=; b=O2AJGGggGmGs8Jc44oZfSbrlqvPlETKtvKuRvMPCyGPdXoMyHPNPqIENYw7TPPt/BD gjkFQQubGqu/6eMBfCXQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=R16D/HoomafR3LEAeOAr4zHsvslvyxaphoK9hMvPMyZUr9WTRbZQBR5Xo9EfqNTzJw 4VfpBLXQZ9AzvWnqMS5Q==
MIME-Version: 1.0
Received: by 10.231.200.134 with SMTP id ew6mr3584604ibb.164.1298494913334; Wed, 23 Feb 2011 13:01:53 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Wed, 23 Feb 2011 13:01:53 -0800 (PST)
In-Reply-To: <4D65752A.2020102@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com>
Date: Wed, 23 Feb 2011 13:01:53 -0800
Message-ID: <AANLkTikD-t9c3CkQSr3MCc9hQ2Wvq83fhOS9NiH+JpKk@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Andy Green <andy@warmcat.com>
Content-Type: multipart/alternative; boundary=90e6ba181c280d5037049cf9689d
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 21:01:08 -0000

--90e6ba181c280d5037049cf9689d
Content-Type: text/plain; charset=UTF-8

On Wed, Feb 23, 2011 at 12:59 PM, Andy Green <andy@warmcat.com> wrote:

> On 02/23/2011 08:53 PM, Somebody in the thread at some point said:
>
>     The scheme will enable low latency multuplexing and PING / PONG etc
>>    transparently independent of the size of the logical message flying
>>    around.
>>
>> More importantly, fragmentation allows a server returning content of
>> unknown size (such as dynamically generated content or the result of
>> compression) without having to buffer the entire message.
>>
>
> How is that going to work in the Browser / Javascript event context then?
>  AIUI you won't get a data ready callback until a frame comes with FIN,
> implying it must buffer the whole message in the browser, is that wrong to
> your understanding?
>
> -Andy
>

A browser may buffer in memory, or may spool to disk. In either case, a user
may actually have more memory or options than a server/intermediary that's
handling hundreds of thousands of concurrent connections and just wants to
pass through data as it becomes available. 100MB may be reasonable for a
client to hold in memory but impossible for a heavily loaded front-end
server or proxy, as an example.

-Ian

--90e6ba181c280d5037049cf9689d
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 12:59 PM, Andy Green <sp=
an dir=3D"ltr">&lt;<a href=3D"mailto:andy@warmcat.com">andy@warmcat.com</a>=
&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0=
 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">On 02/23/2011 08:53 PM, Somebody in the thread at some po=
int said:<br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
 =C2=A0 =C2=A0The scheme will enable low latency multuplexing and PING / PO=
NG etc<br>
 =C2=A0 =C2=A0transparently independent of the size of the logical message =
flying<br>
 =C2=A0 =C2=A0around.<br>
<br>
More importantly, fragmentation allows a server returning content of<br>
unknown size (such as dynamically generated content or the result of<br>
compression) without having to buffer the entire message.<br>
</blockquote>
<br></div>
How is that going to work in the Browser / Javascript event context then? =
=C2=A0AIUI you won&#39;t get a data ready callback until a frame comes with=
 FIN, implying it must buffer the whole message in the browser, is that wro=
ng to your understanding?<br>
<font color=3D"#888888">
<br>
-Andy<br>
</font></blockquote></div><br><div>A browser may buffer in memory, or may s=
pool to disk. In either case, a user may actually have more memory or optio=
ns than a server/intermediary that&#39;s handling hundreds of thousands of =
concurrent connections and just wants to pass through data as it becomes av=
ailable. 100MB may be reasonable for a client to hold in memory but impossi=
ble for a heavily loaded front-end server or proxy, as an example.</div>
<div><br></div><div>-Ian</div>

--90e6ba181c280d5037049cf9689d--

From jat@google.com  Wed Feb 23 13:02:39 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED2B33A6A48 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:02:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.832
X-Spam-Level: 
X-Spam-Status: No, score=-104.832 tagged_above=-999 required=5 tests=[AWL=1.144, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RytB8wyNGv3x for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:02:38 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id C5D383A6965 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:02:37 -0800 (PST)
Received: from kpbe20.cbf.corp.google.com (kpbe20.cbf.corp.google.com [172.25.105.84]) by smtp-out.google.com with ESMTP id p1NL3OvX021114 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:03:24 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298495005; bh=GIWX1Ga3AyTdZyA1v1Dd2VAQ2fs=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=i6PmLx+OT7oXb1UDY5jgAokpOyy26dDtH+bomiJGO1WkhgGXZtfNi/diciUmHQxkS 0ZQsOJgLbNChnQqr9S3IQ==
Received: from yie30 (yie30.prod.google.com [10.243.66.30]) by kpbe20.cbf.corp.google.com with ESMTP id p1NL3MCB004657 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 13:03:22 -0800
Received: by yie30 with SMTP id 30so2486760yie.37 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:03:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=g+JZzrVm67/ExsDoZNY+GIvBzjEw5gYEiQMaEXKPU6s=; b=JTLB1KbZVHD3yHaNJfJihDNssFjDBybBYUOT2z2i/GksiQ8B7EZ8JHPc9065v4fB1b jpwgRn45qlnTvPZhkhlg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=E5PEU/2c0TP/1l4Ky0+PXsL58lH1LrDZUj8tDD4jWGgeGOdLPe0VMC/HBr9DiqCGWH AlwWQF8AsG6sh3MZdq8w==
Received: by 10.150.195.3 with SMTP id s3mr593536ybf.274.1298495002118; Wed, 23 Feb 2011 13:03:22 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Wed, 23 Feb 2011 13:03:02 -0800 (PST)
In-Reply-To: <4D65752A.2020102@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com>
From: John Tamplin <jat@google.com>
Date: Wed, 23 Feb 2011 16:03:02 -0500
Message-ID: <AANLkTinVE-TU=aNqQPP5QaxrCek1N4x8d+T0zuU+ovUa@mail.gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: multipart/alternative; boundary=000e0cd48470580a35049cf96dc3
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 21:02:39 -0000

--000e0cd48470580a35049cf96dc3
Content-Type: text/plain; charset=UTF-8

On Wed, Feb 23, 2011 at 3:59 PM, Andy Green <andy@warmcat.com> wrote:

> How is that going to work in the Browser / Javascript event context then?
>  AIUI you won't get a data ready callback until a frame comes with FIN,
> implying it must buffer the whole message in the browser, is that wrong to
> your understanding?
>

Right, I said in the server.  Ie, I can read dynamically generated content
into a fixed-size buffer, and write a fragment as it fills up.  When the
content is complete, I send a final frame.

Given the current API in the browser, yes, the browser will have to buffer
the entire message.  Perhaps in the future there will be a streaming API
available to JS, or perhaps not.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd48470580a35049cf96dc3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 3:59 PM, Andy Green <spa=
n dir=3D"ltr">&lt;<a href=3D"mailto:andy@warmcat.com">andy@warmcat.com</a>&=
gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">How is that going to work in the Browser / Javascript eve=
nt context then? =C2=A0AIUI you won&#39;t get a data ready callback until a=
 frame comes with FIN, implying it must buffer the whole message in the bro=
wser, is that wrong to your understanding<font class=3D"Apple-style-span" c=
olor=3D"#888888">?</font></div>

</blockquote></div><div><br></div>Right, I said in the server. =C2=A0Ie, I =
can read dynamically generated content into a fixed-size buffer, and write =
a fragment as it fills up. =C2=A0When the content is complete, I send a fin=
al frame.<div>

<br></div><div>Given the current API in the browser, yes, the browser will =
have to buffer the entire message. =C2=A0Perhaps in the future there will b=
e a streaming API available to JS, or perhaps not.<br clear=3D"all"><br>-- =
<br>

John A. Tamplin<br>Software Engineer (GWT), Google<br>
</div>

--000e0cd48470580a35049cf96dc3--

From andy.warmcat.com@googlemail.com  Wed Feb 23 13:09:37 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4F42F3A6A53 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:09:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8zQbad0r8g2r for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:09:36 -0800 (PST)
Received: from mail-ww0-f42.google.com (mail-ww0-f42.google.com [74.125.82.42]) by core3.amsl.com (Postfix) with ESMTP id E620C3A692B for <hybi@ietf.org>; Wed, 23 Feb 2011 13:09:35 -0800 (PST)
Received: by wwi17 with SMTP id 17so5908331wwi.1 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:10:23 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=h+uPjG6zBnG/QtAaxRevwcxmmeLtMH231T9zsdNIA2c=; b=GoSjsEUF69fA/RlH5WOPs6HIS3FG8F145ZSKBIYhMyS5FRvGsEdSnchBEI+dMcHvO9 1xg0NQOYp8Vq1vfuQjvkEDImSvSXO39IOP8VHRhgQdhOzXGNVUTyzWqjSK32AdMaPUdY yzeibIo/CpZmhFT8gnnjFLtjqn9MjIZJDt3/g=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=DczNCxfThZgT80l0Xa96r1cvJdDti3+AZdGxOE0NeUKJgYYgj76eUpvGVgN+m6MHVx gCZ8rrkNWXWByv9AO17yDXz1XFMaxyWC2+R2QAC/OqYdmM/DrPmJ3UgkqQUdIflG0ytJ AbKZvAfFPgAtq3ErBPld/C1nHcsuLyBLs5qBM=
Received: by 10.227.153.202 with SMTP id l10mr4115880wbw.173.1298495423239; Wed, 23 Feb 2011 13:10:23 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id x1sm6354838wbh.14.2011.02.23.13.10.21 (version=SSLv3 cipher=OTHER); Wed, 23 Feb 2011 13:10:22 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6577BD.3070409@warmcat.com>
Date: Wed, 23 Feb 2011 21:10:21 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinVE-TU=aNqQPP5QaxrCek1N4x8d+T0zuU+ovUa@mail.gmail.com>
In-Reply-To: <AANLkTinVE-TU=aNqQPP5QaxrCek1N4x8d+T0zuU+ovUa@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 21:09:37 -0000

On 02/23/2011 09:03 PM, Somebody in the thread at some point said:
> On Wed, Feb 23, 2011 at 3:59 PM, Andy Green <andy@warmcat.com
> <mailto:andy@warmcat.com>> wrote:
>
>     How is that going to work in the Browser / Javascript event context
>     then?  AIUI you won't get a data ready callback until a frame comes
>     with FIN, implying it must buffer the whole message in the browser,
>     is that wrong to your understanding?


 > user may actually have more memory or options than a
 > ...

> Right, I said in the server.  Ie, I can read dynamically generated
> content into a fixed-size buffer, and write a fragment as it fills up.
>   When the content is complete, I send a final frame.

Sorry I missed 'server' when I read it.  Yes that's a nice advantage too.

> Given the current API in the browser, yes, the browser will have to
> buffer the entire message.  Perhaps in the future there will be a
> streaming API available to JS, or perhaps not.

OK we are all straight then, thanks.

-Andy

From silvio.ventres@gmail.com  Wed Feb 23 13:10:41 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 213FD3A6A5D for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:10:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.956
X-Spam-Level: 
X-Spam-Status: No, score=-2.956 tagged_above=-999 required=5 tests=[AWL=-0.357, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TKg4H4VisLcf for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 13:10:35 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id DB4473A6A2C for <hybi@ietf.org>; Wed, 23 Feb 2011 13:10:34 -0800 (PST)
Received: by vxa40 with SMTP id 40so2740207vxa.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 13:11:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=vt2YPIjRhUeKZ7OhtKPACIaiP9XQAJ9M8tQ0LDTI5gs=; b=phvIvhkfqCUXMTMTwwaN7+ApRBMRR9eTyw10D+KX5QOdVL3Gra4s0Wqb5kqqPKFO2r LKoITyzGGz6tuoCDsUo71LjE8/7bNAJbtFyLC65Wq/1JLPrA5cQ1Pv4KH0tLSKgAo0zO a15+M4Ro42vIRYUSm+9PtL9L2Vn3U729BY3Ow=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=RrF+nLIZWENIHdN+LXfqtEH4Hz4MN8jFeUYDUeG64e/91R9JVoExXL0fwSJjfV2eIf +q+HOzwlS+P3+2SmB/yQSGFFOk3Wzol+1Yjneb+kXKrpXvqYQyxGCO6yE/qdh5K30NsE 1PJL18/GW9SdV2y+9LZPSGB5zAG7aQUiSdgDk=
MIME-Version: 1.0
Received: by 10.52.160.37 with SMTP id xh5mr7156108vdb.81.1298495482283; Wed, 23 Feb 2011 13:11:22 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 13:11:22 -0800 (PST)
In-Reply-To: <4D657294.20000@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com>
Date: Wed, 23 Feb 2011 23:11:22 +0200
Message-ID: <AANLkTimeeVcLDyO7b8tqhHxRbn_xoV4-KZqHQm9keV4d@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Feb 2011 21:10:41 -0000

>> No, a server may send the message as multiple fragments which the
>> browser/client will reassemble into a single message, and issue an
>> onmessage() callback when the full message has been received.
>
> To expand a bit because I didn't get how this worked at first either, thi=
s
> is the Continuation opcode / FIN bit scheme. =A0It's the mechanism for
> chopping a logical message (1MB in your example) into as many
> arbitrarily-sized sequential frames as you like but still be one logical
> message that doesn't complete - or notify Javascript land - until the las=
t
> frame comes with FIN set.
>
> The first, well, you can call it "subframe" must go with BINARY or TEXT a=
nd
> if it didn't have FIN set to end the message, subsequent subframes must c=
ome
> with CONTINUATION / FIN clear, and the last guy of the message is
> CONTINUATION with FIN set.

Thank you for the explanation Andy.
It makes sense indeed.

--
 silvio

From ibc@aliax.net  Wed Feb 23 16:12:35 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 034DD3A6933 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:12:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CnSXWZDBZ4A0 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:12:34 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id 29C3B3A6860 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:12:34 -0800 (PST)
Received: by qyk29 with SMTP id 29so3403732qyk.10 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:13:22 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr84701qcb.170.1298506401998; Wed, 23 Feb 2011 16:13:21 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Wed, 23 Feb 2011 16:13:21 -0800 (PST)
In-Reply-To: <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>
Date: Thu, 24 Feb 2011 01:13:21 +0100
Message-ID: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: ifette@google.com
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 00:12:35 -0000

2011/2/23 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) <ifette@google.com>:
> That doesn't scale, sadly. I do agree that we want people to be able to
> participate in the discussion, but if a new person shows up every week an=
d
> wants to re-open debate on things that took us months to move past, at so=
me
> point that's not a scalable solution.

Then just *document* the reasons/arguments/motivations in the draft so
newcomers would not need to re-open old discussions. But currently the
draft gives no arguments at all about several points of the
specification (neither the handshake, framing or client-to-server
masking are argumented in the draft). Such arguments should not exist
in a FAQ, but in the draft itself which should be the only required
piece of information for understanding a specification. Please don't
refer to a FAQ somewhere to complement the information.

A newcomer should be able to come tomorrow to this maillist/group,
read current draft, and understand motivations for current design of
the protocol. He could then suggest changes or improvements without
asking "why this and this and this?".

But if the draft remains as it is now, this is, without describing
motivations/reasons for its design, then the draft is not good and
IMHO shouldn't become an RFC.

Please don't take me wrong, but I'm used to read lots of drafts and
until now I've never found a draft in which a protocol is described in
the fashion "do this and don't ask why".

Regards.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Wed Feb 23 16:26:10 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B84453A659A for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:26:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ybOTF8vZeNls for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:26:09 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id 9C1FA3A6403 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:26:09 -0800 (PST)
Received: by qyk29 with SMTP id 29so3410255qyk.10 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:26:57 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.245.4 with SMTP id ls4mr68445qcb.208.1298507217294; Wed, 23 Feb 2011 16:26:57 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Wed, 23 Feb 2011 16:26:57 -0800 (PST)
In-Reply-To: <4D65752A.2020102@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com>
Date: Thu, 24 Feb 2011 01:26:57 +0100
Message-ID: <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 00:26:10 -0000

2011/2/23 Andy Green <andy@warmcat.com>:
>> More importantly, fragmentation allows a server returning content of
>> unknown size (such as dynamically generated content or the result of
>> compression) without having to buffer the entire message.
>
> How is that going to work in the Browser / Javascript event context then?

Is not the same concept as HTTP chunked transfer? do you mean that a
HTTP client receiving a 200 OK with "Transfer-Encoding: chunked" is
not able to know when the response body terminates?

For sure you are not saying that so I'm missing something :)

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From jat@google.com  Wed Feb 23 16:27:47 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C6EC33A6403 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:27:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.911
X-Spam-Level: 
X-Spam-Status: No, score=-104.911 tagged_above=-999 required=5 tests=[AWL=0.765, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TMWPyUNe37Xp for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:27:47 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 2EAAD3A659A for <hybi@ietf.org>; Wed, 23 Feb 2011 16:27:46 -0800 (PST)
Received: from hpaq6.eem.corp.google.com (hpaq6.eem.corp.google.com [172.25.149.6]) by smtp-out.google.com with ESMTP id p1O0SXge006602 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:28:33 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298507313; bh=XVW2edcLl7Yjr599bJNfDLrTtEE=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=E0hSyV513BFmLhZ5o/7iwbeH29RM4322xflFeicMMuWd+uSlmGfPcneXdHzGxbmRC bh2zj7BG0utcmonauZl2w==
Received: from yxe1 (yxe1.prod.google.com [10.190.2.1]) by hpaq6.eem.corp.google.com with ESMTP id p1O0ST3n003852 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 16:28:32 -0800
Received: by yxe1 with SMTP id 1so19205yxe.11 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:28:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=LTma7X2Qytmn5IFb3b+zgnco8GufJDBSB/l4CCxpWkg=; b=Nw4Z5BgGf2r+KgmRk3REJ54nszHNrT6a+aHn5zw2Qn5ohlgclvFOnMSFHGyqo8pXNj eBt7YGETzFlXprOuBVYQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=cOgSW0uE1IIz2ypa/yiDf6EUy7brR/fq2Xu5OXvyNTF4JFsJoXNFMD+oGyOsCBtbft mAEUXuWOvPQJtDixGHRQ==
Received: by 10.151.14.8 with SMTP id r8mr859171ybi.331.1298507309112; Wed, 23 Feb 2011 16:28:29 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Wed, 23 Feb 2011 16:28:09 -0800 (PST)
In-Reply-To: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Wed, 23 Feb 2011 19:28:09 -0500
Message-ID: <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
To: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
Content-Type: multipart/alternative; boundary=000e0cd6ea72e5df13049cfc4a45
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 00:27:47 -0000

--000e0cd6ea72e5df13049cfc4a45
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 23, 2011 at 7:13 PM, I=C3=B1aki Baz Castillo <ibc@aliax.net> wr=
ote:

> Then just *document* the reasons/arguments/motivations in the draft so
> newcomers would not need to re-open old discussions. But currently the
> draft gives no arguments at all about several points of the
> specification (neither the handshake, framing or client-to-server
> masking are argumented in the draft). Such arguments should not exist
> in a FAQ, but in the draft itself which should be the only required
> piece of information for understanding a specification. Please don't
> refer to a FAQ somewhere to complement the information.
>

As has been discussed in the archives, there has been strong objection to
including rationale in the spec itself.  I think it could be useful to have
a separate document collecting the rationale, though it would take a fair
amount of effort.

--=20
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6ea72e5df13049cfc4a45
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 7:13 PM, I=C3=B1aki Baz =
Castillo <span dir=3D"ltr">&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.n=
et</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"marg=
in:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

Then just *document* the reasons/arguments/motivations in the draft so<br>
newcomers would not need to re-open old discussions. But currently the<br>
draft gives no arguments at all about several points of the<br>
specification (neither the handshake, framing or client-to-server<br>
masking are argumented in the draft). Such arguments should not exist<br>
in a FAQ, but in the draft itself which should be the only required<br>
piece of information for understanding a specification. Please don&#39;t<br=
>
refer to a FAQ somewhere to complement the information.<br></blockquote><di=
v><br></div><div>As has been discussed in the archives, there has been stro=
ng objection to including rationale in the spec itself. =C2=A0I think it co=
uld be useful to have a separate document collecting the rationale, though =
it would take a fair amount of effort.</div>

<div><br></div></div>-- <br>John A. Tamplin<br>Software Engineer (GWT), Goo=
gle<br>

--000e0cd6ea72e5df13049cfc4a45--

From ibc@aliax.net  Wed Feb 23 16:40:54 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 34C143A693F for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:40:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YsPpdVj+tiek for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:40:53 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id 1B3B63A659A for <hybi@ietf.org>; Wed, 23 Feb 2011 16:40:52 -0800 (PST)
Received: by qyk29 with SMTP id 29so3417476qyk.10 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:41:41 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.88.200 with SMTP id b8mr67347qcm.246.1298508100914; Wed, 23 Feb 2011 16:41:40 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Wed, 23 Feb 2011 16:41:40 -0800 (PST)
In-Reply-To: <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
Date: Thu, 24 Feb 2011 01:41:40 +0100
Message-ID: <AANLkTinERzH0Tfx=mf5Z-8rpYVUTXArpcgjBjnfp-c+k@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 00:40:54 -0000

2011/2/24 John Tamplin <jat@google.com>:
> On Wed, Feb 23, 2011 at 7:13 PM, I=C3=B1aki Baz Castillo <ibc@aliax.net> =
wrote:
>>
>> Then just *document* the reasons/arguments/motivations in the draft so
>> newcomers would not need to re-open old discussions. But currently the
>> draft gives no arguments at all about several points of the
>> specification (neither the handshake, framing or client-to-server
>> masking are argumented in the draft). Such arguments should not exist
>> in a FAQ, but in the draft itself which should be the only required
>> piece of information for understanding a specification. Please don't
>> refer to a FAQ somewhere to complement the information.
>
>
>  As has been discussed in the archives, there has been strong objection t=
o
> including rationale in the spec itself.

It's really hard to find such threads in the archive (not enough time
for that), so I just can give my opinion:
A technical specification must include technical rationale. I cannot
imagine all the drafts I've read if rationale was removed from them.
Just my opinion.


> I think it could be useful to have
> a separate document collecting the rationale, though it would take a fair
> amount of effort.

I would prefer rationale within an unique draft, but a separate one
could be an option. In SIP protocol this is common (a draft giving
just requeriments for a specification). Such draft could be named
"Requeriments for two-way TCP communicatino between a web server and a
remote host", or just "Requeriments for WebSocket protocol" :)


Regards.



--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From silvio.ventres@gmail.com  Wed Feb 23 16:47:44 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F40233A659A for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:47:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.912
X-Spam-Level: 
X-Spam-Status: No, score=-2.912 tagged_above=-999 required=5 tests=[AWL=-0.312, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MtjAojOD-1z9 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 16:47:43 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 0BE2F3A6911 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:47:42 -0800 (PST)
Received: by vxa40 with SMTP id 40so17261vxa.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 16:48:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=jQRp4hrNXs8IJuXDuXcjD+S57eCj4rOnUQ9UyQHTs88=; b=xdOAtD++dWklLUvQp8qbL2zjYv/38qwWGDDdx5ZD3P7jxuwaBHuSXDbu2Apnt6OpXZ /k5dl+57q3N9vqObuxJSLsCVUBMHbYpDNyzZ7EdNbQWlNTCxc+YE3zcQIwz4EncAzRM2 W2uIU1HlCXR2i6hRkJBj89fBpppvUzUBZyJnY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=tGtq+8Ac08CwWtzSMb9jfdym7I3HMLdtRKvfO5twDEIHRrSKMxn9aq+zp/ACoYyq/C ySBUB8aBkCLzu8T77Yp2+og23DzyhXHujMpjrNnwWv9HQZ+MBoxxoLU2coLRj7+MFzGF fz3EQvLqHo7xIyonvOc0iwkFteqylByqw48XY=
MIME-Version: 1.0
Received: by 10.52.166.7 with SMTP id zc7mr291323vdb.241.1298508510829; Wed, 23 Feb 2011 16:48:30 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 16:48:30 -0800 (PST)
In-Reply-To: <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
Date: Thu, 24 Feb 2011 02:48:30 +0200
Message-ID: <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 00:47:44 -0000

>> Then just *document* the reasons/arguments/motivations in the draft so
>> newcomers would not need to re-open old discussions. But currently the
>> draft gives no arguments at all about several points of the
>> specification (neither the handshake, framing or client-to-server
>> masking are argumented in the draft). Such arguments should not exist
>> in a FAQ, but in the draft itself which should be the only required
>> piece of information for understanding a specification. Please don't
>> refer to a FAQ somewhere to complement the information.
>
> As has been discussed in the archives, there has been strong objection to
> including rationale in the spec itself. =A0I think it could be useful to =
have
> a separate document collecting the rationale, though it would take a fair
> amount of effort.

Your reply is a great example of the wrong attitude.

Let's provide a rough translation:

"As has been discussed in the archives" =3D "Don't really remember why,
and didn't understand the reason well at the time"
"There has been strong objection" =3D "Someone objected, but not strong
enough to remember why"

The proposition was: "Let's add rationale to the spec".
The answer can argument for or against, providing the last known or
accepted reasoning.
In comparison, an answer saying: "go read archives" doesn't differ
much from "I don't have anything to say but want to write something".

No offense, but, if anyone plans to write any more "go read archives"
messages, please, try assuming the person asking actually _read_ the
archives, and wants an _actual_ answer.

--
 silvio

From jat@google.com  Wed Feb 23 17:04:34 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E4CC33A691B for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:04:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.913
X-Spam-Level: 
X-Spam-Status: No, score=-105.913 tagged_above=-999 required=5 tests=[AWL=0.063, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rlI5mA7ZfenG for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:04:34 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id C89603A6811 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:04:33 -0800 (PST)
Received: from kpbe14.cbf.corp.google.com (kpbe14.cbf.corp.google.com [172.25.105.78]) by smtp-out.google.com with ESMTP id p1O15LO9019277 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:05:21 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298509521; bh=B/GooVHuQzVpRAiMOhjXL+fYRqs=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=lKuaLs0NlPLTra5B7Iwu9ij3jjiOZCAFmOfc+doXUA+pWYcXGMd5rvG+LvxT4Pdb8 wwUCUAQhgo0+ufmQjvnrA==
Received: from gyg13 (gyg13.prod.google.com [10.243.50.141]) by kpbe14.cbf.corp.google.com with ESMTP id p1O14IOZ028471 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 17:05:19 -0800
Received: by gyg13 with SMTP id 13so10424gyg.20 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:05:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=LK6GEnbqccpczR0Y9N90unik7uvgvfJ9Bzn/+/rpKOY=; b=wfUbDFEaILQpKaXckH3bcAVjngFeFeobRt/XmrElwsnGhZ3+OaNzFQTbDe16zQad2O eU7r0o3sD5ekYKSaXWPQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=v+CdtVAM4dzrMKnzOwCHHPtZdH05KLqsh+D8mz1Ccw1a43JSFC+yseo2EBIvi8o5Zm ckJRIPoUK6ApTNqlzPRw==
Received: by 10.151.142.6 with SMTP id u6mr1029707ybn.46.1298509510133; Wed, 23 Feb 2011 17:05:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Wed, 23 Feb 2011 17:04:50 -0800 (PST)
In-Reply-To: <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Wed, 23 Feb 2011 20:04:50 -0500
Message-ID: <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=0015174bdd8016ca1d049cfcce26
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 01:04:35 -0000

--0015174bdd8016ca1d049cfcce26
Content-Type: text/plain; charset=UTF-8

On Wed, Feb 23, 2011 at 7:48 PM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> Your reply is a great example of the wrong attitude.
>
> Let's provide a rough translation:
>
> "As has been discussed in the archives" = "Don't really remember why,
> and didn't understand the reason well at the time"
> "There has been strong objection" = "Someone objected, but not strong
> enough to remember why"
>

No, it is "it is in the archives, if you can't be bothered to find it I
can't be bothered to spend my time looking for it for you".


> The proposition was: "Let's add rationale to the spec".
> The answer can argument for or against, providing the last known or
> accepted reasoning.
> In comparison, an answer saying: "go read archives" doesn't differ
> much from "I don't have anything to say but want to write something".
>

So, how is "there has been strong objection to including rationale in the
spec itself" not providing the "last known or accepted reasoning"?  I wasn't
one of the ones objecting and therefore do not remember all the details of
the objections, and we discussed it and moved on, accepting the reasons of
those objecting.


> No offense, but, if anyone plans to write any more "go read archives"
> messages, please, try assuming the person asking actually _read_ the
> archives, and wants an _actual_ answer.
>

Since some of the questions that have been asked after having been asked to
read the archives were discussed for *months* in *hundreds* of messages (for
example, the need for masking), I do not believe they actually read the
archives if they still didn't find anything relevant.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--0015174bdd8016ca1d049cfcce26
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 7:48 PM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">Your reply is a great example of the wrong attitude.</div=
>
<br>
Let&#39;s provide a rough translation:<br>
<br>
&quot;As has been discussed in the archives&quot; =3D &quot;Don&#39;t reall=
y remember why,<br>
and didn&#39;t understand the reason well at the time&quot;<br>
&quot;There has been strong objection&quot; =3D &quot;Someone objected, but=
 not strong<br>
enough to remember why&quot;<br></blockquote><div><br></div><div>No, it is =
&quot;it is in the archives, if you can&#39;t be bothered to find it I can&=
#39;t be bothered to spend my time looking for it for you&quot;.</div>

<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
The proposition was: &quot;Let&#39;s add rationale to the spec&quot;.<br>
The answer can argument for or against, providing the last known or<br>
accepted reasoning.<br>
In comparison, an answer saying: &quot;go read archives&quot; doesn&#39;t d=
iffer<br>
much from &quot;I don&#39;t have anything to say but want to write somethin=
g&quot;.<br></blockquote><div><br></div><div>So, how is &quot;there has bee=
n strong objection to=C2=A0including rationale in the spec itself&quot; not=
 providing the &quot;last known or accepted reasoning&quot;? =C2=A0I wasn&#=
39;t one of the ones objecting and therefore do not remember all the detail=
s of the objections, and we discussed it and moved on, accepting the reason=
s of those objecting.</div>

<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
No offense, but, if anyone plans to write any more &quot;go read archives&q=
uot;<br>
messages, please, try assuming the person asking actually _read_ the<br>
archives, and wants an _actual_ answer.<br></blockquote></div><div><br></di=
v>Since some of the questions that have been asked after having been asked =
to read the archives were discussed for *months* in *hundreds* of messages =
(for example, the need for masking), I do not believe they actually read th=
e archives if they still didn&#39;t find anything relevant.<br clear=3D"all=
">

<br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--0015174bdd8016ca1d049cfcce26--

From ibc@aliax.net  Wed Feb 23 17:29:18 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 44B543A680F for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:29:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TpItV8j3Fweg for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:29:17 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 33D953A679C for <hybi@ietf.org>; Wed, 23 Feb 2011 17:29:17 -0800 (PST)
Received: by qwh6 with SMTP id 6so51911qwh.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:30:05 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.245.4 with SMTP id ls4mr102308qcb.208.1298511005117; Wed, 23 Feb 2011 17:30:05 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Wed, 23 Feb 2011 17:30:05 -0800 (PST)
In-Reply-To: <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>
Date: Thu, 24 Feb 2011 02:30:05 +0100
Message-ID: <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 01:29:18 -0000

2011/2/24 John Tamplin <jat@google.com>:

>> No offense, but, if anyone plans to write any more "go read archives"
>> messages, please, try assuming the person asking actually _read_ the
>> archives, and wants an _actual_ answer.
>
> Since some of the questions that have been asked after having been asked =
to
> read the archives were discussed for *months* in *hundreds* of messages (=
for
> example, the need for masking), I do not believe they actually read the
> archives if they still didn't find anything relevant.


So, do you still think that in order to properly understand the
WebSocket protocol (as defined in last -05 draft) I must read hundreds
of old mails???
If so, why are you writting a draft? why don't you just tell people
"ey, the specification is writen somehow in the maillist archives,
read them".

If a draft is incomplete and doesn't provide all the required
rationale then it's invalid. A specification can reference other
specifications (informative or normative references), but it cannot
referece a maillist archive!

There are two options IMHO:

1) Include *all* the technical rationale within the draft, so someday
it would become a RFC.

2) Create a separate draft "Requeriments for WebSocket protocol" and
reference it from the current draft. Both drafts should become a RFC
(usually at the same time).

Both options would take some time and efforts, of course, the price of
writing a good standard (and a requeriment, is not?).


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ifette@google.com  Wed Feb 23 17:34:48 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A18F33A6929 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:34:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.926
X-Spam-Level: 
X-Spam-Status: No, score=-104.926 tagged_above=-999 required=5 tests=[AWL=0.750, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WGAS9Hty-Y73 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:34:47 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id AF7363A680F for <hybi@ietf.org>; Wed, 23 Feb 2011 17:34:45 -0800 (PST)
Received: from hpaq7.eem.corp.google.com (hpaq7.eem.corp.google.com [172.25.149.7]) by smtp-out.google.com with ESMTP id p1O1ZXAN004061 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:35:33 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298511333; bh=xf5UrSj4hdiMczhOdBaSE0JVe1E=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=YCrSWgN7G4Tz8aeiNuARrqqotu3qCib39uuDIboGU+fco6DPDYs1Z3sLAarkFOffF Rpa2pYA1sC/nxt89PW80g==
Received: from iwn2 (iwn2.prod.google.com [10.241.68.66]) by hpaq7.eem.corp.google.com with ESMTP id p1O1Z0Pe029102 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 17:35:31 -0800
Received: by iwn2 with SMTP id 2so42599iwn.26 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:35:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=6tPYwRPgsLY3uptf1pXYcmJogkzEaaaiJw3ZwmecA3w=; b=PidwKapwnT1THbI0QUBuHVH6DiXqzLqaivHlcWismr8wi+8qmVsNN3cPT/15yGlQlv c5jgHEoBVM/eRbI5GPPg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=qI46d+VCWDW8f3dceaZ0nbIadVCbmpbtcEVXgDXQfTvVQYZJsGwxIwOAGiYfNWefdB 5OnICFstPZwCo082RquQ==
MIME-Version: 1.0
Received: by 10.231.16.197 with SMTP id p5mr395512iba.39.1298511331336; Wed, 23 Feb 2011 17:35:31 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Wed, 23 Feb 2011 17:35:31 -0800 (PST)
In-Reply-To: <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com>
Date: Wed, 23 Feb 2011 17:35:31 -0800
Message-ID: <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
Content-Type: multipart/alternative; boundary=00221532c5b4a4235c049cfd3ad9
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 01:34:48 -0000

--00221532c5b4a4235c049cfd3ad9
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 23, 2011 at 5:30 PM, I=C3=B1aki Baz Castillo <ibc@aliax.net> wr=
ote:

> 2011/2/24 John Tamplin <jat@google.com>:
>
> >> No offense, but, if anyone plans to write any more "go read archives"
> >> messages, please, try assuming the person asking actually _read_ the
> >> archives, and wants an _actual_ answer.
> >
> > Since some of the questions that have been asked after having been aske=
d
> to
> > read the archives were discussed for *months* in *hundreds* of messages
> (for
> > example, the need for masking), I do not believe they actually read the
> > archives if they still didn't find anything relevant.
>
>
> So, do you still think that in order to properly understand the
> WebSocket protocol (as defined in last -05 draft) I must read hundreds
> of old mails???
> If so, why are you writting a draft? why don't you just tell people
> "ey, the specification is writen somehow in the maillist archives,
> read them".
>
>
The point being made was that the protocol should be the minimum document
required to understand how to build a client/server for the protocol. If yo=
u
want the gory history, read the archives. The rationale and history are not
required to build a complaint piece of software.


> If a draft is incomplete and doesn't provide all the required
> rationale then it's invalid. A specification can reference other
> specifications (informative or normative references), but it cannot
> referece a maillist archive!
>
> There are two options IMHO:
>
> 1) Include *all* the technical rationale within the draft, so someday
> it would become a RFC.
>
> 2) Create a separate draft "Requeriments for WebSocket protocol" and
> reference it from the current draft. Both drafts should become a RFC
> (usually at the same time).
>
> Both options would take some time and efforts, of course, the price of
> writing a good standard (and a requeriment, is not?).
>
>
> --
> I=C3=B1aki Baz Castillo
> <ibc@aliax.net>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--00221532c5b4a4235c049cfd3ad9
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 5:30 PM, I=C3=B1aki Baz =
Castillo <span dir=3D"ltr">&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.n=
et</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"marg=
in:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">2011/2/24 John Tamplin &lt;<a href=3D"mailto:jat@google.c=
om">jat@google.com</a>&gt;:<br>
<br>
</div><div class=3D"im">&gt;&gt; No offense, but, if anyone plans to write =
any more &quot;go read archives&quot;<br>
&gt;&gt; messages, please, try assuming the person asking actually _read_ t=
he<br>
&gt;&gt; archives, and wants an _actual_ answer.<br>
&gt;<br>
&gt; Since some of the questions that have been asked after having been ask=
ed to<br>
&gt; read the archives were discussed for *months* in *hundreds* of message=
s (for<br>
&gt; example, the need for masking), I do not believe they actually read th=
e<br>
&gt; archives if they still didn&#39;t find anything relevant.<br>
<br>
<br>
</div>So, do you still think that in order to properly understand the<br>
WebSocket protocol (as defined in last -05 draft) I must read hundreds<br>
of old mails???<br>
If so, why are you writting a draft? why don&#39;t you just tell people<br>
&quot;ey, the specification is writen somehow in the maillist archives,<br>
read them&quot;.<br>
<br></blockquote><div><br></div><div>The point being made was that the prot=
ocol should be the minimum document required to understand how to build a c=
lient/server for the protocol. If you want the gory history, read the archi=
ves. The rationale and history are not required to build a complaint piece =
of software.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
If a draft is incomplete and doesn&#39;t provide all the required<br>
rationale then it&#39;s invalid. A specification can reference other<br>
specifications (informative or normative references), but it cannot<br>
referece a maillist archive!<br>
<br>
There are two options IMHO:<br>
<br>
1) Include *all* the technical rationale within the draft, so someday<br>
it would become a RFC.<br>
<br>
2) Create a separate draft &quot;Requeriments for WebSocket protocol&quot; =
and<br>
reference it from the current draft. Both drafts should become a RFC<br>
(usually at the same time).<br>
<br>
Both options would take some time and efforts, of course, the price of<br>
writing a good standard (and a requeriment, is not?).<br>
<font color=3D"#888888"><br>
<br>
--<br>
</font><div class=3D"im">I=C3=B1aki Baz Castillo<br>
&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.net</a>&gt;<br>
</div><div><div></div><div class=3D"h5">___________________________________=
____________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--00221532c5b4a4235c049cfd3ad9--

From ibc@aliax.net  Wed Feb 23 17:53:53 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 848733A68C5 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:53:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oNBQKklE2QZd for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 17:53:52 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id A1DDB3A67AB for <hybi@ietf.org>; Wed, 23 Feb 2011 17:53:52 -0800 (PST)
Received: by qyk29 with SMTP id 29so3451552qyk.10 for <hybi@ietf.org>; Wed, 23 Feb 2011 17:54:40 -0800 (PST)
MIME-Version: 1.0
Received: by 10.224.37.81 with SMTP id w17mr186562qad.132.1298512480597; Wed, 23 Feb 2011 17:54:40 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Wed, 23 Feb 2011 17:54:40 -0800 (PST)
In-Reply-To: <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com>
Date: Thu, 24 Feb 2011 02:54:40 +0100
Message-ID: <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: ifette@google.com
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 01:53:53 -0000

2011/2/24 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) <ifette@google.com>:
> The point being made was that the protocol should be the minimum document
> required to understand how to build a client/server for the protocol. If =
you
> want the gory history, read the archives. The rationale and history are n=
ot
> required to build a complaint piece of software.

Really? so what is this draft? a "HOWTO" for developing software?. A
specification describing a protocol must include extensive information
about the reasoning for its design, even more when it aims to become a
standard. You are describing a *protocol*, not a guide for a lazy
implementor. Could you please check *any* other RFC describing any
other protocol?

I understand all of you have spent long time discussing various
aspects of the protocol in the maillist. Conclusions for those
discussions (possible attacks, masking/handshake reasons...) should be
included in the specification, and not just the techniques to
accomplishe with them. If not, this is a HOWTO rather than a protocol
specification.

Best regards.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ifette@google.com  Wed Feb 23 18:01:44 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D9F583A6929 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:01:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.176
X-Spam-Level: 
X-Spam-Status: No, score=-105.176 tagged_above=-999 required=5 tests=[AWL=0.500, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7icM93P9tHz9 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:01:43 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 4EF013A6784 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:01:43 -0800 (PST)
Received: from kpbe17.cbf.corp.google.com (kpbe17.cbf.corp.google.com [172.25.105.81]) by smtp-out.google.com with ESMTP id p1O22UXE019722 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:02:30 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298512951; bh=TOZ5fEah34BT/uMYMO4jlhQ4VHg=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=B/lyWmCDpOHGJCGwBsLFMAHAjfHiA9LbocA6AgsgXeS9/K4KgXt7Tl377sz/ERSXq WanWh+1MseE64uHR0gUCQ==
Received: from iwr19 (iwr19.prod.google.com [10.241.69.83]) by kpbe17.cbf.corp.google.com with ESMTP id p1O22DkQ024409 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 18:02:29 -0800
Received: by iwr19 with SMTP id 19so56160iwr.7 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:02:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=UPj+1CxAAqmSwq5yMKwDF9ZlK253lZQBPZu87VhuY2s=; b=r2pY2SzxvzByKz25qX9u3N+A+LCKGi7HqeYqt+7lm4fOnX66MS9XRIjCCXPkneqp7+ Ebl+G89FyKHrdUzqiJSA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=UkbIjTkrDAoxy0tFg/2qZwhxlIkqd2Q9UgeCd5/eaKa6knZ4ygYDlOsLDgESP1HO0A NW3TJTmpcmbnmB0v6fMQ==
MIME-Version: 1.0
Received: by 10.231.17.193 with SMTP id t1mr410127iba.89.1298512948623; Wed, 23 Feb 2011 18:02:28 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Wed, 23 Feb 2011 18:02:28 -0800 (PST)
In-Reply-To: <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com>
Date: Wed, 23 Feb 2011 18:02:28 -0800
Message-ID: <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
Content-Type: multipart/alternative; boundary=002215046cbb09f823049cfd9b1f
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 02:01:45 -0000

--002215046cbb09f823049cfd9b1f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 23, 2011 at 5:54 PM, I=C3=B1aki Baz Castillo <ibc@aliax.net> wr=
ote:

> 2011/2/24 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=
=83=E3=83=86=E3=82=A3) <ifette@google.com>:
> > The point being made was that the protocol should be the minimum docume=
nt
> > required to understand how to build a client/server for the protocol. I=
f
> you
> > want the gory history, read the archives. The rationale and history are
> not
> > required to build a complaint piece of software.
>
> Really? so what is this draft? a "HOWTO" for developing software?. A
> specification describing a protocol must include extensive information
> about the reasoning for its design, even more when it aims to become a
> standard. You are describing a *protocol*, not a guide for a lazy
> implementor. Could you please check *any* other RFC describing any
> other protocol?
>
>
If RFC2616 had to list out the full history of every debate of every featur=
e
in HTTP it would be unreadable and worthless. The protocol is a guide to
what you must do if you want to create software that can interoperate with
other WS endpoints, in that sense yes, it is something of a howto. You do
not need a transcription of months of arguments that led to what it is. I a=
m
sure that back in the 90s people were debating about whether Accept-Lang:
en, de; q=3D0.8 was more understandable or less understandable than en;
de,q=3D0.8, but at the end of the day one won out, and the history doesn't
really matter as if I want it to work, I need to send en,de;q=3D0.8.



> I understand all of you have spent long time discussing various
> aspects of the protocol in the maillist. Conclusions for those
> discussions (possible attacks, masking/handshake reasons...) should be
> included in the specification, and not just the techniques to
> accomplishe with them. If not, this is a HOWTO rather than a protocol
> specification.
>
> Best regards.
>
>
> --
> I=C3=B1aki Baz Castillo
> <ibc@aliax.net>
>

--002215046cbb09f823049cfd9b1f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 5:54 PM, I=C3=B1aki Baz =
Castillo <span dir=3D"ltr">&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.n=
et</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"marg=
in:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
2011/2/24 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) &lt;<a href=3D"mailto:ifette@google.com">ifette@google.=
com</a>&gt;:<br>
<div class=3D"im">&gt; The point being made was that the protocol should be=
 the minimum document<br>
&gt; required to understand how to build a client/server for the protocol. =
If you<br>
&gt; want the gory history, read the archives. The rationale and history ar=
e not<br>
&gt; required to build a complaint piece of software.<br>
<br>
</div>Really? so what is this draft? a &quot;HOWTO&quot; for developing sof=
tware?. A<br>
specification describing a protocol must include extensive information<br>
about the reasoning for its design, even more when it aims to become a<br>
standard. You are describing a *protocol*, not a guide for a lazy<br>
implementor. Could you please check *any* other RFC describing any<br>
other protocol?<br>
<br></blockquote><div><br></div><div>If RFC2616 had to list out the full hi=
story of every debate of every feature in HTTP it would be unreadable and w=
orthless. The protocol is a guide to what you must do if you want to create=
 software that can interoperate with other WS endpoints, in that sense yes,=
 it is something of a howto. You do not need a transcription of months of a=
rguments that led to what it is. I am sure that back in the 90s people were=
 debating about whether Accept-Lang: en, de; q=3D0.8 was more understandabl=
e or less understandable than en; de,q=3D0.8, but at the end of the day one=
 won out, and the history doesn&#39;t really matter as if I want it to work=
, I need to send en,de;q=3D0.8.</div>
<div><br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"=
margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
I understand all of you have spent long time discussing various<br>
aspects of the protocol in the maillist. Conclusions for those<br>
discussions (possible attacks, masking/handshake reasons...) should be<br>
included in the specification, and not just the techniques to<br>
accomplishe with them. If not, this is a HOWTO rather than a protocol<br>
specification.<br>
<br>
Best regards.<br>
<font color=3D"#888888"><br>
<br>
--<br>
</font><div><div></div><div class=3D"h5">I=C3=B1aki Baz Castillo<br>
&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.net</a>&gt;<br>
</div></div></blockquote></div><br>

--002215046cbb09f823049cfd9b1f--

From ibc@aliax.net  Wed Feb 23 18:22:48 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A87663A68C5 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:22:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PTLzM6jMM4DV for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:22:47 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 997523A6938 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:22:47 -0800 (PST)
Received: by qwh6 with SMTP id 6so76979qwh.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:23:35 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr155925qcb.170.1298514215609; Wed, 23 Feb 2011 18:23:35 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Wed, 23 Feb 2011 18:23:35 -0800 (PST)
In-Reply-To: <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
Date: Thu, 24 Feb 2011 03:23:35 +0100
Message-ID: <AANLkTiny0UFd7=OxeNJEOhzL2q6_yr4z0Ue5S7L42+7W@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: ifette@google.com
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 02:22:48 -0000

2011/2/24 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) <ifette@google.com>:
>> Really? so what is this draft? a "HOWTO" for developing software?. A
>> specification describing a protocol must include extensive information
>> about the reasoning for its design, even more when it aims to become a
>> standard. You are describing a *protocol*, not a guide for a lazy
>> implementor. Could you please check *any* other RFC describing any
>> other protocol?
>>
>
> If RFC2616 had to list out the full history of every debate of every feat=
ure
> in HTTP it would be unreadable and worthless. The protocol is a guide to
> what you must do if you want to create software that can interoperate wit=
h
> other WS endpoints, in that sense yes, it is something of a howto. You do
> not need a transcription of months of arguments that led to what it is. I=
 am
> sure that back in the 90s people were debating about whether Accept-Lang:
> en, de; q=3D0.8 was more understandable or less understandable than en;
> de,q=3D0.8, but at the end of the day one won out, and the history doesn'=
t
> really matter as if I want it to work, I need to send en,de;q=3D0.8.

You are comparing a format/grammar rule with a security design.

I don't expect (neither I desire) that this draft explains why
Sec-WebSocket-1 is called as it is rather than "Security-WS-A", even
if you all spent 5 weeks discussing about it.
But if the draft defines a exotic handshake it must argue it. If it
requires masking just for client-to-server communication it must argue
it ("avoid confusing network intermediaries, such as intercepting
proxies" is not enough).

Also -05 seems to be HTTP compliant but I still don't know how should
a websocket client react if it receives a 302 when performing the
handshake. Same as a "real" HTTP client? or not? Initially the
protocol was just "similar" to HTTP (but not HTTP) so it's hard to
figure how is currently defined to behave without explicit mention in
the draft.

If the protocol is HTTP compliant, why is the draft full of phrases
like the following?:

   Headers in the handshake are sent by the client in a random order;
   the order is not meaningful.

This is obvious in HTTP! order of different headers never matter, so
why to include it in this draft? Is it not clear that a WebSocket
implementor must know HTTP protocol? Wouldn't be better to remove such
unnecessary information from the draft and, instead, include useful
information (as technical rationale)? maybe you still save space :)


Regards.



--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From theturtle32@gmail.com  Wed Feb 23 18:31:13 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BB0633A68C5 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:31:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J7vdRSqPsB6s for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:31:12 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id 6E2083A67DF for <hybi@ietf.org>; Wed, 23 Feb 2011 18:31:12 -0800 (PST)
Received: by iyj8 with SMTP id 8so40662iyj.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:32:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type:content-transfer-encoding; bh=WERmW8+XFjjqTz4o4mtcMyiNvhmqZTfg0sk7FZlQa/8=; b=TvOWsQTOv4r/89EhXQ3krvF8gjl5Ze0QW5rHMKXNQ+aqoHagbsAJjCZPDmejSEHJjU aBH83lDcN1q6fornqOs5EYmRalMFyGAQ57w5S6Lp1UndAssqEriYBZUZ4GnuG7TgwiMA ysS97mjFBs4cASR7DlkQ/Vu9/IZ4e8d/NMN7o=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=XYYZqmudCb5dz3GKjRRi5rm00ahd+W7vjv+E1wLSsBg2vwOEk2M+avukzifZnlUMyw pof5qqo3tUNVKMjh4GgbA59s3Fz74se3GOstd6qK4HYNZMZVYTWz9P0dy+biZyvRyLQJ GjfsSrhsRiLolnkhAqw+soxLVV/6DCMnPAbLA=
MIME-Version: 1.0
Received: by 10.231.182.5 with SMTP id ca5mr428620ibb.144.1298514720750; Wed, 23 Feb 2011 18:32:00 -0800 (PST)
Received: by 10.231.144.193 with HTTP; Wed, 23 Feb 2011 18:32:00 -0800 (PST)
In-Reply-To: <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
Date: Wed, 23 Feb 2011 18:32:00 -0800
Message-ID: <AANLkTin2SBW8GgkqD7qMkv9G7FzsdAmbG33Tj4r3Y6Kx@mail.gmail.com>
From: Brian <theturtle32@gmail.com>
To: Hybi <hybi@ietf.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 02:31:13 -0000

I can empathize with the rationale for both positions here, but I'm
going to agree with Ian -- the specification needs to be lean and
readily understandable.  If I'm on a mission to build a new
implementation of a client or server, I want to be able to do it as
swiftly as possible without getting mired down in superfluous details
that aren't critical to the implementation.

On the other hand, I also feel that an accompanying document would be
a helpful nicety, because indeed, there are many, many things in the
draft that, while there are very specific and nuanced reasons for
their existence, would make any new implementer scratch his/her head
and grumble "WTF?!"

That kind of experience would cause most implementers to feel angry
and resentful of the protocol and its creators.  It took me months of
reading every single mail sent to this list to stop feeling literally
angry at certain members of the working group and finally understand
where they're coming from and why things were decided one way or
another.  There are still things that I'm not thrilled with, but like
others, happy to accept to move forward with a workable and stable
specification.

The big problem with creating such a document is that it's not
strictly required for the standardization process (though it might
expedite things in the later stages of ratification) and everyone on
this mailing list is extremely busy without much time to dedicate to
such an involved side-project.  I know I don't have that kind of time.
 I think the best bet, as suggested by someone previously, is to do it
as an FAQ/Wiki that everyone can contribute to so that it can get done
without putting a large burden on any one individual.  That way the
information is available without having to scour the mailing list
archives, but it wont clutter up the draft.

For what it's worth, I feel your pain with regard to searching the
archives.  It really is a completely insurmountable task at this
point, since the volume on this list has been, at times, a veritable
deluge of information.  Indeed there have been a few days where it
took me multiple hours to get through all the posts sent on that one
day.  Searching through hundreds of messages per week in the mailing
list archives is *not* an option for newcomers on most of the topics
that they would be curious about.


Brian


2011/2/23 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=83=
=E3=83=86=E3=82=A3) <ifette@google.com>:
> On Wed, Feb 23, 2011 at 5:54 PM, I=C3=B1aki Baz Castillo <ibc@aliax.net> =
wrote:
>>
>> 2011/2/24 Ian Fette (=E3=82=A4=E3=82=A2=E3=83=B3=E3=83=95=E3=82=A7=E3=83=
=83=E3=83=86=E3=82=A3) <ifette@google.com>:
>> > The point being made was that the protocol should be the minimum
>> > document
>> > required to understand how to build a client/server for the protocol. =
If
>> > you
>> > want the gory history, read the archives. The rationale and history ar=
e
>> > not
>> > required to build a complaint piece of software.
>>
>> Really? so what is this draft? a "HOWTO" for developing software?. A
>> specification describing a protocol must include extensive information
>> about the reasoning for its design, even more when it aims to become a
>> standard. You are describing a *protocol*, not a guide for a lazy
>> implementor. Could you please check *any* other RFC describing any
>> other protocol?
>>
>
> If RFC2616 had to list out the full history of every debate of every feat=
ure
> in HTTP it would be unreadable and worthless. The protocol is a guide to
> what you must do if you want to create software that can interoperate wit=
h
> other WS endpoints, in that sense yes, it is something of a howto. You do
> not need a transcription of months of arguments that led to what it is. I=
 am
> sure that back in the 90s people were debating about whether Accept-Lang:
> en, de; q=3D0.8 was more understandable or less understandable than en;
> de,q=3D0.8, but at the end of the day one won out, and the history doesn'=
t
> really matter as if I want it to work, I need to send en,de;q=3D0.8.
>
>>
>> I understand all of you have spent long time discussing various
>> aspects of the protocol in the maillist. Conclusions for those
>> discussions (possible attacks, masking/handshake reasons...) should be
>> included in the specification, and not just the techniques to
>> accomplishe with them. If not, this is a HOWTO rather than a protocol
>> specification.
>>
>> Best regards.
>>
>>
>> --
>> I=C3=B1aki Baz Castillo
>> <ibc@aliax.net>
>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>

From mcmanus@ducksong.com  Wed Feb 23 18:58:54 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 088063A6955 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:58:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.449
X-Spam-Level: 
X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BuyYuGzuZ50K for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 18:58:53 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 063803A6938 for <hybi@ietf.org>; Wed, 23 Feb 2011 18:58:52 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 058AC10441; Wed, 23 Feb 2011 21:59:40 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 4567310442; Wed, 23 Feb 2011 21:59:36 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: =?ISO-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
In-Reply-To: <AANLkTiny0UFd7=OxeNJEOhzL2q6_yr4z0Ue5S7L42+7W@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTiny0UFd7=OxeNJEOhzL2q6_yr4z0Ue5S7L42+7W@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Date: Wed, 23 Feb 2011 21:59:23 -0500
Message-ID: <1298516363.2498.470.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 02:58:54 -0000

_The WebSocket Protocol, a History_  does not require nor benefit from
rough technical consensus. Please don't weigh down the protocol document
with trying to get the WG members to write and edit this text and then
achieve consensus around the extra verbiage. 

One or more separate blogs, wikis, books, faqs, masters thesis, movies,
stage plays, street theater performances, or separate internet-drafts
would be lovely and undoubtedly contribute to the eco-system. They need
not be 100% consistent with each other; the underlying arguments
certainly weren't. I would enjoy seeing what anyone motivated enough to
do the work creates on the topic.

-- 
http://www.getfirefox.com/



From duerst@it.aoyama.ac.jp  Wed Feb 23 19:08:51 2011
Return-Path: <duerst@it.aoyama.ac.jp>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F0033A67E4 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:08:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -99.865
X-Spam-Level: 
X-Spam-Status: No, score=-99.865 tagged_above=-999 required=5 tests=[AWL=-0.075, BAYES_00=-2.599, HELO_EQ_JP=1.244, HOST_EQ_JP=1.265, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ywvL7V60+z98 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:08:50 -0800 (PST)
Received: from scintmta01.scbb.aoyama.ac.jp (scintmta01.scbb.aoyama.ac.jp [133.2.253.33]) by core3.amsl.com (Postfix) with ESMTP id C79A53A67C2 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:08:49 -0800 (PST)
Received: from scmse01.scbb.aoyama.ac.jp ([133.2.253.231]) by scintmta01.scbb.aoyama.ac.jp (secret/secret) with SMTP id p1O39Vh0029401 for <hybi@ietf.org>; Thu, 24 Feb 2011 12:09:31 +0900
Received: from (unknown [133.2.206.133]) by scmse01.scbb.aoyama.ac.jp with smtp id 2c04_47f0_7f760fc0_3fc3_11e0_9c6b_001d096c566a; Thu, 24 Feb 2011 12:09:31 +0900
Received: from [IPv6:::1] ([133.2.210.1]:34247) by itmail.it.aoyama.ac.jp with [XMail 1.22 ESMTP Server] id <S14D7A80> for <hybi@ietf.org> from <duerst@it.aoyama.ac.jp>; Thu, 24 Feb 2011 12:09:29 +0900
Message-ID: <4D65CBD0.10501@it.aoyama.ac.jp>
Date: Thu, 24 Feb 2011 12:09:04 +0900
From: =?UTF-8?B?Ik1hcnRpbiBKLiBEw7xyc3Qi?= <duerst@it.aoyama.ac.jp>
Organization: Aoyama Gakuin University
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.9) Gecko/20100722 Eudora/3.0.4
MIME-Version: 1.0
To: =?UTF-8?B?ScOxYWtpIEJheiBDYXN0aWxsbw==?= <ibc@aliax.net>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>	<AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>	<AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com>	<AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>	<AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com>	<AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com>
In-Reply-To: <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 03:08:51 -0000

Hello IÃ±aki,

Why don't you (and maybe Silvio) volunteer to write a draft describing 
background/rationale for WebSockets? I'm sure it would be appreciated by 
a lot of people, and you would get lots of support from the WG.

On 2011/02/24 10:54, IÃ±aki Baz Castillo wrote:
> 2011/2/24 Ian Fette (ã‚¤ã‚¢ãƒ³ãƒ•ã‚§ãƒƒãƒ†ã‚£)<ifette@google.com>:
>> The point being made was that the protocol should be the minimum document
>> required to understand how to build a client/server for the protocol. If you
>> want the gory history, read the archives. The rationale and history are not
>> required to build a complaint piece of software.
>
> Really? so what is this draft? a "HOWTO" for developing software?.

In essence yes. For software to work, it has to work to spec; why the 
spec is the way it is is mostly irrelevant. Indeed having too much 
rationale in the spec may lead implementers to implement to the 
rationale rather than the actual spec, which leads to interoperability 
problems. (Implementers read the rationale, think "a, I see how it's 
supposed to work", and miss some details.)

> A
> specification describing a protocol must include extensive information
> about the reasoning for its design, even more when it aims to become a
> standard. You are describing a *protocol*, not a guide for a lazy
> implementor. Could you please check *any* other RFC describing any
> other protocol?

There is no requirement anywhere in the IETF process that a spec (or 
specifically a standard) has to include rationale. The same applies to 
W3C specs, and I guess to the specs of many other standards 
organizations. Many specs are successful because they are short and to 
the point, rather than because they include a lot of rationale.

A case in point would be XML. The XML spec contains a very short list of 
goals at the start (http://www.w3.org/TR/xml/#sec-origin-goals), which 
is far away from a rationale. For the rest, it's just facts, no reasons. 
And XML was and continues to be extremely widely used.

During the development of XML (something like 1996-1997), there was a 
very strict "go read the mailing list first" policy. The spec would 
maybe never have been completed if not for that policy; otherwise, the 
WG would have been busy all the time giving intros to newcommers rather 
than finishing their work.


> I understand all of you have spent long time discussing various
> aspects of the protocol in the maillist. Conclusions for those
> discussions (possible attacks, masking/handshake reasons...) should be
> included in the specification, and not just the techniques to
> accomplishe with them. If not, this is a HOWTO rather than a protocol
> specification.

You are right for security-related stuff, which has to be discussed in 
the security section (although this is focused on possible attacks that 
are still open, rather than on those that the protocol design closes).
For the rest, a separate document is a much better alternative, and I 
hope you can help us produce one.

Regards,   Martin.

-- 
#-# Martin J. DÃ¼rst, Professor, Aoyama Gakuin University
#-# http://www.sw.it.aoyama.ac.jp   mailto:duerst@it.aoyama.ac.jp

From silvio.ventres@gmail.com  Wed Feb 23 19:48:08 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A3C9E3A67D6 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:48:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.377
X-Spam-Level: 
X-Spam-Status: No, score=-3.377 tagged_above=-999 required=5 tests=[AWL=0.222,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KNVXeeHrOWvt for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:48:07 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 78FE93A67A8 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:48:07 -0800 (PST)
Received: by vws6 with SMTP id 6so121042vws.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:48:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=0mt1QGoJGgVtKca6h1tKIcQtMsuMiRRJFoqQPaHUGkw=; b=cnBdqdVi4IY071pD21XZqmieudi4yu3z65N8Xv6JPlmAtDIjz3HSkRCJv/5DK4HYlf aynpMgse+YHij8YTDNw8L7TeLBL09HQFCxElqvnj7zUk/TVgs3zTm9EzwC1Qby15lLDx 6HOAzQ+FhMNJNTl7fn9tCM92seGD5SM5R4EuY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=k7q+J7mCwMXpypkLo2uvbHHXMswIbgt7B8Ml0+IFqf6QbB6D8M/kbCHFK0TJFSOYBU 2DWvrzRbApilVrdgIYQlmgfFw765YNfNO4kUAF/9tnJzzl35cbv+GOjX7hPlykm7E/fg 1DNzbCjCjn1h44yihRDmvecumLBvSUdkaRq8U=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr560139vdb.121.1298519335823; Wed, 23 Feb 2011 19:48:55 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 19:48:55 -0800 (PST)
In-Reply-To: <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>
Date: Thu, 24 Feb 2011 05:48:55 +0200
Message-ID: <AANLkTi=_UOFS9eyk+Ec89UdhhvnYhrWyR_YZRdBv-aWe@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 03:48:08 -0000

> So, how is "there has been strong objection to=A0including rationale in t=
he
> spec itself" not providing the "last known or accepted reasoning"? =A0I w=
asn't
> one of the ones objecting and therefore do not remember all the details o=
f
> the objections, and we discussed it and moved on, accepting the reasons o=
f
> those objecting.

If you actually _accepted_ the reasons, then you surely remember what
those reasons _were_.
And if you can't remember, it means you didn't really think hard about
them while accepting,
or the reasons didn't really persuade you, or you merely saw someone
else accepting them.

Then, if you aren't the one that accepted or rejected them, don't
remember the reason and
can't be bothered to find it, why did you answer the message
_explicitly_ requesting to quote
the reasoning for the decision?

In any case, if anyone actually knows the main rationale for this
decision, please let know.

--
 silvio

From gregw@intalio.com  Wed Feb 23 19:51:04 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 50B863A6960 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:51:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.662
X-Spam-Level: 
X-Spam-Status: No, score=-2.662 tagged_above=-999 required=5 tests=[AWL=0.315,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oYMguKWVmAZf for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:51:03 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 3220A3A67A8 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:51:02 -0800 (PST)
Received: by vws6 with SMTP id 6so122626vws.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:51:51 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.157.70 with SMTP id wk6mr585630vdb.51.1298519511423; Wed, 23 Feb 2011 19:51:51 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Wed, 23 Feb 2011 19:51:51 -0800 (PST)
In-Reply-To: <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>
Date: Thu, 24 Feb 2011 14:51:51 +1100
X-Google-Sender-Auth: M8kEBBTqyJDqJKkmpWPHS_J6a4w
Message-ID: <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 03:51:04 -0000

On 24 February 2011 11:28, John Tamplin <jat@google.com> wrote:
> As has been discussed in the archives, there has been strong objection to
> including rationale in the spec itself. =A0I think it could be useful to =
have
> a separate document collecting the rationale, though it would take a fair
> amount of effort.

I think that historically the group has had problems regarding such
text - either in the protocol draft, or even the abandoned
requirements draft, because the reasoning text was used to lobby
and/or advocate for one side or another of some very divisive issues.

However, now that we are having some convergence, you'd really hope
that we would all be able to agree on a sentence or two describing why
we are masking (even if you don't agree with the need to mask, you
surely can understand the reasons others do).

So I think that there should be a happy medium between the
specification providing a complete history and reasoning for each
feature, vs providing just a bit of reasoning to motivate a feature.
For example we could just say something like: The data from the client
to the server is masked by the user-agent to protect against HTTP
aware intermediaries mistaking WS content as HTTP requests.

I really don't think it is good that first time readers of the
protocol document have WTF moments that can only be answered by
reading a vast mailing archive.

cheers

From silvio.ventres@gmail.com  Wed Feb 23 19:56:32 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 604613A67D6 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:56:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.899
X-Spam-Level: 
X-Spam-Status: No, score=-2.899 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pzvb1m1hooEx for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 19:56:31 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 3FAF83A67A8 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:56:31 -0800 (PST)
Received: by vxg33 with SMTP id 33so49326vxg.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 19:57:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=dEMGFdooLEWfPlHGKTe198y+chjZdT5CF2PsYyrBJUE=; b=xYRBrn1VMmaks1cO2SaD+N/zuZxyP+gqFawJSTilOMC3tcHqJff9mVBnOSfapiX+6d E1tS6mXYGAiO6rVZv8/WnxAXtTPPIlXQTxxVIwAdPUCwm6thGhqqxCPgLvUpbj0ULtoW AH3VIEH3B3ur+FVk8MHfSrD0HI0KtjX/d/uVI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=vcELOqS++61tNLs/OAF1glvvg8EdlTVa9F+csKqpcwLTMPsAWisdS7RzCtArqrHlGe Url9YOJCAkbh0kxKjeJiOW/MLJoFbaUpp9Is8bWCx1wKEMVcdUmpL29iugreHwRnknMc 7J7effwccMI4dRcmkc5nIbHYQ11FhEJdZj/8I=
MIME-Version: 1.0
Received: by 10.52.164.103 with SMTP id yp7mr544784vdb.161.1298519839444; Wed, 23 Feb 2011 19:57:19 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 19:57:19 -0800 (PST)
In-Reply-To: <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com>
Date: Thu, 24 Feb 2011 05:57:19 +0200
Message-ID: <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 03:56:32 -0000

> If RFC2616 had to list out the full history of every debate of every feature
> in HTTP it would be unreadable and worthless. The protocol is a guide to
> what you must do if you want to create software that can interoperate with
> other WS endpoints, in that sense yes, it is something of a howto. You do
> not need a transcription of months of arguments that led to what it is. I am
> sure that back in the 90s people were debating about whether Accept-Lang:
> en, de; q=0.8 was more understandable or less understandable than en;
> de,q=0.8, but at the end of the day one won out, and the history doesn't
> really matter as if I want it to work, I need to send en,de;q=0.8.

With all due respect, Ian, the current questions are not about amount
of spacing in the headers.
They are about the inherent features that have been included in the
standard for some implied and hidden reasons.
Specifically, security features are only added as a reply to some
possible and explicitly defined attack vectors
You don't just add a defense mechanism, burdening the compliant
implementors, without providing rationale as to why it should exist.
Especially, not when you're only _developing_ a standard.

And the point here is that the debate haven't even begun.
All that was asked is to explain the rationale and provide clear and
concise attack vectors or use scenarios which are promoted or which
are prevented by the measures in the protocol.

Who other than you, Ian, is able to better answer the questions
regarding reasoning behind each feature ?
In the end, it was you that heard all the arguments, accepted some and
rejected others, and thus, you were the
party accepting some argued reasoning, and thus should know and
remember that reasoning fairly well.
Why is it so problematic to provide the reasoning ? If you were
actually persuaded, and understand the reasoning
behind all the features, it should not be that hard to recall them and
write a few sentences of clarification.


--
 silvio

From silvio.ventres@gmail.com  Wed Feb 23 20:18:14 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 076793A6955 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:18:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.872
X-Spam-Level: 
X-Spam-Status: No, score=-2.872 tagged_above=-999 required=5 tests=[AWL=-0.273, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mCAmXT4zyXlH for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:18:13 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 28C163A6953 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:18:13 -0800 (PST)
Received: by vxg33 with SMTP id 33so61046vxg.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:19:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=q58aRQi7tShX1ILZfxmFWhYNWdG2vbqi6XW9mQQYqss=; b=dlvr7pcAlL7QBdcDK/cdPUpGLy3f0y+/a6hoKLc56jGSeKpFD0S3yJbE7Iz23RcGZa f8Exk1QmUMgdnzOhQXhXncLcT1u4xylb9gfziMLW6fzl/5p4cxQ6empmJDQBHRfmKv8U YQOXQ4h+0T+c6lOkdYpx0b6QIzjCHYiFtCp/s=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=N749i75V4aTFPTGUWscfO83MBJXIuVWjw57vtntlDNNbiR1cz3iB1Puf3uVknlfOuH lBEIbNljhONc0FhdiDVbuRJMS0u6Ink/nrf0w5TK54q3szizUf2DvxNVZKsF17JA2HRG 8Ca00ZbOaXrOtKLL9t+7jaIajCERU9m/rE4iM=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr458473vdb.281.1298521141510; Wed, 23 Feb 2011 20:19:01 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Wed, 23 Feb 2011 20:19:01 -0800 (PST)
In-Reply-To: <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>
Date: Thu, 24 Feb 2011 06:19:01 +0200
Message-ID: <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 04:18:14 -0000

> So I think that there should be a happy medium between the
> specification providing a complete history and reasoning for each
> feature, vs providing just a bit of reasoning to motivate a feature.
> For example we could just say something like: The data from the client
> to the server is masked by the user-agent to protect against HTTP
> aware intermediaries mistaking WS content as HTTP requests.

So, to continue with productive discussion (sorry Greg for hijacking
your reply):
Any HTML "src" attribute and "link" tag can be made to query _any_
plaintext of the target server,
and, obviously, XHR methods can also.
This attack vector doesn't seem to be a problem for either.
So why WS takes precautions against this, while losing easy-debug and
low-complexity implementation
ability ? Even Adam Barth's own paper advocated using CONNECT to
overcome this, arguably, non-existent, problem.
Even if anyone would take this attack seriously ignoring the same
_unused_ attack vector within HTML and XHR,
why would one choose to kill debug ability and add considerable
complexity instead of changing header request type ?
The "let's make traffic look random" idea reeks of overkill
pseudo-security features added just "cause they seem cool",
and that don't serve any actual purpose in practice.

This is one of those WTF moments...

--
 silvio

From jat@google.com  Wed Feb 23 20:33:52 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 238FC3A6969 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:33:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.188
X-Spam-Level: 
X-Spam-Status: No, score=-105.188 tagged_above=-999 required=5 tests=[AWL=0.788, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fl2ZxHG0idGt for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:33:51 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id B96143A6955 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:33:50 -0800 (PST)
Received: from kpbe15.cbf.corp.google.com (kpbe15.cbf.corp.google.com [172.25.105.79]) by smtp-out.google.com with ESMTP id p1O4Yb0I026641 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:34:38 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298522078; bh=Q3+XrX19CHOPUwXWQj9l/cv2NFo=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Vr2FHfo68KAaMVPAfbzCuNbKzhGD7u887NU4UB1WV6E1QhFk2+zfgCB//Rn4uULNe A2BdbQxAOphp0prQlslGg==
Received: from yic15 (yic15.prod.google.com [10.243.65.143]) by kpbe15.cbf.corp.google.com with ESMTP id p1O4YXLW004168 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Wed, 23 Feb 2011 20:34:36 -0800
Received: by yic15 with SMTP id 15so93840yic.8 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:34:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=oMdrfqsNsQ6H9r1ynkh74uNW4ONa/ZzEeyWFl0+gw24=; b=dCmm2C8Ckwh8j4bNrDYKb6pzizawahrLXxO6SCF5XpBdYVhbS0yJUFCO7xUspDI+// JC2hSOQ31fLQ7MGj5x0g==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=kndamvPY3uoHJtD6/qDvC6WHYo3CuxHeMyBLkoqr9iNSk2Md0wNDhGlbdb86VRnpqj yUk318ZP4Z0ql+ygozUQ==
Received: by 10.151.14.8 with SMTP id r8mr1156510ybi.331.1298522073137; Wed, 23 Feb 2011 20:34:33 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Wed, 23 Feb 2011 20:34:13 -0800 (PST)
In-Reply-To: <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Wed, 23 Feb 2011 23:34:13 -0500
Message-ID: <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd6ea72e7029e049cffba08
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 04:33:52 -0000

--000e0cd6ea72e7029e049cffba08
Content-Type: text/plain; charset=UTF-8

On Wed, Feb 23, 2011 at 11:19 PM, Silvio Ventres
<silvio.ventres@gmail.com>wrote:

> So, to continue with productive discussion (sorry Greg for hijacking
> your reply):
> Any HTML "src" attribute and "link" tag can be made to query _any_
> plaintext of the target server,
> and, obviously, XHR methods can also.
> This attack vector doesn't seem to be a problem for either.
> So why WS takes precautions against this, while losing easy-debug and
> low-complexity implementation
> ability ? Even Adam Barth's own paper advocated using CONNECT to
> overcome this, arguably, non-existent, problem.
> Even if anyone would take this attack seriously ignoring the same
> _unused_ attack vector within HTML and XHR,
> why would one choose to kill debug ability and add considerable
> complexity instead of changing header request type ?
> The "let's make traffic look random" idea reeks of overkill
> pseudo-security features added just "cause they seem cool",
> and that don't serve any actual purpose in practice.
>
> This is one of those WTF moments...
>

Again, this was discussed ad nauseum for months and months, leading to
Mozilla and Opera disabling WebSockets.

XHR can't be used to attack a server that the script wasn't sourced from,
and can't fake HTTP headers.  Adam & Eric demonstrated that some transparent
intermediaries do not understand Connection: Upgrade and therefore can be
tricked into thinking subsequent traffic is the next HTTP message when it
isn't.  That can be used to poison a cache which will then serve  contents
of the attacker's choosing to all clients behind that cache.

For an idea of the implications, consider if the attacker is able to store
JS of their choice in a cache that will be served for
http://www.google.com/ga.js

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6ea72e7029e049cffba08
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Feb 23, 2011 at 11:19 PM, Silvio Ventres=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.v=
entres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">So, to continue with productive discussion (sorry Greg fo=
r hijacking</div>
your reply):<br>
Any HTML &quot;src&quot; attribute and &quot;link&quot; tag can be made to =
query _any_<br>
plaintext of the target server,<br>
and, obviously, XHR methods can also.<br>
This attack vector doesn&#39;t seem to be a problem for either.<br>
So why WS takes precautions against this, while losing easy-debug and<br>
low-complexity implementation<br>
ability ? Even Adam Barth&#39;s own paper advocated using CONNECT to<br>
overcome this, arguably, non-existent, problem.<br>
Even if anyone would take this attack seriously ignoring the same<br>
_unused_ attack vector within HTML and XHR,<br>
why would one choose to kill debug ability and add considerable<br>
complexity instead of changing header request type ?<br>
The &quot;let&#39;s make traffic look random&quot; idea reeks of overkill<b=
r>
pseudo-security features added just &quot;cause they seem cool&quot;,<br>
and that don&#39;t serve any actual purpose in practice.<br>
<br>
This is one of those WTF moments...<br></blockquote><div><br></div><div>Aga=
in, this was discussed ad nauseum for months and months, leading to Mozilla=
 and Opera disabling WebSockets.</div><div><br></div><div>XHR can&#39;t be =
used to attack a server that the script wasn&#39;t sourced from, and can&#3=
9;t fake HTTP headers. =C2=A0Adam &amp; Eric demonstrated that some transpa=
rent intermediaries do not understand Connection: Upgrade and therefore can=
 be tricked into thinking subsequent traffic is the next HTTP message when =
it isn&#39;t. =C2=A0That can be used to poison a cache which will then serv=
e =C2=A0contents of the attacker&#39;s choosing to all clients behind that =
cache.</div>

<div><br></div><div>For an idea of the implications, consider if the attack=
er is able to store JS of their choice in a cache that will be served for <=
a href=3D"http://www.google.com/ga.js">http://www.google.com/ga.js</a></div=
>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd6ea72e7029e049cffba08--

From gregw@intalio.com  Wed Feb 23 20:34:47 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3EB163A6955 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:34:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.387
X-Spam-Level: 
X-Spam-Status: No, score=-0.387 tagged_above=-999 required=5 tests=[AWL=-2.039, BAYES_00=-2.599, FB_INCREASE_VOL=3.629, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bij8aksgdfZu for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:34:45 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 9C1BC3A6953 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:34:43 -0800 (PST)
Received: by vxg33 with SMTP id 33so69605vxg.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:35:32 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.167.138 with SMTP id zo10mr554181vdb.251.1298522132036; Wed, 23 Feb 2011 20:35:32 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Wed, 23 Feb 2011 20:35:31 -0800 (PST)
In-Reply-To: <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com>
Date: Thu, 24 Feb 2011 15:35:31 +1100
X-Google-Sender-Auth: xl_S6vELtN_KqNcwRox-eEBH3NM
Message-ID: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 04:34:47 -0000

On 24 February 2011 15:19, Silvio Ventres <silvio.ventres@gmail.com> wrote:

> Any HTML "src" attribute and "link" tag can be made to query _any_
> plaintext of the target server,
> and, obviously, XHR methods can also.
> This attack vector doesn't seem to be a problem for either.
> So why WS takes precautions against this,

Because existing HTTP mechanisms do not provide a mechanism to spoof
headers (host header, Sec- headers etc.)
If WS content was ever misinterpreted as a HTTP request, then it would
be more "powerful" than any HTTP request that can be generated by XHR
or src tags.

> while losing easy-debug and
> low-complexity implementation
> ability ?

Well there was significant effort put towards arguing for a masking
mechanism that has the entire key within the frame, so that each frame
can be decoded without needing the entire stream.  Do
easy-debugability was a consideration in the spec.  OK it's not as
easy as plain text, but there were compromises to be made.


> overcome this, arguably, non-existent, problem.

Well you have plenty of supporters who agree that this is arguably a
non-existent problem.   But we were substantiate that it is a provably
non-existent problem -  and for better or worse a proof or a
"solution" was need to achieve rough consensus.

> The "let's make traffic look random" idea reeks of overkill
> pseudo-security features added just "cause they seem cool",
> and that don't serve any actual purpose in practice.

I'm not going to say that masking is a perfect or even necessary
technical solution, but it was the solution that came out of the IETF
process for achieving rough consensus.

I still have issues with it (it should only mask the payload so that
framing is in the clear;  it should be an extension so it can be
replaced or disabled if it proves necessary) and I'm prepared to
significantly increase the volume of the archives in support for those
points.      However I have conceded to the outcome of the process
that we will have masking.

However, I repeat that I think we do need to provide at least some
minimal explanation for it.

> This is one of those WTF moments...

welcome to hybi!

From gregw@intalio.com  Wed Feb 23 20:36:10 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B960F3A6955 for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:36:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.475
X-Spam-Level: 
X-Spam-Status: No, score=-2.475 tagged_above=-999 required=5 tests=[AWL=0.502,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vrMGDw7N1HCI for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:36:09 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id AE8D73A6953 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:36:09 -0800 (PST)
Received: by vws6 with SMTP id 6so146167vws.31 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:36:58 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.157.70 with SMTP id wk6mr633282vdb.51.1298522218194; Wed, 23 Feb 2011 20:36:58 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Wed, 23 Feb 2011 20:36:58 -0800 (PST)
In-Reply-To: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>
Date: Thu, 24 Feb 2011 15:36:58 +1100
X-Google-Sender-Auth: yfpXA3SScsDZ_pORbarEKx583iI
Message-ID: <AANLkTi=8ua14LnOKo9x64Zg2LSUBFKeC_6o-8BZm8Hur@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 04:36:10 -0000

On 24 February 2011 15:35, Greg Wilkins <gregw@webtide.com> wrote:
> Well you have plenty of supporters who agree that this is arguably a
> non-existent problem. =A0 But we were substantiate that it is a provably
> non-existent problem - =A0and for better or worse a proof or a
> "solution" was need to achieve rough consensus.

let me try that in english:

You have plenty of supporters who agree that this is arguably a
non-existent problem.   But we were unable to substantiate that it is
a provably non-existent problem, so for better or worse a proof or a
"solution" was need to achieve rough consensus.

From duerst@it.aoyama.ac.jp  Wed Feb 23 20:59:14 2011
Return-Path: <duerst@it.aoyama.ac.jp>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E0823A698A for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:59:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -99.859
X-Spam-Level: 
X-Spam-Status: No, score=-99.859 tagged_above=-999 required=5 tests=[AWL=-0.069, BAYES_00=-2.599, HELO_EQ_JP=1.244, HOST_EQ_JP=1.265, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id saR0cPXSxNCC for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 20:59:13 -0800 (PST)
Received: from scintmta02.scbb.aoyama.ac.jp (scintmta02.scbb.aoyama.ac.jp [133.2.253.34]) by core3.amsl.com (Postfix) with ESMTP id B3BFB3A6981 for <hybi@ietf.org>; Wed, 23 Feb 2011 20:59:11 -0800 (PST)
Received: from scmse02.scbb.aoyama.ac.jp ([133.2.253.231]) by scintmta02.scbb.aoyama.ac.jp (secret/secret) with SMTP id p1O4xpOx020192 for <hybi@ietf.org>; Thu, 24 Feb 2011 13:59:51 +0900
Received: from (unknown [133.2.206.133]) by scmse02.scbb.aoyama.ac.jp with smtp id 2bd6_8882_e9b90cb6_3fd2_11e0_b074_001d096c5782; Thu, 24 Feb 2011 13:59:51 +0900
Received: from [IPv6:::1] ([133.2.210.1]:34937) by itmail.it.aoyama.ac.jp with [XMail 1.22 ESMTP Server] id <S14D7B84> for <hybi@ietf.org> from <duerst@it.aoyama.ac.jp>; Thu, 24 Feb 2011 13:59:50 +0900
Message-ID: <4D65E5AD.5050209@it.aoyama.ac.jp>
Date: Thu, 24 Feb 2011 13:59:25 +0900
From: =?ISO-8859-1?Q?=22Martin_J=2E_D=FCrst=22?= <duerst@it.aoyama.ac.jp>
Organization: Aoyama Gakuin University
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.9) Gecko/20100722 Eudora/3.0.4
MIME-Version: 1.0
To: Silvio Ventres <silvio.ventres@gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>	<AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>	<AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com>	<AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com>	<AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com>	<AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com>	<AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com>	<AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com>
In-Reply-To: <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 04:59:14 -0000

Hello Silvio,

What you are essentially asking for is that some of the people who 
already spent tons of time in this WG to read lots of mail and 
contribute to spend more time explaining things again and again to 
newcomers, just because these newcomers don't want to invest the same 
time (actually, probably quite a bit less, because you can read the 
mailing list backwards and only pick up the main threads,...) as 
everybody who has participated for a while.

I don't think this is very fair at all.

On 2011/02/24 12:57, Silvio Ventres wrote:
>> If RFC2616 had to list out the full history of every debate of every feature
>> in HTTP it would be unreadable and worthless. The protocol is a guide to
>> what you must do if you want to create software that can interoperate with
>> other WS endpoints, in that sense yes, it is something of a howto. You do
>> not need a transcription of months of arguments that led to what it is. I am
>> sure that back in the 90s people were debating about whether Accept-Lang:
>> en, de; q=0.8 was more understandable or less understandable than en;
>> de,q=0.8, but at the end of the day one won out, and the history doesn't
>> really matter as if I want it to work, I need to send en,de;q=0.8.
>
> With all due respect, Ian, the current questions are not about amount
> of spacing in the headers.
> They are about the inherent features that have been included in the
> standard for some implied and hidden reasons.
> Specifically, security features are only added as a reply to some
> possible and explicitly defined attack vectors
> You don't just add a defense mechanism, burdening the compliant
> implementors, without providing rationale as to why it should exist.
> Especially, not when you're only _developing_ a standard.

Of course you don't. Why do you assume we did? Please go read the archives.

> And the point here is that the debate haven't even begun.

I hope that unless you provide some very new insight, there will be no 
new debate about closed issues. We can't repeat debates every time a new 
member joins the WG.

> All that was asked is to explain the rationale and provide clear and
> concise attack vectors or use scenarios which are promoted or which
> are prevented by the measures in the protocol.

Yes, and all you were told was that you should go and read the archives. 
But rather than doing so, you decided to shift the discussion to 
meta-issues such as how much rationale a spec should provide or why an 
editor (who is doing this work as a volunteer) is supposed to provide a 
free question answering service. Please, please stop bothering this WG 
with such discussions, and go do your homework to catch up with the rest 
of the WG. Thanks a lot!


> Who other than you, Ian, is able to better answer the questions
> regarding reasoning behind each feature ?
> In the end, it was you that heard all the arguments, accepted some and
> rejected others, and thus, you were the
> party accepting some argued reasoning, and thus should know and
> remember that reasoning fairly well.
> Why is it so problematic to provide the reasoning ? If you were
> actually persuaded, and understand the reasoning
> behind all the features, it should not be that hard to recall them and
> write a few sentences of clarification.

Sorry, but Ian is the editor. An editor understands a lot of what's 
going into the spec, but on some issues, he may just use the text that 
has been discussed by the group and approved by the chairs. To some 
extent, it would actually be a bad think if he were too involved with 
the pros and cons of each proposal. The WG has had experience with an 
editor who cared so much about some issues that he was unable to follow 
the instructions from the chairs and decided to hand over his role to 
somebody else.

Regards,   Martin.

-- 
#-# Martin J. Dürst, Professor, Aoyama Gakuin University
#-# http://www.sw.it.aoyama.ac.jp   mailto:duerst@it.aoyama.ac.jp

From andy.warmcat.com@googlemail.com  Wed Feb 23 22:35:48 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 986D63A69EB for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 22:35:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.449
X-Spam-Level: 
X-Spam-Status: No, score=-3.449 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 97xO8by8HTMu for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 22:35:46 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 850D23A6820 for <hybi@ietf.org>; Wed, 23 Feb 2011 22:35:45 -0800 (PST)
Received: by wwb39 with SMTP id 39so231179wwb.13 for <hybi@ietf.org>; Wed, 23 Feb 2011 22:36:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=8Rc9GJwXsp2bNUAVYVi8i8tUbON2qiGbmT6HhabiKpk=; b=N5uEyA3LTrz3i4h1sewNHYk/T1x4bwE2SnAf/o8Yg75x5zClRNJSBm1y+c/6OUuhkd DybnYltYS2lIl+Fbtzo2wzUbVC/xNFrQFdCDznR80bZ7pXOqoL60zI46Y6+s/kLsr4/n xdzkKYMUyX4ag3dvWObbQS2iyOEnTq1LffUxg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=iQqcy25FlWn5ZZdJs0h5qiyNrH7avQl57FylOdkXCHgg/5t8d6kRmx0KP3wrx7vBNl 5s5/xCjk5RmogouHXoQ9Ye7Y7Agj1Xr602ZaBhQBE7+mUAHzCWyj9bWAPcMFifCQN0ZP Cd9OVZbo5GJwzPxRLK94s9ua9NIIl42zW0r/k=
Received: by 10.227.134.135 with SMTP id j7mr363233wbt.12.1298529393504; Wed, 23 Feb 2011 22:36:33 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id o6sm2312015wbo.3.2011.02.23.22.36.30 (version=SSLv3 cipher=OTHER); Wed, 23 Feb 2011 22:36:31 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D65FC6E.7090107@warmcat.com>
Date: Thu, 24 Feb 2011 06:36:30 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: =?UTF-8?B?ScOxYWtpIEJheiBDYXN0aWxsbw==?= <ibc@aliax.net>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<4D657294.20000@warmcat.com>	<AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com>	<4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com>
In-Reply-To: <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 06:35:48 -0000

On 02/24/2011 12:26 AM, Somebody in the thread at some point said:

Hi -

>>> More importantly, fragmentation allows a server returning content of
>>> unknown size (such as dynamically generated content or the result of
>>> compression) without having to buffer the entire message.
>>
>> How is that going to work in the Browser / Javascript event context then?
>
> Is not the same concept as HTTP chunked transfer? do you mean that a
> HTTP client receiving a 200 OK with "Transfer-Encoding: chunked" is
> not able to know when the response body terminates?
>
> For sure you are not saying that so I'm missing something :)

It's similar idea, but with chunked transfer the client is getting each 
piece as it comes, so if it was HTML coming like that the browser can 
redraw the layout if it likes with each new chunk coming until the whole 
thing is done.  Or if it was a PNG coming, the client can redraw with 
what it has got as each new chunk comes.

However with websocket messages, it's a different "promise" to the 
Javascript API: the client buffers up each chunk until the entire 
message "finishes" and presents the whole buffer to Javascript once at 
the end.  So the deal is websocket handler in Javascript only sees 
complete messages and it's invisible how many frames were involved on 
the wire or how big they were.

A message "finishes" by having a frame with FIN bit set one way or another.

You can emulate chunked just fine with websockets, but you'd do that by 
streaming and endless bunch of smaller complete messages, each with 
their own FIN frame that spills the message to Javascript, rather than 
delaying the frame with FIN set in a single message.

-Andy

From andy.warmcat.com@googlemail.com  Wed Feb 23 22:57:39 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9342A3A6A3E for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 22:57:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.582
X-Spam-Level: 
X-Spam-Status: No, score=-3.582 tagged_above=-999 required=5 tests=[AWL=0.017,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lF+Xz9eN5wBk for <hybi@core3.amsl.com>; Wed, 23 Feb 2011 22:57:38 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id B7D5E3A6A2D for <hybi@ietf.org>; Wed, 23 Feb 2011 22:57:37 -0800 (PST)
Received: by wwb39 with SMTP id 39so241479wwb.13 for <hybi@ietf.org>; Wed, 23 Feb 2011 22:58:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=p0ZyPx3oKwKN7fSxYWlJLfPqDvw/eB4mreBxcexgDRg=; b=P6zLkBmNn0UIA02yVCrbCUeDqQJW0e53379HBBH5GwUFv8S+8jPfl6RHRB40GezTdX IfaCD1q5q585X4Nbb7D5/c1KajvSJkrSEMNpVpku+42L0XCJncoyxg+81kAvvxE09299 3xut4PWw7cVvmwoVIGhcExmRUNSE+XZ+vHacw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=a6vI2B4T6y7d2jjlrmipLDGMmc7XymKObbE9r7idHOZXNShxNOovChpZalcw30+Y0+ QFQo9kU4/Wmpemzrn6M3npRoxu99KCx2JccdPBLfjkAwWEk7Ve/CMh0QubOKyJu7knvy fpwT7E1ahwf0gEzIVq0MBn9kgUXc6UYpWreAE=
Received: by 10.227.24.69 with SMTP id u5mr339998wbb.223.1298530706123; Wed, 23 Feb 2011 22:58:26 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id w25sm477075wbd.17.2011.02.23.22.58.24 (version=SSLv3 cipher=OTHER); Wed, 23 Feb 2011 22:58:24 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D66018F.8070705@warmcat.com>
Date: Thu, 24 Feb 2011 06:58:23 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>	<AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>	<AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>	<AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com>
In-Reply-To: <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 06:57:39 -0000

On 02/24/2011 04:34 AM, Somebody in the thread at some point said:
> On Wed, Feb 23, 2011 at 11:19 PM, Silvio Ventres
> <silvio.ventres@gmail.com <mailto:silvio.ventres@gmail.com>> wrote:
>
>     So, to continue with productive discussion (sorry Greg for hijacking
>     your reply):
>     Any HTML "src" attribute and "link" tag can be made to query _any_
>     plaintext of the target server,
>     and, obviously, XHR methods can also.
>     This attack vector doesn't seem to be a problem for either.
>     So why WS takes precautions against this, while losing easy-debug and
>     low-complexity implementation
>     ability ? Even Adam Barth's own paper advocated using CONNECT to
>     overcome this, arguably, non-existent, problem.
>     Even if anyone would take this attack seriously ignoring the same
>     _unused_ attack vector within HTML and XHR,
>     why would one choose to kill debug ability and add considerable
>     complexity instead of changing header request type ?
>     The "let's make traffic look random" idea reeks of overkill
>     pseudo-security features added just "cause they seem cool",
>     and that don't serve any actual purpose in practice.
>
>     This is one of those WTF moments...
>
>
> Again, this was discussed ad nauseum for months and months, leading to
> Mozilla and Opera disabling WebSockets.

Well, just a precision from what I could work out watching it, it was 
the claims in Barth's paper, the subsequent media attention that led to 
Mozilla disabling it by default and writing about the nobility of taking 
security seriously.  For Opera, they have written on the list in a 
pretty annoyed tone that they won't track websocket standard any more 
until it finalizes (or dies) so I think that drove that side as much as 
the allegations.

It wasn't the case that Mozilla and Opera followed the "discussion" for 
"months and months" and then after consideration disabled it.  To be 
fair, if the allegations were true, is was better that they didn't wait. 
  But there has been a really strange lack of repeatability for the 
claims, a lack of open-ness for enabling repeatability by others via 
publishing the scripts AFAIK and a lack of identification of a single 
vulnerable intermediary.  Maybe that's because the attack was so 
effective, they just notify vendors in secret, but -->

> XHR can't be used to attack a server that the script wasn't sourced
> from, and can't fake HTTP headers.  Adam & Eric demonstrated that some
> transparent intermediaries do not understand Connection: Upgrade and
> therefore can be tricked into thinking subsequent traffic is the next
> HTTP message when it isn't.  That can be used to poison a cache which
> will then serve  contents of the attacker's choosing to all clients
> behind that cache.
>
> For an idea of the implications, consider if the attacker is able to
> store JS of their choice in a cache that will be served for
> http://www.google.com/ga.js

... so curious if one believes that, that Chrome notably didn't disable 
websockets support.

Anyway what's done is done.  For sure this is a good example of why 
excessive rationales would cause more harm than good because munging 
frames would need to be rationalized as "Added to give Mozilla an excuse 
to enable us again".

-Andy

From ibc@aliax.net  Thu Feb 24 02:16:07 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C9F03A6846 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 02:16:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.057
X-Spam-Level: 
X-Spam-Status: No, score=-2.057 tagged_above=-999 required=5 tests=[AWL=-0.620, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1, SARE_LWSHORTT=1.24]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zh0mfNjNP--p for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 02:16:06 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 1C5E53A6A58 for <hybi@ietf.org>; Thu, 24 Feb 2011 02:16:05 -0800 (PST)
Received: by qwh6 with SMTP id 6so311492qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 02:16:55 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr447733qcb.170.1298542614876; Thu, 24 Feb 2011 02:16:54 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 02:16:53 -0800 (PST)
In-Reply-To: <AANLkTin2SBW8GgkqD7qMkv9G7FzsdAmbG33Tj4r3Y6Kx@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTin2SBW8GgkqD7qMkv9G7FzsdAmbG33Tj4r3Y6Kx@mail.gmail.com>
Date: Thu, 24 Feb 2011 11:16:53 +0100
Message-ID: <AANLkTimqvRV7bgBdnoaMOyNGhL2jhdtgXyWnmFRvRpW=@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Brian <theturtle32@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 10:16:07 -0000

2011/2/24 Brian <theturtle32@gmail.com>:
> I can empathize with the rationale for both positions here, but I'm
> going to agree with Ian -- the specification needs to be lean and
> readily understandable. =C2=A0If I'm on a mission to build a new
> implementation of a client or server, I want to be able to do it as
> swiftly as possible without getting mired down in superfluous details
> that aren't critical to the implementation.
>
> On the other hand, I also feel that an accompanying document would be
> a helpful nicety, because indeed, there are many, many things in the
> draft that, while there are very specific and nuanced reasons for
> their existence, would make any new implementer scratch his/her head
> and grumble "WTF?!"

That is exactly what I felt when reading this draft. So imagine how
many people will feel the same when it becomes a RFC.


> That kind of experience would cause most implementers to feel angry
> and resentful of the protocol and its creators. =C2=A0It took me months o=
f
> reading every single mail sent to this list to stop feeling literally
> angry at certain members of the working group and finally understand
> where they're coming from and why things were decided one way or
> another. =C2=A0There are still things that I'm not thrilled with, but lik=
e
> others, happy to accept to move forward with a workable and stable
> specification.
>
> The big problem with creating such a document is that it's not
> strictly required for the standardization process (though it might
> expedite things in the later stages of ratification) and everyone on
> this mailing list is extremely busy without much time to dedicate to
> such an involved side-project. =C2=A0I know I don't have that kind of tim=
e.
> =C2=A0I think the best bet, as suggested by someone previously, is to do =
it
> as an FAQ/Wiki that everyone can contribute to so that it can get done
> without putting a large burden on any one individual. =C2=A0That way the
> information is available without having to scour the mailing list
> archives, but it wont clutter up the draft.

The FAQ/Wiki is better than nothing (the mail archives in nothing, as
there are 99% of discussions and just 1% of useful conclusions).
Anyhow IMHO a draft with WebSocket Requeriments whould me more
appropriate.

If you want to see a good example:

- RFC 3323: A Privacy Mechanism for the Session Initiation Protocol (SIP).
- RFC 3324: Short Term Requirements for Network Asserted Identity
- RFC 3325: Private Extensions to the Session Initiation Protocol (SIP) for
                   Asserted Identity within Trusted Networks

An implementor would directly read RFC 3325 and "follow instructions".
A reader interested in motivations and technical rationale of the spec
would also read RFC 3323 and 3324 (instead of being redirected to ugly
mail archives full of discussions and useless mails).


> For what it's worth, I feel your pain with regard to searching the
> archives. =C2=A0It really is a completely insurmountable task at this
> point, since the volume on this list has been, at times, a veritable
> deluge of information. =C2=A0Indeed there have been a few days where it
> took me multiple hours to get through all the posts sent on that one
> day. =C2=A0Searching through hundreds of messages per week in the mailing
> list archives is *not* an option for newcomers on most of the topics
> that they would be curious about.

Unfortunatelly it seems that other members here expect that a newcomer
should navigate through hundreds of mails in an old archive ("it's was
hard for me so it must be so hard for you").


Thanks fo your response.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Thu Feb 24 02:45:22 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CAD513A6A07 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 02:45:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.625
X-Spam-Level: 
X-Spam-Status: No, score=-2.625 tagged_above=-999 required=5 tests=[AWL=0.052,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3W+SN+AvEAdg for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 02:45:21 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 9D9A83A69F7 for <hybi@ietf.org>; Thu, 24 Feb 2011 02:45:21 -0800 (PST)
Received: by qwh6 with SMTP id 6so330847qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 02:46:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr474493qcb.170.1298544369129; Thu, 24 Feb 2011 02:46:09 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 02:46:08 -0800 (PST)
In-Reply-To: <4D65CBD0.10501@it.aoyama.ac.jp>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <4D65CBD0.10501@it.aoyama.ac.jp>
Date: Thu, 24 Feb 2011 11:46:08 +0100
Message-ID: <AANLkTi=_jXgJO1ywiMMGr5gmpoPyA0ffz-wGi1G3ZeEg@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: =?UTF-8?Q?Martin_J=2E_D=C3=BCrst?= <duerst@it.aoyama.ac.jp>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 10:45:22 -0000

2011/2/24 "Martin J. D=C3=BCrst" <duerst@it.aoyama.ac.jp>:
> Hello I=C3=B1aki,
>
> Why don't you (and maybe Silvio) volunteer to write a draft describing
> background/rationale for WebSockets? I'm sure it would be appreciated by =
a
> lot of people, and you would get lots of support from the WG.

As I'm a newcomer and didn't participate in old discussions in the
maillist, I don't think I'm the best profile to summarize all the
discussions and conclusions which took place in the archives.

I'm interested in WebSocket protocol, I am able to participate in
someway (I'm not a super-expert but I'm used to deal with network
protocols) but for that I require a real document (or whatever useful
thing) in which rationale is described (I mean conclusions not the
whole and long discussions as mail archives provide). I've not enough
time to read all the mail archives, but IMHO it shouldn't be required
at all if conclusions were documented (as they are in so many other
specifications).



>> Really? so what is this draft? a "HOWTO" for developing software?.
>
> In essence yes. For software to work, it has to work to spec; why the spe=
c
> is the way it is is mostly irrelevant. Indeed having too much rationale i=
n
> the spec may lead implementers to implement to the rationale rather than =
the
> actual spec, which leads to interoperability problems. (Implementers read
> the rationale, think "a, I see how it's supposed to work", and miss some
> details.)

Ok, I couldl agree, but the rationale should be (IMHO) *documented*
somewhere (mail archives is not an option, it stores full discusions).



> There is no requirement anywhere in the IETF process that a spec (or
> specifically a standard) has to include rationale. The same applies to W3=
C
> specs, and I guess to the specs of many other standards organizations. Ma=
ny
> specs are successful because they are short and to the point, rather than
> because they include a lot of rationale.
>
> A case in point would be XML. The XML spec contains a very short list of
> goals at the start (http://www.w3.org/TR/xml/#sec-origin-goals), which is
> far away from a rationale. For the rest, it's just facts, no reasons. And
> XML was and continues to be extremely widely used.
>
> During the development of XML (something like 1996-1997), there was a ver=
y
> strict "go read the mailing list first" policy. The spec would maybe neve=
r
> have been completed if not for that policy; otherwise, the WG would have
> been busy all the time giving intros to newcommers rather than finishing
> their work.

Ok, but honestly, the decisions taken on WebSocket protocol are, at
least, debatable (for example the exotic handshake which IMHO provides
nothing better than a simple "magig string" mechanism). When I read
the draft my first time I asked my self "why such unuseful and exotic
handshake? it's just a waste of computation cycles providing no real
security at all". Same with masking, "it is just randomizing the
bytes, no more, it provides nothing useful".

Of course you have debated a lot about it (and it would be insane for
anyone if he must read all your long discussions to understand the
rationale). So instead of leave such conclusions somewhere in the mail
archives, please properly document them. Maybe I'm wrong, but IMHO it
should be a requeriment for a draft to become a standard.





> You are right for security-related stuff, which has to be discussed in th=
e
> security section (although this is focused on possible attacks that are
> still open, rather than on those that the protocol design closes).

True. The Security sections should not explain motivations for the
design of the protocol but instead it should warn about expectable
attacks or security issues given the current design.



> For the rest, a separate document is a much better alternative, and I hop=
e
> you can help us produce one.

So I just need to read hundred of old mails :)


Thanks.



--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Thu Feb 24 02:51:58 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 938B93A6947 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 02:51:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.629
X-Spam-Level: 
X-Spam-Status: No, score=-2.629 tagged_above=-999 required=5 tests=[AWL=0.048,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4VePY+OYlszB for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 02:51:57 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id A1EA83A683E for <hybi@ietf.org>; Thu, 24 Feb 2011 02:51:57 -0800 (PST)
Received: by qyk29 with SMTP id 29so3713383qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 02:52:46 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr478873qcb.170.1298544766607; Thu, 24 Feb 2011 02:52:46 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 02:52:46 -0800 (PST)
In-Reply-To: <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>
Date: Thu, 24 Feb 2011 11:52:46 +0100
Message-ID: <AANLkTi=9kD6C2XkBTLPq7P1wxkhHd6p-mwtVOeeX4H3K@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 10:51:58 -0000

2011/2/24 Greg Wilkins <gregw@webtide.com>:
> So I think that there should be a happy medium between the
> specification providing a complete history and reasoning for each
> feature, vs providing just a bit of reasoning to motivate a feature.
> For example we could just say something like: The data from the client
> to the server is masked by the user-agent to protect against HTTP
> aware intermediaries mistaking WS content as HTTP requests.
>
> I really don't think it is good that first time readers of the
> protocol document have WTF moments that can only be answered by
> reading a vast mailing archive.

How is possible that other members in this group don't agree with the
above comment? It's just obvious, it just makes all the sense.

Please, don't assume that future readers of this specification will
just be lazy programmers just interested in make it work ASAP in their
software.

Don't take me wrong, but the handshake, masking and some other stuff
in the draft seem ridiculous wihout a good rationale documenting them.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Thu Feb 24 03:08:37 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C06683A6A82 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:08:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.633
X-Spam-Level: 
X-Spam-Status: No, score=-2.633 tagged_above=-999 required=5 tests=[AWL=0.044,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9n62qGX8J8Ea for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:08:37 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id CE7713A6A81 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:08:36 -0800 (PST)
Received: by qwh6 with SMTP id 6so346996qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:09:26 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr491060qcb.170.1298545765992; Thu, 24 Feb 2011 03:09:25 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 03:09:25 -0800 (PST)
In-Reply-To: <4D65E5AD.5050209@it.aoyama.ac.jp>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com> <4D65E5AD.5050209@it.aoyama.ac.jp>
Date: Thu, 24 Feb 2011 12:09:25 +0100
Message-ID: <AANLkTin9LXVWgLA8BgXm_ReGzK5GYrkHXxPKiM+ptPc-@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: =?UTF-8?Q?Martin_J=2E_D=C3=BCrst?= <duerst@it.aoyama.ac.jp>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 11:08:37 -0000

2011/2/24 "Martin J. D=C3=BCrst" <duerst@it.aoyama.ac.jp>:
> Hello Silvio,
>
> What you are essentially asking for is that some of the people who alread=
y
> spent tons of time in this WG to read lots of mail and contribute to spen=
d
> more time explaining things again and again to newcomers, just because th=
ese
> newcomers don't want to invest the same time (actually, probably quite a =
bit
> less, because you can read the mailing list backwards and only pick up th=
e
> main threads,...) as everybody who has participated for a while.

If rationale adopted in the maillist archives would be *documented*
somewhere (hopefully in a separate draft) there would be no need of
asking/replyin again and again.




>> And the point here is that the debate haven't even begun.

> I hope that unless you provide some very new insight, there will be no ne=
w
> debate about closed issues. We can't repeat debates every time a new memb=
er
> joins the WG.

I don't want to re-open a debate. I just want to understand the
reasons motivating the final design decisions. And nobody is able to
extract such infromation from the mail archives (except people with
too much spare time or paeplo payed for that).

Redirecting people to mail archives is like ensuring that newcomers
will not participate in the group.




>> All that was asked is to explain the rationale and provide clear and
>> concise attack vectors or use scenarios which are promoted or which
>> are prevented by the measures in the protocol.
>
> Yes, and all you were told was that you should go and read the archives.

Which is not a valid option IMHO.


Regards.




--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Thu Feb 24 03:19:40 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 02B1E3A69E7 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:19:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.636
X-Spam-Level: 
X-Spam-Status: No, score=-2.636 tagged_above=-999 required=5 tests=[AWL=0.041,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YHDdZ1A48npm for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:19:38 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id 98BB13A69C4 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:19:38 -0800 (PST)
Received: by qyk29 with SMTP id 29so3730999qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:20:27 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.245.4 with SMTP id ls4mr474548qcb.208.1298546427780; Thu, 24 Feb 2011 03:20:27 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 03:20:27 -0800 (PST)
In-Reply-To: <4D65FC6E.7090107@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com>
Date: Thu, 24 Feb 2011 12:20:27 +0100
Message-ID: <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 11:19:40 -0000

2011/2/24 Andy Green <andy@warmcat.com>:
>> Is not the same concept as HTTP chunked transfer? do you mean that a
>> HTTP client receiving a 200 OK with "Transfer-Encoding: chunked" is
>> not able to know when the response body terminates?
>>
>> For sure you are not saying that so I'm missing something :)
>
> It's similar idea, but with chunked transfer the client is getting each
> piece as it comes, so if it was HTML coming like that the browser can red=
raw
> the layout if it likes with each new chunk coming until the whole thing i=
s
> done. =C2=A0Or if it was a PNG coming, the client can redraw with what it=
 has got
> as each new chunk comes.
>
> However with websocket messages, it's a different "promise" to the
> Javascript API: the client buffers up each chunk until the entire message
> "finishes" and presents the whole buffer to Javascript once at the end. =
=C2=A0So
> the deal is websocket handler in Javascript only sees complete messages a=
nd
> it's invisible how many frames were involved on the wire or how big they
> were.

This could be achieved within the specific protocol carried by
websocket stream. Maybe the JavaScript client could trigger
"on_partial_message(fragment)" if the negociated protocol is known to
carry "fragmentable" information (as images). But this depends on the
carried protocol on top of WS. Such protocol should use something like
"Content-Type" and so.

For example, the API could include a function
"on_partial_receive(fragment)" which would be invoked when partial
data arrives. It's up to the JavaScript code to decide if it does
something or not when such function is called. It could just do
nothing and wait for "on_message(message)" to be triggered (which full
message). In this way, the feature would exist in WS core spec, but
should be accomplished by protocols on top of WS (propietary or
standard protocols, it doesn't matter as it is the JavaScript code
which decides to react or not upon receipt of partial data).


Cheers.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From tyoshino@google.com  Thu Feb 24 03:32:07 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CE3E3A6A86 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:32:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.63
X-Spam-Level: 
X-Spam-Status: No, score=-105.63 tagged_above=-999 required=5 tests=[AWL=0.346, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sk-2EsZnJ8aY for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:32:04 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 03CEF3A6866 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:32:03 -0800 (PST)
Received: from hpaq12.eem.corp.google.com (hpaq12.eem.corp.google.com [172.25.149.12]) by smtp-out.google.com with ESMTP id p1OBWqPt020300 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:32:52 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298547172; bh=OldSPVAMADGO8As8A4LHwyJK6DQ=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=oUv5F7FGGAGz/JnIBx7QKaW7Cc8wGN0kMUfgRGU0S88tXa1zdfNRTxrO/MLvGx+sB N7gkpXVvqC/O4gcEam4mA==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by hpaq12.eem.corp.google.com with ESMTP id p1OBWn1k016116 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 03:32:50 -0800
Received: by iwl42 with SMTP id 42so270751iwl.32 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:32:49 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=QP4kjOnU1iLaAa4mqYiKIPRQZ3nBhj0vbY09ehIDsHc=; b=oB1piuSWHoe4/Kw/RFTjvv0JgX04pBrJD9myJ6qqSGCZgFXPNxCAUBZyzwvMWfZtfq it3rHdmgsQsO/FkNuPFg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=yWWIlP7RA1EeLrtvh6YtOEj+QYqYEQQF8NZL63AxsWz/xJZSEKDZ2R1jda0d3wtOwF OcPxj74cmKLWu3sGXXDg==
Received: by 10.231.200.138 with SMTP id ew10mr1268586ibb.59.1298547169338; Thu, 24 Feb 2011 03:32:49 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Thu, 24 Feb 2011 03:32:29 -0800 (PST)
In-Reply-To: <1298516363.2498.470.camel@ds9.ducksong.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTiny0UFd7=OxeNJEOhzL2q6_yr4z0Ue5S7L42+7W@mail.gmail.com> <1298516363.2498.470.camel@ds9.ducksong.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Thu, 24 Feb 2011 20:32:29 +0900
Message-ID: <AANLkTingiF2UzwbLnNNvXHQSDzTHxU2YLeo-UkfVhviz@mail.gmail.com>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Content-Type: multipart/alternative; boundary=90e6ba181976c0a6b1049d0592c6
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 11:32:07 -0000

--90e6ba181976c0a6b1049d0592c6
Content-Type: text/plain; charset=ISO-8859-1

I've been taking some note for tracking discussion on HyBi. I've moved it
from intranet to Google Code.
http://code.google.com/p/pywebsocket/wiki/WebSocketProtocolSpec
I can't promise that I'll keep this maintained. But it may be helpful in
some degree.

Takeshi


On Thu, Feb 24, 2011 at 11:59, Pat McManus @Mozilla <mcmanus@ducksong.com>wrote:

> _The WebSocket Protocol, a History_  does not require nor benefit from
> rough technical consensus. Please don't weigh down the protocol document
> with trying to get the WG members to write and edit this text and then
> achieve consensus around the extra verbiage.
>
> One or more separate blogs, wikis, books, faqs, masters thesis, movies,
> stage plays, street theater performances, or separate internet-drafts
> would be lovely and undoubtedly contribute to the eco-system. They need
> not be 100% consistent with each other; the underlying arguments
> certainly weren't. I would enjoy seeing what anyone motivated enough to
> do the work creates on the topic.
>
> --
> http://www.getfirefox.com/
>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--90e6ba181976c0a6b1049d0592c6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I&#39;ve been taking some note for tracking discussion on HyBi. I&#39;ve mo=
ved it from intranet to Google Code.<div><a href=3D"http://code.google.com/=
p/pywebsocket/wiki/WebSocketProtocolSpec" target=3D"_blank">http://code.goo=
gle.com/p/pywebsocket/wiki/WebSocketProtocolSpec</a></div>



<div>I can&#39;t promise that I&#39;ll keep this maintained. But it may be =
helpful in some degree.</div><div><br clear=3D"all">Takeshi<br>
<br><br><div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 11:59, Pat McMan=
us @Mozilla <span dir=3D"ltr">&lt;<a href=3D"mailto:mcmanus@ducksong.com" t=
arget=3D"_blank">mcmanus@ducksong.com</a>&gt;</span> wrote:<br><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex">



_The WebSocket Protocol, a History_ =A0does not require nor benefit from<br=
>
rough technical consensus. Please don&#39;t weigh down the protocol documen=
t<br>
with trying to get the WG members to write and edit this text and then<br>
achieve consensus around the extra verbiage.<br>
<br>
One or more separate blogs, wikis, books, faqs, masters thesis, movies,<br>
stage plays, street theater performances, or separate internet-drafts<br>
would be lovely and undoubtedly contribute to the eco-system. They need<br>
not be 100% consistent with each other; the underlying arguments<br>
certainly weren&#39;t. I would enjoy seeing what anyone motivated enough to=
<br>
do the work creates on the topic.<br>
<font color=3D"#888888"><br>
--<br>
<a href=3D"http://www.getfirefox.com/" target=3D"_blank">http://www.getfire=
fox.com/</a><br>
</font><div><div></div><div><br>
<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br></div>

--90e6ba181976c0a6b1049d0592c6--

From ibc@aliax.net  Thu Feb 24 03:41:44 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A58993A6A92 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:41:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.638
X-Spam-Level: 
X-Spam-Status: No, score=-2.638 tagged_above=-999 required=5 tests=[AWL=0.039,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AC0ksC0KeJfC for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:41:43 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id C28713A6A93 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:41:43 -0800 (PST)
Received: by qwh6 with SMTP id 6so370805qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:42:33 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.241.196 with SMTP id lf4mr492833qcb.284.1298547752941; Thu, 24 Feb 2011 03:42:32 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 03:42:32 -0800 (PST)
Date: Thu, 24 Feb 2011 12:42:32 +0100
Message-ID: <AANLkTim++VybhnRK-CcR=XK6LhLTrrB-RbPn9KrZkZ=A@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Hybi <hybi@ietf.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: [hybi] WebSocket Wiki
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 11:41:44 -0000

Hi, it seems that it is hard to expect that a separate document with
technical rationale would be written (given the today/yesterday
threads), so I propose at least the following:

In the wiki (http://trac.tools.ietf.org/wg/hybi/trac/wiki) there could
be usual questions containing just links to relevant mails/threads in
the archives. For example:

* Motivations for the handshake:
- link to mail 1
- link to mail 2
...

* Motivations for client to server masking:
- link to mail 1
- link to mail 2
...


I expect this wouldn't take so many time for the authors and
participants in this group from the start to fill such basic questions
(as they know better than anyone which exact threads covered the
useful discussions about each issue).

This would produce two beneficts:

1) Newcomers could easily understand the reasoning behing current
specs. This is a MUST IMHO.

2) It would be easy to write, in a future, a draft/document containing
the rationale of the spec.

Maybe option 2 never takes place, but at least make it feasible.


Cheers.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From andy.warmcat.com@googlemail.com  Thu Feb 24 03:49:03 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C2BA33A6AA0 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:49:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.449
X-Spam-Level: 
X-Spam-Status: No, score=-3.449 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gV4J7CN3pgpb for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 03:49:02 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 75E673A6A9F for <hybi@ietf.org>; Thu, 24 Feb 2011 03:49:02 -0800 (PST)
Received: by wwb39 with SMTP id 39so447233wwb.13 for <hybi@ietf.org>; Thu, 24 Feb 2011 03:49:51 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=IyE24GOkPLdX6K7rms7jS01Asc/wBgOG8BTOj6tB4p4=; b=ChidzQmTmlUQLtL9p6/FErnsXw3/0DX0VtXGRmYsv3qwcXwiWM4VG3fEBR1iBU8W9L FvWAuK32ViD9oUoFbMONPTFv/fi567BMlzMR0NwGoRK6Q/NUlSk0hFu6Djqq8LJnXACA a050PIFVi8jumJYtGdcbmRu2LybIZ1si0ggHs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=rs1xgcFvrAoDj5/OmlFsD8phu5N4jZCurWUtiLifV/xz7K6eZ7BmEzM+hJFqwR75fh ulh6JJjrxNfh/nMmgw95HChSR9+Nkgu5cKKYTVKjgA9a4h0MA0tTM9QlqCKmT5c3KD8K 7szOzoIu1PHQ05+e0+wRR2nSmJBgbEOkdmkOE=
Received: by 10.227.144.213 with SMTP id a21mr672862wbv.8.1298548191384; Thu, 24 Feb 2011 03:49:51 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id y29sm1570574wbd.10.2011.02.24.03.49.49 (version=SSLv3 cipher=OTHER); Thu, 24 Feb 2011 03:49:50 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6645DC.4070907@warmcat.com>
Date: Thu, 24 Feb 2011 11:49:48 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: =?UTF-8?B?ScOxYWtpIEJheiBDYXN0aWxsbw==?= <ibc@aliax.net>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<4D657294.20000@warmcat.com>	<AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com>	<4D65752A.2020102@warmcat.com>	<AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com>	<4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com>
In-Reply-To: <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 11:49:03 -0000

On 02/24/2011 11:20 AM, Somebody in the thread at some point said:

Hi -

> This could be achieved within the specific protocol carried by
> websocket stream. Maybe the JavaScript client could trigger
> "on_partial_message(fragment)" if the negociated protocol is known to
> carry "fragmentable" information (as images). But this depends on the
> carried protocol on top of WS. Such protocol should use something like
> "Content-Type" and so.
>
> For example, the API could include a function
> "on_partial_receive(fragment)" which would be invoked when partial
> data arrives. It's up to the JavaScript code to decide if it does
> something or not when such function is called. It could just do
> nothing and wait for "on_message(message)" to be triggered (which full
> message). In this way, the feature would exist in WS core spec, but
> should be accomplished by protocols on top of WS (propietary or
> standard protocols, it doesn't matter as it is the JavaScript code
> which decides to react or not upon receipt of partial data).

Sorry, what's the benefit of all that compared to making the choice of 
how to fragment it in the server as allowed already?  It already "exists 
in the core spec" that you can chop your stream up into multiple 
messages if you want to see stuff coming in piece by piece at the client.

If you're not in control of how the server is going to chop it up you 
can't play those games anyway since it may then buffer the whole message 
on you.  If you are in control of how the server chops it up, you don't 
need to play the game suggested.

The existing way is simple on the wire and code, and doesn't impose 
anything on the protocol inside the payload, while allowing for low 
latency interleaving of other streams / control frames, and as John and 
Ian pointed out also allows intermediaries and the server in many cases 
anyway to just have enough buffer for a frame not a message.

It's also a very simple proposition for Javascript guys that all this on 
the wire is something they never have to know, they just see big or 
small "messages" coming, I think that's valuable.

-Andy

From ibc@aliax.net  Thu Feb 24 04:12:30 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 61F063A6AB1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 04:12:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.641
X-Spam-Level: 
X-Spam-Status: No, score=-2.641 tagged_above=-999 required=5 tests=[AWL=0.036,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YJSftdRLnZaf for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 04:12:29 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 12E963A6AAF for <hybi@ietf.org>; Thu, 24 Feb 2011 04:12:28 -0800 (PST)
Received: by qwh6 with SMTP id 6so394198qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 04:13:18 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.245.4 with SMTP id ls4mr515557qcb.208.1298549598302; Thu, 24 Feb 2011 04:13:18 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 04:13:18 -0800 (PST)
In-Reply-To: <4D6645DC.4070907@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com>
Date: Thu, 24 Feb 2011 13:13:18 +0100
Message-ID: <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 12:12:30 -0000

2011/2/24 Andy Green <andy@warmcat.com>:
>> For example, the API could include a function
>> "on_partial_receive(fragment)" which would be invoked when partial
>> data arrives. It's up to the JavaScript code to decide if it does
>> something or not when such function is called. It could just do
>> nothing and wait for "on_message(message)" to be triggered (which full
>> message). In this way, the feature would exist in WS core spec, but
>> should be accomplished by protocols on top of WS (propietary or
>> standard protocols, it doesn't matter as it is the JavaScript code
>> which decides to react or not upon receipt of partial data).
>
> Sorry, what's the benefit of all that compared to making the choice of ho=
w
> to fragment it in the server as allowed already?

If the server decides to split a message into varios fragments, would
the API function "on_message()" be called in the client for each
fragment? If not the client must wait for the entire content (a 3MB
PNG file) to be buffered before start rendering it, which is not cool
taking into account that HTTP/1.1 already allows clients rendering
partial content.

Maybe I'm wrong.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From andy.warmcat.com@googlemail.com  Thu Feb 24 04:50:20 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F2433A6ADC for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 04:50:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.424
X-Spam-Level: 
X-Spam-Status: No, score=-3.424 tagged_above=-999 required=5 tests=[AWL=-0.125, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fXpgu2rzg+vR for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 04:50:18 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 8C5913A6AD7 for <hybi@ietf.org>; Thu, 24 Feb 2011 04:50:18 -0800 (PST)
Received: by wwb39 with SMTP id 39so502915wwb.13 for <hybi@ietf.org>; Thu, 24 Feb 2011 04:51:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=MmMvHSrJms8h/pIAjP8OhEe/Hg76RHeJ2PSJzsodFJ0=; b=MumZlbTJUWeXoagZsX0+UscyanF+bNgtF8b9hgQyN1+Bic4coOrbeT6CxWzmO3AHzo ZFl02YXJlrh3JIBvPikkNg14xW6FfSW0xF1jefitIPiqBfbMysh3XLLfymnFAzCSud3L 1ZMsn2uZXA3ExbnHJPtc3iNQk9l+mIlXSqIHk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=OVTPL5hO/MVeyJlTKQJM3bLs8vj8EzF2px5B5LsgyHInOtVGAS+G+JqI7iAacE5dE/ liwbiSTQsFIAbs1JPVHeE9TwK7VeEZVFSN4v1m29up2dRIAwUu4oIlE00J2p937CVQWs tLD5gX7vJznJWvbt5zrvZ1xAEDVUkpdrvBACg=
Received: by 10.227.134.85 with SMTP id i21mr749443wbt.49.1298551867497; Thu, 24 Feb 2011 04:51:07 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id f27sm2536646wbf.19.2011.02.24.04.51.05 (version=SSLv3 cipher=OTHER); Thu, 24 Feb 2011 04:51:06 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D665439.7050301@warmcat.com>
Date: Thu, 24 Feb 2011 12:51:05 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: =?UTF-8?B?ScOxYWtpIEJheiBDYXN0aWxsbw==?= <ibc@aliax.net>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<4D657294.20000@warmcat.com>	<AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com>	<4D65752A.2020102@warmcat.com>	<AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com>	<4D65FC6E.7090107@warmcat.com>	<AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com>	<4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com>
In-Reply-To: <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 12:50:20 -0000

On 02/24/2011 12:13 PM, Somebody in the thread at some point said:
> 2011/2/24 Andy Green<andy@warmcat.com>:
>>> For example, the API could include a function
>>> "on_partial_receive(fragment)" which would be invoked when partial
>>> data arrives. It's up to the JavaScript code to decide if it does
>>> something or not when such function is called. It could just do
>>> nothing and wait for "on_message(message)" to be triggered (which full
>>> message). In this way, the feature would exist in WS core spec, but
>>> should be accomplished by protocols on top of WS (propietary or
>>> standard protocols, it doesn't matter as it is the JavaScript code
>>> which decides to react or not upon receipt of partial data).
>>
>> Sorry, what's the benefit of all that compared to making the choice of how
>> to fragment it in the server as allowed already?
>
> If the server decides to split a message into varios fragments, would
> the API function "on_message()" be called in the client for each
> fragment? If not the client must wait for the entire content (a 3MB
> PNG file) to be buffered before start rendering it, which is not cool
> taking into account that HTTP/1.1 already allows clients rendering
> partial content.
>
> Maybe I'm wrong.

No as you expect you won't get any on_message() for the pieces of a 
message as they come, just one for the message.

But, if you like to see the pieces come in, you can arrange that the 
server sends your 3MB PNG data in a bunch of messages, not just one 3MB 
one.  Maybe that's what you were saying about the protocol, you would 
then need to leverage your protocol header to understand how each 
message that turned up fitted into the 3MB whole.  The spec leaves the 
protocol payload totally alone AFAIK.

3MB PNG is not an unrealistic example but I guess many other 
applications for websocket are going to be focused on realtime low 
latency data.  At least if you are using short whole messages there you 
can leverage message boundaries to simplify your streaming protocol, ie, 
always know there's a protocol header at the start of the message rather 
than it being fragmented partway through.

-Andy

From godjonez@codepad.info  Thu Feb 24 04:56:12 2011
Return-Path: <godjonez@codepad.info>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7C8113A6AE4 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 04:56:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.299
X-Spam-Level: 
X-Spam-Status: No, score=-3.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FGcYk+uz939t for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 04:56:11 -0800 (PST)
Received: from smtpout.kotinet.com (smtpout.kotinet.com [212.50.215.76]) by core3.amsl.com (Postfix) with ESMTP id 3665D3A6ADE for <hybi@ietf.org>; Thu, 24 Feb 2011 04:56:11 -0800 (PST)
Received: from codepad.info (codepad.info [62.240.71.135]) by smtpout.kotinet.com (Postfix) with ESMTP id C48564789E; Thu, 24 Feb 2011 14:56:49 +0200 (EET)
Received: from jfy-10031.uefad.uef.fi (gatekeeper.joensuu.fi [193.167.41.1]) by codepad.info (Postfix) with ESMTPSA id 257B5F44003; Thu, 24 Feb 2011 14:56:49 +0200 (EET)
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: =?utf-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com>
Date: Thu, 24 Feb 2011 14:56:48 +0200
MIME-Version: 1.0
Content-Transfer-Encoding: Quoted-Printable
From: "Joonas Lehtolahti" <godjonez@codepad.info>
Message-ID: <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
In-Reply-To: <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com>
User-Agent: Opera Mail/11.01 (Win32)
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 12:56:12 -0000

On Thu, 24 Feb 2011 14:13:18 +0200, I=C3=B1aki Baz Castillo <ibc@aliax.n=
et>  =

wrote:

> 2011/2/24 Andy Green <andy@warmcat.com>:
>>> For example, the API could include a function
>>> "on_partial_receive(fragment)" which would be invoked when partial
>>> data arrives. It's up to the JavaScript code to decide if it does
>>> something or not when such function is called. It could just do
>>> nothing and wait for "on_message(message)" to be triggered (which fu=
ll
>>> message). In this way, the feature would exist in WS core spec, but
>>> should be accomplished by protocols on top of WS (propietary or
>>> standard protocols, it doesn't matter as it is the JavaScript code
>>> which decides to react or not upon receipt of partial data).
>>
>> Sorry, what's the benefit of all that compared to making the choice o=
f  =

>> how
>> to fragment it in the server as allowed already?
>
> If the server decides to split a message into varios fragments, would
> the API function "on_message()" be called in the client for each
> fragment? If not the client must wait for the entire content (a 3MB
> PNG file) to be buffered before start rendering it, which is not cool
> taking into account that HTTP/1.1 already allows clients rendering
> partial content.
>
> Maybe I'm wrong.

I'll try to put in other words what others have already said eariler in =
 =

this discussion. Note that in the following text I will be using the ter=
m  =

application to refer to for example a script on a webpage that uses  =

WebSockets message API and doesn't have direct contact with the actual  =

WebSockets protocol.

To be able to handle partial data, the client application must know what=
  =

kind of data is coming and how to handle it progressively. If it only  =

knows what to do with whole messages, it needs to buffer all the parts  =

completely, right? Okay, so let's assume the client is expecting a data =
 =

that it allows to be fragmented and can handle each incoming piece  =

separately without needing to buffer all the data first. How can the  =

client know what data the server is sending? Well, the application has  =

some kind of internal protocol it talks inside the WebSockets channel.

Therefore you can do the fragmentation to smaller chunks in this  =

application-level protocol. On the client side the onmessage() will be  =

called for each full WebSockets message. Each of those full WebSockets  =

messages may be chunks of bigger application-logical messages, so the  =

application can handle big data coming in smaller parts. But the actual =
 =

WebSockets protocol is still invisible to the application logic, those  =

chunks of data which are complete WebSocket messages may be fragmented o=
n  =

the WebSockets protocol level too. No onmessage() will be called for tho=
se  =

WebSockets parts, but your application doesn't need to care about that.

From tyoshino@google.com  Thu Feb 24 05:11:21 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CA593A6B0E for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 05:11:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.659
X-Spam-Level: 
X-Spam-Status: No, score=-105.659 tagged_above=-999 required=5 tests=[AWL=0.317, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S5Bz+cYV2gHP for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 05:11:20 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 21EE53A6AFC for <hybi@ietf.org>; Thu, 24 Feb 2011 05:11:19 -0800 (PST)
Received: from hpaq2.eem.corp.google.com (hpaq2.eem.corp.google.com [172.25.149.2]) by smtp-out.google.com with ESMTP id p1ODC70b019132 for <hybi@ietf.org>; Thu, 24 Feb 2011 05:12:08 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298553128; bh=yi6lOFfd3j5/j0HHr2UoPYUNphE=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=IlpLjMMeDzbcudIUFgdLaFIObzghR/Jes02bl0l+vnu60844kMONXmmunE8Z7uRoS p7JHrPcg5HnmIkP8AlxPA==
Received: from iyj12 (iyj12.prod.google.com [10.241.51.76]) by hpaq2.eem.corp.google.com with ESMTP id p1ODC5l9005327 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 05:12:06 -0800
Received: by iyj12 with SMTP id 12so293584iyj.13 for <hybi@ietf.org>; Thu, 24 Feb 2011 05:12:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=hOJ6KGcL7igIu1gXiYPgIiqZnPaDgCvXaUlVHFP5nW8=; b=CfptA6RY/rFJWiDROneVjcphGFAjTF3iIJzdj7wEgqK7zWYckFgCgwXSU6sgZSmDbH 8o0y7PhnpbHmJnaOI6Kg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=AmgflFCZB4fzPw4+dxcBSruqvvIo33efaeRmC9tN4/oR8wsdXEU22Q0E+7Y1DJYW/P Ou4lF55e1lh3B6rtlQgg==
Received: by 10.231.206.197 with SMTP id fv5mr1411894ibb.84.1298553124961; Thu, 24 Feb 2011 05:12:04 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Thu, 24 Feb 2011 05:11:09 -0800 (PST)
In-Reply-To: <OFC19D8FEF.225C2E75-ON8825783A.00827B4C-8825783B.00031959@playstation.sony.com>
References: <AANLkTimyGWacfoVFon1TsQzqmsEcKy9tNsmKhCnJhgWM@mail.gmail.com> <OFC19D8FEF.225C2E75-ON8825783A.00827B4C-8825783B.00031959@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Thu, 24 Feb 2011 22:11:09 +0900
Message-ID: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=90e6ba4fc248bc3db6049d06f53b
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 13:11:22 -0000

--90e6ba4fc248bc3db6049d06f53b
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 18, 2011 at 09:33, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> Hi Takeshi,
>
> Good point. There is indeed a legitmate case where trailing bytes is
> present after
> Close frame.
>

It is important to note that after endpoint sent and received Close frame,
> it is considered
> that WebSocket layer close handshake has been complete ('wasClear' gets set
> to 1,
> etc.).
>
> What Takeshi pointed out is a good motivation for WS-layer to perform
> graceful
> shutdown at TCP layer as well. After Close frame has been exchanged
> successfully,
> the endpoint must start shutting down the local TCP connection with
> shutdown(SHUT_WR), and discard the trailing bytes, if any received, and
> then finally
> close the socket on receipt of EoS.
>

This works for any trailing bytes that could be caused by artifact of
> another deflate
> algorithm that may be introduced in the future, or just by a bug.
>
>
For this case, we can take another way without depending on TCP FIN
- have deflater compress Closing frame in BFINAL block (flush with Z_FINISH)
- have inflater drain compressed stream until it see EOB

This might work for most environments, but not all library/wrapper of zlib
expose API to recognize EOB/BFINAL immediately. For example, zlib module of
Python doesn't. See the explanation of zlib.Decompress.unused_data. If we
move Close frame out of compressed stream, we can use this, but it
complicates protocol.

I agree that using SHUT_WR + EoS is nice on platforms where they're
available, but I still want to provide a way that deals with this issue
without depending on them if possible.

Takeshi

--90e6ba4fc248bc3db6049d06f53b
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 18, 2011 at 09:33,  <span dir=3D"ltr=
">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com" target=3D"_blan=
k">Yutaka_Takeda@playstation.sony.com</a>&gt;</span> wrote:<br><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex">



<br><font size=3D"2" face=3D"sans-serif">Hi Takeshi,</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">Good point. There is indeed a legi=
tmate
case where trailing bytes is present after </font>
<br><font size=3D"2" face=3D"sans-serif">Close frame.</font>
<br>=A0</blockquote><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0=
 .8ex;border-left:1px #ccc solid;padding-left:1ex"><font size=3D"2" face=3D=
"sans-serif">It is important to note that after endpoint
sent and received Close frame, it is considered </font>
<br><font size=3D"2" face=3D"sans-serif">that WebSocket layer close handsha=
ke
has been complete (&#39;wasClear&#39; gets set to 1, </font>
<br><font size=3D"2" face=3D"sans-serif">etc.).</font>
<br>
<br><font size=3D"2" face=3D"sans-serif">What Takeshi pointed out is a good=
 motivation
for WS-layer to perform graceful </font>
<br><font size=3D"2" face=3D"sans-serif">shutdown at TCP layer as well. Aft=
er
Close frame has been exchanged successfully, </font>
<br><font size=3D"2" face=3D"sans-serif">the endpoint must start shutting d=
own
the local TCP connection with </font>
<br><font size=3D"2" face=3D"sans-serif">shutdown(SHUT_WR), and discard the=
 trailing
bytes, if any received, and then finally </font>
<br><font size=3D"2" face=3D"sans-serif">close the socket on receipt of EoS=
.</font>
<br>=A0</blockquote><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0=
 .8ex;border-left:1px #ccc solid;padding-left:1ex"><font size=3D"2" face=3D=
"sans-serif">This works for any trailing bytes that
could be caused by artifact of another deflate </font>
<br><font size=3D"2" face=3D"sans-serif">algorithm that may be introduced i=
n
the future, or just by a bug.</font>
<br>
<br></blockquote><div><br></div><div>For this case, we can take another way=
 without depending on TCP FIN</div><div>- have deflater compress Closing fr=
ame in BFINAL block (flush with Z_FINISH)</div><div>- have inflater drain c=
ompressed stream until it see EOB</div>


<div><br></div><div>This might work for most environments, but not all libr=
ary/wrapper of zlib expose API to recognize EOB/BFINAL immediately. For exa=
mple,=A0zlib module of Python doesn&#39;t. See the explanation of zlib.Deco=
mpress.unused_data.=A0If we move Close frame out of compressed stream, we c=
an use this, but it complicates protocol.</div>


<div><br></div><div>I agree that using SHUT_WR + EoS is nice on platforms w=
here they&#39;re available, but I still want to provide a way that deals wi=
th this issue without depending on them if possible.</div><div><br></div>

<div>Takeshi</div><div><br></div></div>

--90e6ba4fc248bc3db6049d06f53b--

From silvio.ventres@gmail.com  Thu Feb 24 05:53:23 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C4913A6B16 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 05:53:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.349
X-Spam-Level: 
X-Spam-Status: No, score=-3.349 tagged_above=-999 required=5 tests=[AWL=0.250,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LdZwyLiVsYst for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 05:53:22 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 329163A6B13 for <hybi@ietf.org>; Thu, 24 Feb 2011 05:53:22 -0800 (PST)
Received: by vws6 with SMTP id 6so494240vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 05:54:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=OiwrBpsOKrgkVkDVdx3qv4+GjMw/GoEmz9Bcw1AidOw=; b=OPkCoxRaHu2lPB5PPEndRa3RYoJBnYteU5Zy7E4hSUMXLmy/Rhirh7dN6UPrC8JBuX Vf3ld/C88xVjJhyWq9jYPmFPCq0nCrNyKyb2UetGoxC62oo8cAtKqAx6amKxmPQDMhiY CYswofWl7Z5dxyh6KSeFy5QQXvZwjnd452NV0=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=AFIpkVFTz8iJFHb5xNCpfGVpc94zwgcv/WWZUjjzTu8r/nRevkWSozEza98NXf4wLb Y0QlFAM38mPdK8g1VY7QBtSJmu1Y6J+r6rhQtd+tXTpKTmg9XfpuPZbkQxmHSq/u7Wn+ VeriCdDY7mZoYw61ms24EDSzHc///DHDDzE68=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr1563886vdb.121.1298555587026; Thu, 24 Feb 2011 05:53:07 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 05:53:06 -0800 (PST)
In-Reply-To: <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com>
Date: Thu, 24 Feb 2011 15:53:06 +0200
Message-ID: <AANLkTikRiuKvUrFhX6P7cnEJTEBNQKavsWJHy0+H5fk=@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 13:53:23 -0000

On Thu, Feb 24, 2011 at 6:34 AM, John Tamplin <jat@google.com> wrote:
> On Wed, Feb 23, 2011 at 11:19 PM, Silvio Ventres <silvio.ventres@gmail.co=
m>
> wrote:
>>
>> So, to continue with productive discussion (sorry Greg for hijacking
>> your reply):
>> Any HTML "src" attribute and "link" tag can be made to query _any_
>> plaintext of the target server,
>> and, obviously, XHR methods can also.
>> This attack vector doesn't seem to be a problem for either.
>> So why WS takes precautions against this, while losing easy-debug and
>> low-complexity implementation
>> ability ? Even Adam Barth's own paper advocated using CONNECT to
>> overcome this, arguably, non-existent, problem.
>> Even if anyone would take this attack seriously ignoring the same
>> _unused_ attack vector within HTML and XHR,
>> why would one choose to kill debug ability and add considerable
>> complexity instead of changing header request type ?
>> The "let's make traffic look random" idea reeks of overkill
>> pseudo-security features added just "cause they seem cool",
>> and that don't serve any actual purpose in practice.
>>
>> This is one of those WTF moments...
>
> Again, this was discussed ad nauseum for months and months, leading to
> Mozilla and Opera disabling WebSockets.
> XHR can't be used to attack a server that the script wasn't sourced from,
> and can't fake HTTP headers. =A0Adam & Eric demonstrated that some transp=
arent
> intermediaries do not understand Connection: Upgrade and therefore can be
> tricked into thinking subsequent traffic is the next HTTP message when it
> isn't. =A0That can be used to poison a cache which will then serve =A0con=
tents
> of the attacker's choosing to all clients behind that cache.
> For an idea of the implications, consider if the attacker is able to stor=
e
> JS of their choice in a cache that will be served for
> http://www.google.com/ga.js

Adam's paper clearly states that CONNECT method prevents any problems,
while acknowledging that the problem actually affects about 0.001% of userb=
ase.
In any case, it does _not_ give any rationale to the masking procedure, and
does not try to repeat the experiments with and without masking, proving th=
at
the masking is required in practice.
Masking has never been shown as a required solution, just a "nice to have".
It's an overkill that causes direct and dire harm
to the ability of developers to implement, debug and support WS protocol.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 05:59:47 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B32E13A6B2C for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 05:59:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.368
X-Spam-Level: 
X-Spam-Status: No, score=-3.368 tagged_above=-999 required=5 tests=[AWL=0.231,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4NYkbqsa8J5t for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 05:59:47 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id D27503A6889 for <hybi@ietf.org>; Thu, 24 Feb 2011 05:59:46 -0800 (PST)
Received: by vws6 with SMTP id 6so500325vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:00:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=eqwzGu53AFuCYfwbNvBz2SiD4a6XGk4BMuUwys3htKA=; b=pLx+2LEd2r/rpYj45eANpAudnaVffRp84uoT0f41FIHl1BXMyzBjVrMPr5K63Y9haP 1I1lNd3I66vQ37jmp43BVROP7ow136DNB4vxprdEfkI4Vaxn3mDOrbWkHLCbl7uaUrza ossPDsNEZYnI3HCmihWvyracsEwoJGawfK214=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=f/K/6Fklp9JtLaB0d2ZUJ2ssjRinak/dS8mseriZWAGjOtOIPfIl1MshOtRIdlxpL+ Zkme49lK5v8Qj8iWG6VNMjxDWfqYUPL2r+jGWkdyrHmt8dkhFjtkaMsbumKTZ/f6hxis JFT2VS8lfK7cZ+3sEp56pJTY1SuHJYN25JEnA=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr1603693vdb.41.1298556035662; Thu, 24 Feb 2011 06:00:35 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 06:00:35 -0800 (PST)
In-Reply-To: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>
Date: Thu, 24 Feb 2011 16:00:35 +0200
Message-ID: <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 13:59:47 -0000

> Because existing HTTP mechanisms do not provide a mechanism to spoof
> headers (host header, Sec- headers etc.)
> If WS content was ever misinterpreted as a HTTP request, then it would
> be more "powerful" than any HTTP request that can be generated by XHR
> or src tags.

Well, if the "Host" header is the problem, why not solve _that_ problem ?
Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
with a real "Host:".
Since only WS servers will actually answer WS requests, you don't lose
any functionality here.

That's a better "tradeoff" than masking, isn't it ? Leaves debug
ability and is easy on the cpu.

--
 silvio

From andy.warmcat.com@googlemail.com  Thu Feb 24 06:22:20 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D8A03A6975 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:22:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.556
X-Spam-Level: 
X-Spam-Status: No, score=-3.556 tagged_above=-999 required=5 tests=[AWL=0.043,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qa5DKvijFD6Y for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:22:19 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 199833A69F2 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:22:18 -0800 (PST)
Received: by wyb42 with SMTP id 42so612174wyb.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:23:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=oQcpcMLTXepynOPjb1oWNdaSKwbWAhFpudAwWDsS9ic=; b=H0Kagm9e2aSH1XmCpqkAgj6Uv3G0gTTcQE0pstZal7KXmjHSr8MVsT4lwdOWtoqyJN sdkbkwK2qbzX9sYvbVmhYHRJTZTmpQc8Jf0ZvgTx/m1ceiciMIPYXllVANYUr+X5CigJ 7gUFwQTQ7XpGZXVKf/qVHr7cpCciDqjJDyn5U=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=cSNUSxwXuDPoFBaJTyvfnTYTZ/5g931xlvdzMuximUSJKOmoMI8sFRVsa0HzNXnDd/ DyTYhzf9mgZ8lFuouEs1uWLxyjURU8GYxm/63hlQg/OqJoCwvPKLqRedXd2ak33I9cf5 ZhQI6+o7cjA+GYGlweeAKg9aGjOJ9uSsaL7rI=
Received: by 10.227.153.21 with SMTP id i21mr846972wbw.50.1298557388309; Thu, 24 Feb 2011 06:23:08 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id w25sm752263wbd.17.2011.02.24.06.23.05 (version=SSLv3 cipher=OTHER); Thu, 24 Feb 2011 06:23:06 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6669C8.70603@warmcat.com>
Date: Thu, 24 Feb 2011 14:23:04 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Silvio Ventres <silvio.ventres@gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com>	<AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com>	<AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com>	<AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com>	<AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com>	<AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com>	<AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com>	<AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com>	<AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com>	<AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com>	<AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com>	<AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com>	<AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com>
In-Reply-To: <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:22:20 -0000

On 02/24/2011 02:00 PM, Somebody in the thread at some point said:
>> Because existing HTTP mechanisms do not provide a mechanism to spoof
>> headers (host header, Sec- headers etc.)
>> If WS content was ever misinterpreted as a HTTP request, then it would
>> be more "powerful" than any HTTP request that can be generated by XHR
>> or src tags.
>
> Well, if the "Host" header is the problem, why not solve _that_ problem ?
> Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
> with a real "Host:".
> Since only WS servers will actually answer WS requests, you don't lose
> any functionality here.

No the header won't answer the claimed problem, which is that 
intermediaries, like proxies and caches who do not really understand 
websockets protocol, may be dumb enough to keep parsing the websocket 
traffic as http even when the two endpoints, the client and server, do 
understand and negotiated an upgrade correctly.  Using another magic 
header the alleged intermediary is clueless about won't help that.

Then a bad guy could do what Barth claims his experiment did, convince 
browsers to send websocket content through these alleged intermediaries 
that is just right to perform the proposed bad deed.

Yes, the alleged intermediaries are still sat there as vulnerable as 
ever to the right packets sent another way.  But that "other way" is not 
so bad-guy-friendly as javascript in a browser that is true.

Yes, no intermediary suffering from that has ever been identified AFAIK.

Yes, if it was identified, the vendor would fix it or the thing would be 
replaced with something less broken.

Yes, until there's more evidence you would not be alone reasonably 
taking from that they don't exist and Barth's one-shot experiment 
interpreted misinterpreted the cause of the few results that seemed to 
show hits.

> That's a better "tradeoff" than masking, isn't it ? Leaves debug
> ability and is easy on the cpu.

Yes if the above is true masking is worthless.

Unfortunately munging is in there for political reasons, not techincal 
reasons, and the political reasons are real enough.

-Andy

From silvio.ventres@gmail.com  Thu Feb 24 06:24:49 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B02013A69E6 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:24:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.235
X-Spam-Level: 
X-Spam-Status: No, score=-3.235 tagged_above=-999 required=5 tests=[AWL=0.064,  BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0NLR0B+krIuo for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:24:48 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 681A23A68AD for <hybi@ietf.org>; Thu, 24 Feb 2011 06:24:48 -0800 (PST)
Received: by vws6 with SMTP id 6so524890vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:25:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=avsaTZoIOu/p5VeXv6Q8/+WkbSgM3OLFuUqoJS18x6g=; b=BOjSIpx4eU6TOLa4AjzJ9WK+aK2IoGi4pAQTCuEvZpgS2yScSBf9F5sHAAO249w+4V owV5ibj6+rBmkePHDuoVtJYV3biE7VtbjaSJZ+Mg3+qEhVcmBIMZDIAQUFYASk5Jiq+1 dKrDwcMLsbUWCzvx2jsl5VYimGafzpIN+Glto=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=goINtNh35tINcuuzUXxBabmC9T/YCuZ2/R8mCyIjwY73AaQ4CLe2nxZzpAdnmc+rrr +WSV/ID5Zm75CaWt15awPvnTA6yrRmRW8EIvzuylWQ8WfsW+vyQuYOrNewmwsnYo2u36 yqSkO0GBpwUCviVALIzSfw8ovAP2v/yjscmQ4=
MIME-Version: 1.0
Received: by 10.52.160.37 with SMTP id xh5mr1638207vdb.81.1298557194287; Thu, 24 Feb 2011 06:19:54 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 06:19:54 -0800 (PST)
In-Reply-To: <4D65E5AD.5050209@it.aoyama.ac.jp>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com> <4D65E5AD.5050209@it.aoyama.ac.jp>
Date: Thu, 24 Feb 2011 16:19:54 +0200
Message-ID: <AANLkTinZw-xOY+Mc2CXE=1+7TK7=5OsLwO4KK=HZaBVr@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: =?ISO-8859-1?Q?Martin_J=2E_D=FCrst?= <duerst@it.aoyama.ac.jp>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:24:49 -0000

> What you are essentially asking for is that some of the people who already
> spent tons of time in this WG to read lots of mail and contribute to spend
> more time explaining things again and again to newcomers, just because these
> newcomers don't want to invest the same time (actually, probably quite a bit
> less, because you can read the mailing list backwards and only pick up the
> main threads,...) as everybody who has participated for a while.

There is a difference between explaining something you understand and
something you don't.
If you understand a concept and the rationale, it takes 2-3 sentences
to explain it.
Roughly the same amount of sentences as saying "Go read archives".
If you don't understand or don't agree with rationale, it makes you want to
make the question go away, and this is where "go read the archives" comes in.

>> You don't just add a defense mechanism, burdening the compliant
>> implementors, without providing rationale as to why it should exist.
>> Especially, not when you're only _developing_ a standard.
>
> Of course you don't. Why do you assume we did? Please go read the archives.

Because the original masking idea came from Adam Barth, and was never
proven by anyone
to be necessary. Indeed, if the "Host:" header is the problem, it can
be changed to
"Sec-Host-WebSocket", if the "GET" is the problem, it can be changed
to "CONNECT".
The experiments were never repeated with those changes, although they
are much easier
to implement than the masking procedure, and have a much smaller
impact on implementation
simplicity and debug-ability of the protocol.


> I hope that unless you provide some very new insight, there will be no new
> debate about closed issues. We can't repeat debates every time a new member
> joins the WG.

When you have a clear requirement for something, you can explain a solution.
For example, since WS is _required_ to coexist on port 80, it currently has the
HTTP-like headers. This is easy to explain and clarify, since it's a solution to
a clearly-defined problem.

The masking procedure is a solution to an ill-defined problem.
Moreover, the problem,
ill-defined as it is, can be solved by other, much less intrusive solutions.
Thus, it is hard to explain and clarify and much easier to say "go
read archives".


>> All that was asked is to explain the rationale and provide clear and
>> concise attack vectors or use scenarios which are promoted or which
>> are prevented by the measures in the protocol.
>
> Yes, and all you were told was that you should go and read the archives. But
> rather than doing so, you decided to shift the discussion to meta-issues
> such as how much rationale a spec should provide or why an editor (who is
> doing this work as a volunteer) is supposed to provide a free question
> answering service. Please, please stop bothering this WG with such
> discussions, and go do your homework to catch up with the rest of the WG.
> Thanks a lot!

You have just written 7 lines of text. Did you consider that instead
of fighting, you could
have used the same time to answer the questions asked ?
Since you probably did, the only answer here is that you either don't
understand the
solution rationale yourself, or didn't accept the solution and don't want to be
reminded of that.
In both cases, with all due respect, if you don't have any
constructive feedback other than
"go read the archives", and don't plan to answer any questions
regarding the issues with
the protocol, please feel free to postpone replies to the posts until you do.


> Sorry, but Ian is the editor. An editor understands a lot of what's going
> into the spec, but on some issues, he may just use the text that has been
> discussed by the group and approved by the chairs. To some extent, it would
> actually be a bad think if he were too involved with the pros and cons of
> each proposal. The WG has had experience with an editor who cared so much
> about some issues that he was unable to follow the instructions from the
> chairs and decided to hand over his role to somebody else.

As an editor, Ian MUST understand the rationale and be able to clarify
the solutions.
It doesn't take much time to clarify solutions when a clear
understanding of those
exist. It takes roughly the same amount of time and text as an
elaborate "go read the archives" answer.

--
 silvio

From gregw@intalio.com  Thu Feb 24 06:28:56 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 331A63A69FA for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:28:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.525
X-Spam-Level: 
X-Spam-Status: No, score=-2.525 tagged_above=-999 required=5 tests=[AWL=0.452,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j9wfItjE5Sr2 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:28:53 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 36EA53A6975 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:28:53 -0800 (PST)
Received: by vws6 with SMTP id 6so529480vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:29:42 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.158.136 with SMTP id wu8mr1655655vdb.91.1298557779719; Thu, 24 Feb 2011 06:29:39 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Thu, 24 Feb 2011 06:29:39 -0800 (PST)
In-Reply-To: <AANLkTikRiuKvUrFhX6P7cnEJTEBNQKavsWJHy0+H5fk=@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com> <AANLkTikRiuKvUrFhX6P7cnEJTEBNQKavsWJHy0+H5fk=@mail.gmail.com>
Date: Fri, 25 Feb 2011 01:29:39 +1100
X-Google-Sender-Auth: m724lkKlDx55HnUCwFZvwUM0xoc
Message-ID: <AANLkTikeC1dLuSrbgS+M5e+YZxDSkiMMn1DjVDrOcAu+@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:28:56 -0000

On 25 February 2011 00:53, Silvio Ventres <silvio.ventres@gmail.com> wrote:
> Adam's paper clearly states that CONNECT method prevents any problems,
> while acknowledging that the problem actually affects about 0.001% of userbase.

Yes it does, but I don't think he was able to convince the list that
it was actually true.

> Well, if the "Host" header is the problem, why not solve _that_ problem ?
> Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
> with a real "Host:".

The host header in WS handshake is not the problem.

The issue is that a hypothetical intermediary might exist that allows
WS to work, but is actually scanning the data stream looking for HTTP
requests.  It skips all the stuff it thinks is garbage and then sees a
spoofed HTTP request in the WS payload, with a spoofed Host header.
It knows nothing about WS, so it would not be affected by anything the
WS spec said about alternate host headers.  This hypothetical
intermediary then skips over all the "rubbish" in the return stream
(eg the handshake responses needed to allow the client to send a
payload in the first place) and eventually sees a HTTP response
provided by the evil/compromised server.   It then puts the content of
that response into a cache for the spoofed host header, and the cache
is then poisoned.

Masking will prevent evil payloads from looking like HTTP requests.
(it will also occasionally make good payloads look like HTTP requests
:(.

But it was the least worst acceptable option for the most people

cheers

From silvio.ventres@gmail.com  Thu Feb 24 06:32:03 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A2493A69FE for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:32:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.889
X-Spam-Level: 
X-Spam-Status: No, score=-2.889 tagged_above=-999 required=5 tests=[AWL=-0.290, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id anyXiLP3twhI for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:32:02 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 7E5993A69FA for <hybi@ietf.org>; Thu, 24 Feb 2011 06:32:02 -0800 (PST)
Received: by vxg33 with SMTP id 33so451585vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:32:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=LJG4qTbIZ2QkMBRRUsPEtkwz3vE5/3+To8Z5fcSNWkA=; b=bA7ic4D4f15TeYD4wbBj1woZ4dosfP/e0FBbeV8iczW1yOtkf2OKX1we8cmfasWXCk Y8WxoljFyFobkrk1GLYhe1CJ8ksSSZ8ql0zdy0+jTcvWJFz+j8LEiRnFtm/tLb3UfAxv Jnz48+AS8kexYx2Y+jNzUhWHSvMQrlHcb/hWU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=BjQcAikozKznst5+1FM31m7+y3czP3JEL98/KmcD0fIihie3V0yC3LzcPf1QfPYRpH xGeOjo3TtxizsbveutgjC3li3ar0TqUo4OY2o/33eoTIrhIGNq12hPN/kXFsAgKtPBCQ d6KAVItxHzRADsv99LTb4U5DXtNfWBk/1Yaw0=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr1504123vdb.281.1298557971089; Thu, 24 Feb 2011 06:32:51 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 06:32:50 -0800 (PST)
In-Reply-To: <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
Date: Thu, 24 Feb 2011 16:32:50 +0200
Message-ID: <AANLkTim0PyycJbYEhhbmS+cz4kwmDJS_sE+Rksk-Q4t8@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Joonas Lehtolahti <godjonez@codepad.info>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:32:03 -0000

>> If the server decides to split a message into varios fragments, would
>> the API function "on_message()" be called in the client for each
>> fragment? If not the client must wait for the entire content (a 3MB
>> PNG file) to be buffered before start rendering it, which is not cool
>> taking into account that HTTP/1.1 already allows clients rendering
>> partial content.
>>
>> Maybe I'm wrong.
>
> I'll try to put in other words what others have already said eariler in this
> discussion. Note that in the following text I will be using the term
> application to refer to for example a script on a webpage that uses
> WebSockets message API and doesn't have direct contact with the actual
> WebSockets protocol.
>
> To be able to handle partial data, the client application must know what
> kind of data is coming and how to handle it progressively. If it only knows
> what to do with whole messages, it needs to buffer all the parts completely,
> right? Okay, so let's assume the client is expecting a data that it allows
> to be fragmented and can handle each incoming piece separately without
> needing to buffer all the data first. How can the client know what data the
> server is sending? Well, the application has some kind of internal protocol
> it talks inside the WebSockets channel.
>
> Therefore you can do the fragmentation to smaller chunks in this
> application-level protocol. On the client side the onmessage() will be
> called for each full WebSockets message. Each of those full WebSockets
> messages may be chunks of bigger application-logical messages, so the
> application can handle big data coming in smaller parts. But the actual
> WebSockets protocol is still invisible to the application logic, those
> chunks of data which are complete WebSocket messages may be fragmented on
> the WebSockets protocol level too. No onmessage() will be called for those
> WebSockets parts, but your application doesn't need to care about that.


The point here is that the current solution reduces buffering
requirements on the _server_, while making sure the _client_ still has
to buffer the whole message.
As you noted before, if the client wants to use message fragments and
a reduced buffer, the client is free to use a custom "protocol| on top
of WS to do that,
for example, chopping files on the server and sending chopped chunks
in separate WS messages.
This also opens the door for the fragmentation attacks, or simply
server sending fragments indefinitely. Not only will JS client not be
able to get the message or
its fragments, but it will never be able to stop the buffer from
expanding, as the browser does not export any control information in
the JS API.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 06:36:17 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1A6AE3A6B32 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:36:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.371
X-Spam-Level: 
X-Spam-Status: No, score=-3.371 tagged_above=-999 required=5 tests=[AWL=0.228,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LQ-lmraeTFHk for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:36:16 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 338953A69FA for <hybi@ietf.org>; Thu, 24 Feb 2011 06:36:16 -0800 (PST)
Received: by vws6 with SMTP id 6so536905vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:37:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=9cIEWj6UjlIiA0UAAD0SF2PfKS6U1Uag3lXJzNKWfl4=; b=O2K2F0+qgbz53XW9DqDAsLoXOhoRXssqTE5U3aBLtqUP6tIXoG/En67/4nVhIJIT2r wVbucri4FDCW9HkX+ck6z3BpooG3+8C+0E/syHittEdD9+R4qxOr5NWt9EkvEgTMtAYj ZuxcG/nUGTwSlgytEmmBFRQqHFz2oZc4aiMjI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=t2OXgry5mCOoyxYh5lXVxL3Bkfsfu7E3tYE2xiDYWcRYVV5CJwJYtxhrbc+pZdox0M iL4Kae6phy1cjxrrZ5L8C3P2dGEScJywZRXhbU3JOd+GIkke5qblT/U2PD2wgCrwfNoo eKeWhCvV22/vAqp0z6jm4rAJnyHdZIZZi2noQ=
MIME-Version: 1.0
Received: by 10.52.94.194 with SMTP id de2mr1653703vdb.1.1298558142865; Thu, 24 Feb 2011 06:35:42 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 06:35:42 -0800 (PST)
In-Reply-To: <4D6669C8.70603@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com>
Date: Thu, 24 Feb 2011 16:35:42 +0200
Message-ID: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:36:17 -0000

>> Well, if the "Host" header is the problem, why not solve _that_ problem =
?
>> Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
>> with a real "Host:".
>> Since only WS servers will actually answer WS requests, you don't lose
>> any functionality here.
>
> No the header won't answer the claimed problem, which is that
> intermediaries, like proxies and caches who do not really understand
> websockets protocol, may be dumb enough to keep parsing the websocket
> traffic as http even when the two endpoints, the client and server, do
> understand and negotiated an upgrade correctly. =A0Using another magic he=
ader
> the alleged intermediary is clueless about won't help that.

Adam Barth's paper _explicitly_ identifies the "Host:" header as the
part that confuses
the intermediaries. Thus, even if the vulnerabilities shown in the
paper exist in practice,
the use of "Sec-WebSocket-Server:" instead of "Host:" should prevent
any attacks.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 06:42:49 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 898413A6B43 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:42:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.384
X-Spam-Level: 
X-Spam-Status: No, score=-3.384 tagged_above=-999 required=5 tests=[AWL=0.215,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 91gqsz6QyTBC for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:42:48 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id B198D3A6B35 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:42:48 -0800 (PST)
Received: by vws6 with SMTP id 6so543219vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:43:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=/Jp/YxfeiS2HNncKxWBXdQ3NbX68wRyqTN4pg1owj8E=; b=m+LPOrV4kq4b5/BnwaP9DM+FdaAzrlH2Jfdj2YNdBCHPJtMLqltgTyGQEaSNUagUq+ 0sRv9X0iBdO5D4nP6cJn6MO3VQTE/jdw/PgrMj+ec+Wkj6adyAE3budUKmIBGOuZZXsv 6zFSLoLgysTmB1JrqxoRnv/rpmjieCXMfMRN8=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=ZOcmcqT5mCA4K/g/NesrDmVRM+jIksn+gYAzyGwYL4F2s5L05P2KX7vw+aZiNIKR94 cwkJCuRlCI1ZgWe9dGzUlbWlLQQgbmPtpDJFte7n1P8+T8EzxrcVsVHfi3MZVJcc5gic 0qQqYE/l7L/8n3G8WWjdNE426ERvgiRuqJUCk=
MIME-Version: 1.0
Received: by 10.52.166.7 with SMTP id zc7mr1607060vdb.241.1298558616655; Thu, 24 Feb 2011 06:43:36 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 06:43:36 -0800 (PST)
In-Reply-To: <AANLkTikeC1dLuSrbgS+M5e+YZxDSkiMMn1DjVDrOcAu+@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTikUJiwL3VgppJzYJxLkSBse_s_Cr775QaF8gqNd@mail.gmail.com> <AANLkTikRiuKvUrFhX6P7cnEJTEBNQKavsWJHy0+H5fk=@mail.gmail.com> <AANLkTikeC1dLuSrbgS+M5e+YZxDSkiMMn1DjVDrOcAu+@mail.gmail.com>
Date: Thu, 24 Feb 2011 16:43:36 +0200
Message-ID: <AANLkTinb=g8DUkQVeKPLLVPx36diN+Oi=GBgjdzqfjg9@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:42:49 -0000

>> Well, if the "Host" header is the problem, why not solve _that_ problem =
?
>> Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
>> with a real "Host:".
>
> The host header in WS handshake is not the problem.
>
> The issue is that a hypothetical intermediary might exist that allows
> WS to work, but is actually scanning the data stream looking for HTTP
> requests. =A0It skips all the stuff it thinks is garbage and then sees a
> spoofed HTTP request in the WS payload, with a spoofed Host header.
> It knows nothing about WS, so it would not be affected by anything the
> WS spec said about alternate host headers. =A0This hypothetical
> intermediary then skips over all the "rubbish" in the return stream
> (eg the handshake responses needed to allow the client to send a
> payload in the first place) and eventually sees a HTTP response
> provided by the evil/compromised server. =A0 It then puts the content of
> that response into a cache for the spoofed host header, and the cache
> is then poisoned.

Another solution may be to forcibly add a static "Host:
nonexistent.websocket" header
to all packets sent using WS. This will make sure even those rare
proxies Adam found
will not be confused anymore.

--
 silvio

From simone.bordet@gmail.com  Thu Feb 24 06:44:26 2011
Return-Path: <simone.bordet@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9AED23A6B3D for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:44:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZDIFiWIJnrXP for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:44:25 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id B719E3A6B3C for <hybi@ietf.org>; Thu, 24 Feb 2011 06:44:25 -0800 (PST)
Received: by qyk29 with SMTP id 29so3883955qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:45:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type:content-transfer-encoding; bh=ElwPBGrHJ2EOv2ijuKuP+ipXAdssrQWAUtAsaEZi0b0=; b=XubxDVnct5Yx3Y3BVuNE93hwItCNq3xVeH9THt4wLxQGK5XDkqTJJWs7V4lpCzPobV 7Y7f3zY8ec2Y5dNZs7fIvYUghjDLWRjmkzOZi5WHd4coq6QPoipNU6cfZ/CHzrQIhVD2 1NrkEHQNvL9wANzbNRpPW1yHuLTtMrKfqbHJU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=edgiiXGe3BFfpnVzp1YM1EQVTxrUEsPvzzhMeGq83+HBZjQV+dmq++wQkNuHkStfGT 5qy5sRiDzS1gUOfxcpYIW6yO1StE9Lyofwr+RjIBcqeE3UvXKeKJ/QhClNcL3nFw2svN ksjsHjjBjuzks0WQqJiaB6FcicZiM0BgRDXKE=
MIME-Version: 1.0
Received: by 10.224.60.193 with SMTP id q1mr770145qah.342.1298558714932; Thu, 24 Feb 2011 06:45:14 -0800 (PST)
Received: by 10.229.77.96 with HTTP; Thu, 24 Feb 2011 06:45:14 -0800 (PST)
In-Reply-To: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com>
Date: Thu, 24 Feb 2011 15:45:14 +0100
Message-ID: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>
From: Simone Bordet <simone.bordet@gmail.com>
To: hybi@ietf.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:44:26 -0000

Hi,

On Thu, Feb 24, 2011 at 15:35, Silvio Ventres <silvio.ventres@gmail.com> wr=
ote:
>>> Well, if the "Host" header is the problem, why not solve _that_ problem=
 ?
>>> Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
>>> with a real "Host:".
>>> Since only WS servers will actually answer WS requests, you don't lose
>>> any functionality here.
>>
>> No the header won't answer the claimed problem, which is that
>> intermediaries, like proxies and caches who do not really understand
>> websockets protocol, may be dumb enough to keep parsing the websocket
>> traffic as http even when the two endpoints, the client and server, do
>> understand and negotiated an upgrade correctly. =C2=A0Using another magi=
c header
>> the alleged intermediary is clueless about won't help that.
>
> Adam Barth's paper _explicitly_ identifies the "Host:" header as the
> part that confuses
> the intermediaries. Thus, even if the vulnerabilities shown in the
> paper exist in practice,
> the use of "Sec-WebSocket-Server:" instead of "Host:" should prevent
> any attacks.

How can you prevent that an attacker puts *in the body of a WS
message* some text that is a valid HTTP request with a "Host" header ?
That text could be accidentally parsed and could poison the cache, right ?

Simon
--=20
http://bordet.blogspot.com
---
Finally, no matter how good the architecture and design are,
to deliver bug-free software with optimal performance and reliability,
the implementation technique must be flawless.=C2=A0=C2=A0 Victoria Livschi=
tz

From w@1wt.eu  Thu Feb 24 06:50:44 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AAA233A6A08 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:50:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.953
X-Spam-Level: 
X-Spam-Status: No, score=-1.953 tagged_above=-999 required=5 tests=[AWL=0.090,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bEIPV26Iv86O for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:50:44 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 880B13A69FE for <hybi@ietf.org>; Thu, 24 Feb 2011 06:50:43 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OEpQpc018901; Thu, 24 Feb 2011 15:51:26 +0100
Date: Thu, 24 Feb 2011 15:51:26 +0100
From: Willy Tarreau <w@1wt.eu>
To: Simone Bordet <simone.bordet@gmail.com>
Message-ID: <20110224145126.GF17386@1wt.eu>
References: <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:50:44 -0000

On Thu, Feb 24, 2011 at 03:45:14PM +0100, Simone Bordet wrote:
> Hi,
> 
> On Thu, Feb 24, 2011 at 15:35, Silvio Ventres <silvio.ventres@gmail.com> wrote:
> >>> Well, if the "Host" header is the problem, why not solve _that_ problem ?
> >>> Change it to "Sec-Host-WebSocket:" so no legacy equipment confuses it
> >>> with a real "Host:".
> >>> Since only WS servers will actually answer WS requests, you don't lose
> >>> any functionality here.
> >>
> >> No the header won't answer the claimed problem, which is that
> >> intermediaries, like proxies and caches who do not really understand
> >> websockets protocol, may be dumb enough to keep parsing the websocket
> >> traffic as http even when the two endpoints, the client and server, do
> >> understand and negotiated an upgrade correctly.  Using another magic header
> >> the alleged intermediary is clueless about won't help that.
> >
> > Adam Barth's paper _explicitly_ identifies the "Host:" header as the
> > part that confuses
> > the intermediaries. Thus, even if the vulnerabilities shown in the
> > paper exist in practice,
> > the use of "Sec-WebSocket-Server:" instead of "Host:" should prevent
> > any attacks.
> 
> How can you prevent that an attacker puts *in the body of a WS
> message* some text that is a valid HTTP request with a "Host" header ?
> That text could be accidentally parsed and could poison the cache, right ?

Please, please, this was discussed to death for maybe 2 months. We're
going backwards, let's not have everyone re-explain why some things
are possible and others are not. What is currently being done is killing
any hope of progress.

Thanks,
Willy


From dave@cridland.net  Thu Feb 24 06:51:27 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB49E3A689D for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:51:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RBN0w5wcf7pZ for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:51:26 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id C71FF3A69FE for <hybi@ietf.org>; Thu, 24 Feb 2011 06:51:25 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 449BC1168093; Thu, 24 Feb 2011 14:52:07 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RX+Z+6MOWqDd; Thu, 24 Feb 2011 14:52:04 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id 1EF6F1168064; Thu, 24 Feb 2011 14:52:04 +0000 (GMT)
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com>
In-Reply-To: <4D6669C8.70603@warmcat.com>
MIME-Version: 1.0
Message-Id: <15283.1298559124.138532@puncture>
Date: Thu, 24 Feb 2011 14:52:04 +0000
From: Dave Cridland <dave@cridland.net>
To: Andy Green <andy@warmcat.com>, "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>, Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed"
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:51:28 -0000

On Thu Feb 24 14:23:04 2011, Andy Green wrote:
> Yes, the alleged intermediaries are still sat there as vulnerable  
> as ever to the right packets sent another way.  But that "other  
> way" is not so bad-guy-friendly as javascript in a browser that is  
> true.

You missed that it's something that's easily detectable in a browser  
prior to allowing websockets (or Flash, or Java, from which one can  
also attack the intermediaries in a way proven to actually exist - as  
unfashionable as that may be).

But primarily, you forgot that this is not the argument behind  
masking - the particular security issue with intermediaries that  
you're referring to has a number of solutions, many of which I can  
even describe as "sensible" with a straight face, such as CONNECT,  
testing, etc.

But the argument for masking is that there exists some security hole  
in intermediaries that we haven't thought of, and the best defence  
against this issue is to randomize the output from the browser. This  
is, naturally, a very hard argument to address, even though it  
strikes me as being very similar to the ontological argument for the  
existence of a supreme being.

Opponents of masking have suggested that a security hole might exist  
that we haven't thought of for which random data might be the cause;  
sadly many of us are mired in the kind of logical thinking that  
doesn't lend itself well to arguments of that nature.

In any case, due to this ontological argument, the supreme being  
*and* the web browser vendors have insisted on masking, so the  
opponents have merely tried to do damage limitation; the ship has  
sailed, and while unfortunately it's on a course to la-la-land, the  
best we can do is steer carefully.

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From silvio.ventres@gmail.com  Thu Feb 24 06:56:22 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6470B3A6A10 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:56:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.896
X-Spam-Level: 
X-Spam-Status: No, score=-2.896 tagged_above=-999 required=5 tests=[AWL=-0.297, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DSl8X1xJdiFd for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 06:56:21 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 78AC93A6A11 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:56:21 -0800 (PST)
Received: by vxg33 with SMTP id 33so476411vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 06:57:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=D7457WkiVJnOiEfPFtp2gxET3RRCWqalp2XRlUDYAJM=; b=k5fUjrOGmIybiXF9c5Whv0is76BscgrdGZb5vsXxg47kO5U0j/E73tJtT+qxaRyurG eGEpV2+zd6gaYNxYvfQJiU830OY7i7fa8uYslBmzKj0lux1SdJOucbfnZ+0G+toia7he jnPVK9zcmihmmxnHXS8iZPtmMgRKjY7jE0t+M=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=GpqYUFfC8K02GF9RPcMl45+HxMPqgL8gY9pjIBFYW5B5+SXeH9VTnumXK/sjGH/+V9 j1jrg9vdAjyPZ/9CEnwc2iUEAWyHft0577KUBGlMrjGWEJ+0k1xrp8i4emSooFcwEhkW DwtftXHZkm4POE2ApavhOcfkRRtA7cxFGEYIk=
MIME-Version: 1.0
Received: by 10.52.160.37 with SMTP id xh5mr1704658vdb.81.1298559206086; Thu, 24 Feb 2011 06:53:26 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 06:53:25 -0800 (PST)
In-Reply-To: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>
Date: Thu, 24 Feb 2011 16:53:25 +0200
Message-ID: <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Simone Bordet <simone.bordet@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 14:56:22 -0000

> How can you prevent that an attacker puts *in the body of a WS
> message* some text that is a valid HTTP request with a "Host" header ?
> That text could be accidentally parsed and could poison the cache, right ?

The intermediary will only parse it if it's in the header of the packet.
Thus, you make sure that the header will not be poisonable, by forcing
specific, static and _invalid_ "Host: invalid.websocket.security" header for
_each_ packet, whether during or after handshake.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 07:01:39 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 807903A6A16 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:01:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.381
X-Spam-Level: 
X-Spam-Status: No, score=-3.381 tagged_above=-999 required=5 tests=[AWL=0.218,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cJCS8aLZSPG9 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:01:38 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 9D2C03A6A11 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:01:38 -0800 (PST)
Received: by vws6 with SMTP id 6so562810vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:02:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=txKCnqegFxwecH0DuVk89dsIhIbZWTrE8pLFf6Q9GuI=; b=elJMs0DgE3UMzxk53CYIdBWsaHd/DF/i/+HsolBafLO03NBgwdelTs3XlpuzbWNfbx jGQHVfyj3ZRuhfU+VhXazHTS4DXQna6/WotCRqoUy2fiaDPtHh6Tbp9ncUqgb1yYpIdk 4QgNlX0n2hYC/PRWzVP6S6XmRioJ7VctXxvss=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=sn2sml7dP98Vr6yCHNt3ZcOsrYDf6M91aCgUv5zq9c9RlZHdCREycKNVU/mJqOiESW P+0SciDrwWjz9oO+Jy2wlU6atnhyxyYsMgA0dvxFSmJm6KcgRK2qNG3AIk0RJScC8xmq BFssQgtOEwWcjkXGkuWFPK62eYidty2y24MLs=
MIME-Version: 1.0
Received: by 10.52.164.103 with SMTP id yp7mr1683786vdb.161.1298559742059; Thu, 24 Feb 2011 07:02:22 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 07:02:21 -0800 (PST)
In-Reply-To: <15283.1298559124.138532@puncture>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <15283.1298559124.138532@puncture>
Date: Thu, 24 Feb 2011 17:02:21 +0200
Message-ID: <AANLkTi=w77047nXFQn6HvCY9nQk1G_tXQ3kJXj0z2u3a@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:01:39 -0000

> But the argument for masking is that there exists some security hole in
> intermediaries that we haven't thought of, and the best defence against this
> issue is to randomize the output from the browser. This is, naturally, a
> very hard argument to address, even though it strikes me as being very
> similar to the ontological argument for the existence of a supreme being.

As understood from the Adam's paper, the argument was that WS is
allowed to send headers in _each_ packet,
and _after_ the handshake, those packets can include stuff that might
confuse intermediaries, such
as sending a request packet, that, coincidentally results in a
separate packet, starting with what looks
like a valid HTTP request, with "Host:" and other headers in place.
This might actually happen, although the WS packets have considerable
binary content before the actual
frame content, a skilled attacker might cause WS to output such a packet.

The problem is thus: WS packets may include malicious HTTP "Host:"
headers that are authored by JS author.

One of the solutions is to mask all content, but this solution is an
overkill, taking debugging and implementation
simplicity with it as collateral damage.

An arguably better solution to this _specific_ problem is to make sure
no malicious "Host:" headers are parsed,
by, f.e. adding "Host: websockets.invalid\r\n\r\n" to each packet
after, and even during handshake.

--
 silvio

From w@1wt.eu  Thu Feb 24 07:04:07 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC5763A6A1C for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:04:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.968
X-Spam-Level: 
X-Spam-Status: No, score=-1.968 tagged_above=-999 required=5 tests=[AWL=0.075,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LUbhMkpKRpB0 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:04:07 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id A58DF3A6A1B for <hybi@ietf.org>; Thu, 24 Feb 2011 07:04:06 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OF4plN019033; Thu, 24 Feb 2011 16:04:51 +0100
Date: Thu, 24 Feb 2011 16:04:51 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224150451.GG17386@1wt.eu>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:04:08 -0000

On Thu, Feb 24, 2011 at 04:53:25PM +0200, Silvio Ventres wrote:
> > How can you prevent that an attacker puts *in the body of a WS
> > message* some text that is a valid HTTP request with a "Host" header ?
> > That text could be accidentally parsed and could poison the cache, right ?
> 
> The intermediary will only parse it if it's in the header of the packet.
> Thus, you make sure that the header will not be poisonable, by forcing
> specific, static and _invalid_ "Host: invalid.websocket.security" header for
> _each_ packet, whether during or after handshake.

Please adapt your terminology so as not to confuse anyone. Those are not
"packets" but HTTP request messages. A message is a stream of bytes which
can be made of one or multiple segments, themselves split over multiple
packets in any order. A same packet may contain both the header and body
part of an HTTP message. The packet header is where you find the IP-specific
information.

Such confusions are precisely the reasons why people are talking about
various types of non-existing risks such as what is written above. 

Thanks,
Willy


From silvio.ventres@gmail.com  Thu Feb 24 07:10:37 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 44BA83A6A1C for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:10:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.892
X-Spam-Level: 
X-Spam-Status: No, score=-2.892 tagged_above=-999 required=5 tests=[AWL=-0.292, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PyoD-fZJVBOS for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:10:35 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 69EE13A6A13 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:10:35 -0800 (PST)
Received: by vxg33 with SMTP id 33so492124vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:11:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=e0eJy2P6AzySTrr7sfNGQNYGNFsQ5wPM5i1A8AfhHEk=; b=vFBE3OIWX72zfMbeHrN2AUkoxlsS+dGQtq+4jbAfXjCaw8NyW/fR1C9v0Rlj5DqnSN SSjSFsINN0y4tVkjUXby5X625k6Z24NHS7qvmjVDL/NMkHl+nM6mBtUSlw4hm6Pwlhzs kK53CabCcGewnhUePYsSKUfE9X5N1+hevzh4g=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=IygE1rj2a1X8YWeQuLBh4+i5M2EWqnbsD2vYqUAs3kG4lRxL73DZkTAbjtWu1OLDag HENFewdg6HX+nomMNnIXWYiRkCpI9LbCkBEJFhjutj8ZJw+QUdSJqoQsNHgJcaJC4Rgj l9JAoXsMdfD+FRmj/5Hk6BajQKK5vS2fPpQeU=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr1763513vdb.41.1298560279092; Thu, 24 Feb 2011 07:11:19 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 07:11:18 -0800 (PST)
In-Reply-To: <20110224150451.GG17386@1wt.eu>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu>
Date: Thu, 24 Feb 2011 17:11:18 +0200
Message-ID: <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:10:37 -0000

On Thu, Feb 24, 2011 at 5:04 PM, Willy Tarreau <w@1wt.eu> wrote:
> On Thu, Feb 24, 2011 at 04:53:25PM +0200, Silvio Ventres wrote:
>> > How can you prevent that an attacker puts *in the body of a WS
>> > message* some text that is a valid HTTP request with a "Host" header ?
>> > That text could be accidentally parsed and could poison the cache, right ?
>>
>> The intermediary will only parse it if it's in the header of the packet.
>> Thus, you make sure that the header will not be poisonable, by forcing
>> specific, static and _invalid_ "Host: invalid.websocket.security" header for
>> _each_ packet, whether during or after handshake.
>
> Please adapt your terminology so as not to confuse anyone. Those are not
> "packets" but HTTP request messages. A message is a stream of bytes which
> can be made of one or multiple segments, themselves split over multiple
> packets in any order. A same packet may contain both the header and body
> part of an HTTP message. The packet header is where you find the IP-specific
> information.

What was meant is that for each WS-sourced TCP packet, there should be a
statically added "Host: websocket.invalid\r\n\r\n" header added before
the actual WS frame.
The rationale is that this will be parsed by the intermediaries and
make them ignore
the rest of the message, having found the "Host:" header and the
"\r\n\r\n" separator.

Please comment on this solution when you can.

--
 silvio

From w@1wt.eu  Thu Feb 24 07:15:31 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A09EC3A6B4F for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:15:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.979
X-Spam-Level: 
X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[AWL=0.064,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id blHa7B-isJX2 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:15:30 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 2AD5B3A6B3D for <hybi@ietf.org>; Thu, 24 Feb 2011 07:15:29 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OFGAp8019100; Thu, 24 Feb 2011 16:16:10 +0100
Date: Thu, 24 Feb 2011 16:16:10 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224151610.GH17386@1wt.eu>
References: <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <15283.1298559124.138532@puncture> <AANLkTi=w77047nXFQn6HvCY9nQk1G_tXQ3kJXj0z2u3a@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=w77047nXFQn6HvCY9nQk1G_tXQ3kJXj0z2u3a@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:15:31 -0000

On Thu, Feb 24, 2011 at 05:02:21PM +0200, Silvio Ventres wrote:
> > But the argument for masking is that there exists some security hole in
> > intermediaries that we haven't thought of, and the best defence against this
> > issue is to randomize the output from the browser. This is, naturally, a
> > very hard argument to address, even though it strikes me as being very
> > similar to the ontological argument for the existence of a supreme being.
> 
> As understood from the Adam's paper, the argument was that WS is
> allowed to send headers in _each_ packet,
> and _after_ the handshake, those packets can include stuff that might
> confuse intermediaries, such
> as sending a request packet, that, coincidentally results in a
> separate packet, starting with what looks
> like a valid HTTP request, with "Host:" and other headers in place.
> This might actually happen, although the WS packets have considerable
> binary content before the actual
> frame content, a skilled attacker might cause WS to output such a packet.

It's vaguely what you describe. Adam's paper what much more precise on the
issue. The issue is that if we allow an attacker to completely manipulate
the stream immediately after the handshake *and* a caching intermediary
ignores the 101/upgrade *and* accepts a second request over the same
connection *and* uses the initial connection's destination IP address to
route the traffic but uses the Host header to index the cache entry, *then*
it is possible for an attacker which has control over both the browser and
the server side to forge a valid request and a valid response that will
be cached by the vulnerable intermediary for the requested host. Note
that this is already possible for anyone using telnet, netcat or by simply
setting the attacker's IP address in /etc/hosts on the client. The worries
here are the massive use of browsers to build the attack.

WS framing already takes care of not emitting data that look like valid
HTTP traffic, but there was speculation that we should not completely
eliminate the risk that some intermediaries would skip over unknown bytes
at the beginning of the stream and resync to what looks like a valid HTTP
request.  

As such, it was preferred to mask the data from the browser to the server
with a random, non-controllable key so that the attacker which has control
over the browser and the server at the same time cannot reliably decide
what the output stream will look like, thus making this attack useless.

The risk was extremely low, and the solution is acceptably cheap, so it
looks like it was worth implementing it to get everyone agree on it.

Regards,
Willy


From w@1wt.eu  Thu Feb 24 07:20:00 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CBF33A6B4F for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:20:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.987
X-Spam-Level: 
X-Spam-Status: No, score=-1.987 tagged_above=-999 required=5 tests=[AWL=0.056,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LF8yTjnj69lE for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:19:59 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id DB4FD3A6B48 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:19:58 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OFKhAl019127; Thu, 24 Feb 2011 16:20:43 +0100
Date: Thu, 24 Feb 2011 16:20:43 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224152043.GI17386@1wt.eu>
References: <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:20:00 -0000

On Thu, Feb 24, 2011 at 05:11:18PM +0200, Silvio Ventres wrote:
> On Thu, Feb 24, 2011 at 5:04 PM, Willy Tarreau <w@1wt.eu> wrote:
> > On Thu, Feb 24, 2011 at 04:53:25PM +0200, Silvio Ventres wrote:
> >> > How can you prevent that an attacker puts *in the body of a WS
> >> > message* some text that is a valid HTTP request with a "Host" header ?
> >> > That text could be accidentally parsed and could poison the cache, right ?
> >>
> >> The intermediary will only parse it if it's in the header of the packet.
> >> Thus, you make sure that the header will not be poisonable, by forcing
> >> specific, static and _invalid_ "Host: invalid.websocket.security" header for
> >> _each_ packet, whether during or after handshake.
> >
> > Please adapt your terminology so as not to confuse anyone. Those are not
> > "packets" but HTTP request messages. A message is a stream of bytes which
> > can be made of one or multiple segments, themselves split over multiple
> > packets in any order. A same packet may contain both the header and body
> > part of an HTTP message. The packet header is where you find the IP-specific
> > information.
> 
> What was meant is that for each WS-sourced TCP packet, there should be a
> statically added "Host: websocket.invalid\r\n\r\n" header added before
> the actual WS frame.

No, please don't write that. Applications, parsers, senders, etc... have no
visibility over *packets*. There is no WS-sourced TCP packets. There's a WS
sourced TCP stream which is composed of any number of packets and the
application has no way of knowing how they are split. You can have multiple
WS frames per TCP segment, as well as having a WS frame span over multiple
TCP segments.

> The rationale is that this will be parsed by the intermediaries and
> make them ignore
> the rest of the message, having found the "Host:" header and the
> "\r\n\r\n" separator.

Please see how an HTTP parser works and particularly the ones implemented
in caching intermediaries. Those are much more complex than a random string
lookup in random data. HTTP has strong semantics which forces agents to
strictly respect, otherwise they can't keep in sync with the stream and
process more than one request over a connection.

Regards,
Willy


From salvatore.loreto@ericsson.com  Thu Feb 24 07:26:12 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4BC783A6B50 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:26:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.589
X-Spam-Level: 
X-Spam-Status: No, score=-106.589 tagged_above=-999 required=5 tests=[AWL=0.010, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CLIVgL2UfWFI for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:26:11 -0800 (PST)
Received: from mailgw10.se.ericsson.net (mailgw10.se.ericsson.net [193.180.251.61]) by core3.amsl.com (Postfix) with ESMTP id D9BEF3A6A3D for <hybi@ietf.org>; Thu, 24 Feb 2011 07:26:10 -0800 (PST)
X-AuditID: c1b4fb3d-b7c78ae000005844-f8-4d6678c37b9b
Received: from esessmw0237.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw10.se.ericsson.net (Symantec Mail Security) with SMTP id A1.EF.22596.3C8766D4; Thu, 24 Feb 2011 16:26:59 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0237.eemea.ericsson.se (153.88.115.91) with Microsoft SMTP Server id 8.2.234.1; Thu, 24 Feb 2011 16:26:59 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id 4565625C4	for <hybi@ietf.org>; Thu, 24 Feb 2011 17:26:59 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 0454D5090A	for <hybi@ietf.org>; Thu, 24 Feb 2011 17:26:59 +0200 (EET)
Received: from Salvatore-Loretos-MacBook-Pro.local (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 98E234FE40	for <hybi@ietf.org>; Thu, 24 Feb 2011 17:26:58 +0200 (EET)
Message-ID: <4D6678C2.6000400@ericsson.com>
Date: Thu, 24 Feb 2011 17:26:58 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: "hybi@ietf.org" <hybi@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Subject: [hybi] how to better document FAQ and other stuff
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:26:12 -0000

(as co-chair)

Hi there,

after reading the last two days mails,
I think that it would be good have a FAQ where newcomers can find some 
information,
to understand a little better the rational behind some choice and other 
stuff,
without be forced to go through all the HyBi mail archives... (more the 
6000mails)
or put on the editor and wg main contributors shoulders the 
responsibility to provide the information.

I have created a wiki page, within the IETF website, where we can start 
to collect info:
http://trac.tools.ietf.org/wg/hybi/trac/wiki/FAQ


in order to update the page you need to login,
if you do not have a login/pw you can get one from here: 
http://trac.tools.ietf.org/tools/loginmgr/newlogin

anyone can contribute to build the FAQ.
I have already received mails from people interested to contribute,
so people interested/eager to contribute
can start to contribute and just notify the HyBi ml when they do some 
change.


About the possibility to also document more information within a draft,
I don't think draft-ietf-hybi-thewebsocketprotocol is the right document 
for that;
instead we can use the 
http://tools.ietf.org/html/draft-ietf-hybi-design-space
as I have been suggested by Stefano Salsano


cheers
/Sal


-- 
Salvatore Loreto
www.sloreto.com


From dave@cridland.net  Thu Feb 24 07:38:20 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE35F3A6A31 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:38:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oRcjXgffAuf9 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:38:18 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id 843AB3A69FE for <hybi@ietf.org>; Thu, 24 Feb 2011 07:38:18 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 4BEC71168087; Thu, 24 Feb 2011 15:39:03 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ixrk69rkljWS; Thu, 24 Feb 2011 15:39:00 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id CF12F1168064; Thu, 24 Feb 2011 15:38:59 +0000 (GMT)
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>
In-Reply-To: <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <15283.1298561939.804809@puncture>
Date: Thu, 24 Feb 2011 15:38:59 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, Server-Initiated HTTP <hybi@ietf.org>, Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed"
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:38:20 -0000

On Thu Feb 24 15:11:18 2011, Silvio Ventres wrote:
> What was meant is that for each WS-sourced TCP packet, there should  
> be a
> statically added "Host: websocket.invalid\r\n\r\n" header added  
> before
> the actual WS frame.
> The rationale is that this will be parsed by the intermediaries and
> make them ignore
> the rest of the message, having found the "Host:" header and the
> "\r\n\r\n" separator.
> 
> Please comment on this solution when you can.

The problem is that nobody could prove that:

"GET /ga.js HTTP/1.1
Host: www.google.com

"

would not be interpreted as an HTTP request by some intermediary  
somewhere, wherever it might appear in the sequence of octets  
subsequent to a successful websocket handshake, including a sequence  
such as:

"CONNECT non-existent HTTP/1.1
Host: non-existent

GET /ga.js HTTP/1.1
Host: www.google.com

"

You'd be forgiven for thinking this is tremendously unlikely to occur  
in reality, since if it did then intermediaries would be horrendously  
confused by a number of similar cases that undoubtedly exist in the  
wild.

However, this is not the only issue, and not the one that has coerced  
us into masking - the argument is that there exists some *other* -  
possibly unrelated - issue that a malicious script could take  
advantage of, and that by removing the ability for such a script to  
control any of the octets on the wire, this avenue of exploit is  
rendered impossible.

In other words, we have had this very argument, and you'd be advised  
to read the archives to see if this particular solution has been  
raised before advancing it. (Actually, it hasn't, but it demonstrates  
a lack of understanding of the problem as posed anyway).

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From ibc@aliax.net  Thu Feb 24 07:52:24 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 83E133A63CB for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:52:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.643
X-Spam-Level: 
X-Spam-Status: No, score=-2.643 tagged_above=-999 required=5 tests=[AWL=0.034,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2BJY8bN3tVdK for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:52:22 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 97B103A6403 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:52:22 -0800 (PST)
Received: by qwh6 with SMTP id 6so589786qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:53:12 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.88.200 with SMTP id b8mr759371qcm.246.1298562792059; Thu, 24 Feb 2011 07:53:12 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 07:53:11 -0800 (PST)
In-Reply-To: <4D665439.7050301@warmcat.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <4D665439.7050301@warmcat.com>
Date: Thu, 24 Feb 2011 16:53:11 +0100
Message-ID: <AANLkTi=xzKbcEkUORu+ypc4YmdXmr=ZrSp1S16xTTKuX@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:52:24 -0000

2011/2/24 Andy Green <andy@warmcat.com>:
> No as you expect you won't get any on_message() for the pieces of a messa=
ge
> as they come, just one for the message.
>
> But, if you like to see the pieces come in, you can arrange that the serv=
er
> sends your 3MB PNG data in a bunch of messages, not just one 3MB one. =C2=
=A0Maybe
> that's what you were saying about the protocol, you would then need to
> leverage your protocol header to understand how each message that turned =
up
> fitted into the 3MB whole. =C2=A0The spec leaves the protocol payload tot=
ally
> alone AFAIK.

So, the server should then split the protocol message into various WS
messages. For each one the client would invoke on_message() and it's
to the javascript code to render such partial protocol message, am I
right?

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Thu Feb 24 07:54:26 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B1D503A6452 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:54:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.644
X-Spam-Level: 
X-Spam-Status: No, score=-2.644 tagged_above=-999 required=5 tests=[AWL=0.033,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jRN8zS+F2wVQ for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:54:25 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id A3A123A63EC for <hybi@ietf.org>; Thu, 24 Feb 2011 07:54:25 -0800 (PST)
Received: by qwh6 with SMTP id 6so592095qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:55:15 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.245.4 with SMTP id ls4mr771631qcb.208.1298562914991; Thu, 24 Feb 2011 07:55:14 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 07:55:14 -0800 (PST)
In-Reply-To: <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
Date: Thu, 24 Feb 2011 16:55:14 +0100
Message-ID: <AANLkTinc=bLQszQg18QHrh2xAjyorG20JJeVq+S4DfGX@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Joonas Lehtolahti <godjonez@codepad.info>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:54:26 -0000

2011/2/24 Joonas Lehtolahti <godjonez@codepad.info>:
> To be able to handle partial data, the client application must know what
> kind of data is coming and how to handle it progressively. If it only kno=
ws
> what to do with whole messages, it needs to buffer all the parts complete=
ly,
> right? Okay, so let's assume the client is expecting a data that it allow=
s
> to be fragmented and can handle each incoming piece separately without
> needing to buffer all the data first. How can the client know what data t=
he
> server is sending? Well, the application has some kind of internal protoc=
ol
> it talks inside the WebSockets channel.
>
> Therefore you can do the fragmentation to smaller chunks in this
> application-level protocol. On the client side the onmessage() will be
> called for each full WebSockets message. Each of those full WebSockets
> messages may be chunks of bigger application-logical messages, so the
> application can handle big data coming in smaller parts. But the actual
> WebSockets protocol is still invisible to the application logic, those
> chunks of data which are complete WebSocket messages may be fragmented on
> the WebSockets protocol level too. No onmessage() will be called for thos=
e
> WebSockets parts, but your application doesn't need to care about that.

Clear now. I was suggesting a different approach, but I don't think it
was better than the mechanism already defined by WS.

Thanks a lot.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From silvio.ventres@gmail.com  Thu Feb 24 07:57:09 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A0633A657C for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:57:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.878
X-Spam-Level: 
X-Spam-Status: No, score=-2.878 tagged_above=-999 required=5 tests=[AWL=-0.279, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id msc-ZDfp2B5s for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:57:08 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 5EF8A3A6452 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:57:08 -0800 (PST)
Received: by vxg33 with SMTP id 33so541095vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:57:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=1njbzQEorjapszJQbhAp4h7xhcmpV6IznTeIZyxcYCU=; b=mXivNN4CI6XqiKUfGvwPzh+FRhiTfQTjzltQWyEm3hF2fboyhGKV/RsRqpPwgett9F spY+jRMZ76mDBXaASNwtVlAELVtKiQUy2XcReY0SGA5Eq8XCgLd78eD9LyAvExtgBMed dCqdt6ZsbsRth9BBTUAxkzbeh99J4RG1Jp14I=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=t8wS/tWlbqwPF+dbSuYf6UGEXbzJqD3Rf0ZkyA3D3b+CEPEeh/l5qzuT7rM0iRkYUs 4wdd3Atrnr65hHMgSnsd9tBAO5Kkq1KAcktt6BARlgrKXtR6viApmQCZUXfnBmL9DdUM JSnhz0ABQcemZYme/aK/O4g/wmkTEtFcMFm5M=
MIME-Version: 1.0
Received: by 10.52.94.194 with SMTP id de2mr1844648vdb.1.1298562838110; Thu, 24 Feb 2011 07:53:58 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 07:53:57 -0800 (PST)
In-Reply-To: <15283.1298561939.804809@puncture>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture>
Date: Thu, 24 Feb 2011 17:53:57 +0200
Message-ID: <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:57:09 -0000

On Thu, Feb 24, 2011 at 5:38 PM, Dave Cridland <dave@cridland.net> wrote:
> "CONNECT non-existent HTTP/1.1
> Host: non-existent
>
> GET /ga.js HTTP/1.1
> Host: www.google.com
>
> "

Let's first divide the problem into the "actually-possible attack
vector" such as above, and the "improbable" attack vectors such as
ones that you prevent with masking.

Regarding the attack vector you've shown, isn't it possible to execute
it with a javascript-sourced POST method, which, as part of the data,
contains the HTTP request?
For example:

"POST ...
...
<binary>
GET /ga.js HTTP/1.1
Host: www.google.com
"

Then the target webserver can answer with whatever it wants the proxy
to cache as www.google.com/ga.js as it would in the WS case.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 07:58:32 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BBBC53A657C for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:58:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.715
X-Spam-Level: 
X-Spam-Status: No, score=-2.715 tagged_above=-999 required=5 tests=[AWL=-0.416, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qdSny1L75NYD for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 07:58:32 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id F41F93A6452 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:58:31 -0800 (PST)
Received: by vxg33 with SMTP id 33so542575vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 07:59:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=qdeIN9TkWVpw+TjXMuidkL5zecQDd76cwbyIPCel+Lo=; b=q9QwP12x0SA7dI7ZNs/kPQhEVXjjUgu4MBGwGSDVkJf9eh0G49Bzz+Xd3/VqzGXRi7 qF7jSw8POI5737UuG/DnmsThK3gt1ZYZeKhXrF/RsN8QlwpngujSevmt0OB8Uukxt+Yn Hrr4GR1mq/urDDeI3ZTBpSEMZ+EkPOVRk1Jgo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=v5PVG1sGuR+gWprjk7XqrkP593UKppnnQEc0cQYM7ybg7hd/7bu/XLLX+ZLMI4jZob EFTFkoX9a55eUlO72DLlDJJL+M1ttFOXs5jN2xBLOoDCgbMlsMeL/jKFCJ7rgGvdeV0m PP4PssHGWQz2yIoS9VRErXny1AhJs4rPww+B8=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr1853971vdb.121.1298562958254; Thu, 24 Feb 2011 07:55:58 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 07:55:58 -0800 (PST)
In-Reply-To: <AANLkTi=xzKbcEkUORu+ypc4YmdXmr=ZrSp1S16xTTKuX@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <4D665439.7050301@warmcat.com> <AANLkTi=xzKbcEkUORu+ypc4YmdXmr=ZrSp1S16xTTKuX@mail.gmail.com>
Date: Thu, 24 Feb 2011 17:55:58 +0200
Message-ID: <AANLkTinQB01yzpCaEnnzkLCLUv2FxUYXDVe+_zNGhXn7@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: =?ISO-8859-1?Q?I=F1aki_Baz_Castillo?= <ibc@aliax.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 15:58:32 -0000

On Thu, Feb 24, 2011 at 5:53 PM, I=F1aki Baz Castillo <ibc@aliax.net> wrote=
:
> So, the server should then split the protocol message into various WS
> messages. For each one the client would invoke on_message() and it's
> to the javascript code to render such partial protocol message, am I
> right?

The browser acts as the fragment-assembler, and the onmessage()
returns the complete message as assembled by the browser from the
parts sent by the server.
At least that is the current API.
Thus, seems like, if you've got a 800MB file coming through, the
browser should buffer the whole 800MB without any progress
indication...

--
 silvio

From w@1wt.eu  Thu Feb 24 08:18:48 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4F8373A6407 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:18:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.993
X-Spam-Level: 
X-Spam-Status: No, score=-1.993 tagged_above=-999 required=5 tests=[AWL=0.050,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TWvpTtReFaxu for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:18:47 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 287613A63CB for <hybi@ietf.org>; Thu, 24 Feb 2011 08:18:46 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OGJQOY019382; Thu, 24 Feb 2011 17:19:26 +0100
Date: Thu, 24 Feb 2011 17:19:26 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224161926.GJ17386@1wt.eu>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:18:48 -0000

On Thu, Feb 24, 2011 at 05:53:57PM +0200, Silvio Ventres wrote:
> On Thu, Feb 24, 2011 at 5:38 PM, Dave Cridland <dave@cridland.net> wrote:
> > "CONNECT non-existent HTTP/1.1
> > Host: non-existent
> >
> > GET /ga.js HTTP/1.1
> > Host: www.google.com
> >
> > "
> 
> Let's first divide the problem into the "actually-possible attack
> vector" such as above, and the "improbable" attack vectors such as
> ones that you prevent with masking.
> 
> Regarding the attack vector you've shown, isn't it possible to execute
> it with a javascript-sourced POST method, which, as part of the data,
> contains the HTTP request?
> For example:
> 
> "POST ...
> ...
> <binary>
> GET /ga.js HTTP/1.1
> Host: www.google.com
> "

It is exactly the same, that's why such an attack is non-sense as it
is described here. Simply try to write that in your favorite webmail
interface and check whether it breaks any intermediary. Response: it
wont because HTTP messages are correctly bounded and there is no
ambiguity as to what is part of a header and what is part of a body.

The issue comes with GET+101+immediate request after the first one+
101-unawared intermediary+all the points mentionned in Adam's paper.
Those are addressed with the current draft.

Regards,
Willy


From silvio.ventres@gmail.com  Thu Feb 24 08:22:58 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 481993A63CB for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:22:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.347
X-Spam-Level: 
X-Spam-Status: No, score=-3.347 tagged_above=-999 required=5 tests=[AWL=0.252,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a5Su8vECVM9p for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:22:56 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id A02163A676A for <hybi@ietf.org>; Thu, 24 Feb 2011 08:22:56 -0800 (PST)
Received: by vws6 with SMTP id 6so645856vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:23:46 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=kvA8KR1+zPWVEzBBFKNImo2h+ZX7z5dAuYLV4IKIsZE=; b=JxbOt3bbrTSZj7qdpuGak4L3fIxhbiUU4P+7pst26HZyUSKUX8jT5O7AT6gPYImDaw GUMzLI95EhrlMVmuj1cTDJTskO7sT7su2WmDojBjCpwR6nfTNgWLMfH98fKGoikX9xZQ golF7kpbFTYSzzroAt+flc++/Nc6jVtsHTw/w=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=BfVADlH+xvbBgQ2Ol7aUWZpgzixKxqzzbWZHur6FY1IlWXlRlCERcQDFTHup1JKf4h 0KUpYOAToG3DXN6KQCucpAaKV/TrtSkQTPlHsoARnMTLcgcWP1zgHoWUAJULaYJv8Cub PMB6G6YKEJjNxhgBXrpy4tfv0IGvO9WnzDmfs=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr1941047vdb.41.1298564479014; Thu, 24 Feb 2011 08:21:19 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:21:18 -0800 (PST)
In-Reply-To: <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi>
Date: Thu, 24 Feb 2011 18:21:18 +0200
Message-ID: <AANLkTinTP8Ys=710J+0LTop96N0hHrcO9yFSZ=mmQkVH@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Joonas Lehtolahti <godjonez@codepad.info>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:22:58 -0000

> To be able to handle partial data, the client application must know what
> kind of data is coming and how to handle it progressively. If it only knows
> what to do with whole messages, it needs to buffer all the parts completely,
> right? Okay, so let's assume the client is expecting a data that it allows
> to be fragmented and can handle each incoming piece separately without
> needing to buffer all the data first. How can the client know what data the
> server is sending? Well, the application has some kind of internal protocol
> it talks inside the WebSockets channel.
>
> Therefore you can do the fragmentation to smaller chunks in this
> application-level protocol. On the client side the onmessage() will be
> called for each full WebSockets message. Each of those full WebSockets
> messages may be chunks of bigger application-logical messages, so the
> application can handle big data coming in smaller parts. But the actual
> WebSockets protocol is still invisible to the application logic, those
> chunks of data which are complete WebSocket messages may be fragmented on
> the WebSockets protocol level too. No onmessage() will be called for those
> WebSockets parts, but your application doesn't need to care about that.

So, the goal of the fragmentation, as noted by Ian, is to allow
servers and intermediaries
to support WS without allocating huge buffers.

For intermediaries, the fragmentation only _suggests_ a solution. That
is, without a mandatory
fragment size limit, the application developer can choose it
arbitrarily, or not use the
fragmentation at all. This means the goal for "intermediaries" is not
being addressed.

Many application developers, without real benchmark to understand the
impact of frame size,
will choose frame sizes which will be suboptimal.  This is not a
variable that is best left for the
application developers to decide.

--
 silvio

From ifette@google.com  Thu Feb 24 08:24:15 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D3A2B3A66B4 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:24:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.301
X-Spam-Level: 
X-Spam-Status: No, score=-105.301 tagged_above=-999 required=5 tests=[AWL=0.375, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FuYek0+NAaMD for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:24:14 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id C64D73A63CB for <hybi@ietf.org>; Thu, 24 Feb 2011 08:24:13 -0800 (PST)
Received: from kpbe13.cbf.corp.google.com (kpbe13.cbf.corp.google.com [172.25.105.77]) by smtp-out.google.com with ESMTP id p1OGP1kT028865 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:25:01 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298564703; bh=HnLhy7pF3S08w9kJ5vJXShzCl3Y=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=jjKxeSggeAWzI5O/pNXdYbvU3xRoqoasuXeNs+cQIC4Re8lLLFPjQujC7bHcfX96f fhc6iLaB0dGCSF8bCH3Uw==
Received: from iyf40 (iyf40.prod.google.com [10.241.50.104]) by kpbe13.cbf.corp.google.com with ESMTP id p1OGNJhL016801 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 08:24:59 -0800
Received: by iyf40 with SMTP id 40so614770iyf.22 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:24:59 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=8gFQynpwa/o9coxq/zZG422OR1iBSEwtk8T77eSP0Xc=; b=mS7T+cDTdwH0ZHqAPOH7dNzEPiC7pt8xr/1uI0RNT0qCEsA1Eh9iE/1K/c01o6ELlh 0Uzo0iAXLgGgvTWLDaPg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=BJpDsRkV3gkpJKJukzqu3KRcDRhwrymipyRcApMgWS7d9refOQb5sG5YodRo9FbPyC 61ng9xrEMjFg6uestZiQ==
MIME-Version: 1.0
Received: by 10.231.200.134 with SMTP id ew6mr1661622ibb.164.1298564699195; Thu, 24 Feb 2011 08:24:59 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Thu, 24 Feb 2011 08:24:58 -0800 (PST)
In-Reply-To: <AANLkTinZw-xOY+Mc2CXE=1+7TK7=5OsLwO4KK=HZaBVr@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com> <4D65E5AD.5050209@it.aoyama.ac.jp> <AANLkTinZw-xOY+Mc2CXE=1+7TK7=5OsLwO4KK=HZaBVr@mail.gmail.com>
Date: Thu, 24 Feb 2011 08:24:58 -0800
Message-ID: <AANLkTi=U0+APscvVctkp+0T=U2sgwVe6e0Vc9kmBjpum@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=90e6ba181c289d0d6f049d09a7fc
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:24:15 -0000

--90e6ba181c289d0d6f049d09a7fc
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 6:19 AM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> > What you are essentially asking for is that some of the people who
> already
> > spent tons of time in this WG to read lots of mail and contribute to
> spend
> > more time explaining things again and again to newcomers, just because
> these
> > newcomers don't want to invest the same time (actually, probably quite a
> bit
> > less, because you can read the mailing list backwards and only pick up
> the
> > main threads,...) as everybody who has participated for a while.
>
> There is a difference between explaining something you understand and
> something you don't.
> If you understand a concept and the rationale, it takes 2-3 sentences
> to explain it.
> Roughly the same amount of sentences as saying "Go read archives".
> If you don't understand or don't agree with rationale, it makes you want to
> make the question go away, and this is where "go read the archives" comes
> in.
>
> >> You don't just add a defense mechanism, burdening the compliant
> >> implementors, without providing rationale as to why it should exist.
> >> Especially, not when you're only _developing_ a standard.
> >
> > Of course you don't. Why do you assume we did? Please go read the
> archives.
>
> Because the original masking idea came from Adam Barth, and was never
> proven by anyone
> to be necessary. Indeed, if the "Host:" header is the problem, it can
> be changed to
> "Sec-Host-WebSocket", if the "GET" is the problem, it can be changed
> to "CONNECT".
> The experiments were never repeated with those changes, although they
> are much easier
> to implement than the masking procedure, and have a much smaller
> impact on implementation
> simplicity and debug-ability of the protocol.
>
>
> > I hope that unless you provide some very new insight, there will be no
> new
> > debate about closed issues. We can't repeat debates every time a new
> member
> > joins the WG.
>
> When you have a clear requirement for something, you can explain a
> solution.
> For example, since WS is _required_ to coexist on port 80, it currently has
> the
> HTTP-like headers. This is easy to explain and clarify, since it's a
> solution to
> a clearly-defined problem.
>
> The masking procedure is a solution to an ill-defined problem.
> Moreover, the problem,
> ill-defined as it is, can be solved by other, much less intrusive
> solutions.
> Thus, it is hard to explain and clarify and much easier to say "go
> read archives".
>
>
> >> All that was asked is to explain the rationale and provide clear and
> >> concise attack vectors or use scenarios which are promoted or which
> >> are prevented by the measures in the protocol.
> >
> > Yes, and all you were told was that you should go and read the archives.
> But
> > rather than doing so, you decided to shift the discussion to meta-issues
> > such as how much rationale a spec should provide or why an editor (who is
> > doing this work as a volunteer) is supposed to provide a free question
> > answering service. Please, please stop bothering this WG with such
> > discussions, and go do your homework to catch up with the rest of the WG.
> > Thanks a lot!
>
> You have just written 7 lines of text. Did you consider that instead
> of fighting, you could
> have used the same time to answer the questions asked ?
> Since you probably did, the only answer here is that you either don't
> understand the
> solution rationale yourself, or didn't accept the solution and don't want
> to be
> reminded of that.
> In both cases, with all due respect, if you don't have any
> constructive feedback other than
> "go read the archives", and don't plan to answer any questions
> regarding the issues with
> the protocol, please feel free to postpone replies to the posts until you
> do.
>
>
> > Sorry, but Ian is the editor. An editor understands a lot of what's going
> > into the spec, but on some issues, he may just use the text that has been
> > discussed by the group and approved by the chairs. To some extent, it
> would
> > actually be a bad think if he were too involved with the pros and cons of
> > each proposal. The WG has had experience with an editor who cared so much
> > about some issues that he was unable to follow the instructions from the
> > chairs and decided to hand over his role to somebody else.
>
> As an editor, Ian MUST understand the rationale and be able to clarify
> the solutions.
> It doesn't take much time to clarify solutions when a clear
> understanding of those
> exist. It takes roughly the same amount of time and text as an
> elaborate "go read the archives" answer.
>

Yes, I do, and when I tried to give pithy responses at the beginning I got
dragged into an 80+ email thread that shows no sign of ending where people
want to re-open debate on closed issues. I am happy to give brief responses
giving the general reasoning, but if people want to debate the reasoning of
issues we've moved beyond, that is not something I am interested in spending
my time on. I am currently working on getting -06 out the door, and I feel
my time is better spent doing that than continuing to participate in this
thread.


>
> --
>  silvio
>

--90e6ba181c289d0d6f049d09a7fc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 6:19 AM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">&gt; What you are essentially asking for is that some of =
the people who already<br>
&gt; spent tons of time in this WG to read lots of mail and contribute to s=
pend<br>
&gt; more time explaining things again and again to newcomers, just because=
 these<br>
&gt; newcomers don&#39;t want to invest the same time (actually, probably q=
uite a bit<br>
&gt; less, because you can read the mailing list backwards and only pick up=
 the<br>
&gt; main threads,...) as everybody who has participated for a while.<br>
<br>
</div>There is a difference between explaining something you understand and=
<br>
something you don&#39;t.<br>
If you understand a concept and the rationale, it takes 2-3 sentences<br>
to explain it.<br>
Roughly the same amount of sentences as saying &quot;Go read archives&quot;=
.<br>
If you don&#39;t understand or don&#39;t agree with rationale, it makes you=
 want to<br>
make the question go away, and this is where &quot;go read the archives&quo=
t; comes in.<br>
<div class=3D"im"><br>
&gt;&gt; You don&#39;t just add a defense mechanism, burdening the complian=
t<br>
&gt;&gt; implementors, without providing rationale as to why it should exis=
t.<br>
&gt;&gt; Especially, not when you&#39;re only _developing_ a standard.<br>
&gt;<br>
&gt; Of course you don&#39;t. Why do you assume we did? Please go read the =
archives.<br>
<br>
</div>Because the original masking idea came from Adam Barth, and was never=
<br>
proven by anyone<br>
to be necessary. Indeed, if the &quot;Host:&quot; header is the problem, it=
 can<br>
be changed to<br>
&quot;Sec-Host-WebSocket&quot;, if the &quot;GET&quot; is the problem, it c=
an be changed<br>
to &quot;CONNECT&quot;.<br>
The experiments were never repeated with those changes, although they<br>
are much easier<br>
to implement than the masking procedure, and have a much smaller<br>
impact on implementation<br>
simplicity and debug-ability of the protocol.<br>
<div class=3D"im"><br>
<br>
&gt; I hope that unless you provide some very new insight, there will be no=
 new<br>
&gt; debate about closed issues. We can&#39;t repeat debates every time a n=
ew member<br>
&gt; joins the WG.<br>
<br>
</div>When you have a clear requirement for something, you can explain a so=
lution.<br>
For example, since WS is _required_ to coexist on port 80, it currently has=
 the<br>
HTTP-like headers. This is easy to explain and clarify, since it&#39;s a so=
lution to<br>
a clearly-defined problem.<br>
<br>
The masking procedure is a solution to an ill-defined problem.<br>
Moreover, the problem,<br>
ill-defined as it is, can be solved by other, much less intrusive solutions=
.<br>
Thus, it is hard to explain and clarify and much easier to say &quot;go<br>
read archives&quot;.<br>
<div class=3D"im"><br>
<br>
&gt;&gt; All that was asked is to explain the rationale and provide clear a=
nd<br>
&gt;&gt; concise attack vectors or use scenarios which are promoted or whic=
h<br>
&gt;&gt; are prevented by the measures in the protocol.<br>
&gt;<br>
&gt; Yes, and all you were told was that you should go and read the archive=
s. But<br>
&gt; rather than doing so, you decided to shift the discussion to meta-issu=
es<br>
&gt; such as how much rationale a spec should provide or why an editor (who=
 is<br>
&gt; doing this work as a volunteer) is supposed to provide a free question=
<br>
&gt; answering service. Please, please stop bothering this WG with such<br>
&gt; discussions, and go do your homework to catch up with the rest of the =
WG.<br>
&gt; Thanks a lot!<br>
<br>
</div>You have just written 7 lines of text. Did you consider that instead<=
br>
of fighting, you could<br>
have used the same time to answer the questions asked ?<br>
Since you probably did, the only answer here is that you either don&#39;t<b=
r>
understand the<br>
solution rationale yourself, or didn&#39;t accept the solution and don&#39;=
t want to be<br>
reminded of that.<br>
In both cases, with all due respect, if you don&#39;t have any<br>
constructive feedback other than<br>
&quot;go read the archives&quot;, and don&#39;t plan to answer any question=
s<br>
regarding the issues with<br>
the protocol, please feel free to postpone replies to the posts until you d=
o.<br>
<div class=3D"im"><br>
<br>
&gt; Sorry, but Ian is the editor. An editor understands a lot of what&#39;=
s going<br>
&gt; into the spec, but on some issues, he may just use the text that has b=
een<br>
&gt; discussed by the group and approved by the chairs. To some extent, it =
would<br>
&gt; actually be a bad think if he were too involved with the pros and cons=
 of<br>
&gt; each proposal. The WG has had experience with an editor who cared so m=
uch<br>
&gt; about some issues that he was unable to follow the instructions from t=
he<br>
&gt; chairs and decided to hand over his role to somebody else.<br>
<br>
</div>As an editor, Ian MUST understand the rationale and be able to clarif=
y<br>
the solutions.<br>
It doesn&#39;t take much time to clarify solutions when a clear<br>
understanding of those<br>
exist. It takes roughly the same amount of time and text as an<br>
elaborate &quot;go read the archives&quot; answer.<br></blockquote><div><br=
></div><div>Yes, I do, and when I tried to give pithy responses at the begi=
nning I got dragged into an 80+ email thread that shows no sign of ending w=
here people want to re-open debate on closed issues. I am happy to give bri=
ef responses giving the general reasoning, but if people want to debate the=
 reasoning of issues we&#39;ve moved beyond, that is not something I am int=
erested in spending my time on. I am currently working on getting -06 out t=
he door, and I feel my time is better spent doing that than continuing to p=
articipate in this thread.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font></blockquote></div><br>

--90e6ba181c289d0d6f049d09a7fc--

From silvio.ventres@gmail.com  Thu Feb 24 08:27:21 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2998F3A6781 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:27:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.857
X-Spam-Level: 
X-Spam-Status: No, score=-2.857 tagged_above=-999 required=5 tests=[AWL=-0.258, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tRMNKHxVtx5b for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:27:20 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 11CC33A676A for <hybi@ietf.org>; Thu, 24 Feb 2011 08:27:19 -0800 (PST)
Received: by vxg33 with SMTP id 33so572884vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:28:09 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=DOhg8qd1m0xz8KM1dxCIDKiZQt9Cl4ZtFxFyDlmg94g=; b=BDGxdJrq+R1mukuoGcursw846SZ8ahu9FbPxj/Ly9POWsjCZrceRzzm3G0AUIYSRIM b0+ULysurc/w7spsbOaB8EpzRdZBWa8q/XW+FJJJMPTSIwTe4Cjutg1oWZqKsoGLGWZi gmxfeJhjhvBwlSs3jTOpTGZRbvFaFRLv9DRV0=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=gCIt/5D58QZUgIayB+Mq35OrjtLgaTDajshJ3XKzv4sou0uE9HbsehsoykJT0HSb2k lgEdeZo/dpLeVV4fn5xFIkK9KJ1tVanWhtWoL+aBdE+khU8veF93eCZl1RZyLLR0Tuhd QGw3ZO49BD5nCyxt6VimDtrk6EL83WRfY2tvg=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr1952730vdb.41.1298564743461; Thu, 24 Feb 2011 08:25:43 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:25:43 -0800 (PST)
In-Reply-To: <20110224161926.GJ17386@1wt.eu>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu>
Date: Thu, 24 Feb 2011 18:25:43 +0200
Message-ID: <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:27:21 -0000

>> "POST ...
>> ...
>> <binary>
>> GET /ga.js HTTP/1.1
>> Host: www.google.com
>> "
>
> It is exactly the same, that's why such an attack is non-sense as it
> is described here. Simply try to write that in your favorite webmail
> interface and check whether it breaks any intermediary. Response: it
> wont because HTTP messages are correctly bounded and there is no
> ambiguity as to what is part of a header and what is part of a body.

So, you agree that the same attack that is being prevented in WS is
easily possible
by simple a simple POST from the same javascript?

If so, the attack will be done whether it's prevented in WS or not, since the
POST mechanism is actually easier to execute. So WS should not try to prevent
it, especially at a cost of significant complexity in debug and implementation.

> The issue comes with GET+101+immediate request after the first one+
> 101-unawared intermediary+all the points mentionned in Adam's paper.
> Those are addressed with the current draft.

Can you elaborate on that ?

Thank you.

--
 silvio

From ifette@google.com  Thu Feb 24 08:28:13 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 23AC63A6774 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:28:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.719
X-Spam-Level: 
X-Spam-Status: No, score=-105.719 tagged_above=-999 required=5 tests=[AWL=-0.043, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qo6AwslKzUA1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:28:12 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id C72B33A676A for <hybi@ietf.org>; Thu, 24 Feb 2011 08:28:11 -0800 (PST)
Received: from kpbe17.cbf.corp.google.com (kpbe17.cbf.corp.google.com [172.25.105.81]) by smtp-out.google.com with ESMTP id p1OGT1Ev028216 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:29:01 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298564941; bh=4TxAWHrkKrZ2f7n4FKWm4BWc4JE=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=fc87F1QId/hWZUXZScUeZhrDcEGT8jBNZPaUthvCP/hYwNr2hDmjzHTl4+8JCwUER cspJZVLtzkiLkuK7SarFw==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by kpbe17.cbf.corp.google.com with ESMTP id p1OGSYjv022010 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 08:29:00 -0800
Received: by iwl42 with SMTP id 42so441312iwl.32 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:29:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=hF8TXZljLvyzuvA3p1oCwjTFt9QnhOEoOFxJxCS1xlo=; b=rWtycnSWUM5LJkfTtwKABCZ6K91JSH5S9JowWKMIczJcjB+NksHq2LfgzP/FAadihP 8BqJ/NBN4FGcnUmYrGuA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=KpapYVG9ipBlXbqOSkniTyDU+cOasz6XaKSa2eAcEzo7UdsMJKx7PtiA5VSZ+Vf4V1 6aqGyygO1QuvUWQCfC5w==
MIME-Version: 1.0
Received: by 10.231.11.139 with SMTP id t11mr1651422ibt.189.1298564828956; Thu, 24 Feb 2011 08:27:08 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Thu, 24 Feb 2011 08:27:08 -0800 (PST)
In-Reply-To: <AANLkTinTP8Ys=710J+0LTop96N0hHrcO9yFSZ=mmQkVH@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi> <AANLkTinTP8Ys=710J+0LTop96N0hHrcO9yFSZ=mmQkVH@mail.gmail.com>
Date: Thu, 24 Feb 2011 08:27:08 -0800
Message-ID: <AANLkTi=vwc6oEWOKmBWzDarUhwFKSdkXc2x6BBjKL8-S@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=0003255749625909c3049d09af4a
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:28:13 -0000

--0003255749625909c3049d09af4a
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 8:21 AM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> > To be able to handle partial data, the client application must know what
> > kind of data is coming and how to handle it progressively. If it only
> knows
> > what to do with whole messages, it needs to buffer all the parts
> completely,
> > right? Okay, so let's assume the client is expecting a data that it
> allows
> > to be fragmented and can handle each incoming piece separately without
> > needing to buffer all the data first. How can the client know what data
> the
> > server is sending? Well, the application has some kind of internal
> protocol
> > it talks inside the WebSockets channel.
> >
> > Therefore you can do the fragmentation to smaller chunks in this
> > application-level protocol. On the client side the onmessage() will be
> > called for each full WebSockets message. Each of those full WebSockets
> > messages may be chunks of bigger application-logical messages, so the
> > application can handle big data coming in smaller parts. But the actual
> > WebSockets protocol is still invisible to the application logic, those
> > chunks of data which are complete WebSocket messages may be fragmented on
> > the WebSockets protocol level too. No onmessage() will be called for
> those
> > WebSockets parts, but your application doesn't need to care about that.
>
> So, the goal of the fragmentation, as noted by Ian, is to allow
> servers and intermediaries
> to support WS without allocating huge buffers.
>
> For intermediaries, the fragmentation only _suggests_ a solution. That
> is, without a mandatory
> fragment size limit, the application developer can choose it
> arbitrarily, or not use the
> fragmentation at all. This means the goal for "intermediaries" is not
> being addressed.
>

Intermediaries are free to refragment a message. If they see a 10MB message
coming in, they may read 1MB and send that off as a fragment.


>
> Many application developers, without real benchmark to understand the
> impact of frame size,
> will choose frame sizes which will be suboptimal.  This is not a
> variable that is best left for the
> application developers to decide.
>

I expect it's Apache or IIS or whatever your server is that's choosing frame
sizes. They are probably in a reasonable position...


>
> --
>  silvio
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--0003255749625909c3049d09af4a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 8:21 AM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">&gt; To be able to handle partial data, the client applic=
ation must know what<br>
&gt; kind of data is coming and how to handle it progressively. If it only =
knows<br>
&gt; what to do with whole messages, it needs to buffer all the parts compl=
etely,<br>
&gt; right? Okay, so let&#39;s assume the client is expecting a data that i=
t allows<br>
&gt; to be fragmented and can handle each incoming piece separately without=
<br>
&gt; needing to buffer all the data first. How can the client know what dat=
a the<br>
&gt; server is sending? Well, the application has some kind of internal pro=
tocol<br>
&gt; it talks inside the WebSockets channel.<br>
&gt;<br>
&gt; Therefore you can do the fragmentation to smaller chunks in this<br>
&gt; application-level protocol. On the client side the onmessage() will be=
<br>
&gt; called for each full WebSockets message. Each of those full WebSockets=
<br>
&gt; messages may be chunks of bigger application-logical messages, so the<=
br>
&gt; application can handle big data coming in smaller parts. But the actua=
l<br>
&gt; WebSockets protocol is still invisible to the application logic, those=
<br>
&gt; chunks of data which are complete WebSocket messages may be fragmented=
 on<br>
&gt; the WebSockets protocol level too. No onmessage() will be called for t=
hose<br>
&gt; WebSockets parts, but your application doesn&#39;t need to care about =
that.<br>
<br>
</div>So, the goal of the fragmentation, as noted by Ian, is to allow<br>
servers and intermediaries<br>
to support WS without allocating huge buffers.<br>
<br>
For intermediaries, the fragmentation only _suggests_ a solution. That<br>
is, without a mandatory<br>
fragment size limit, the application developer can choose it<br>
arbitrarily, or not use the<br>
fragmentation at all. This means the goal for &quot;intermediaries&quot; is=
 not<br>
being addressed.<br></blockquote><div><br></div><div>Intermediaries are fre=
e to refragment a message. If they see a 10MB message coming in, they may r=
ead 1MB and send that off as a fragment.</div><div>=C2=A0</div><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex;">

<br>
Many application developers, without real benchmark to understand the<br>
impact of frame size,<br>
will choose frame sizes which will be suboptimal. =C2=A0This is not a<br>
variable that is best left for the<br>
application developers to decide.<br></blockquote><div><br></div><div>I exp=
ect it&#39;s Apache or IIS or whatever your server is that&#39;s choosing f=
rame sizes. They are probably in a reasonable position...</div><div>=C2=A0<=
/div>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font><div><div></div><div class=3D"h5">__________________________________=
_____________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--0003255749625909c3049d09af4a--

From jat@google.com  Thu Feb 24 08:28:13 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 967DA3A676A for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:28:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.301
X-Spam-Level: 
X-Spam-Status: No, score=-105.301 tagged_above=-999 required=5 tests=[AWL=0.675, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eYB7tEjH6fEz for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:28:12 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 13F353A6781 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:28:11 -0800 (PST)
Received: from hpaq12.eem.corp.google.com (hpaq12.eem.corp.google.com [172.25.149.12]) by smtp-out.google.com with ESMTP id p1OGT1X0014558 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:29:01 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298564941; bh=bukULU9MPYxdyXy7fiyz0H0iHZU=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=pWruao8Vw+vdpacyrPODC/AUKsV4vvOie/Rj1tyGPr89l6jps2WTCIKDhVERPE0dB JbdSuhF1S+WUy/aibkW/A==
Received: from yic15 (yic15.prod.google.com [10.243.65.143]) by hpaq12.eem.corp.google.com with ESMTP id p1OGSxqq014409 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 08:29:00 -0800
Received: by yic15 with SMTP id 15so600422yic.22 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:28:59 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=sGNHd+wB4pgOi4LkybfsINCwYJ5ZIStwWIsc/MHosrA=; b=so/3pAt5rF6xxarj5TDYBHQsYey6MyFSd4nvELFLXF/xWWoAtIQ1vbN3VNWqOy1f1I SYKKtsemP8osANclX1aw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=DBfh65Br3o0zch1zo11TgsoAz8LYFNXvOk74c+9RO0v52kfkEjPQvxUXEYBSj8xYmt /O9iWgB2jAwMiTOU8PRQ==
Received: by 10.150.165.21 with SMTP id n21mr2017023ybe.445.1298564939113; Thu, 24 Feb 2011 08:28:59 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Thu, 24 Feb 2011 08:28:39 -0800 (PST)
In-Reply-To: <15283.1298561939.804809@puncture>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture>
From: John Tamplin <jat@google.com>
Date: Thu, 24 Feb 2011 11:28:39 -0500
Message-ID: <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: multipart/alternative; boundary=000e0cd56f86e9e4fc049d09b5dd
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:28:13 -0000

--000e0cd56f86e9e4fc049d09b5dd
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 10:38 AM, Dave Cridland <dave@cridland.net> wrote:

> The problem is that nobody could prove that:
>
> "GET /ga.js HTTP/1.1
> Host: www.google.com
>
> "
>
> would not be interpreted as an HTTP request by some intermediary somewhere,
> wherever it might appear in the sequence of octets subsequent to a
> successful websocket handshake, including a sequence such as:
>
> "CONNECT non-existent HTTP/1.1
> Host: non-existent
>
> GET /ga.js HTTP/1.1
> Host: www.google.com
>
> "
>
> You'd be forgiven for thinking this is tremendously unlikely to occur in
> reality, since if it did then intermediaries would be horrendously confused
> by a number of similar cases that undoubtedly exist in the wild.
>

See, this is where this discussion is opening old wounds and threatening the
very progress we made.  Adam, AFAIK, was happy with a CONNECT based solution
hiding future WebSockets content from the transparent intermediaries.
 However, many other people were not happy with using CONNECT at all, even
in your proposal where it was never intended to be seen in the context of an
HTTP request but only after the upgrade to WebSocket had been completed.
 Since CONNECT was not goiing to achieve consensus, we had to come up with
some other way to avoid the problem, and masking was the way that did
achieve consensus.  As you note below, it also has the benefit of protecting
from other problems we don't know exist, even if that wasn't the reason
behind this.


> However, this is not the only issue, and not the one that has coerced us
> into masking - the argument is that there exists some *other* - possibly
> unrelated - issue that a malicious script could take advantage of, and that
> by removing the ability for such a script to control any of the octets on
> the wire, this avenue of exploit is rendered impossible.
>
> In other words, we have had this very argument, and you'd be advised to
> read the archives to see if this particular solution has been raised before
> advancing it. (Actually, it hasn't, but it demonstrates a lack of
> understanding of the problem as posed anyway).


Please, let's not reopen these discussions that took months to achieve
consensus.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd56f86e9e4fc049d09b5dd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 10:38 AM, Dave Cridland =
<span dir=3D"ltr">&lt;<a href=3D"mailto:dave@cridland.net">dave@cridland.ne=
t</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margi=
n:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">The problem is that nobody could prove that:</div>
<br>
&quot;GET /ga.js HTTP/1.1<br>
Host: <a href=3D"http://www.google.com" target=3D"_blank">www.google.com</a=
><br>
<br>
&quot;<br>
<br>
would not be interpreted as an HTTP request by some intermediary somewhere,=
 wherever it might appear in the sequence of octets subsequent to a success=
ful websocket handshake, including a sequence such as:<br>
<br>
&quot;CONNECT non-existent HTTP/1.1<br>
Host: non-existent<br>
<br>
GET /ga.js HTTP/1.1<br>
Host: <a href=3D"http://www.google.com" target=3D"_blank">www.google.com</a=
><br>
<br>
&quot;<br>
<br>
You&#39;d be forgiven for thinking this is tremendously unlikely to occur i=
n reality, since if it did then intermediaries would be horrendously confus=
ed by a number of similar cases that undoubtedly exist in the wild.<br>

</blockquote><div><br></div><div>See, this is where this discussion is open=
ing old wounds and threatening the very progress we made. =C2=A0Adam, AFAIK=
, was happy with a CONNECT based solution hiding future WebSockets content =
from the transparent intermediaries. =C2=A0However, many other people were =
not happy with using CONNECT at all, even in your proposal where it was nev=
er intended to be seen in the context of an HTTP request but only after the=
 upgrade to WebSocket had been completed. =C2=A0Since CONNECT was not goiin=
g to achieve consensus, we had to come up with some other way to avoid the =
problem, and masking was the way that did achieve consensus. =C2=A0As you n=
ote below, it also has the benefit of protecting from other problems we don=
&#39;t know exist, even if that wasn&#39;t the reason behind this.</div>

<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
However, this is not the only issue, and not the one that has coerced us in=
to masking - the argument is that there exists some *other* - possibly unre=
lated - issue that a malicious script could take advantage of, and that by =
removing the ability for such a script to control any of the octets on the =
wire, this avenue of exploit is rendered impossible.<br>


<br>
In other words, we have had this very argument, and you&#39;d be advised to=
 read the archives to see if this particular solution has been raised befor=
e advancing it. (Actually, it hasn&#39;t, but it demonstrates a lack of und=
erstanding of the problem as posed anyway).</blockquote>

<div><br></div><div>Please, let&#39;s not reopen these discussions that too=
k months to achieve consensus.</div></div><br>-- <br>John A. Tamplin<br>Sof=
tware Engineer (GWT), Google<br>

--000e0cd56f86e9e4fc049d09b5dd--

From silvio.ventres@gmail.com  Thu Feb 24 08:29:31 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D77D73A6781 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:29:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.847
X-Spam-Level: 
X-Spam-Status: No, score=-2.847 tagged_above=-999 required=5 tests=[AWL=-0.248, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XLob1Aw5K1Kq for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:29:30 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id C1A2F3A6774 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:29:30 -0800 (PST)
Received: by vxg33 with SMTP id 33so575161vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:30:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=riYTIcfvL+OzsFANrioduzhiSfmuURapwRHdenjsgPM=; b=PeE+Npxo4jutTrY4pQZkMQo9o/YBZlbnOtmEWhcqHPh+QjTqZCYtt1bvKcX6lhgH5k G0y5Lp2QUGB/7SVp8cSU+ft6upJ4RM5GIIYTodJAvf14JqEqRaBgZO6nwd9+K7p5jE7N LI/7B8Ky3Dbwv/Y1/Mv54kHZ5N2kYrKw5A+sY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=CJbKmT5viJNvLO31jJO6v74LJhO76CuDcN90O0j61nSuG7zrvJBp8VLgtxGAbK4GSL kFj4cgOOZU++HOYrNBRU2/cXqljokM+j3JlOm+2e5yP/v6S6W/VSbNmQ3BuQ/HaidmIN F0Z7EwpDiPQp46vtAzsxHYCgbLQrgD0QcgDks=
MIME-Version: 1.0
Received: by 10.52.166.7 with SMTP id zc7mr1867494vdb.241.1298564979072; Thu, 24 Feb 2011 08:29:39 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:29:38 -0800 (PST)
In-Reply-To: <AANLkTi=U0+APscvVctkp+0T=U2sgwVe6e0Vc9kmBjpum@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTi=qc9VZsjmGKEAZKEOFh6ADX-P8QVKLRuFhFgs6@mail.gmail.com> <AANLkTi=FYSzrTj+t-TejKXQgh__cpivyJkVOuv3-dHaj@mail.gmail.com> <AANLkTim4apFEtzYNNCDOfN9XWpSf3FQnAM5Ry_QPN_h5@mail.gmail.com> <AANLkTin-Kh8BYv=wSqoUWBCcnA0koUj1ec0=W3dkXaVx@mail.gmail.com> <AANLkTimnZHWhO1KfGXv9JfTAuXGYY0ExPKioAX9xNPVh@mail.gmail.com> <AANLkTi=HV2Et1tEXFE5khLRw6Gox4BR_uJmkcg4oUxu6@mail.gmail.com> <AANLkTimBYh9gtG5B3Lzxy6HvcvBbDN6SqXmz14mMGDec@mail.gmail.com> <4D65E5AD.5050209@it.aoyama.ac.jp> <AANLkTinZw-xOY+Mc2CXE=1+7TK7=5OsLwO4KK=HZaBVr@mail.gmail.com> <AANLkTi=U0+APscvVctkp+0T=U2sgwVe6e0Vc9kmBjpum@mail.gmail.com>
Date: Thu, 24 Feb 2011 18:29:38 +0200
Message-ID: <AANLkTinm+dYb1qfsA=WkA9x6=jd0ys45RwEmNjhT1GAD@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, hybi@ietf.org, jhildebr@cisco.com
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:29:32 -0000

>> As an editor, Ian MUST understand the rationale and be able to clarify
>> the solutions.
>> It doesn't take much time to clarify solutions when a clear
>> understanding of those
>> exist. It takes roughly the same amount of time and text as an
>> elaborate "go read the archives" answer.
>
> Yes, I do, and when I tried to give pithy responses at the beginning I got
> dragged into an 80+ email thread that shows no sign of ending where people
> want to re-open debate on closed issues. I am happy to give brief responses
> giving the general reasoning, but if people want to debate the reasoning of
> issues we've moved beyond, that is not something I am interested in spending
> my time on. I am currently working on getting -06 out the door, and I feel
> my time is better spent doing that than continuing to participate in this
> thread.

Well, the amount of text you wrote above is basically enough to answer
2 or 3 of the
questions asked, for example, the one about the handshake computation.
You mentioned it's there to "prove the server actually parsed the header".

The argument advanced against that was that if a server developer
isn't interested
in parsing the header, he can easily trick you by using an external library to
pass the handshake test. Given that, the solution fails to meet it's
goals and should be removed.

If you have some other rationale on the handshake-computation, or you don't
accept the fact that the server author cannot be coerced into doing
anything he doesn't like,
please reply with your elaboration.

Thank you.

--
 silvio

From ibc@aliax.net  Thu Feb 24 08:31:27 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA6053A67B1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:31:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.646
X-Spam-Level: 
X-Spam-Status: No, score=-2.646 tagged_above=-999 required=5 tests=[AWL=0.031,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hu9vLrDtmVCy for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:31:27 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id CCFC13A6784 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:31:26 -0800 (PST)
Received: by qyk29 with SMTP id 29so3979006qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:32:16 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr846962qcb.170.1298565136368; Thu, 24 Feb 2011 08:32:16 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 08:32:16 -0800 (PST)
In-Reply-To: <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com>
Date: Thu, 24 Feb 2011 17:32:16 +0100
Message-ID: <AANLkTimVoM3QNOmuTU5x33XsJX9YUkXpoCDOAECG75PM@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:31:27 -0000

2011/2/24 John Tamplin <jat@google.com>:
> Please, let's not reopen these discussions that took months to achieve
> consensus.

Nobody would reopen old discussions if conclusions of such discussions
would be properly documented as in many other specifications.
Note: "mail list archives" is not a documentation backend.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From silvio.ventres@gmail.com  Thu Feb 24 08:33:17 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 78CA13A67C1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:33:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.837
X-Spam-Level: 
X-Spam-Status: No, score=-2.837 tagged_above=-999 required=5 tests=[AWL=-0.238, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DNJ57LF-RTZI for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:33:16 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 9D6A03A67B0 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:33:16 -0800 (PST)
Received: by vxg33 with SMTP id 33so579148vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:34:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=l0MKEmPt4nhsvnh+YC2N0Nu7N7UZDACllEFBhsReIqM=; b=kL/SyXBLAX5TUc/Rs5jE8DGg+j0KjeDwxnfjSpWH1lfe0KiQbPqBXDwcuxZQy8z0Mh 1kZIUOikgngJZFKKdye2K6EM9EgiUE3WMIN15m4rzKbrpSufNJ4LAbr06kgHJ7qjfn+c rfNoep2PAfuzKCd54/kpwu+10oqoJOjbVYM4o=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=I48Md/YO/kxewYXBrLyerstiLPZ9Z2qrsM0WwJE/gT2+L6SY7lPHY1M4HHnULnRH3q MsYTGZBJZ9XoduTSVR5611xJdBT0JaR2hoXNbFfVPF3rbFoCokp5HL3m3FjYt1Mu+LUr RC06zI2RRgm/FRf0R7ORCLbS5Dkt0+dWD0x6c=
MIME-Version: 1.0
Received: by 10.52.166.7 with SMTP id zc7mr1876949vdb.241.1298565203232; Thu, 24 Feb 2011 08:33:23 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:33:23 -0800 (PST)
In-Reply-To: <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com>
Date: Thu, 24 Feb 2011 18:33:23 +0200
Message-ID: <AANLkTikUhU=7h01fox-4VVo5Hv9=3Ary8PYFgaawbYrw@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:33:17 -0000

> =A0However, many other people were not happy with using CONNECT at all, e=
ven
> in your proposal where it was never intended to be seen in the context of=
 an
> HTTP request but only after the upgrade to WebSocket had been completed.

The way you solve this is by clarifying the goals, hearing each
argument and finding a solution that
satisfies the goals while proving to each arguing party that the
arguments are false.

You don't leave it be when it is clearly an overkill and impacts such
basic parts of the protocol
as debugging ability.

--
 silvio

From jat@google.com  Thu Feb 24 08:38:20 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 62B753A67C1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:38:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.772
X-Spam-Level: 
X-Spam-Status: No, score=-105.772 tagged_above=-999 required=5 tests=[AWL=-0.096, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ib-GvzqAzm43 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:38:19 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 545053A67B5 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:38:19 -0800 (PST)
Received: from kpbe20.cbf.corp.google.com (kpbe20.cbf.corp.google.com [172.25.105.84]) by smtp-out.google.com with ESMTP id p1OGd9sc025501 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:39:09 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298565549; bh=qOOCFrdjXHj9KM22XQIl1yXEbzA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Bnaug0/ZCNP+M5xtmxN69R8oVPbt17QLE+0oyHwPlIZJ5e05nJnJ+1zrdJQH4D3zk HYCjatcWEltdEj6th4gTA==
Received: from yic15 (yic15.prod.google.com [10.243.65.143]) by kpbe20.cbf.corp.google.com with ESMTP id p1OGd7FW030665 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 08:39:07 -0800
Received: by yic15 with SMTP id 15so394871yic.8 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:39:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=XnsyOltYIjXA4R0+l2WwiINix8QY9ccaaoTMTw6nEVU=; b=FtMjcrLEomsvLa+cwCdAvqZLK0ciXhBAUBff3NhNER8XwjmPWLlz7iKiVuc07qLqTK nWHzDbWg8O/S9lPynB0A==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=PQumAGQV1s3OfkFxWW1Oj8wi7ow2p3haF/0tJw0OZIgY0o0Ey70h3y5eO5K27FJFOa S2vahkqJiqMoSMHo+MAA==
Received: by 10.150.165.21 with SMTP id n21mr2031335ybe.445.1298565547101; Thu, 24 Feb 2011 08:39:07 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Thu, 24 Feb 2011 08:38:47 -0800 (PST)
In-Reply-To: <AANLkTimVoM3QNOmuTU5x33XsJX9YUkXpoCDOAECG75PM@mail.gmail.com>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com> <AANLkTimVoM3QNOmuTU5x33XsJX9YUkXpoCDOAECG75PM@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Thu, 24 Feb 2011 11:38:47 -0500
Message-ID: <AANLkTikc9QEcW7R20oPASBQQ-NHbt=dQ1ZtdXJ-2CEtN@mail.gmail.com>
To: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
Content-Type: multipart/alternative; boundary=000e0cd56f86270dc7049d09da86
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:38:20 -0000

--000e0cd56f86270dc7049d09da86
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Feb 24, 2011 at 11:32 AM, I=C3=B1aki Baz Castillo <ibc@aliax.net> w=
rote:

> Nobody would reopen old discussions if conclusions of such discussions
> would be properly documented as in many other specifications.
> Note: "mail list archives" is not a documentation backend.
>

Well, the problem is I don't have time to coalesce years of discussions on
this list into bullet points summarizing the rationale for you, and I don't
imagine anyone else has time to do so either.  When I joined the discussion
(admittedly there was far less history at that time), I spent a week readin=
g
all the archives before posting anything.

So, while it would be nice to have such a document, I don't know that there
is sufficient manpower available to make it happen.  The chair has created =
a
FAQ editable by anyone, so it can be done incrementally, but I still don't
expect the rationale of all the decisions made to make it there anytime
soon.

As usual, the ones who care wind up doing the work.  In this case, since yo=
u
appear to be the one that cares the most about having a rationale document,
it seems likely you will have to put forth the effort to collect the data.

--=20
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd56f86270dc7049d09da86
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 11:32 AM, I=C3=B1aki Baz=
 Castillo <span dir=3D"ltr">&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.=
net</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

Nobody would reopen old discussions if conclusions of such discussions<br>
would be properly documented as in many other specifications.<br>
Note: &quot;mail list archives&quot; is not a documentation backend.<font c=
lass=3D"Apple-style-span" color=3D"#888888"><br></font></blockquote></div><=
div><br></div><div>Well, the problem is I don&#39;t have time to=C2=A0coale=
sce=C2=A0years of discussions on this list into bullet points summarizing t=
he rationale for you, and I don&#39;t imagine anyone else has time to do so=
 either. =C2=A0When I joined the discussion (admittedly there was far less =
history at that time), I spent a week reading all the archives before posti=
ng anything.</div>

<div><br></div><div>So, while it would be nice to have such a document, I d=
on&#39;t know that there is sufficient manpower available to make it happen=
. =C2=A0The chair has created a FAQ editable by anyone, so it can be done i=
ncrementally, but I still don&#39;t expect the rationale of all the decisio=
ns made to make it there anytime soon.</div>

<div><br></div><div>As usual, the ones who care wind up doing the work. =C2=
=A0In this case, since you appear to be the one that cares the most about h=
aving a rationale document, it seems likely you will have to put forth the =
effort to collect the data.</div>

<br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd56f86270dc7049d09da86--

From silvio.ventres@gmail.com  Thu Feb 24 08:39:43 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1D743A67AF for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:39:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.329
X-Spam-Level: 
X-Spam-Status: No, score=-3.329 tagged_above=-999 required=5 tests=[AWL=0.270,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 60kEKhhYIdYW for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:39:43 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id F0DF93A65A5 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:39:42 -0800 (PST)
Received: by vws6 with SMTP id 6so663567vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:40:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=bfPeMJt23qa+5uyLrVf52OciNcukQGL1yB9nHMpeLws=; b=R7+6DnfHYUuhposiWx1ilGIhvGCUorU3d0in923fPqXL+amPI50mIa64BqN6CuzDYO tYe3P+NQy4P2nDHwWy76gYae+WfROJl5ymzyprTK/9Q+PuM7pvRisZC0dRuLHw5a2lOl v/nnLTVqR6dodtaBTGdH3509TwNv/ibEyy628=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=DyDpS3w2MbUEw8KB35LgbbYtUUP3M2V1YashYKpRuFRDL8wIdvkaU4YTFnsD+WeYkG nlCsGaFBi6iGPtLQugFBC0rKlfZ9iXPBIT7MvD0XvNz2TRFAWMrXvl5LWv4NKaqt0r9J OokS8L/vwEsTXzTrqdmuhkolsyrNAipH0HdVs=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr1983841vdb.41.1298565468222; Thu, 24 Feb 2011 08:37:48 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:37:48 -0800 (PST)
In-Reply-To: <AANLkTi=vwc6oEWOKmBWzDarUhwFKSdkXc2x6BBjKL8-S@mail.gmail.com>
References: <AANLkTinMDCm=uv1KPaXW3PwVN-0Fmtw8sn2iWzVjSh7h@mail.gmail.com> <AANLkTi=h+1cQKW87Gs7dOKnAQRuEtt6ZDmi4VHSwHxLF@mail.gmail.com> <AANLkTikxWyNZT1KyREH04jwqNp06qi+_zfhNAkz24Xma@mail.gmail.com> <AANLkTim-8S8AZxGKGStfBEE9j85yx06UetCPM-yhY7QW@mail.gmail.com> <AANLkTinfvRDzmXMBSFrbkzFRO5M4kdqpxiMi7xZnxyhN@mail.gmail.com> <AANLkTi=mR3a-WWVRQ_MZxPSGpFG3QZAQ=JcyU7GhQJh=@mail.gmail.com> <AANLkTinzZXgYhspJNo4G3H+iuGs_atC=SN03=CbM--mf@mail.gmail.com> <AANLkTimonxh=8_G4qvW+VaXejRjjdOqUu-W=XsdV5B_V@mail.gmail.com> <4D657294.20000@warmcat.com> <AANLkTi=4s51Rf=h1dG8GjFm2uE6NRjNbkUujcmDbEPLq@mail.gmail.com> <4D65752A.2020102@warmcat.com> <AANLkTinK0n=TTbQrZ5L2sCqFjsteebZsTu3G7ZN95s=w@mail.gmail.com> <4D65FC6E.7090107@warmcat.com> <AANLkTi=qLyiVAEX0z22dK9vxQr72zExK5hbjvnz_rGBm@mail.gmail.com> <4D6645DC.4070907@warmcat.com> <AANLkTinm5Fk75hDega-BHddEwdizxQV=r_7rxx1QcmQb@mail.gmail.com> <op.vrerkyteuykfxw@jfy-10031.uefad.uef.fi> <AANLkTinTP8Ys=710J+0LTop96N0hHrcO9yFSZ=mmQkVH@mail.gmail.com> <AANLkTi=vwc6oEWOKmBWzDarUhwFKSdkXc2x6BBjKL8-S@mail.gmail.com>
Date: Thu, 24 Feb 2011 18:37:48 +0200
Message-ID: <AANLkTinNtr4pXgPjwZZeH69diw9HmduBa51aJWR1m9c5@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:39:43 -0000

> Intermediaries are free to refragment a message. If they see a 10MB messa=
ge
> coming in, they may read 1MB and send that off as a fragment.

For that, intermediaries have to actually know about WS. Simple HTTP
intermediaries
won't be able to do that.

>> Many application developers, without real benchmark to understand the
>> impact of frame size,
>> will choose frame sizes which will be suboptimal. =A0This is not a
>> variable that is best left for the
>> application developers to decide.
>
> I expect it's Apache or IIS or whatever your server is that's choosing fr=
ame
> sizes. They are probably in a reasonable position...

The actual WS-talking parts are the only ones that can set WS
fragmentation flags.
Whether Apache or anything else, a plugin will probably be doing the
work. In many
cases the WS servers are custom-written, in python or node.js.
By _not_ mandating the frame size, you are leaving it up to the user
who does not
have enough information for an informed choice. At least provide a suggesti=
on.

--
 silvio

From jat@google.com  Thu Feb 24 08:41:29 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7ED273A67B1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:41:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.61
X-Spam-Level: 
X-Spam-Status: No, score=-105.61 tagged_above=-999 required=5 tests=[AWL=-0.234, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UdtSbyQhZ0qm for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:41:28 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 76E633A677E for <hybi@ietf.org>; Thu, 24 Feb 2011 08:41:28 -0800 (PST)
Received: from wpaz5.hot.corp.google.com (wpaz5.hot.corp.google.com [172.24.198.69]) by smtp-out.google.com with ESMTP id p1OGgIHr020485 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:42:18 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298565738; bh=jEHbPMGT/pCYKEC4bzrmA6TpgFg=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=mcXJw/hryY0UyEcU1UsDOlNpln/f+JLFbzLOii/VMLYMnORaDdp2JIsbswnXmWF/W HYDmqI2D+5/CPb0yTUGRA==
Received: from gyh3 (gyh3.prod.google.com [10.243.50.195]) by wpaz5.hot.corp.google.com with ESMTP id p1OGfp8W011697 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 08:42:17 -0800
Received: by gyh3 with SMTP id 3so382871gyh.8 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:42:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=CWfgssKUV9H+RbQhqsbsT3dEsXY7gpr0uq1Cl1SuF9A=; b=b0Atgag/0KMGGb61gJy58huBMHL1ez7CiulU0O783CNJLnzFt+lUCwQGVfFLi/j2Nw Nf2c3dG4MXZk66LN9Y4w==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=mfdN7sMICyqjNLeHVGOmrKKZcWvOCZ++p9JPfajtWKDR+SN4gWM/7gOgK7Kq6xnijt bO1ZRDa67nsFzoZnIRUQ==
Received: by 10.151.142.6 with SMTP id u6mr2225268ybn.46.1298565737122; Thu, 24 Feb 2011 08:42:17 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Thu, 24 Feb 2011 08:41:56 -0800 (PST)
In-Reply-To: <AANLkTikUhU=7h01fox-4VVo5Hv9=3Ary8PYFgaawbYrw@mail.gmail.com>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com> <AANLkTikUhU=7h01fox-4VVo5Hv9=3Ary8PYFgaawbYrw@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Thu, 24 Feb 2011 11:41:56 -0500
Message-ID: <AANLkTikGFB3hpSxq8q3EhOBY01y6V64Q80jmM-pHLErv@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=0015174bdd807a8cfe049d09e5e6
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:41:29 -0000

--0015174bdd807a8cfe049d09e5e6
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 11:33 AM, Silvio Ventres
<silvio.ventres@gmail.com>wrote:

> >  However, many other people were not happy with using CONNECT at all,
> even
> > in your proposal where it was never intended to be seen in the context of
> an
> > HTTP request but only after the upgrade to WebSocket had been completed.
>
> The way you solve this is by clarifying the goals, hearing each
> argument and finding a solution that
> satisfies the goals while proving to each arguing party that the
> arguments are false.
>
> You don't leave it be when it is clearly an overkill and impacts such
> basic parts of the protocol
> as debugging ability.
>

So how do you think we declared consensus on masking?  It was after months
of discussing various alternatives and determining that while nobody liked
the solution (for various reasons, some thought it didn't go far enough and
others thought it went to far), it was the only solution to the problems
that all involved were willing to live with.

As far as debugging ability, XOR'ing the frame is no harder to deal with
than decompressing compressed content (which will hopefully be a
common occurrence on WebSocket connections as well).

-- 
John A. Tamplin
Software Engineer (GWT), Google

--0015174bdd807a8cfe049d09e5e6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 11:33 AM, Silvio Ventres=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.v=
entres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">&gt; =C2=A0However, many other people were not happy with=
 using CONNECT at all, even<br>
&gt; in your proposal where it was never intended to be seen in the context=
 of an<br>
&gt; HTTP request but only after the upgrade to WebSocket had been complete=
d.<br>
<br>
</div>The way you solve this is by clarifying the goals, hearing each<br>
argument and finding a solution that<br>
satisfies the goals while proving to each arguing party that the<br>
arguments are false.<br>
<br>
You don&#39;t leave it be when it is clearly an overkill and impacts such<b=
r>
basic parts of the protocol<br>
as debugging ability.<br></blockquote><div><br></div><div>So how do you thi=
nk we declared consensus on masking? =C2=A0It was after months of discussin=
g various alternatives and determining that while nobody liked the solution=
 (for various reasons, some thought it didn&#39;t go far enough and others =
thought it went to far), it was the only solution to the problems that all =
involved were willing to live with.</div>

<div><br></div><div>As far as debugging ability, XOR&#39;ing the frame is n=
o harder to deal with than decompressing compressed content (which will hop=
efully be a common=C2=A0occurrence on WebSocket connections=C2=A0as well).<=
/div>
</div>
<br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--0015174bdd807a8cfe049d09e5e6--

From jat@google.com  Thu Feb 24 08:42:37 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 96F293A67B5 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:42:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.584
X-Spam-Level: 
X-Spam-Status: No, score=-105.584 tagged_above=-999 required=5 tests=[AWL=-0.208, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_37=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qmLUP7nBXPYy for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:42:36 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 836A13A677E for <hybi@ietf.org>; Thu, 24 Feb 2011 08:42:36 -0800 (PST)
Received: from hpaq6.eem.corp.google.com (hpaq6.eem.corp.google.com [172.25.149.6]) by smtp-out.google.com with ESMTP id p1OGh4gw021752 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:43:05 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298565785; bh=y745+y4encqDdtMaiP0SqXVrNoo=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=wA0MY9A6nExT9eDSE0SKkvWhl8VnEV2qWa1WyeHdNgoSWYC7cIheNqpK6fOLkAKLk 7Dp+HJAfJtTnAwO2QYPSg==
Received: from gxk21 (gxk21.prod.google.com [10.202.11.21]) by hpaq6.eem.corp.google.com with ESMTP id p1OGgG4A019077 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 08:43:03 -0800
Received: by gxk21 with SMTP id 21so340625gxk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:43:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=fdDYQEcCRNuywrxAqth1tJ0mYXFebKwKtmBIgEUIOoc=; b=BaN7Q6ztPhAonzU4KSbKXnjHFKbHPFbgs4eeqtd8DbjPPG8GRH3sSQBZfyLSq/BNup PSoBcdeL098fcuje4GkA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=A17dDAAN3aZij0Gr4wqR+1e/Ou89MNMABLk0NDSJB+jQZ5pbV/uFK84YYLCy1idOP5 53hMgXiokYwnSikvPFIw==
Received: by 10.150.140.6 with SMTP id n6mr2101926ybd.160.1298565783129; Thu, 24 Feb 2011 08:43:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Thu, 24 Feb 2011 08:42:42 -0800 (PST)
In-Reply-To: <20110224161926.GJ17386@1wt.eu>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu>
From: John Tamplin <jat@google.com>
Date: Thu, 24 Feb 2011 11:42:42 -0500
Message-ID: <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: multipart/alternative; boundary=000e0cd37592388f1c049d09e8c0
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:42:37 -0000

--000e0cd37592388f1c049d09e8c0
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 11:19 AM, Willy Tarreau <w@1wt.eu> wrote:

> > Regarding the attack vector you've shown, isn't it possible to execute
> > it with a javascript-sourced POST method, which, as part of the data,
> > contains the HTTP request?
> > For example:
> >
> > "POST ...
> > ...
> > <binary>
> > GET /ga.js HTTP/1.1
> > Host: www.google.com
> > "
>
> It is exactly the same, that's why such an attack is non-sense as it
> is described here. Simply try to write that in your favorite webmail
> interface and check whether it breaks any intermediary. Response: it
> wont because HTTP messages are correctly bounded and there is no
> ambiguity as to what is part of a header and what is part of a body.
>
> The issue comes with GET+101+immediate request after the first one+
> 101-unawared intermediary+all the points mentionned in Adam's paper.
> Those are addressed with the current draft.
>

The difference is that the intermediaries know about POST and know that the
data framed by the POST method is not HTTP protocol content, but instead
user data.  In the GET+Upgrade case, those intermediaries did not understand
Connection: Upgrade, so they treated the next bytes after the completed GET
message as another HTTP message.  Adam did not show that those
intermediaries would skip past WebSocket framing, but given the lazy HTTP
parsers we have all seen it seems entirely plausible that they would skip
garbage and try and synchronize on what appears to be an HTTP header.  After
all, these are transparent intermediaries, so they can't just terminate the
connection and resync on a fresh connection attempt, nor can they simply
stop working indefinitely because they didn't understand some command.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd37592388f1c049d09e8c0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 11:19 AM, Willy Tarreau =
<span dir=3D"ltr">&lt;<a href=3D"mailto:w@1wt.eu">w@1wt.eu</a>&gt;</span> w=
rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">&gt; Regarding the attack vector you&#39;ve shown, isn&#3=
9;t it possible to execute<br>
&gt; it with a javascript-sourced POST method, which, as part of the data,<=
br>
&gt; contains the HTTP request?<br>
&gt; For example:<br>
&gt;<br>
&gt; &quot;POST ...<br>
&gt; ...<br>
&gt; &lt;binary&gt;<br>
&gt; GET /ga.js HTTP/1.1<br>
&gt; Host: <a href=3D"http://www.google.com" target=3D"_blank">www.google.c=
om</a><br>
&gt; &quot;<br>
<br>
</div>It is exactly the same, that&#39;s why such an attack is non-sense as=
 it<br>
is described here. Simply try to write that in your favorite webmail<br>
interface and check whether it breaks any intermediary. Response: it<br>
wont because HTTP messages are correctly bounded and there is no<br>
ambiguity as to what is part of a header and what is part of a body.<br>
<br>
The issue comes with GET+101+immediate request after the first one+<br>
101-unawared intermediary+all the points mentionned in Adam&#39;s paper.<br=
>
Those are addressed with the current draft.<br></blockquote><div><br></div>=
<div>The difference is that the intermediaries know about POST and know tha=
t the data framed by the POST method is not HTTP protocol content, but inst=
ead user data. =C2=A0In the GET+Upgrade case, those intermediaries did not =
understand Connection: Upgrade, so they treated the next bytes after the co=
mpleted GET message as another HTTP message. =C2=A0Adam did not show that t=
hose intermediaries would skip past WebSocket framing, but given the lazy H=
TTP parsers we have all seen it seems entirely plausible that they would sk=
ip garbage and try and synchronize on what appears to be an HTTP header. =
=C2=A0After all, these are transparent intermediaries, so they can&#39;t ju=
st terminate the connection and resync on a fresh connection attempt, nor c=
an they simply stop working indefinitely because they didn&#39;t understand=
 some command.=C2=A0</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd37592388f1c049d09e8c0--

From w@1wt.eu  Thu Feb 24 08:57:54 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 495D13A6765 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:57:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.698
X-Spam-Level: 
X-Spam-Status: No, score=-1.698 tagged_above=-999 required=5 tests=[AWL=-0.255, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, J_CHICKENPOX_37=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JpVoKn3JSnYh for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:57:53 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 332AF3A677E for <hybi@ietf.org>; Thu, 24 Feb 2011 08:57:52 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OGwO1Z019656; Thu, 24 Feb 2011 17:58:24 +0100
Date: Thu, 24 Feb 2011 17:58:24 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224165824.GK17386@1wt.eu>
References: <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:57:54 -0000

On Thu, Feb 24, 2011 at 06:25:43PM +0200, Silvio Ventres wrote:
> >> "POST ...
> >> ...
> >> <binary>
> >> GET /ga.js HTTP/1.1
> >> Host: www.google.com
> >> "
> >
> > It is exactly the same, that's why such an attack is non-sense as it
> > is described here. Simply try to write that in your favorite webmail
> > interface and check whether it breaks any intermediary. Response: it
> > wont because HTTP messages are correctly bounded and there is no
> > ambiguity as to what is part of a header and what is part of a body.
> 
> So, you agree that the same attack that is being prevented in WS is
> easily possible
> by simple a simple POST from the same javascript?

No, instead I'm trying to make you understand that it does not more
exist with WS than it does with a simple POST. An intermediary will
never look at random strings. It parses request headers when it
expects request headers and it parses body when it expects body. It
has no reason to confuse both of them.

However in the case of WS, we know that few intermediaries are aware of
the GET+Upgrade handshake, and that some of them will expect a new request
just after the handshake because they'll think there's no body and they
don't know that a tunnel is established. So if you'd immediately send a
new HTTP request-looking sequence of bytes on the wire after the first
one, some of them could mistake it for the HTTP request they're expecting.
But the WS framing prevents that since it contains bytes that can't appear
in an HTTP request. The masking ensures that nobody will control the stream
in case a less regarding one is discovered.

(in fact, the masking key placed before the stream could possibly make a
valid looking request appear, but since that's random, it's not exploitable).

Hoping this helps,
Willy


From silvio.ventres@gmail.com  Thu Feb 24 08:58:03 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 651443A6765 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:58:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.038
X-Spam-Level: 
X-Spam-Status: No, score=-3.038 tagged_above=-999 required=5 tests=[AWL=-0.039, BAYES_00=-2.599, J_CHICKENPOX_37=0.6, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IyhgPvGgNN64 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:58:00 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 443B93A65A5 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:58:00 -0800 (PST)
Received: by vws6 with SMTP id 6so681785vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:58:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=uMW3MO7JfDO2qvTm+G6ftEDvcYIOugmCIJGpMTPnJ6s=; b=mOcHToEhx/MuqbG7DfXKaNwd8vFbD6Y65Nkzjxae9yl4L73hhOiChzlvejFLuZJJIr JvcHQt6NVdM2SGmFkJuVbS1fVkesa1Kt83xj11R+z5vf3OW4fLBEDxzKNzquN9okoH5H O+rxNe+vkChKM39h5T/vE0hbw7ccgiGN4D460=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=c9GLUnuj9MlsvtCqYstRxsUub2uOzSSGLarybERRY0+8ySuLO/A6z7c3qKxefZ/UW4 D49L8VJhJtN3nauPTDB6dp8SJ+YGMTDqQi+F6HD37eP64jn21POxPIUbl4warttoaGAl WxkfYL2ROoq+tSMB7QoINFKPkD8uJmnRxyhCU=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr2030290vdb.41.1298566603832; Thu, 24 Feb 2011 08:56:43 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:56:43 -0800 (PST)
In-Reply-To: <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com>
Date: Thu, 24 Feb 2011 18:56:43 +0200
Message-ID: <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:58:03 -0000

> The difference is that the intermediaries know about POST and know that t=
he
> data framed by the POST method is not HTTP protocol content, but instead
> user data. =A0In the GET+Upgrade case, those intermediaries did not under=
stand
> Connection: Upgrade, so they treated the next bytes after the completed G=
ET
> message as another HTTP message. =A0Adam did not show that those
> intermediaries would skip past WebSocket framing, but given the lazy HTTP
> parsers we have all seen it seems entirely plausible that they would skip
> garbage and try and synchronize on what appears to be an HTTP header. =A0=
After
> all, these are transparent intermediaries, so they can't just terminate t=
he
> connection and resync on a fresh connection attempt, nor can they simply
> stop working indefinitely because they didn't understand some command.

Since you agree that those intermediaries would NOT get confused if
you use POST,
then POST solves the problem posed.

Why not simply use POST and remove the masking ?

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 08:58:24 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 584113A65A5 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:58:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.537
X-Spam-Level: 
X-Spam-Status: No, score=-2.537 tagged_above=-999 required=5 tests=[AWL=-0.538, BAYES_00=-2.599, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2vKq-XWg9Bel for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 08:58:23 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 852073A67D1 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:58:23 -0800 (PST)
Received: by vxg33 with SMTP id 33so605638vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 08:59:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=JxCBEbZYCvuf5731EVG1oB0TaBrI0K8fF5A/LNleBtk=; b=JPm2z8jshKilSgz3ISl1yBunjWw59gCEx2ME2TWx5FFt3HLxzvuhZ8yOh9Dc9i74LR ZM4aAAbrGdWwo4jRCtN+QR1ZQaIzWiVUCJwYI31n1tOBFprHbTXtzPqu0MWgMhqXqVvk UHJwBW8wIRUJZL2mjiaxr2JgSXW6LTCv3cm9k=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=gpyHslRyO/eDwpxwxcwCmbFLr2ny+EpNfb7D4UOlFU2K+Nh1CIL8A/DoZNDNFD76q6 b10VgDJ7kcB/bUMIqujX9P1bZL+fjWmDq0QZIdUIxhRAubTsuX4/x5nsuckDoX6MXgM9 S7+SKx0qbrSWb+giKChU0V43BAssJaFrYbGxY=
MIME-Version: 1.0
Received: by 10.52.164.36 with SMTP id yn4mr1892086vdb.201.1298566524077; Thu, 24 Feb 2011 08:55:24 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 08:55:23 -0800 (PST)
In-Reply-To: <AANLkTikGFB3hpSxq8q3EhOBY01y6V64Q80jmM-pHLErv@mail.gmail.com>
References: <AANLkTik+Oz_LdCBQ3dkhxw5gPBytDnVTDZbm_gcnTLLj@mail.gmail.com> <AANLkTimUzXykudZVyW7Z7X5N6Pi1vTWOf7+TWzDEDSOp@mail.gmail.com> <AANLkTimk416zJfedGJnRByiE_Et3wBhUy2Pm28QKC-ii@mail.gmail.com> <AANLkTikSjWaexxJarZfLee7vQZtQD9oXsC3UbB4jWW1p@mail.gmail.com> <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTimOrm477Ur86FuQZEH-OetyaH1_Ku0gT119r=Va@mail.gmail.com> <AANLkTikUhU=7h01fox-4VVo5Hv9=3Ary8PYFgaawbYrw@mail.gmail.com> <AANLkTikGFB3hpSxq8q3EhOBY01y6V64Q80jmM-pHLErv@mail.gmail.com>
Date: Thu, 24 Feb 2011 18:55:23 +0200
Message-ID: <AANLkTim_rh53OrksSxY+5BePaf-V9VrzfSNZKGbT+s-G@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 16:58:24 -0000

> So how do you think we declared consensus on masking? =A0It was after mon=
ths
> of discussing various alternatives and determining that while nobody like=
d
> the solution (for various reasons, some thought it didn't go far enough a=
nd
> others thought it went to far), it was the only solution to the problems
> that all involved were willing to live with.

Well, how you arrived to consensus was to do a "straw vote" which
doesn't seem like a real consensus.
What should have been done is to clarify the goal, add subgoals based
on various inputs,
removing irrelevant ones, such as "add security features for fun", and
clarify that there is
no point in making WS _more_ secure than HTTP, since any attacks that
can be done using standard
HTTP (i.e. POST-based proxy-confusion) will be done using it, since
it's more used in the wild.
After removing the irrelevant goals, solutions should be proposed and
weighed along their
impact on the protocol implementation simplicity, debugging ability,
understanding complexity,
expected performance and maintainability. The solution that impacts
the least while satisfying the
goals stated should have been chosen to be represented in the specification=
.

> As far as debugging ability, XOR'ing the frame is no harder to deal with
> than decompressing compressed content (which will hopefully be a
> common=A0occurrence on WebSocket connections=A0as well).

Do you think HTTP would be so prevalent today if it had been using XOR mask=
ing ?
Did you ever write an HTTP server ? Debugged an HTTP application ?
You can always disable compression. Per current spec, masking is mandatory.

--
 silvio

From w@1wt.eu  Thu Feb 24 09:02:20 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA20D3A63CB for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:02:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.675
X-Spam-Level: 
X-Spam-Status: No, score=-1.675 tagged_above=-999 required=5 tests=[AWL=-0.232, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, J_CHICKENPOX_37=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fZgxHv7hrF1W for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:02:20 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id BB6A33A677E for <hybi@ietf.org>; Thu, 24 Feb 2011 09:02:19 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OH33hx019694; Thu, 24 Feb 2011 18:03:03 +0100
Date: Thu, 24 Feb 2011 18:03:03 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224170303.GL17386@1wt.eu>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:02:21 -0000

On Thu, Feb 24, 2011 at 06:56:43PM +0200, Silvio Ventres wrote:
> > The difference is that the intermediaries know about POST and know that the
> > data framed by the POST method is not HTTP protocol content, but instead
> > user data.  In the GET+Upgrade case, those intermediaries did not understand
> > Connection: Upgrade, so they treated the next bytes after the completed GET
> > message as another HTTP message.  Adam did not show that those
> > intermediaries would skip past WebSocket framing, but given the lazy HTTP
> > parsers we have all seen it seems entirely plausible that they would skip
> > garbage and try and synchronize on what appears to be an HTTP header.  After
> > all, these are transparent intermediaries, so they can't just terminate the
> > connection and resync on a fresh connection attempt, nor can they simply
> > stop working indefinitely because they didn't understand some command.
> 
> Since you agree that those intermediaries would NOT get confused if
> you use POST, then POST solves the problem posed.
> 
> Why not simply use POST and remove the masking ?

POST is not bidirectional, otherwise it would not have been needed to
start this WG if the solution was *that* obvious ! The goal of the WG is
to achieve bidirectional communications over HTTP, which currently can't
reliably be achieved with common methods.

Willy


From ferg@caucho.com  Thu Feb 24 09:02:49 2011
Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 66B253A6765 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:02:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eWQKxMv44hbe for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:02:48 -0800 (PST)
Received: from nm6.bullet.mail.ac4.yahoo.com (nm6.bullet.mail.ac4.yahoo.com [98.139.52.203]) by core3.amsl.com (Postfix) with SMTP id 7D9C63A63CB for <hybi@ietf.org>; Thu, 24 Feb 2011 09:02:48 -0800 (PST)
Received: from [98.139.52.192] by nm6.bullet.mail.ac4.yahoo.com with NNFMP; 24 Feb 2011 17:03:35 -0000
Received: from [98.139.52.153] by tm5.bullet.mail.ac4.yahoo.com with NNFMP; 24 Feb 2011 17:03:35 -0000
Received: from [127.0.0.1] by omp1036.mail.ac4.yahoo.com with NNFMP; 24 Feb 2011 17:03:35 -0000
X-Yahoo-Newman-Id: 698519.56759.bm@omp1036.mail.ac4.yahoo.com
Received: (qmail 71524 invoked from network); 24 Feb 2011 17:03:35 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp112.biz.mail.re2.yahoo.com with SMTP; 24 Feb 2011 09:03:35 -0800 PST
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: gdKzIdEVM1kcRoYr3gwnbirIXVpPSU.fynxFE1kW9VGfFAw l6ufs98YzheQUs6j57uZ1_DddAUkWa.58lznqVpBDAK2zA7z4Opok89MMnkw sHMyrZubGjMnVv.m_xo3iD7XnahBPrakCzedzLiUju_XNVb1RVY7UL9XDz8U TZRjsElHpI0RDVOy0sNrq4S4UZzX_h5VjWpq0EXxU0g5uxYvxZY9m0EPix.J tlLYFMEomYjHthMHyiVEtQojgsCE-
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4D668F66.8060607@caucho.com>
Date: Thu, 24 Feb 2011 09:03:34 -0800
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>	<AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com>	<4D6669C8.70603@warmcat.com>	<AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com>	<AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>	<AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com>	<20110224150451.GG17386@1wt.eu>	<AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>	<15283.1298561939.804809@puncture>	<AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com>	<20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com>
In-Reply-To: <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:02:49 -0000

John Tamplin wrote:
> but given the lazy HTTP parsers we have all seen it seems entirely 
> plausible that they would skip garbage and try and synchronize on what 
> appears to be an HTTP header. 

No, that's not plausible at all.

-- Scott


From silvio.ventres@gmail.com  Thu Feb 24 09:09:55 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD5973A6765 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:09:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.019
X-Spam-Level: 
X-Spam-Status: No, score=-3.019 tagged_above=-999 required=5 tests=[AWL=-0.020, BAYES_00=-2.599, J_CHICKENPOX_37=0.6, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OKBS+ZC3Csvf for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:09:54 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id B94433A67AF for <hybi@ietf.org>; Thu, 24 Feb 2011 09:09:54 -0800 (PST)
Received: by vws6 with SMTP id 6so693571vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:10:44 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=XN7hXuARduBF4mhEucKqCZ0ayFPbssGogHazGhyFgQ0=; b=vfUJV2RcB6pH0HfsskK8R+ASE4w3hPFp8hn+pOtYyrVAz2DXy8CJer2oL/RKAGo4Ds Vyw3j1IuytBrVfkZJBmBcPXX14NgYo7FhWy+gKeEViqtSajpf74KJZVUetnENxFn3Hdu /0wY6ER3H+dFKKtTCBb/GhQFvjdFP4w1KNzR8=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Xn5Ihgn5tpVvZwEckkXjuJThrWECKufU4lXSXVQu02CyBbqJ88kKzMMBaK8mlDpryD JzXyFsEFgGVjbCFf1byz+nCK6nn59HiS7d9daP0pj90b0sNT7RLZyA699U53mWXCPYL7 qn8BrbCEhzdxjbabr2CmPGY4oHB4YSa6y4ot4=
MIME-Version: 1.0
Received: by 10.52.94.194 with SMTP id de2mr1981520vdb.1.1298567215494; Thu, 24 Feb 2011 09:06:55 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:06:55 -0800 (PST)
In-Reply-To: <20110224165824.GK17386@1wt.eu>
References: <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu>
Date: Thu, 24 Feb 2011 19:06:55 +0200
Message-ID: <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:09:56 -0000

>> So, you agree that the same attack that is being prevented in WS is
>> easily possible
>> by simple a simple POST from the same javascript?
>
> No, instead I'm trying to make you understand that it does not more
> exist with WS than it does with a simple POST. An intermediary will
> never look at random strings. It parses request headers when it
> expects request headers and it parses body when it expects body. It
> has no reason to confuse both of them.

Well, then it seems you don't believe this attack vector has impact at all.

> However in the case of WS, we know that few intermediaries are aware of
> the GET+Upgrade handshake, and that some of them will expect a new request
> just after the handshake because they'll think there's no body and they
> don't know that a tunnel is established. So if you'd immediately send a
> new HTTP request-looking sequence of bytes on the wire after the first
> one, some of them could mistake it for the HTTP request they're expecting.
> But the WS framing prevents that since it contains bytes that can't appear
> in an HTTP request. The masking ensures that nobody will control the stream
> in case a less regarding one is discovered.

Since from your explanation it seems that the problem lies with the
"GET+Upgrade" headers,
and the fact that intermediaries expect no body, it can be fixed by
either adding some
data after the handshake, or changing the GET+Upgrade to something else.
In any case, masking is too invasive, and the debug ability is _very_ important.
You _do_ want the application developers to be able to debug their applications.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 09:12:06 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2220A3A6765 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:12:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.318
X-Spam-Level: 
X-Spam-Status: No, score=-3.318 tagged_above=-999 required=5 tests=[AWL=0.281,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ni3kxidleSe8 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:11:56 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id AA8433A67E2 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:11:48 -0800 (PST)
Received: by vws6 with SMTP id 6so695402vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:12:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=3cHJp9Sc0UjF9etLETO0MO2K97re2VL5T30bp7pCkxo=; b=UMPlJ6rVnSKNAfphX5NsK46krzk7Bwn/fa2IP9jJsW1xbtC2jhvWmrzNzIBCS8oEqz PMAKc6vtGhMe0fEANPKdlig879YyPR9p5AXIj86rH9xPm6iPN0GA4BTKoXpBBy057GDB 7L+ONFWqn9skBP+P6uC0MwADFz7iuoBbNBxmU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=o8GwqcgRckc5NMIACcwrkXkBPL4J4gAibICvBz1oY6+s5K0uIk0UtK2fwKDWN7wqwx 4weK8V4/remrdM9ZyHv1gYgxkW21cIVkGsEsHiQTYckEXdo93SVTyYh0pE6u9Jnot+SX H8f7iL2jb+ege44B7MLlrr5PHlyDa32TOPuKI=
MIME-Version: 1.0
Received: by 10.52.164.103 with SMTP id yp7mr2004356vdb.161.1298567478211; Thu, 24 Feb 2011 09:11:18 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:11:18 -0800 (PST)
In-Reply-To: <20110224170303.GL17386@1wt.eu>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu>
Date: Thu, 24 Feb 2011 19:11:18 +0200
Message-ID: <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:12:06 -0000

> POST is not bidirectional, otherwise it would not have been needed to
> start this WG if the solution was *that* obvious ! The goal of the WG is
> to achieve bidirectional communications over HTTP, which currently can't
> reliably be achieved with common methods.

You misunderstood. What was meant is to use POST as the method to start
the WS handshake, not to replace WS with POST :)

WS is _not_ HTTP. The only reason, as mentioned by Ian, that "GET"
method is used instead of "WAFFLES", is to be multiplexed through port 80.
So, if using POST method fixes the problems mentioned by Adam Barth,
there's no reason to even consider the masking procedures.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 09:13:39 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 74A873A67AF for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:13:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.827
X-Spam-Level: 
X-Spam-Status: No, score=-2.827 tagged_above=-999 required=5 tests=[AWL=-0.228, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oklr9madV505 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:13:38 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id A10AF3A67D3 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:13:38 -0800 (PST)
Received: by vxg33 with SMTP id 33so620946vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:14:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=1aPty2YhtdAZ5bdTwjaGUphTNaijhBay+7JvphhIGXg=; b=qYSS3B+wlQ1UByLAek8VXXNghx0SZXs8vSLPBvqH2l/mEVXFEYqvM25wlWqdDTURCw KC6XvGwSt6Flzac7y+aVSKMwr4zpr10wJjLkPIKi9HYHI8/9TnxygC1edBDgca184IbQ icoYX67ETjLLwOidA/99PX+MK0OKUnNJlKbtU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=ZdkbKNlV0ZW7SIUNKc+ALOD1OQ4w7fVKCXNTSL5TWAa/zuaxTP5Ugpi47je0SL6vfr QM0FrSdjVYCoHIKcP2YrZYxrb3itBrANr6VIJvCcxbJzOYLz4BkhqQ58NIkrW0DMQzBZ 4GN0t2rs55/QenFg9JEPs58v15mik5ifLsdtU=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr2004439vdb.121.1298567541567; Thu, 24 Feb 2011 09:12:21 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:12:21 -0800 (PST)
In-Reply-To: <4D668F66.8060607@caucho.com>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com>
Date: Thu, 24 Feb 2011 19:12:21 +0200
Message-ID: <AANLkTi=b=YJDHTvwZX1GboWpd+TLKXVHz=WUk2RkX+_=@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Scott Ferguson <ferg@caucho.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:13:39 -0000

On Thu, Feb 24, 2011 at 7:03 PM, Scott Ferguson <ferg@caucho.com> wrote:
> John Tamplin wrote:
>>
>> but given the lazy HTTP parsers we have all seen it seems entirely
>> plausible that they would skip garbage and try and synchronize on what
>> appears to be an HTTP header.
>
> No, that's not plausible at all.

Well, then, problem solved?
Masking has no real reason to exist ?

--
 silvio

From w@1wt.eu  Thu Feb 24 09:13:49 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D85A33A67B1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:13:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.655
X-Spam-Level: 
X-Spam-Status: No, score=-1.655 tagged_above=-999 required=5 tests=[AWL=-0.213, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, J_CHICKENPOX_37=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WLJ1CLdiqoGO for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:13:49 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id BA2973A67AF for <hybi@ietf.org>; Thu, 24 Feb 2011 09:13:48 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OHEXPv019778; Thu, 24 Feb 2011 18:14:33 +0100
Date: Thu, 24 Feb 2011 18:14:33 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224171433.GM17386@1wt.eu>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:13:49 -0000

On Thu, Feb 24, 2011 at 07:06:55PM +0200, Silvio Ventres wrote:
> Since from your explanation it seems that the problem lies with the
> "GET+Upgrade" headers,
> and the fact that intermediaries expect no body, it can be fixed by
> either adding some
> data after the handshake, or changing the GET+Upgrade to something else.

That was already proposed, with random bytes, invalid requests or even
Dave's proposal of a CONNECT request to force the broken ones to fail.
Still those arguments were not convincing enough to reach consensus.

> In any case, masking is too invasive, and the debug ability is _very_ important.
> You _do_ want the application developers to be able to debug their applications.

When debugging, simply force the mask to 0 on the client and you'll see it as
clear text. It's not that hard. And believe, masking it not much invasive
compared to other alternatives that were studied.

Regards,
Willy


From w@1wt.eu  Thu Feb 24 09:17:00 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CD803A67D7 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:17:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.939
X-Spam-Level: 
X-Spam-Status: No, score=-1.939 tagged_above=-999 required=5 tests=[AWL=0.104,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8qZHKlz2GKrX for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:16:59 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id CF04C3A6767 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:16:58 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OHHhvG019795; Thu, 24 Feb 2011 18:17:43 +0100
Date: Thu, 24 Feb 2011 18:17:43 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110224171743.GN17386@1wt.eu>
References: <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:17:00 -0000

On Thu, Feb 24, 2011 at 07:11:18PM +0200, Silvio Ventres wrote:
> > POST is not bidirectional, otherwise it would not have been needed to
> > start this WG if the solution was *that* obvious ! The goal of the WG is
> > to achieve bidirectional communications over HTTP, which currently can't
> > reliably be achieved with common methods.
> 
> You misunderstood. What was meant is to use POST as the method to start
> the WS handshake, not to replace WS with POST :)
> 
> WS is _not_ HTTP. The only reason, as mentioned by Ian, that "GET"
> method is used instead of "WAFFLES", is to be multiplexed through port 80.
> So, if using POST method fixes the problems mentioned by Adam Barth,
> there's no reason to even consider the masking procedures.

It does not change anything at all then. Using POST + Upgrade will
still make the intermediary wait for a new request after the response
is seen. Also this causes more issues related to the mixing of POST
with 1xx responses which can be mistaken for 100, causing a real
desynchronization between both ends.

Silvio, I really assure you that it's very painful to re-argument one
after the other many things that were discussed months ago. As Sal said
it, more than 6000 e-mails were exchanged on the subject, so you can
imagine than many ideas were explored, and I'd say tens more than what
we've discussed since you opened this thread.

Thanks,
Willy


From ibc@aliax.net  Thu Feb 24 09:20:17 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC9A73A677E for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:20:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.647
X-Spam-Level: 
X-Spam-Status: No, score=-2.647 tagged_above=-999 required=5 tests=[AWL=0.030,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8DEpgOew6D5S for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:20:16 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id BD1953A6767 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:20:16 -0800 (PST)
Received: by qyk29 with SMTP id 29so4021429qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:21:06 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr909647qcb.170.1298568066408; Thu, 24 Feb 2011 09:21:06 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 09:21:05 -0800 (PST)
In-Reply-To: <4D668F66.8060607@caucho.com>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com>
Date: Thu, 24 Feb 2011 18:21:05 +0100
Message-ID: <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Scott Ferguson <ferg@caucho.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:20:18 -0000

2011/2/24 Scott Ferguson <ferg@caucho.com>:
> John Tamplin wrote:
>>
>> but given the lazy HTTP parsers we have all seen it seems entirely
>> plausible that they would skip garbage and try and synchronize on what
>> appears to be an HTTP header.

So imagine this wrong GET request:

  GET /index.html HTTP/1.1\r\n
  Host: 1.2.3.4GET /lala.txt HTTP/1.1\r\n
  Host: attack.domain\r\n\r\n

The first Host header has wrong content. Do you expect that HTTP
parsers out there would discard garbage data until "1.2.3.4" and start
parsing again from "GET /lala.txt"?

I strongly don't think so. I expect most of the HTTP servers would
drop the whole received data after detecting the grammar failure, and
many of them would also terminate the TCP connection.

If a HTTP server starts parsing from "GET /lala.txt" that is a bug and
a vulnerability (probably).

Regards.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From Joe.Hildebrand@webex.com  Thu Feb 24 09:20:54 2011
Return-Path: <Joe.Hildebrand@webex.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 915BF3A677E for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:20:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.741
X-Spam-Level: 
X-Spam-Status: No, score=-103.741 tagged_above=-999 required=5 tests=[AWL=0.791, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, RCVD_NUMERIC_HELO=2.067, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mSPKtzagDPIW for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:20:53 -0800 (PST)
Received: from gw2.webex.com (gw2.webex.com [64.68.122.209]) by core3.amsl.com (Postfix) with SMTP id 5F4BB3A6767 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:20:53 -0800 (PST)
Received: from SRV-EXSC03.webex.local ([192.168.252.198]) by gw2.webex.com with Microsoft SMTPSVC(6.0.3790.4675);  Thu, 24 Feb 2011 09:21:43 -0800
Received: from 66.114.169.8 ([66.114.169.8]) by SRV-EXSC03.webex.local ([192.168.252.200]) via Exchange Front-End Server mailus.webex.com ([66.114.175.12]) with Microsoft Exchange Server HTTP-DAV ; Thu, 24 Feb 2011 17:21:42 +0000
User-Agent: Microsoft-Entourage/12.24.0.100205
Date: Thu, 24 Feb 2011 10:21:42 -0700
From: Joe Hildebrand <joe.hildebrand@webex.com>
To: Silvio Ventres <silvio.ventres@gmail.com>, <ifette@google.com>
Message-ID: <C98BE1B6.4B0BE%joe.hildebrand@webex.com>
Thread-Topic: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
Thread-Index: AcvUR02beYuUJalenE+ue/vrkzbGIg==
In-Reply-To: <AANLkTinm+dYb1qfsA=WkA9x6=jd0ys45RwEmNjhT1GAD@mail.gmail.com>
IM-ID: xmpp:jhildebr@cisco.com
Presence-ID: xmpp:jhildebr@cisco.com
Jabber-ID: jhildebr@cisco.com
Mime-version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit
X-OriginalArrivalTime: 24 Feb 2011 17:21:43.0346 (UTC) FILETIME=[4E68F920:01CBD447]
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:20:54 -0000

On 2/24/11 9:29 AM, "Silvio Ventres" <silvio.ventres@gmail.com> wrote:

> If you have some other rationale on the handshake-computation, or you don't
> accept the fact that the server author cannot be coerced into doing
> anything he doesn't like, please reply with your elaboration.

Please keep in mind that standards creation is as much a political process
as a technical one.  Not every decision we make will have an absolutely firm
technical foundation in everyone's mind because of that -- often the best we
can hope for is to compromise on something that nobody hates enough to
filibuster.

Some of the past political compromises have caused hurt feelings from
multiple parties, and what you're asking for is for those feelings to be
replayed in public, which means that the tenuous progress that we've made is
likely to be lost as we devolve (again) into finger-pointing and
name-calling.

We've also had a history of newcomers joining the process late, and making
us rehash *every* decision or disrupting the process with new personality
conflicts.  Because of that history, you're getting more pushback than seems
appropriate to you, but feels fairly well-justified to those that have been
around for a while.

I'll repeat what someone said earlier.  If someone wants to write an
individual informational I-D describing the justifications for everything
that ends up in the protocol, that would be fine.  However, I'm not
interested in that being a working group document at the moment, since there
will be an entire series of meta-arguments about what the justifications
are, and how to word them, all of which will prevent us from getting to a
point of completion on the protocol in a timely manner.  If the I-D ends up
being useful and complete as an individual draft, we can revisit whether to
make it a working group draft later.

-- 
Joe Hildebrand
(as chair)


From jat@google.com  Thu Feb 24 09:27:40 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 23CFA3A67ED for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:27:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.863
X-Spam-Level: 
X-Spam-Status: No, score=-105.863 tagged_above=-999 required=5 tests=[AWL=0.113, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6xyq1KvmYqDu for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:27:39 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 07A8D3A67E3 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:27:38 -0800 (PST)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p1OHSSoK021899 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:28:28 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298568508; bh=wLYskTgB9vbohXfUL5k2yYJTGpk=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=jGmnXzrfoTl4bokN+CgnrzFS/1L4tQVe1TtzG+s+ZnDmjlvG4dOD+H1rWVzHkgjPC GKsnC+ep2wNaMW6i3xEdA==
Received: from gwj20 (gwj20.prod.google.com [10.200.10.20]) by wpaz37.hot.corp.google.com with ESMTP id p1OHSRr0010643 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 09:28:27 -0800
Received: by gwj20 with SMTP id 20so359977gwj.19 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:28:27 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=lETX+cwyK+IL7ScnlhIWKkrphwg8duiLzIJLMaYI9u0=; b=Br2Jm0t0wSTrPascKZztXqJSGtRlkPJzMBQI05EIraC896CH8uq5OlHAzqF2enbxvg +v2qIbqR2099PcdUfPHQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=sr1t835f7RaB0dUrmEz6XEwdPy6D37musWqFvNyXcEIdDdAeOw7JqH4rdwVIllGMEg AGJQlRnm+WDAo6UBVWuw==
Received: by 10.150.195.3 with SMTP id s3mr2175518ybf.274.1298568507149; Thu, 24 Feb 2011 09:28:27 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Thu, 24 Feb 2011 09:28:07 -0800 (PST)
In-Reply-To: <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Thu, 24 Feb 2011 12:28:07 -0500
Message-ID: <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd48470961c6b049d0a8afa
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:27:40 -0000

--000e0cd48470961c6b049d0a8afa
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 12:11 PM, Silvio Ventres
<silvio.ventres@gmail.com>wrote:

> > POST is not bidirectional, otherwise it would not have been needed to
> > start this WG if the solution was *that* obvious ! The goal of the WG is
> > to achieve bidirectional communications over HTTP, which currently can't
> > reliably be achieved with common methods.
>
> You misunderstood. What was meant is to use POST as the method to start
> the WS handshake, not to replace WS with POST :)
>
> WS is _not_ HTTP. The only reason, as mentioned by Ian, that "GET"
> method is used instead of "WAFFLES", is to be multiplexed through port 80.
> So, if using POST method fixes the problems mentioned by Adam Barth,
> there's no reason to even consider the masking procedures.
>

POST by itself does not fix the problem, since immediately after the POST
request is complete, those same intermediaries which don't know about
WebSocket will be parsing WebSocket frames as HTTP requests.

It was proposed and rejected to use POST and chunked encoding to send frames
in both directions, since there are known to be intermediaries that de-chunk
all traffic passing through them (and would therefore wait to read the last
chunk before sending any frame on), and because client->server chunking is
hardly used and therefore likely to be as broken as Connection: Upgrade in
those intermediaries.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd48470961c6b049d0a8afa
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 12:11 PM, Silvio Ventres=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.v=
entres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

&gt; POST is not bidirectional, otherwise it would not have been needed to<=
br>
&gt; start this WG if the solution was *that* obvious ! The goal of the WG =
is<br>
&gt; to achieve bidirectional communications over HTTP, which currently can=
&#39;t<br>
&gt; reliably be achieved with common methods.<br>
<br>
You misunderstood. What was meant is to use POST as the method to start<br>
the WS handshake, not to replace WS with POST :)<br>
<br>
WS is _not_ HTTP. The only reason, as mentioned by Ian, that &quot;GET&quot=
;<br>
method is used instead of &quot;WAFFLES&quot;, is to be multiplexed through=
 port 80.<br>
So, if using POST method fixes the problems mentioned by Adam Barth,<br>
there&#39;s no reason to even consider the masking procedures.<br></blockqu=
ote><div><br></div><div>POST by itself does not fix the problem, since imme=
diately after the POST request is complete, those same intermediaries which=
 don&#39;t know about WebSocket will be parsing WebSocket frames as HTTP re=
quests.</div>

<div><br></div><div>It was proposed and rejected to use POST and chunked en=
coding to send frames in both directions, since there are known to be inter=
mediaries that de-chunk all traffic passing through them (and would therefo=
re wait to read the last chunk before sending any frame on), and because cl=
ient-&gt;server chunking is hardly used and therefore likely to be as broke=
n as Connection: Upgrade in those intermediaries.=C2=A0</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd48470961c6b049d0a8afa--

From ibc@aliax.net  Thu Feb 24 09:29:03 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B049B3A67F0 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:29:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.649
X-Spam-Level: 
X-Spam-Status: No, score=-2.649 tagged_above=-999 required=5 tests=[AWL=0.028,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1yfVIARfDCWV for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:29:01 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 8762F3A67ED for <hybi@ietf.org>; Thu, 24 Feb 2011 09:29:01 -0800 (PST)
Received: by qwh6 with SMTP id 6so688946qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:29:51 -0800 (PST)
MIME-Version: 1.0
Received: by 10.224.37.81 with SMTP id w17mr1066842qad.132.1298568591068; Thu, 24 Feb 2011 09:29:51 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 09:29:51 -0800 (PST)
In-Reply-To: <20110224171433.GM17386@1wt.eu>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com> <20110224171433.GM17386@1wt.eu>
Date: Thu, 24 Feb 2011 18:29:51 +0100
Message-ID: <AANLkTi=SOF8mR5GekO3zee2gZK5LEpJDuSfKPe7R+ser@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:29:04 -0000

2011/2/24 Willy Tarreau <w@1wt.eu>:
>> In any case, masking is too invasive, and the debug ability is _very_ im=
portant.
>> You _do_ want the application developers to be able to debug their appli=
cations.
>
> When debugging, simply force the mask to 0 on the client and you'll see i=
t as
> clear text. It's not that hard. And believe, masking it not much invasive
> compared to other alternatives that were studied.

In many cases the developer will need to analyze data coming from
usual web browsers to his WS server, so he cannot change the client
mask.

For example, I work in SIP world, I code SIP servers and I spent long
time every day debugging SIP protocol *in the server*, so I've no
control over the clients (common SIP phones). Same concept applies for
WS application developers.



--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From jat@google.com  Thu Feb 24 09:31:19 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8F4D73A67E3 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:31:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.724
X-Spam-Level: 
X-Spam-Status: No, score=-105.724 tagged_above=-999 required=5 tests=[AWL=-0.048, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MxG464e-BlaC for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:31:18 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id AC8A73A67D3 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:31:18 -0800 (PST)
Received: from hpaq7.eem.corp.google.com (hpaq7.eem.corp.google.com [172.25.149.7]) by smtp-out.google.com with ESMTP id p1OHW7wx017560 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:32:08 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298568728; bh=3LQzBcgxprY/1fPEl1DZT0fjsTA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=mlQ+Ha4Ds6eWEwy21eTnr7IWiHhgU8ofS7+WizBTw9r25IHj510XgtxRa9gpzQ1pQ O+cc4TbKlvIP/GwQHucYg==
Received: from yws5 (yws5.prod.google.com [10.192.19.5]) by hpaq7.eem.corp.google.com with ESMTP id p1OHVbgg030004 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 09:32:06 -0800
Received: by yws5 with SMTP id 5so119343yws.14 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:32:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=i1HKZXL0zughCpkoBzNuTqJuO65NlgJ6JIQegjlY7tg=; b=FjxaiN4/hQnimm27Dalq4w9vf0xeN77rACAWyEsPgssW9EoMtys+u/viJs6XCw671A 34yl/ZpIwwdU2GpQBrRA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=cJN0cbuiGu6+FDZ1/0u3aE/P7TpxGGAtMaJ2d4XmL6tQYBBrcqa/oiEp5K4bNv03k0 rGnPpKMpTbVyuRiyEz+g==
Received: by 10.150.69.5 with SMTP id r5mr1048270yba.217.1298568726095; Thu, 24 Feb 2011 09:32:06 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Thu, 24 Feb 2011 09:31:46 -0800 (PST)
In-Reply-To: <AANLkTi=SOF8mR5GekO3zee2gZK5LEpJDuSfKPe7R+ser@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com> <20110224171433.GM17386@1wt.eu> <AANLkTi=SOF8mR5GekO3zee2gZK5LEpJDuSfKPe7R+ser@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Thu, 24 Feb 2011 12:31:46 -0500
Message-ID: <AANLkTikgLVGvj6MykQp2cHB4x_vmBi=-YMrkwke9zwUU@mail.gmail.com>
To: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
Content-Type: multipart/alternative; boundary=000e0cd591b4a2a91e049d0a9791
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:31:19 -0000

--000e0cd591b4a2a91e049d0a9791
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Feb 24, 2011 at 12:29 PM, I=C3=B1aki Baz Castillo <ibc@aliax.net> w=
rote:

> In many cases the developer will need to analyze data coming from
> usual web browsers to his WS server, so he cannot change the client
> mask.
>
> For example, I work in SIP world, I code SIP servers and I spent long
> time every day debugging SIP protocol *in the server*, so I've no
> control over the clients (common SIP phones). Same concept applies for
> WS application developers.


Then presumably you are using something like Wireshark, and writing a
protocol dissector for WebSockets will be trivial.

--=20
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd591b4a2a91e049d0a9791
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 12:29 PM, I=C3=B1aki Baz=
 Castillo <span dir=3D"ltr">&lt;<a href=3D"mailto:ibc@aliax.net">ibc@aliax.=
net</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

In many cases the developer will need to analyze data coming from<br>
usual web browsers to his WS server, so he cannot change the client<br>
mask.<br>
<br>
For example, I work in SIP world, I code SIP servers and I spent long<br>
time every day debugging SIP protocol *in the server*, so I&#39;ve no<br>
control over the clients (common SIP phones). Same concept applies for<br>
WS application developers.</blockquote><div><br></div><div>Then presumably =
you are using something like Wireshark, and writing a protocol dissector fo=
r WebSockets will be trivial.=C2=A0</div></div><br>-- <br>John A. Tamplin<b=
r>

Software Engineer (GWT), Google<br>

--000e0cd591b4a2a91e049d0a9791--

From silvio.ventres@gmail.com  Thu Feb 24 09:33:30 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3460A3A67E3 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:33:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.52
X-Spam-Level: 
X-Spam-Status: No, score=-2.52 tagged_above=-999 required=5 tests=[AWL=-0.521,  BAYES_00=-2.599, J_CHICKENPOX_37=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eJoOHirBv1fU for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:33:29 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 643493A67D3 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:33:29 -0800 (PST)
Received: by vxg33 with SMTP id 33so642376vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:34:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=O9l4Vkg4Dz2op3YkLbo8F3YUtWDi62OE5/nT1w7vPNs=; b=mvCt+AkK8Q088wOoT8DJ1mKHWHLSQI3+FPIOcqtoFt2PKZF+LxG33xGKWsa5JJAX4E mzxCF4rqgymJHO7yvEOlvw4MA7YGBL/zm2YYUENanapP7Hlxb8hEOQs1VJbmUQT0CXo0 S5p4dE1sRzPtItL9KoFBcxxAyjADKciNaRWZI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=w/LenHdSrOB0Svhfef4SettLaMqP75kN+XmRAR+m25V+ntOdy3xOPTNE2IfvLvJbW8 MIIZU43v6njR6h+w8un/gx5NV58GezCy3w+lV032gYertsbDU7a7SwNSBPe7ee8ebOit ZJ4Qe9BOmm1CNAO8DACYS6SzXfuFnuRrzFMpc=
MIME-Version: 1.0
Received: by 10.52.164.103 with SMTP id yp7mr2058802vdb.161.1298568814271; Thu, 24 Feb 2011 09:33:34 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:33:34 -0800 (PST)
In-Reply-To: <20110224171433.GM17386@1wt.eu>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com> <20110224171433.GM17386@1wt.eu>
Date: Thu, 24 Feb 2011 19:33:34 +0200
Message-ID: <AANLkTikOhCRP58hTh3hPep07LuhK5PTUUe7rFMUdBwm5@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:33:30 -0000

>> Since from your explanation it seems that the problem lies with the
>> "GET+Upgrade" headers,
>> and the fact that intermediaries expect no body, it can be fixed by
>> either adding some
>> data after the handshake, or changing the GET+Upgrade to something else.
>
> That was already proposed, with random bytes, invalid requests or even
> Dave's proposal of a CONNECT request to force the broken ones to fail.
> Still those arguments were not convincing enough to reach consensus.

Well, what exactly was unconvincing ?
Why is it so easy for you to just leave it be and accept a solution that has
so much impact ? Masking breaks debug.

> When debugging, simply force the mask to 0 on the client and you'll see it as
> clear text. It's not that hard. And believe, masking it not much invasive
> compared to other alternatives that were studied.

If the browser is the UA that implements WS for you, you can't really
force it to do anything.
Same with Web Services, you don't always have control over the server
configuration.

--
 silvio

From ibc@aliax.net  Thu Feb 24 09:36:18 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F6303A6800 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:36:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.65
X-Spam-Level: 
X-Spam-Status: No, score=-2.65 tagged_above=-999 required=5 tests=[AWL=0.027,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 32yFwVtjHWux for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:36:17 -0800 (PST)
Received: from mail-qy0-f179.google.com (mail-qy0-f179.google.com [209.85.216.179]) by core3.amsl.com (Postfix) with ESMTP id 5D0AD3A67E3 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:36:17 -0800 (PST)
Received: by qyk7 with SMTP id 7so649090qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:37:07 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.88.200 with SMTP id b8mr893394qcm.246.1298569026770; Thu, 24 Feb 2011 09:37:06 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 09:37:06 -0800 (PST)
In-Reply-To: <AANLkTikgLVGvj6MykQp2cHB4x_vmBi=-YMrkwke9zwUU@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com> <20110224171433.GM17386@1wt.eu> <AANLkTi=SOF8mR5GekO3zee2gZK5LEpJDuSfKPe7R+ser@mail.gmail.com> <AANLkTikgLVGvj6MykQp2cHB4x_vmBi=-YMrkwke9zwUU@mail.gmail.com>
Date: Thu, 24 Feb 2011 18:37:06 +0100
Message-ID: <AANLkTi=5wn2S5QFn=xJX9oGtSKHCh7p0OKC-FoPo53ff@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:36:18 -0000

2011/2/24 John Tamplin <jat@google.com>:
>> For example, I work in SIP world, I code SIP servers and I spent long
>> time every day debugging SIP protocol *in the server*, so I've no
>> control over the clients (common SIP phones). Same concept applies for
>> WS application developers.
>
> Then presumably you are using something like Wireshark, and writing a
> protocol dissector for WebSockets will be trivial.

No. I use basic ngrep in most of the cases. Easy debugging in realime
without having to open a generated file in my local computer, just run
"ngrep --options" in the server and voila!.

SIP is plain text protocol like HTTP. And SIP has become the winning
VoIP protocol since it uses plain text. Other VoIP protocols like H323
are binary protocols and have mostly dissapeared. Take it into account
please.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From Joe.Hildebrand@webex.com  Thu Feb 24 09:36:23 2011
Return-Path: <Joe.Hildebrand@webex.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7F7B93A680B for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:36:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.939
X-Spam-Level: 
X-Spam-Status: No, score=-103.939 tagged_above=-999 required=5 tests=[AWL=0.593, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, RCVD_NUMERIC_HELO=2.067, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R2gwgm4D1mdo for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:36:22 -0800 (PST)
Received: from gw1.webex.com (gw1.webex.com [64.68.122.208]) by core3.amsl.com (Postfix) with SMTP id CC6443A67E3 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:36:22 -0800 (PST)
Received: from SRV-EXSC03.webex.local ([192.168.252.198]) by gw1.webex.com with Microsoft SMTPSVC(6.0.3790.4675);  Thu, 24 Feb 2011 09:37:12 -0800
Received: from 66.114.169.8 ([66.114.169.8]) by SRV-EXSC03.webex.local ([192.168.252.200]) via Exchange Front-End Server mailus.webex.com ([66.114.175.12]) with Microsoft Exchange Server HTTP-DAV ; Thu, 24 Feb 2011 17:37:12 +0000
User-Agent: Microsoft-Entourage/12.24.0.100205
Date: Thu, 24 Feb 2011 10:37:11 -0700
From: Joe Hildebrand <joe.hildebrand@webex.com>
To: Silvio Ventres <silvio.ventres@gmail.com>, Willy Tarreau <w@1wt.eu>
Message-ID: <C98BE557.4B0D2%joe.hildebrand@webex.com>
Thread-Topic: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
Thread-Index: AcvUSXdVmRwyJDq8FEiDJSCVpMGYqw==
In-Reply-To: <AANLkTikOhCRP58hTh3hPep07LuhK5PTUUe7rFMUdBwm5@mail.gmail.com>
IM-ID: xmpp:jhildebr@cisco.com
Presence-ID: xmpp:jhildebr@cisco.com
Jabber-ID: jhildebr@cisco.com
Mime-version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit
X-OriginalArrivalTime: 24 Feb 2011 17:37:12.0510 (UTC) FILETIME=[783C25E0:01CBD449]
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:36:23 -0000

On 2/24/11 10:33 AM, "Silvio Ventres" <silvio.ventres@gmail.com> wrote:

> Well, what exactly was unconvincing ?
> Why is it so easy for you to just leave it be and accept a solution that has
> so much impact ? Masking breaks debug.

This discussion isn't moving our work forward.  Everyone get your last
points in, because I'm perilously close to asking for it to stop.

-- 
Joe Hildebrand
(as chair)


From silvio.ventres@gmail.com  Thu Feb 24 09:37:31 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 69CBD3A6803 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:37:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.305
X-Spam-Level: 
X-Spam-Status: No, score=-3.305 tagged_above=-999 required=5 tests=[AWL=0.294,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pLr4E9OS+opK for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:37:30 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id C98483A6800 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:37:29 -0800 (PST)
Received: by vws6 with SMTP id 6so721746vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:38:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=WbVb6j1Qyh9+ZbEYDC25mPPRhrKNw0C8Ke0Dfzl/eac=; b=wxYrkI1IHPUcXjsFIVGY4lfk/XeifSM9dCs1vO7rDgfd8LQ/4Y+mLE5Yq6X8hRpVK/ JTbmbm8QMlpoiZEsych5jZCYhLQwJKT04zXBJUaUWFJJ5N5sVzCJ8fHgHQ0I9DMGs7w/ SiZ19XsdwtH5yJC9Qhu+LsWx8xc6QGC7Aw32s=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=sAeyGWR6397EdMUAuZ1pNG8PgmrorREtCg7wh7n4ufI2zx0ifE7L0TozJs8H4TeSnf 6o+sXpQqd1lt/O45y0+rvY5KVDGxgV8wsRVzaNPZRf1MpKYPEvOw/F+NyvfZGAieGqk5 rhnkJtWpQZfm9h3XIRahxNeQJJqEnaX33Nd+0=
MIME-Version: 1.0
Received: by 10.52.166.7 with SMTP id zc7mr2033868vdb.241.1298569040965; Thu, 24 Feb 2011 09:37:20 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:37:20 -0800 (PST)
In-Reply-To: <C98BE1B6.4B0BE%joe.hildebrand@webex.com>
References: <AANLkTinm+dYb1qfsA=WkA9x6=jd0ys45RwEmNjhT1GAD@mail.gmail.com> <C98BE1B6.4B0BE%joe.hildebrand@webex.com>
Date: Thu, 24 Feb 2011 19:37:20 +0200
Message-ID: <AANLkTi=VdHmdwf+U-ap-EH7KM2W6buEKWLrRBPzZ-4su@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Joe Hildebrand <joe.hildebrand@webex.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:37:32 -0000

> that ends up in the protocol, that would be fine. =A0However, I'm not
> interested in that being a working group document at the moment, since th=
ere
> will be an entire series of meta-arguments about what the justifications
> are, and how to word them, all of which will prevent us from getting to a
> point of completion on the protocol in a timely manner. =A0If the I-D end=
s up
> being useful and complete as an individual draft, we can revisit whether =
to
> make it a working group draft later.

Arguably, the fact that justifications will be argumented and worded
correctly will
only bring better understanding and faster completion of the main
protocol specification.

--
 sivlio

From ferg@caucho.com  Thu Feb 24 09:38:30 2011
Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8949A3A6800 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:38:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idUcWjS6Rylz for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:38:29 -0800 (PST)
Received: from nm10-vm0.bullet.mail.ac4.yahoo.com (nm10-vm0.bullet.mail.ac4.yahoo.com [98.139.53.194]) by core3.amsl.com (Postfix) with SMTP id AB0FC3A67AF for <hybi@ietf.org>; Thu, 24 Feb 2011 09:38:29 -0800 (PST)
Received: from [98.139.52.188] by nm10.bullet.mail.ac4.yahoo.com with NNFMP; 24 Feb 2011 17:39:17 -0000
Received: from [98.139.52.144] by tm1.bullet.mail.ac4.yahoo.com with NNFMP; 24 Feb 2011 17:39:17 -0000
Received: from [127.0.0.1] by omp1027.mail.ac4.yahoo.com with NNFMP; 24 Feb 2011 17:39:17 -0000
X-Yahoo-Newman-Id: 49538.20222.bm@omp1027.mail.ac4.yahoo.com
Received: (qmail 94081 invoked from network); 24 Feb 2011 17:39:17 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp115.biz.mail.re2.yahoo.com with SMTP; 24 Feb 2011 09:39:16 -0800 PST
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: k9G.VmUVM1nLC2KUsjqcCFjTSVECRvxbxC1GBi4iOy.Lec2 77t4LhsSmhZp.taN_l4l3KrLzeYO6CCV0Q5C9nmTXF41pgp4BC4IOEQnF.KR O2EG9yEJiI8r.R4iI2Xmkx_L7P5hi7BOCXnXc7iqZuUyqR0PT2uUMiXvszxp 3jSLP8HX2UFiJEBYSNNDaCIJrazm4oAOQiTj1vOdvBCVVWQuOLSYRj7tlGQi TdUefd7ItoyaC1sRcCSDZGEvJepmpfPPjJAU4hMclvICtv.bmUUNiUryu6ML 7eYnSCCseXKg0xn_TcTM2V1C5U147nJcI4bk-
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4D6697C4.8090504@caucho.com>
Date: Thu, 24 Feb 2011 09:39:16 -0800
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: Silvio Ventres <silvio.ventres@gmail.com>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com>	<AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com>	<4D6669C8.70603@warmcat.com>	<AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com>	<AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com>	<AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com>	<20110224150451.GG17386@1wt.eu>	<AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com>	<15283.1298561939.804809@puncture>	<AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com>	<20110224161926.GJ17386@1wt.eu>	<AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com>	<4D668F66.8060607@caucho.com> <AANLkTi=b=YJDHTvwZX1GboWpd+TLKXVHz=WUk2RkX+_=@mail.gmail.com>
In-Reply-To: <AANLkTi=b=YJDHTvwZX1GboWpd+TLKXVHz=WUk2RkX+_=@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:38:30 -0000

Silvio Ventres wrote:
> On Thu, Feb 24, 2011 at 7:03 PM, Scott Ferguson <ferg@caucho.com> wrote:
>   
>> John Tamplin wrote:
>>     
>>> but given the lazy HTTP parsers we have all seen it seems entirely
>>> plausible that they would skip garbage and try and synchronize on what
>>> appears to be an HTTP header.
>>>       
>> No, that's not plausible at all.
>>     
>
> Well, then, problem solved?
> Masking has no real reason to exist ?
>   

No, because there may be other target vulnerabilities other than the 
specific intermediate-synchronization one. Possibly even vulnerabilities 
for protocols that haven't been invented yet. The problem is an 
open-ended one, which makes it more complicated.

The difficulty with the hijacking scenario is that the hijacker has an 
amazing amount of control, particularly with something like websockets 
that's more than just a single request/response of HTTP.

Given the hijacking scenario, it's better to solve the problem by 
denying plaintext control over the output bytes, rather than hoping that 
we've covered every present and future case. That might end up being a 
bit of overkill. It might not.

So consider the masking a hijacking-cost of allowing the client to 
execute arbitrary and possibly hostile code.

-- Scott


From ifette@google.com  Thu Feb 24 09:41:02 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F8393A6818 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:41:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.376
X-Spam-Level: 
X-Spam-Status: No, score=-105.376 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0pu40s11nLoJ for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:41:00 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id CCA323A6817 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:40:59 -0800 (PST)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p1OHfmMg024594 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:41:49 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298569309; bh=l0lu4oPVlWtyvB3mr6EZpAFrJ/0=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=UsJ5D6acvBHGdkRBUjaUR/IItavIVRIixVV6Tl+OwrfuU8zH2irFQBYLttvPnifMS QO7UUJEwUhzBuQf0lI/Mg==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by wpaz37.hot.corp.google.com with ESMTP id p1OHeaiE028929 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 09:41:47 -0800
Received: by iwl42 with SMTP id 42so468754iwl.28 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:41:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=j+D4qBrp1e7EBl40rIjFAqWBqvu4wlHLrWVIdPWL1Uc=; b=aFFPILwgtEuNERwYYRzI+yjWHm4mpC4tRDOvt8NOwu6sP7Vg7I1SDpUrZnWcvoYDe4 MvMihouMc4s6yZaoEpGw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=fPVTYjEBuJfYBOaKoOZ/SlZogM6q84MAm6pCL3LCkx8lqhoUb2h6aXiesc4G/EocTF afEi6JVnRyra7Kb19gjg==
MIME-Version: 1.0
Received: by 10.231.11.68 with SMTP id s4mr1850884ibs.14.1298569307201; Thu, 24 Feb 2011 09:41:47 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Thu, 24 Feb 2011 09:41:47 -0800 (PST)
In-Reply-To: <C98BE557.4B0D2%joe.hildebrand@webex.com>
References: <AANLkTikOhCRP58hTh3hPep07LuhK5PTUUe7rFMUdBwm5@mail.gmail.com> <C98BE557.4B0D2%joe.hildebrand@webex.com>
Date: Thu, 24 Feb 2011 09:41:47 -0800
Message-ID: <AANLkTim3pq-Fq_9K8P0GETXnc3BXFxK0_kJ9Kbmak1CB@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Joe Hildebrand <joe.hildebrand@webex.com>
Content-Type: multipart/alternative; boundary=00221532c7cc45c255049d0aba1b
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:41:02 -0000

--00221532c7cc45c255049d0aba1b
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 9:37 AM, Joe Hildebrand <joe.hildebrand@webex.com>wrote:

> On 2/24/11 10:33 AM, "Silvio Ventres" <silvio.ventres@gmail.com> wrote:
>
> > Well, what exactly was unconvincing ?
> > Why is it so easy for you to just leave it be and accept a solution that
> has
> > so much impact ? Masking breaks debug.
>
> This discussion isn't moving our work forward.  Everyone get your last
> points in, because I'm perilously close to asking for it to stop.
>
>
FWIW I stopped reading this thread, and the centithread it forked from, a
while ago.


> --
> Joe Hildebrand
> (as chair)
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--00221532c7cc45c255049d0aba1b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 9:37 AM, Joe Hildebrand =
<span dir=3D"ltr">&lt;<a href=3D"mailto:joe.hildebrand@webex.com">joe.hilde=
brand@webex.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">On 2/24/11 10:33 AM, &quot;Silvio Ventres&quot; &lt;<a hr=
ef=3D"mailto:silvio.ventres@gmail.com">silvio.ventres@gmail.com</a>&gt; wro=
te:<br>
<br>
&gt; Well, what exactly was unconvincing ?<br>
&gt; Why is it so easy for you to just leave it be and accept a solution th=
at has<br>
&gt; so much impact ? Masking breaks debug.<br>
<br>
</div>This discussion isn&#39;t moving our work forward. =C2=A0Everyone get=
 your last<br>
points in, because I&#39;m perilously close to asking for it to stop.<br>
<font color=3D"#888888"><br></font></blockquote><div><br></div><div>FWIW I =
stopped reading this thread, and the centithread it forked from, a while ag=
o.</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:=
0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<font color=3D"#888888">
--<br>
Joe Hildebrand<br>
(as chair)<br>
</font><div><div></div><div class=3D"h5"><br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--00221532c7cc45c255049d0aba1b--

From silvio.ventres@gmail.com  Thu Feb 24 09:44:29 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 12E673A682C for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:44:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.313
X-Spam-Level: 
X-Spam-Status: No, score=-3.313 tagged_above=-999 required=5 tests=[AWL=0.286,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v1oyU80MYDW3 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:44:28 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 2FF183A67EF for <hybi@ietf.org>; Thu, 24 Feb 2011 09:44:28 -0800 (PST)
Received: by vws6 with SMTP id 6so728431vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:45:18 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=9Xms96W6cut2T++OSl7G3RpWS9dcyn0iWXBD/zhPmhs=; b=VJzqd4rTThp4Afk8QkLaUDyX2ff8g09NZftEGeFtLgJcZ+surbgy5xRQBqdW9SrTLF GlQSf+gPmPHYTe3QtgPHgg/PXYfHwmTzmjqXaAIWGnLmGELx1sdnXorRtgsu0l75R1mx 50RNAWavVfCjonqdpe7V925DvXs9RDwsN00z4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=HKuIziCZLjd5TfJu0jQcIycoCAi8PlnFPTK06GgbyZuroEJuyGDytlO8ElpdqpodqF hR/hBsu5E7sIz0kK64Qsvht2FuAkJUsOy3w4kVdE1J8ppuzeSg/qGVKpAYuixCvP1uVp JJCAhkyuA3TEvGRaW7fvgANjMvlac8u3+Gp8E=
MIME-Version: 1.0
Received: by 10.52.160.37 with SMTP id xh5mr2087619vdb.81.1298569303407; Thu, 24 Feb 2011 09:41:43 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:41:43 -0800 (PST)
In-Reply-To: <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com> <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com>
Date: Thu, 24 Feb 2011 19:41:43 +0200
Message-ID: <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:44:29 -0000

>> WS is _not_ HTTP. The only reason, as mentioned by Ian, that "GET"
>> method is used instead of "WAFFLES", is to be multiplexed through port 80.
>> So, if using POST method fixes the problems mentioned by Adam Barth,
>> there's no reason to even consider the masking procedures.
>
> POST by itself does not fix the problem, since immediately after the POST
> request is complete, those same intermediaries which don't know about
> WebSocket will be parsing WebSocket frames as HTTP requests.
> It was proposed and rejected to use POST and chunked encoding to send frames
> in both directions, since there are known to be intermediaries that de-chunk
> all traffic passing through them (and would therefore wait to read the last
> chunk before sending any frame on), and because client->server chunking is
> hardly used and therefore likely to be as broken as Connection: Upgrade in
> those intermediaries.

Make each separate WS-sourced packet have a header that makes it look like
a completely new POST request (not a chunk). Then the proxies will not find any
malicious headers at the start of the packet, indeed they would assume
it's binary
data and leave it be.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 09:45:47 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DFB0C3A6817 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:45:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.321
X-Spam-Level: 
X-Spam-Status: No, score=-3.321 tagged_above=-999 required=5 tests=[AWL=0.278,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GV5D1bOU2pgy for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:45:47 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 1F3003A67EF for <hybi@ietf.org>; Thu, 24 Feb 2011 09:45:47 -0800 (PST)
Received: by vws6 with SMTP id 6so729751vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:46:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=3xMYtyQRsaT+4N9d/BfrYhWQ6JuYd8hAhzJzSKJ3vGA=; b=qjBxEmVnWJZpPLcPiIpsvINBeFAWxbxawOSLKFo4dmuxBpfaoiq7jKIT2PshlQo97K D7alue/vbBL1nPqQSWbFoZr+7X9mlT+z2P/OLYRCeiL8LrylOHY5oSt1MTQ2geEFu5C1 Ufocg8vSrycEpX224lp7PcBCx9rvmuCgsgNRw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=eARCoQoO3ifWtXYDRBTDX27uohtJJhMVC38pzddui4LLXU1koFT0lzSnPPVCZGrqbq ao87nBVwF/S5VIyVOmlDRcm/mJwKsLEn5sMeitkEcIWAJhGrWeo+L7XRfESfkQpti1VT oLZknM4FsKbrr1JkAKW6PvZw5Q5JGF3B3mkPM=
MIME-Version: 1.0
Received: by 10.52.94.194 with SMTP id de2mr2070547vdb.1.1298569409237; Thu, 24 Feb 2011 09:43:29 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:43:29 -0800 (PST)
In-Reply-To: <AANLkTikgLVGvj6MykQp2cHB4x_vmBi=-YMrkwke9zwUU@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com> <20110224171433.GM17386@1wt.eu> <AANLkTi=SOF8mR5GekO3zee2gZK5LEpJDuSfKPe7R+ser@mail.gmail.com> <AANLkTikgLVGvj6MykQp2cHB4x_vmBi=-YMrkwke9zwUU@mail.gmail.com>
Date: Thu, 24 Feb 2011 19:43:29 +0200
Message-ID: <AANLkTik4LcQrQZbWBhKLyawXvqe-=nHaK7aPS8vMpHaC@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:45:48 -0000

>> For example, I work in SIP world, I code SIP servers and I spent long
>> time every day debugging SIP protocol *in the server*, so I've no
>> control over the clients (common SIP phones). Same concept applies for
>> WS application developers.
>
> Then presumably you are using something like Wireshark, and writing a
> protocol dissector for WebSockets will be trivial.

There are other tools except WireShark.
For example, tcpdump, netcat/telnet combined with shell scripts, using grep etc.

--
 silvio

From dave@cridland.net  Thu Feb 24 09:46:41 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C769E3A6817 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:46:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zw9sUK2oeJBj for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:46:40 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id 5924B3A67EE for <hybi@ietf.org>; Thu, 24 Feb 2011 09:46:40 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 941231168090; Thu, 24 Feb 2011 17:47:27 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1dDiXfNtp6E; Thu, 24 Feb 2011 17:47:24 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id 701F61168064; Thu, 24 Feb 2011 17:47:24 +0000 (GMT)
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com> <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com> <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com>
In-Reply-To: <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <15283.1298569644.472078@puncture>
Date: Thu, 24 Feb 2011 17:47:24 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, Server-Initiated HTTP <hybi@ietf.org>, John Tamplin <jat@google.com>
Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed"
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:46:41 -0000

On Thu Feb 24 17:41:43 2011, Silvio Ventres wrote:
> Make each separate WS-sourced packet have a header that makes it  
> look like
> a completely new POST request (not a chunk). Then the proxies will  
> not find any
> malicious headers at the start of the packet, indeed they would  
> assume
> it's binary
> data and leave it be.

You are now describing BOSH.

http://xmpp.org/extensions/xep-0124.html

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From silvio.ventres@gmail.com  Thu Feb 24 09:49:41 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D23B63A6835 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:49:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.829
X-Spam-Level: 
X-Spam-Status: No, score=-2.829 tagged_above=-999 required=5 tests=[AWL=-0.230, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zOQOz9yppveW for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:49:41 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id E98D63A6833 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:49:40 -0800 (PST)
Received: by vxg33 with SMTP id 33so658743vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:50:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=mQjKoVN9fQSFzDlg6W334HWP4Btq2NdOOixqbNbG6VA=; b=HrGBVw5kRyfdSmi+lDPfrF2CQVcXvXyhXkSD8ZsLYGEHcCAHvD2zP5X4CGYs+k2vmz hXJ6kdgCJGT6JiJrzhQK8H7/ulFRTlyWyXlbX7iJ0zw8jETyWyqM4puilgko837cwdyW KOXkUh3MPpAVlqyJgoPCvRTqG9PH00VOkwGxg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=eSRLrDX7CeycB7mcOEGjC6mB34pCRsxH0Ktx6vByqb9J3MWm2dsd/4WwsfggIqbDZQ CM1y0VwxWuj6b9laydnGJ8uH9BZvvbYalpmVVo99X+CaWqukHEmdM89VF1Xk+dXFGOS/ b5Lc70tLQfG2ETQ0RJHeg0qIR5Cs/Ohoyj7SQ=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr1982594vdb.281.1298569745962; Thu, 24 Feb 2011 09:49:05 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:49:05 -0800 (PST)
In-Reply-To: <4D6697C4.8090504@caucho.com>
References: <AANLkTimvJMVrGCc54vbTyya9VwiU=-B+8Z0ZdFqd_34P@mail.gmail.com> <AANLkTi=1fRGUvM3btKUEbuSpDYCrJMicLD5ab6udrZ8D@mail.gmail.com> <4D6669C8.70603@warmcat.com> <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTi=b=YJDHTvwZX1GboWpd+TLKXVHz=WUk2RkX+_=@mail.gmail.com> <4D6697C4.8090504@caucho.com>
Date: Thu, 24 Feb 2011 19:49:05 +0200
Message-ID: <AANLkTi=mxdzzngw2Dr9ukOXiZgfzWDLgJdkW0dmchSZV@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Scott Ferguson <ferg@caucho.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:49:41 -0000

> So consider the masking a hijacking-cost of allowing the client to execute
> arbitrary and possibly hostile code.

The WS protocol doesn't exist in vacuum.
HTTP protocol has similar deficiencies.
Thus, when specifying WS protocol, the authors have to understand that there is
no point in making WS protocol prevent features that are _already_
available in HTTP.
Indeed, if the usage of POST method will bring WS to the same playing
field as HTTP POST,
you don't need to go any further. HTTP is more prevalent than WS, and
thus, any attacker
would choose HTTP over WS to execute the attack. There is absolutely
_no_ point in
adding features that will prevent attacks that will first happen in HTTP anyway.

To reiterate: if HTTP allows a specific unmitigated attack vector,
there's no point in preventing it in WS.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 09:53:19 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 247EB3A677E for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:53:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.823
X-Spam-Level: 
X-Spam-Status: No, score=-2.823 tagged_above=-999 required=5 tests=[AWL=-0.224, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uzjz3MlvCyM7 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:53:17 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 2B4DA3A6784 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:53:17 -0800 (PST)
Received: by vxg33 with SMTP id 33so662247vxg.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:54:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=46euNfmgqmzHEiJORzfcE+dpIAAvbVETIg4oUi8gzfU=; b=Wc/8HruAy9suFC95q1V4rLF0XhaYEoRiUKWr61P42UCre7EWl4K7zCU3PA73/kf9kw Sg9EKoogOcO0dJEGLp1p0JYnwtbzV1s6Knbdp13SlmiBA1OmIgL84wkfotv1b1uVAmoz BLLrMf/Oor9WbSwXv6qxBKSYJudbnOEf8Jz+o=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=eOw+IRnP+EfvGKUanLoSL4LWGN8EyR2lU6mpqRvT9aDUQoffyottkrm8Pm7Yw75uIt NrHfnRqSu3VpqyqWt7cgJwup3lO8uw8DBlUtzN2go+gycC66bfhrysQCOkUDm7F4FS7W pqgEwcrrIqivzoQSwSnKBeK/NIfIvWBHWFb7U=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr1990561vdb.281.1298569955026; Thu, 24 Feb 2011 09:52:35 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:52:34 -0800 (PST)
Date: Thu, 24 Feb 2011 19:52:34 +0200
Message-ID: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:53:19 -0000

Hello, Ian.

You noted handshake includes the computation step to "prove that
server actually parsed the header".

Counter-argument: author that doesn't _want_ to parse the header will
find a way to _not_ parse the header,
for example, by using an external tool/library to complete the handshake.

Please let know if there are any other reasons for the computation in
the handshake.
If there are none, please remove the feature, as it serves no actual
purpose and impacts
the complexity of the protocol.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 09:56:01 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 25C643A67F8 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:56:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.317
X-Spam-Level: 
X-Spam-Status: No, score=-3.317 tagged_above=-999 required=5 tests=[AWL=0.282,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NN-4qzZQXIiu for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:56:00 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 323BD3A6784 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:56:00 -0800 (PST)
Received: by vws6 with SMTP id 6so740453vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:56:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=AW/SE9VqA6N+3iqaXbApcz68dWeznQcm4HNF3b0qPX4=; b=yCiSfh8vO/vis1IOxW0tfOCwk81ZDW9sZOrCR0we965wS2eX6CZvrwcGMC/DvSZegu M8ZnVj8ih9udaCqUIau8xwXmt8nP8odx0uVdi2V9r4baqwKOwsnZ2l8KTIDu8uG2n+3+ UgptzoGAuSlT89sqe29VdcN0izv6IojGAOHR4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=U8G2AJb4XwV0ICOHRiFSPDELHfgnT2qMEajmSPTu5MpdQZiKlTBBx3sJo01NzXMDGR cN9id1Hqx+8nbAnyir8Jo4VNtr4+kdymtfQj9Fxi82VnrcHj2voZPL9WzuUwodiU825x T2qk84+bwOLR/T+UX8bKmIpqgP9siT0h5XZw8=
MIME-Version: 1.0
Received: by 10.52.158.66 with SMTP id ws2mr1996644vdb.281.1298570120709; Thu, 24 Feb 2011 09:55:20 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 09:55:20 -0800 (PST)
In-Reply-To: <15283.1298569644.472078@puncture>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com> <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com> <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com> <15283.1298569644.472078@puncture>
Date: Thu, 24 Feb 2011 19:55:20 +0200
Message-ID: <AANLkTimdLrAHVYqdO86F-omNi5+yqeuYrBzMSTJe0Fht@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:56:01 -0000

>> Make each separate WS-sourced packet have a header that makes it look like
>> a completely new POST request (not a chunk). Then the proxies will not
>> find any
>> malicious headers at the start of the packet, indeed they would assume
>> it's binary
>> data and leave it be.
>
> You are now describing BOSH.

No, the connection is still bidirectional and doesn't need multiple streams.
Basically, the same WS protocol, but adding the fake POST headers at
beginning each packet to prevent proxy confusion

--
 silvio

From ifette@google.com  Thu Feb 24 09:57:17 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA3A83A67A1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:57:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.713
X-Spam-Level: 
X-Spam-Status: No, score=-105.713 tagged_above=-999 required=5 tests=[AWL=-0.037, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y3BZdjU24uZa for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 09:57:16 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id B57E73A6784 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:57:16 -0800 (PST)
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13]) by smtp-out.google.com with ESMTP id p1OHw6Ng012934 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:58:06 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298570286; bh=5z5mHkXX6ILled31YGR4f9MqnM0=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=E1P9/DQ7NwbP2ZcO8vVO9ToR3dyWdleHgU8DaOsy7M1zqBAvmrQwp0G5+3xywKNHt jlK4+iDS/iAl3Q0mpZ/uA==
Received: from iwn9 (iwn9.prod.google.com [10.241.68.73]) by hpaq13.eem.corp.google.com with ESMTP id p1OHw3hF031529 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 09:58:04 -0800
Received: by iwn9 with SMTP id 9so539322iwn.37 for <hybi@ietf.org>; Thu, 24 Feb 2011 09:58:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=foe56y4p8FHQhvH4J9o1jpPF/ETt8s3ArNFWZGn1O0E=; b=cVDsHIukLu3OyRMxxl9RqXokR+7m8/RRIJniaB34R3mVKkD3IZFJxJhDSt+yMmh2mt dM5MXSCfoTaCzZVBDMCg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=KpzadIAdXeSBLBxu3rI55N4ByJVAMZiXg2svK18SllzgtAVzZJz52/XQRgGApP25nA +18TkIklKJEVXXvGNrmg==
MIME-Version: 1.0
Received: by 10.231.17.193 with SMTP id t1mr1840873iba.89.1298570283334; Thu, 24 Feb 2011 09:58:03 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Thu, 24 Feb 2011 09:58:03 -0800 (PST)
In-Reply-To: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com>
Date: Thu, 24 Feb 2011 09:58:03 -0800
Message-ID: <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=002215046cbb743ce3049d0af440
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 17:57:18 -0000

--002215046cbb743ce3049d0af440
Content-Type: text/plain; charset=UTF-8

An external tool/library to parse the WS handshake indicates that the
handshake was actually parsed by something that has an understanding of
websockets, and not just some non-WS endpoint that was tricked into replying
to a WS handshake, so this does not seem like a problem and seems like it
would be in-line with the goals.

-Ian

On Thu, Feb 24, 2011 at 9:52 AM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> Hello, Ian.
>
> You noted handshake includes the computation step to "prove that
> server actually parsed the header".
>
> Counter-argument: author that doesn't _want_ to parse the header will
> find a way to _not_ parse the header,
> for example, by using an external tool/library to complete the handshake.
>
> Please let know if there are any other reasons for the computation in
> the handshake.
> If there are none, please remove the feature, as it serves no actual
> purpose and impacts
> the complexity of the protocol.
>
> --
>  silvio
>

--002215046cbb743ce3049d0af440
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

An external tool/library to parse the WS handshake indicates that the hands=
hake was actually parsed by something that has an understanding of websocke=
ts, and not just some non-WS endpoint that was tricked into replying to a W=
S handshake, so this does not seem like a problem and seems like it would b=
e in-line with the goals.<div>
<br></div><div>-Ian<br><br><div class=3D"gmail_quote">On Thu, Feb 24, 2011 =
at 9:52 AM, Silvio Ventres <span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.v=
entres@gmail.com">silvio.ventres@gmail.com</a>&gt;</span> wrote:<br><blockq=
uote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc =
solid;padding-left:1ex;">
Hello, Ian.<br>
<br>
You noted handshake includes the computation step to &quot;prove that<br>
server actually parsed the header&quot;.<br>
<br>
Counter-argument: author that doesn&#39;t _want_ to parse the header will<b=
r>
find a way to _not_ parse the header,<br>
for example, by using an external tool/library to complete the handshake.<b=
r>
<br>
Please let know if there are any other reasons for the computation in<br>
the handshake.<br>
If there are none, please remove the feature, as it serves no actual<br>
purpose and impacts<br>
the complexity of the protocol.<br>
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font></blockquote></div><br></div>

--002215046cbb743ce3049d0af440--

From ifette@google.com  Thu Feb 24 10:00:11 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C244D3A67A1 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:00:11 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.426
X-Spam-Level: 
X-Spam-Status: No, score=-105.426 tagged_above=-999 required=5 tests=[AWL=0.250, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x-6R4QlCvLrg for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:00:10 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 7A2423A6784 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:00:10 -0800 (PST)
Received: from kpbe20.cbf.corp.google.com (kpbe20.cbf.corp.google.com [172.25.105.84]) by smtp-out.google.com with ESMTP id p1OI0xGa026279 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:00:59 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298570460; bh=RAQ+05wJDlC2PMGGYr9ecvbi3xc=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=x2i9oFTAsYh1lHRRMBpA+gu/iI1L854sQaPDfcybaXxpvViW2ZyKPoFBsUqQWPnFh OSq+XsYnfJ0Hr4b3v3AIw==
Received: from iyf40 (iyf40.prod.google.com [10.241.50.104]) by kpbe20.cbf.corp.google.com with ESMTP id p1OHxsgK007140 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 10:00:57 -0800
Received: by iyf40 with SMTP id 40so544993iyf.16 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:00:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=FZFyKPC/wDvt+9fImkaAIryWUEIrMWBLh8hc/DR172k=; b=bfhwHM+E0Xz1INf0y+IY6NWGBmmYbz9eeRCv1kCgIEVznlNf8Y/PX4Tqhso3RvTqvQ zoIDckQam94w+4Sdbz/Q==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=vKLyHZBA2zS0yoJAu6TrNCq42shKNm3Om2ET+53cGHtFp7GXhXCFOxdWHjjBJraMF5 rc9zsq933/wGhmgSWX/g==
MIME-Version: 1.0
Received: by 10.231.35.136 with SMTP id p8mr1823882ibd.139.1298570454794; Thu, 24 Feb 2011 10:00:54 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Thu, 24 Feb 2011 10:00:54 -0800 (PST)
In-Reply-To: <AANLkTimdLrAHVYqdO86F-omNi5+yqeuYrBzMSTJe0Fht@mail.gmail.com>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com> <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com> <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com> <15283.1298569644.472078@puncture> <AANLkTimdLrAHVYqdO86F-omNi5+yqeuYrBzMSTJe0Fht@mail.gmail.com>
Date: Thu, 24 Feb 2011 10:00:54 -0800
Message-ID: <AANLkTinNhnN=nsTFp9LyxypbipFfOFepMjAUv3mb06Y4@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=00032557a35eac845d049d0afe1f
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 18:00:11 -0000

--00032557a35eac845d049d0afe1f
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 9:55 AM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> >> Make each separate WS-sourced packet have a header that makes it look
> like
> >> a completely new POST request (not a chunk). Then the proxies will not
> >> find any
> >> malicious headers at the start of the packet, indeed they would assume
> >> it's binary
> >> data and leave it be.
> >
> > You are now describing BOSH.
>
> No, the connection is still bidirectional and doesn't need multiple
> streams.
> Basically, the same WS protocol, but adding the fake POST headers at
> beginning each packet to prevent proxy confusion
>
>
Do recall that WS is not request/response, i.e. a server can send data to a
client not in request to a specific response. That would imply that a client
has a hanging GET waiting for the data, or that there's some other magic
happening to let you do this with a single channel.

Taking a step back, what exactly are you trying to achieve? Your posts thus
far are not adding to anything the WG is going, your proposals wouldn't
really make any material difference in terms of capabilities / efficiency,
and instead appear ill-informed and argumentative, leading to centithreads
that go nowhere and people wasting their time just at the point that the WG
was once again making progress.


> --
>  silvio
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--00032557a35eac845d049d0afe1f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 9:55 AM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">&gt;&gt; Make each separate WS-sourced packet have a head=
er that makes it look like<br>
&gt;&gt; a completely new POST request (not a chunk). Then the proxies will=
 not<br>
&gt;&gt; find any<br>
&gt;&gt; malicious headers at the start of the packet, indeed they would as=
sume<br>
&gt;&gt; it&#39;s binary<br>
&gt;&gt; data and leave it be.<br>
&gt;<br>
&gt; You are now describing BOSH.<br>
<br>
</div>No, the connection is still bidirectional and doesn&#39;t need multip=
le streams.<br>
Basically, the same WS protocol, but adding the fake POST headers at<br>
beginning each packet to prevent proxy confusion<br>
<br></blockquote><div><br></div><div>Do recall that WS is not request/respo=
nse, i.e. a server can send data to a client not in request to a specific r=
esponse. That would imply that a client has a hanging GET waiting for the d=
ata, or that there&#39;s some other magic happening to let you do this with=
 a single channel.</div>
<div><br></div><div>Taking a step back, what exactly are you trying to achi=
eve? Your posts thus far are not adding to anything the WG is going, your p=
roposals wouldn&#39;t really make any material difference in terms of capab=
ilities / efficiency, and instead appear ill-informed and argumentative, le=
ading to centithreads that go nowhere and people wasting their time just at=
 the point that the WG was once again making progress.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font><div><div></div><div class=3D"h5">__________________________________=
_____________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--00032557a35eac845d049d0afe1f--

From silvio.ventres@gmail.com  Thu Feb 24 10:07:22 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 27BC63A6835 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:07:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.324
X-Spam-Level: 
X-Spam-Status: No, score=-3.324 tagged_above=-999 required=5 tests=[AWL=0.275,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8M8O9opDIB-A for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:07:21 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 3BD6E3A67A1 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:07:21 -0800 (PST)
Received: by vws6 with SMTP id 6so751427vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:08:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=B+cEvD9SUdbCbQI3+x18QWJLt4F0qryAqdj6bNe+vJI=; b=vvqhrnbSajLlJbg2j1788yQxLl9iCHmrVnIpxcy9LGKv8aTpzXLciewGgcSbQ/war1 JXia0XALAK+9eMnnyH7XpBhmiTqrRD9PpLNaRVUeeiP1nUUfsU1OkINIyHcRQQrbpNps SFHXVoy0IhK515GYz9hdw72Yu1d0sUcLNB3A0=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=xFD16+f+aWPe6DTo/XyhfeJ7VxEjRYhvEsD8LFQwXoXn0faCQ4kD6N5WF9Z69zWl0V +0NgpKtdSdVbCpmA8nDFRAnE8qMI87vAkimdPU37JfWXeuYZrLz882C2noJrJK35cIdb wrPrCxSnu4DfpnHZzwbalWfNAN4q/WU2FGnys=
MIME-Version: 1.0
Received: by 10.52.94.194 with SMTP id de2mr2120607vdb.1.1298570726049; Thu, 24 Feb 2011 10:05:26 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 10:05:26 -0800 (PST)
In-Reply-To: <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com>
Date: Thu, 24 Feb 2011 20:05:26 +0200
Message-ID: <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 18:07:22 -0000

> An external tool/library to parse the WS handshake indicates that the
> handshake was actually parsed by something that has an understanding of
> websockets, and not just some non-WS endpoint that was tricked into replying
> to a WS handshake, so this does not seem like a problem and seems like it
> would be in-line with the goals.

How do you see a non-WS endpoint can be tricked into replying to a
magic string and
echo based handshake ?

Do you expect a non-WS endpoint to be able to answer the WS request
with a WS-specific MAGIC STRING,
such as: "101 WebSocket-MagicString" and an echo of the relevant field ?

The computation part of the handshake could be reasoned to prevent
implementation
of buggy endpoints that want to seem WS-compliant but aren't, but it
seems you don't
insist on that reason.

--
 silvio

From silvio.ventres@gmail.com  Thu Feb 24 10:14:05 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E7EC3A6848 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:14:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.711
X-Spam-Level: 
X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[AWL=-0.352, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, SARE_LWSHORTT=1.24]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JTiFN9La3BUt for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:14:04 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 7DE933A6784 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:14:03 -0800 (PST)
Received: by vws6 with SMTP id 6so757604vws.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:14:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=eM1dd/g4RxS/+RFaNCiS4OgAeuEAqQyfyKgnDqPfhrk=; b=O5BvoFagIBORvfr9Z588TIrnb5xjlsRADxKZn64FmOz+pJlLLW6EjT6jx8UW193i0V O1DVsPDzlwIqDKNSVTNH2BdNNvzGSRYFwyot3pPwYmA5RDcqDlNy3fzFyDTIbTGYHMkL AfZ1g5HnidcOigVrxHzaYthq+eITsiUp3hoB4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Uv6e+8yuTmjol3OyVf+hOhvplM3/+TBvA5eYFWh6BpsnOrYmWsE/y+MQ/JmiPvxfdA D/RM2E4ZuqSUWQiKDuyCWYFbnZdnAR8poy+opI0jdTpQ/bId7b8IYvW3MrEA7b7rzD11 CqRmNeY1xHKrGZS33KMuIcx2aVfxdiiDIJsJo=
MIME-Version: 1.0
Received: by 10.52.158.231 with SMTP id wx7mr2214106vdb.41.1298571231096; Thu, 24 Feb 2011 10:13:51 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Thu, 24 Feb 2011 10:13:51 -0800 (PST)
In-Reply-To: <AANLkTinNhnN=nsTFp9LyxypbipFfOFepMjAUv3mb06Y4@mail.gmail.com>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com> <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com> <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com> <15283.1298569644.472078@puncture> <AANLkTimdLrAHVYqdO86F-omNi5+yqeuYrBzMSTJe0Fht@mail.gmail.com> <AANLkTinNhnN=nsTFp9LyxypbipFfOFepMjAUv3mb06Y4@mail.gmail.com>
Date: Thu, 24 Feb 2011 20:13:51 +0200
Message-ID: <AANLkTik2tGdgXWJoOd6g=M0PMGU2LUknrfQv9qo3MhPo@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 18:14:05 -0000

> Do recall that WS is not request/response, i.e. a server can send data to a
> client not in request to a specific response. That would imply that a client
> has a hanging GET waiting for the data, or that there's some other magic
> happening to let you do this with a single channel.

Does WS as currently specified use a "hanging GET" to pass through proxies?
Then how is that different for a web developer than XHR ?

The proposal was to add fake POST headers to each packet sent,
such that proxies do not confuse themselves. If the channel
cannot be kept open for bidirectional messages, then why use WS
compared to XHR ?

Ian, can you please let know if you think the problem with proxy
confusion actually exists?
And the scenario which, theoretically, can trigger the confusion ?


> Taking a step back, what exactly are you trying to achieve? Your posts thus
> far are not adding to anything the WG is going, your proposals wouldn't
> really make any material difference in terms of capabilities / efficiency,
> and instead appear ill-informed and argumentative, leading to centithreads
> that go nowhere and people wasting their time just at the point that the WG
> was once again making progress.

The fact that the posts, having got lots of "read the archives"
replies, ignited a discussion
about the general spec-drafting procedures is the consequence of the
people that wrote
massive amounts of messages with nothing but "read the archives"
answers in them.
If you remove those, rest of discussion taking place is quite constructive, and,
hopefully, will bring benefit to the spec in both long and short term

--
 silvio

From derhoermi@gmx.net  Thu Feb 24 10:32:52 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BC9EF3A67A6 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:32:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.309
X-Spam-Level: 
X-Spam-Status: No, score=-3.309 tagged_above=-999 required=5 tests=[AWL=-0.710, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ufwNz2o3-fDh for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:32:51 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 1BFEA3A67F5 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:32:50 -0800 (PST)
Received: (qmail invoked by alias); 24 Feb 2011 18:33:39 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp024) with SMTP; 24 Feb 2011 19:33:39 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX19dSWsyfqxdlU43HeJc1djD6YHuveU0rqQd6v4LRw V6A8/H2TG/k8Fi
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Thu, 24 Feb 2011 19:33:40 +0100
Message-ID: <1v6dm61bkqsc47hos27e0orobbl4t2r53b@hive.bjoern.hoehrmann.de>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com>
In-Reply-To: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 18:32:52 -0000

* Silvio Ventres wrote:
>You noted handshake includes the computation step to "prove that
>server actually parsed the header".
>
>Counter-argument: author that doesn't _want_ to parse the header will
>find a way to _not_ parse the header,
>for example, by using an external tool/library to complete the handshake.

The goal is that if a Websocket client attempts to connect to a server
that is not a Websocket server, then the handshake fails. That requires
that the server does something that is unique to the Websocket protocol,
something that an attacker cannot make a non-Websocket server do.

We know that you can make servers echo data that is sent to it, so the
server is required to transform the data in a manner that is unique to
the Websocket protocol. That way the server would only generate a right
response by random chance.

It is likely that there is actually no way to make deployed servers get
other aspects of the handshake right, like sending the right status code
and the right Upgrade header, but the unique process is cheap, so it's
used instead of contemplating how robust the protocol is without it.

If this is not clear from the current draft, suggestions how and where
to explain this better are most welcome.

Thanks for raising this issue in a separate thread.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From jmason@rim.com  Thu Feb 24 10:37:48 2011
Return-Path: <jmason@rim.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A9DFD3A67D2 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:37:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.037
X-Spam-Level: 
X-Spam-Status: No, score=0.037 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, SARE_LWSHORTT=1.24]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uufGwcsd6gqc for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:37:48 -0800 (PST)
Received: from mhs060cnc.rim.net (mhs060cnc.rim.net [208.65.73.34]) by core3.amsl.com (Postfix) with ESMTP id D31163A67C3 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:37:47 -0800 (PST)
X-AuditID: 0a41282f-b7b1fae0000058ad-24-4d66a5ad4015
Received: from XHT109CNC.rim.net (xht109cnc.rim.net [10.65.12.218]) (using TLS with cipher AES128-SHA (AES128-SHA/128 bits)) (Client did not present a certificate) by mhs060cnc.rim.net (SBG) with SMTP id F1.B3.22701.DA5A66D4; Thu, 24 Feb 2011 18:38:37 +0000 (GMT)
Received: from XCH117CNC.rim.net ([fe80::b8df:541f:9d85:9909]) by XHT109CNC.rim.net ([fe80::8412:4d9e:eb55:2c7b%11]) with mapi; Thu, 24 Feb 2011 13:38:37 -0500
From: Joe Mason <jmason@rim.com>
To: Silvio Ventres <silvio.ventres@gmail.com>, "ifette@google.com" <ifette@google.com>
Date: Thu, 24 Feb 2011 13:38:51 -0500
Thread-Topic: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
Thread-Index: AcvUTr7ciRz8AfQtR5KpIEmqX4qc2QAAwl2A
Message-ID: <BB31C4AB95A70042A256109D4619912606369ECF@XCH117CNC.rim.net>
References: <AANLkTi=458gAS8iZkPQObFUiFHe324tSm+kxQVe-6WmJ@mail.gmail.com> <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <AANLkTiko4+9C1qL5TqXuACiLX6aRx09WWKFj+i2D8Y2Q@mail.gmail.com> <20110224170303.GL17386@1wt.eu> <AANLkTimTLC1864OS0nhATm6oc=pD8ty-Acso6e8Hyb0_@mail.gmail.com> <AANLkTinKpyFB338WP11B_cmMu+0VQvzpdu_S_Ai4xA0T@mail.gmail.com> <AANLkTinYwABiXGZKSAC66x9Ph5BiAyWfYwzLq4wMyb8F@mail.gmail.com> <15283.1298569644.472078@puncture> <AANLkTimdLrAHVYqdO86F-omNi5+yqeuYrBzMSTJe0Fht@mail.gmail.com> <AANLkTinNhnN=nsTFp9LyxypbipFfOFepMjAUv3mb06Y4@mail.gmail.com> <AANLkTik2tGdgXWJoOd6g=M0PMGU2LUknrfQv9qo3MhPo@mail.gmail.com>
In-Reply-To: <AANLkTik2tGdgXWJoOd6g=M0PMGU2LUknrfQv9qo3MhPo@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
content-transfer-encoding: quoted-printable
MIME-Version: 1.0
X-Brightmail-Tracker: AAAAAQAAAZE=
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 18:37:48 -0000

> -----Original Message-----
> From: hybi-bounces@ietf.org [mailto:hybi-bounces@ietf.org] On Behalf Of
> Silvio Ventres
> 
> The fact that the posts, having got lots of "read the archives"
> replies, ignited a discussion
> about the general spec-drafting procedures is the consequence of the
> people that wrote
> massive amounts of messages with nothing but "read the archives"
> answers in them.
> If you remove those, rest of discussion taking place is quite
> constructive, and,
> hopefully, will bring benefit to the spec in both long and short term

No, it really isn't.  It may appear constructive from your point of view bec=
ause you're getting your questions answered, but the rest of the group is ju=
st wasting their time repeating what's already been said.

Joe

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential infor=
mation, privileged material (including material protected by the solicitor-c=
lient or other applicable privileges), or constitute non-public information.=
 Any use of this information by anyone other than the intended recipient is=
 prohibited. If you have received this transmission in error, please immedia=
tely reply to the sender and delete this information from your system. Use,=
 dissemination, distribution, or reproduction of this transmission by uninte=
nded recipients is not authorized and may be unlawful.

From ifette@google.com  Thu Feb 24 10:44:29 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B260B3A67E2 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:44:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.462
X-Spam-Level: 
X-Spam-Status: No, score=-105.462 tagged_above=-999 required=5 tests=[AWL=0.214, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qs4hD1BDU3Ks for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 10:44:28 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 684983A67D8 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:44:28 -0800 (PST)
Received: from hpaq12.eem.corp.google.com (hpaq12.eem.corp.google.com [172.25.149.12]) by smtp-out.google.com with ESMTP id p1OIjFcA000762 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:45:15 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298573117; bh=qO3ZOgPfJxRUQBKyCH8QI2EOKw4=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=K+fJKFyHWdQSqvl+iHUu104hAYXdL3N+HLfxjbA3hbOOc3sbu0mSHrORTiok3Fauv durUqNKpA+o3VOsBwAXww==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by hpaq12.eem.corp.google.com with ESMTP id p1OIjDBr012260 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 10:45:14 -0800
Received: by iwl42 with SMTP id 42so596452iwl.0 for <hybi@ietf.org>; Thu, 24 Feb 2011 10:45:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=0TZ9FoYomJhpngNyVVGZn/1fmqzdAkSwi4zxXUGW1TU=; b=F1brksLSzZYwKowCxVk48Cw/VSP/r82REqMXWxc/LXSqprSOikdF84cNq6vD/AQyae NA3+KEQ1lizeYhH2/26w==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=KtDWBAyesZ2PEdQ/UfDJ+25KWZqHihW28QShWii+5AC4l9gGulmb17hZbOJ3WhYNq9 q1KwbXt57Pdfm5G7ujTQ==
MIME-Version: 1.0
Received: by 10.231.14.136 with SMTP id g8mr1903570iba.114.1298573112980; Thu, 24 Feb 2011 10:45:12 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Thu, 24 Feb 2011 10:45:12 -0800 (PST)
In-Reply-To: <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com>
Date: Thu, 24 Feb 2011 10:45:12 -0800
Message-ID: <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=0003255745be1d3ac4049d0b9d95
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 18:44:29 -0000

--0003255745be1d3ac4049d0b9d95
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 24, 2011 at 10:05 AM, Silvio Ventres
<silvio.ventres@gmail.com>wrote:

> > An external tool/library to parse the WS handshake indicates that the
> > handshake was actually parsed by something that has an understanding of
> > websockets, and not just some non-WS endpoint that was tricked into
> replying
> > to a WS handshake, so this does not seem like a problem and seems like it
> > would be in-line with the goals.
>
> How do you see a non-WS endpoint can be tricked into replying to a
> magic string and
> echo based handshake ?
>
> Do you expect a non-WS endpoint to be able to answer the WS request
> with a WS-specific MAGIC STRING,

such as: "101 WebSocket-MagicString" and an echo of the relevant field ?
>
>
One of the assumptions made as part of the security model is that there are
non-WS endpoints that you can get to echo things. As such, if you (attacker
JS) send that "magic string" as part of your attack, you could potentially
get the attacked-server to echo that. By having the browser send something
outside of JavaScript control, and having the server perform computation on
that something, we have more robustness.

Also, it's cheap and easy to reason about, and prevents a larger class of
attacks than you are focused on.

I really don't see much point in reopening this discussion. This is not
adding anything.


> The computation part of the handshake could be reasoned to prevent
> implementation
> of buggy endpoints that want to seem WS-compliant but aren't, but it
> seems you don't
> insist on that reason.
>
> --
>  silvio
>

--0003255745be1d3ac4049d0b9d95
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Thu, Feb 24, 2011 at 10:05 AM, Silvio Ventres=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.v=
entres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">&gt; An external tool/library to parse the WS handshake i=
ndicates that the<br>
&gt; handshake was actually parsed by something that has an understanding o=
f<br>
&gt; websockets, and not just some non-WS endpoint that was tricked into re=
plying<br>
&gt; to a WS handshake, so this does not seem like a problem and seems like=
 it<br>
&gt; would be in-line with the goals.<br>
<br>
</div>How do you see a non-WS endpoint can be tricked into replying to a<br=
>
magic string and<br>
echo based handshake ?<br>
<br>
Do you expect a non-WS endpoint to be able to answer the WS request<br>
with a WS-specific MAGIC STRING,=C2=A0</blockquote><blockquote class=3D"gma=
il_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-lef=
t:1ex;">such as: &quot;101 WebSocket-MagicString&quot; and an echo of the r=
elevant field ?<br>

<br></blockquote><div><br></div><div>One of the assumptions made as part of=
 the security model is that there are non-WS endpoints that you can get to =
echo things. As such, if you (attacker JS) send that &quot;magic string&quo=
t; as part of your attack, you could potentially get the attacked-server to=
 echo that. By having the browser send something outside of JavaScript cont=
rol, and having the server perform computation on that something, we have m=
ore robustness.</div>
<div><br></div><div>Also, it&#39;s cheap and easy to reason about, and prev=
ents a larger class of attacks than you are focused on.</div><div><br></div=
><div>I really don&#39;t see much point in reopening this discussion. This =
is not adding anything.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
The computation part of the handshake could be reasoned to prevent<br>
implementation<br>
of buggy endpoints that want to seem WS-compliant but aren&#39;t, but it<br=
>
seems you don&#39;t<br>
insist on that reason.<br>
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font></blockquote></div><br>

--0003255745be1d3ac4049d0b9d95--

From w@1wt.eu  Thu Feb 24 12:55:22 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 173A43A683F for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 12:55:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.797
X-Spam-Level: 
X-Spam-Status: No, score=-1.797 tagged_above=-999 required=5 tests=[AWL=-0.054, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I6MakYC8vWvb for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 12:55:21 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id EDC063A6807 for <hybi@ietf.org>; Thu, 24 Feb 2011 12:55:20 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OKu190021044; Thu, 24 Feb 2011 21:56:01 +0100
Date: Thu, 24 Feb 2011 21:56:01 +0100
From: Willy Tarreau <w@1wt.eu>
To: =?iso-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
Message-ID: <20110224205601.GB20927@1wt.eu>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 20:55:22 -0000

On Thu, Feb 24, 2011 at 06:21:05PM +0100, Iñaki Baz Castillo wrote:
> 2011/2/24 Scott Ferguson <ferg@caucho.com>:
> > John Tamplin wrote:
> >>
> >> but given the lazy HTTP parsers we have all seen it seems entirely
> >> plausible that they would skip garbage and try and synchronize on what
> >> appears to be an HTTP header.
> 
> So imagine this wrong GET request:
> 
>   GET /index.html HTTP/1.1\r\n
>   Host: 1.2.3.4GET /lala.txt HTTP/1.1\r\n
>   Host: attack.domain\r\n\r\n
> 
> The first Host header has wrong content. Do you expect that HTTP
> parsers out there would discard garbage data until "1.2.3.4" and start
> parsing again from "GET /lala.txt"?
> 
> I strongly don't think so. I expect most of the HTTP servers would
> drop the whole received data after detecting the grammar failure, and
> many of them would also terminate the TCP connection.
> 
> If a HTTP server starts parsing from "GET /lala.txt" that is a bug and
> a vulnerability (probably).

Even simpler : the grammar is OK. You simply have a first Host header whose
content is "1.2.3.4GET /lala.txt HTTP/1.1" and a second one whose content
is "attack.domain". Both intermediaries and receiver are even free to fold
them in a single one by delimiting them with a coma :

   "1.2.3.4GET /lala.txt HTTP/1.1, attack.domain"

After that, the upper layers may decide whether this Host header is something
valid they want to process or not.

Regards,
Willy


From w@1wt.eu  Thu Feb 24 13:00:23 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D16353A6807 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 13:00:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.793
X-Spam-Level: 
X-Spam-Status: No, score=-1.793 tagged_above=-999 required=5 tests=[AWL=-0.050, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cTRzA8oiyKv3 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 13:00:23 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 98B273A6802 for <hybi@ietf.org>; Thu, 24 Feb 2011 13:00:22 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1OL140n021079; Thu, 24 Feb 2011 22:01:04 +0100
Date: Thu, 24 Feb 2011 22:01:04 +0100
From: Willy Tarreau <w@1wt.eu>
To: =?iso-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
Message-ID: <20110224210104.GC20927@1wt.eu>
References: <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=gq3FC8krk8djGTGzoW+JpMqf21BrwerdF976R@mail.gmail.com> <20110224165824.GK17386@1wt.eu> <AANLkTi=hnP8256TWjaWwVgU89sg9L2u+ZmJYtHFs+_HA@mail.gmail.com> <20110224171433.GM17386@1wt.eu> <AANLkTi=SOF8mR5GekO3zee2gZK5LEpJDuSfKPe7R+ser@mail.gmail.com> <AANLkTikgLVGvj6MykQp2cHB4x_vmBi=-YMrkwke9zwUU@mail.gmail.com> <AANLkTi=5wn2S5QFn=xJX9oGtSKHCh7p0OKC-FoPo53ff@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTi=5wn2S5QFn=xJX9oGtSKHCh7p0OKC-FoPo53ff@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 21:00:24 -0000

On Thu, Feb 24, 2011 at 06:37:06PM +0100, Iñaki Baz Castillo wrote:
> 2011/2/24 John Tamplin <jat@google.com>:
> >> For example, I work in SIP world, I code SIP servers and I spent long
> >> time every day debugging SIP protocol *in the server*, so I've no
> >> control over the clients (common SIP phones). Same concept applies for
> >> WS application developers.
> >
> > Then presumably you are using something like Wireshark, and writing a
> > protocol dissector for WebSockets will be trivial.
> 
> No. I use basic ngrep in most of the cases. Easy debugging in realime
> without having to open a generated file in my local computer, just run
> "ngrep --options" in the server and voila!.
> 
> SIP is plain text protocol like HTTP. And SIP has become the winning
> VoIP protocol since it uses plain text. Other VoIP protocols like H323
> are binary protocols and have mostly dissapeared. Take it into account
> please.

Iñaki, I really understand your point. We all would prefer to get plain
text if no risks were identified, many of us would feel more comfortable
with no masking at all, just as well as many of us don't feel comfortable
with so little masking. We have to satisfy everyone's fears.

If you have control over the server, you can easily insert a simple proxy
which will unmask and forward the frames with a zero mask. Ngrep will then
work on the forwarded stream. I agree it is more cumbersome than being able
to grep the live stream but I'm trying to help you find solutions with the
current design, and they don't look too hard.

Regards,
Willy


From bruce@callenish.com  Thu Feb 24 13:27:52 2011
Return-Path: <bruce@callenish.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3DE363A6832 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 13:27:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TTKBAo1mAOwE for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 13:27:51 -0800 (PST)
Received: from biz82.inmotionhosting.com (biz82.inmotionhosting.com [74.124.202.87]) by core3.amsl.com (Postfix) with ESMTP id 6BF5C3A6807 for <hybi@ietf.org>; Thu, 24 Feb 2011 13:27:51 -0800 (PST)
Received: from [24.108.133.142] (helo=[192.168.145.101]) by biz82.inmotionhosting.com with esmtpa (Exim 4.69) (envelope-from <bruce@callenish.com>) id 1Psijc-00079v-QT; Thu, 24 Feb 2011 13:28:28 -0800
Message-ID: <4D66CD88.2090106@callenish.com>
Date: Thu, 24 Feb 2011 13:28:40 -0800
From: Bruce Atherton <bruce@callenish.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Salvatore Loreto <salvatore.loreto@ericsson.com>
References: <4D6678C2.6000400@ericsson.com>
In-Reply-To: <4D6678C2.6000400@ericsson.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - biz82.inmotionhosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - callenish.com
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] how to better document FAQ and other stuff
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 21:27:52 -0000

I've added a section on how the decision for masking was achieved. 
Hopefully it will clarify some things being discussed. I've tried to 
represent the majority of opinions expressed during the debates several 
months ago, but if someone feels I've misrepresented a position or left 
out something important, please edit it to make it more representative 
of the history.

On 24/02/2011 7:26 AM, Salvatore Loreto wrote:
> (as co-chair)
>
> Hi there,
>
> after reading the last two days mails,
> I think that it would be good have a FAQ where newcomers can find some 
> information,
> to understand a little better the rational behind some choice and 
> other stuff,
> without be forced to go through all the HyBi mail archives... (more 
> the 6000mails)
> or put on the editor and wg main contributors shoulders the 
> responsibility to provide the information.
>
> I have created a wiki page, within the IETF website, where we can 
> start to collect info:
> http://trac.tools.ietf.org/wg/hybi/trac/wiki/FAQ
>
>
> in order to update the page you need to login,
> if you do not have a login/pw you can get one from here: 
> http://trac.tools.ietf.org/tools/loginmgr/newlogin
>
> anyone can contribute to build the FAQ.
> I have already received mails from people interested to contribute,
> so people interested/eager to contribute
> can start to contribute and just notify the HyBi ml when they do some 
> change.
>
>
> About the possibility to also document more information within a draft,
> I don't think draft-ietf-hybi-thewebsocketprotocol is the right 
> document for that;
> instead we can use the 
> http://tools.ietf.org/html/draft-ietf-hybi-design-space
> as I have been suggested by Stefano Salsano
>
>
> cheers
> /Sal
>
>


From ibc@aliax.net  Thu Feb 24 13:57:14 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B3E373A6808 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 13:57:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.651
X-Spam-Level: 
X-Spam-Status: No, score=-2.651 tagged_above=-999 required=5 tests=[AWL=0.026,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cbP0dB9OL4l4 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 13:57:14 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id AE6813A6807 for <hybi@ietf.org>; Thu, 24 Feb 2011 13:57:13 -0800 (PST)
Received: by qwh6 with SMTP id 6so901932qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 13:58:04 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.245.4 with SMTP id ls4mr1175166qcb.208.1298584683946; Thu, 24 Feb 2011 13:58:03 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 13:58:03 -0800 (PST)
In-Reply-To: <20110224205601.GB20927@1wt.eu>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu>
Date: Thu, 24 Feb 2011 22:58:03 +0100
Message-ID: <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 21:57:14 -0000

2011/2/24 Willy Tarreau <w@1wt.eu>:
> Even simpler : the grammar is OK. You simply have a first Host header who=
se
> content is "1.2.3.4GET /lala.txt HTTP/1.1" and a second one whose content
> is "attack.domain". Both intermediaries and receiver are even free to fol=
d
> them in a single one by delimiting them with a coma :
>
> =C2=A0 "1.2.3.4GET /lala.txt HTTP/1.1, attack.domain"
>
> After that, the upper layers may decide whether this Host header is somet=
hing
> valid they want to process or not.

It was just an example, however I expect that a HTTP intermediary is
clever enough to invalidate current request (as Host header is
obviously wrong). Or maybe they are bery lazy, ok.

Anyhow, no HTTP server/intermediary will ignore wrong bytes until it
gets something like GET/POST (IMHO).

Regards.


--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From ibc@aliax.net  Thu Feb 24 14:05:25 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CCA963A6812 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 14:05:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.652
X-Spam-Level: 
X-Spam-Status: No, score=-2.652 tagged_above=-999 required=5 tests=[AWL=0.025,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NVZXoOkN271H for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 14:05:25 -0800 (PST)
Received: from mail-qy0-f172.google.com (mail-qy0-f172.google.com [209.85.216.172]) by core3.amsl.com (Postfix) with ESMTP id E78F23A67F1 for <hybi@ietf.org>; Thu, 24 Feb 2011 14:05:24 -0800 (PST)
Received: by qyk29 with SMTP id 29so4237782qyk.10 for <hybi@ietf.org>; Thu, 24 Feb 2011 14:06:15 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr1209653qcb.170.1298585175263; Thu, 24 Feb 2011 14:06:15 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 14:06:15 -0800 (PST)
In-Reply-To: <4D66CD88.2090106@callenish.com>
References: <4D6678C2.6000400@ericsson.com> <4D66CD88.2090106@callenish.com>
Date: Thu, 24 Feb 2011 23:06:15 +0100
Message-ID: <AANLkTi=SFO8QTW-w6Wb6i2utK7Ln3-208C2TM_XWg_zQ@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Bruce Atherton <bruce@callenish.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] how to better document FAQ and other stuff
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 22:05:25 -0000

2011/2/24 Bruce Atherton <bruce@callenish.com>:
> I've added a section on how the decision for masking was achieved. Hopefu=
lly
> it will clarify some things being discussed. I've tried to represent the
> majority of opinions expressed during the debates several months ago, but=
 if
> someone feels I've misrepresented a position or left out something
> important, please edit it to make it more representative of the history.

I strongly appreciate it. I'm reading it right now and it's a really
BIG help to understand current point of the specification.

This is the way (rather than having to navigate through 2000 old
mails). Really thanks a lot for your effort.

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From mcmanus@ducksong.com  Thu Feb 24 14:32:12 2011
Return-Path: <mcmanus@ducksong.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 308053A6867 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 14:32:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.428
X-Spam-Level: 
X-Spam-Status: No, score=-2.428 tagged_above=-999 required=5 tests=[AWL=-0.129, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UmwBNCCj05Bh for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 14:32:08 -0800 (PST)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by core3.amsl.com (Postfix) with ESMTP id 021093A6808 for <hybi@ietf.org>; Thu, 24 Feb 2011 14:32:07 -0800 (PST)
Received: by linode.ducksong.com (Postfix, from userid 1000) id 677701043E; Thu, 24 Feb 2011 17:32:57 -0500 (EST)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 0077810157; Thu, 24 Feb 2011 17:32:53 -0500 (EST)
From: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
To: =?ISO-8859-1?Q?I=F1aki?= Baz Castillo <ibc@aliax.net>
In-Reply-To: <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Date: Thu, 24 Feb 2011 17:32:40 -0500
Message-ID: <1298586760.2498.603.camel@ds9.ducksong.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3 
Content-Transfer-Encoding: 8bit
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 22:32:12 -0000

On Thu, 2011-02-24 at 22:58 +0100, IÃ±aki Baz Castillo wrote:

> Anyhow, no HTTP server/intermediary will ignore wrong bytes until it
> gets something like GET/POST (IMHO).

consider this: 
http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpTransaction.cpp#683

it is a client doing response parsing, so it is analogous though not a
direct example. The mess of different bugwards compatible exceptions to
strict http framing rules seen there aren't present because we think it
is a good idea, nor are they there out of any form of laziness I am
familiar with. They are there because various http server stacks
actually generate that crap all the time and one of the realistic things
you have to do is try and resync by looking for known tokens. This
happens in all manner of interesting ways usually involving a framing
error followed by a connection reuse (e.g. content-bodies non sensically
added to 304s, content-lengths that aren't udpated in the face of
runtime compression, extra-or-missing crlfs after the closing
chunked-encoding 0-chunk, content-lengths that are short by a few
because they counted the number of utf-8 characters instead of the
number of octets and didn't test with any cases that contained multibyte
chars, etc..). Many of these scenarios can easily apply to responses
too.

The question for hybi is not whether or not mozilla should have done
this (I personally have some reservations), but whether or not it is
reasonable to assume a request parsing stack would see the same
pressures for greasing the skids of interop - and of course they do.
Masking helps cover up that entire class of exposure when running
websockets through http-only intermediaries, which is a good thing. And
a unidirectional xor does it at a remarkably inexpensive cost both
computationally and in terms of complexity.

We've been over all this before - if you aren't going to bring any new
information to the discussion that warrants reconsideration, then please
respect the existing consensus declaration.

-- 
http://www.getfirefox.com/



From ibc@aliax.net  Thu Feb 24 15:21:14 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2818A3A6808 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 15:21:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.653
X-Spam-Level: 
X-Spam-Status: No, score=-2.653 tagged_above=-999 required=5 tests=[AWL=0.024,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dZznBC3zHdFY for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 15:21:12 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id 985EA3A680C for <hybi@ietf.org>; Thu, 24 Feb 2011 15:21:12 -0800 (PST)
Received: by qwh6 with SMTP id 6so954005qwh.31 for <hybi@ietf.org>; Thu, 24 Feb 2011 15:22:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.229.190.13 with SMTP id dg13mr1273968qcb.170.1298589722561; Thu, 24 Feb 2011 15:22:02 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Thu, 24 Feb 2011 15:22:02 -0800 (PST)
In-Reply-To: <1298586760.2498.603.camel@ds9.ducksong.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com>
Date: Fri, 25 Feb 2011 00:22:02 +0100
Message-ID: <AANLkTikBbeezY=5i-=g__C97b3VH3qKREkXNgx7hie8p@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Feb 2011 23:21:14 -0000

2011/2/24 Pat McManus @Mozilla <mcmanus@ducksong.com>:
> it is a client doing response parsing, so it is analogous though not a
> direct example. The mess of different bugwards compatible exceptions to
> strict http framing rules seen there aren't present because we think it
> is a good idea, nor are they there out of any form of laziness I am
> familiar with. They are there because various http server stacks
> actually generate that crap all the time and one of the realistic things
> you have to do is try and resync by looking for known tokens. This
> happens in all manner of interesting ways usually involving a framing
> error followed by a connection reuse (e.g. content-bodies non sensically
> added to 304s, content-lengths that aren't udpated in the face of
> runtime compression, extra-or-missing crlfs after the closing
> chunked-encoding 0-chunk, content-lengths that are short by a few
> because they counted the number of utf-8 characters instead of the
> number of octets and didn't test with any cases that contained multibyte
> chars, etc..). Many of these scenarios can easily apply to responses
> too.

I like being more strict when parsing, but I understand your points,
all of them got from the real world. Thanks for the explantion.




> We've been over all this before - if you aren't going to bring any new
> information to the discussion that warrants reconsideration, then please
> respect the existing consensus declaration.

I respect it. I just want to know rationale for current design. The
new content of the wiki has helped me a lot:

http://trac.tools.ietf.org/wg/hybi/trac/wiki/FAQ

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From trac@tools.ietf.org  Thu Feb 24 17:17:41 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54E9F3A688A for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 17:17:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.543
X-Spam-Level: 
X-Spam-Status: No, score=-102.543 tagged_above=-999 required=5 tests=[AWL=0.057, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ne45K-FcRBV0 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 17:17:40 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id A8E4B3A67FA for <hybi@ietf.org>; Thu, 24 Feb 2011 17:17:40 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PsmKF-0002h8-FO; Thu, 24 Feb 2011 17:18:31 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: ifette@google.com
X-Trac-Project: hybi
Date: Fri, 25 Feb 2011 01:18:31 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/41#comment:1
Message-ID: <068.58d6c46ae0768a95cc0581bb5b49a50e@tools.ietf.org>
References: <059.f762b4dde4d9971f23da8c744849c3e8@tools.ietf.org>
X-Trac-Ticket-ID: 41
In-Reply-To: <059.f762b4dde4d9971f23da8c744849c3e8@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: ifette@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #41: Use URI/IRI terminology
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 01:17:41 -0000

#41: Use URI/IRI terminology

Changes (by ifette@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 Fixed in r68 in svn, will be in -08

-- 
----------------------------------+-----------------------------------------
 Reporter:  sm+ietf@â€¦             |        Owner:        
     Type:  defect                |       Status:  closed
 Priority:  major                 |    Milestone:        
Component:  thewebsocketprotocol  |      Version:        
 Severity:  -                     |   Resolution:  fixed 
 Keywords:                        |  
----------------------------------+-----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/41#comment:1>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Thu Feb 24 17:19:04 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4CE163A68BD for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 17:19:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.547
X-Spam-Level: 
X-Spam-Status: No, score=-102.547 tagged_above=-999 required=5 tests=[AWL=0.053, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q+s1mE4+9dvh for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 17:19:03 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 97F253A688A for <hybi@ietf.org>; Thu, 24 Feb 2011 17:19:03 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PsmLa-0004bM-Kd; Thu, 24 Feb 2011 17:19:54 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: ifette@google.com
X-Trac-Project: hybi
Date: Fri, 25 Feb 2011 01:19:54 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/42#comment:1
Message-ID: <068.b3c84bc52c4f89c8d7f1b659cea76b96@tools.ietf.org>
References: <059.f0bd958c502484df5afae54610748904@tools.ietf.org>
X-Trac-Ticket-ID: 42
In-Reply-To: <059.f0bd958c502484df5afae54610748904@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: ifette@google.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #42: HTML spec reference
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 01:19:04 -0000

#42: HTML spec reference

Changes (by ifette@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 Fixed in r69 in svn. Removed reference to html api on whatwg. will be in
 -06

-- 
----------------------------------+-----------------------------------------
 Reporter:  sm+ietf@â€¦             |        Owner:        
     Type:  defect                |       Status:  closed
 Priority:  major                 |    Milestone:        
Component:  thewebsocketprotocol  |      Version:        
 Severity:  -                     |   Resolution:  fixed 
 Keywords:                        |  
----------------------------------+-----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/42#comment:1>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From tyoshino@google.com  Thu Feb 24 20:18:13 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4F46F3A6908 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 20:18:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.683
X-Spam-Level: 
X-Spam-Status: No, score=-105.683 tagged_above=-999 required=5 tests=[AWL=0.293, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MnSAsN7dos8r for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 20:18:12 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 3090E3A6904 for <hybi@ietf.org>; Thu, 24 Feb 2011 20:18:11 -0800 (PST)
Received: from wpaz1.hot.corp.google.com (wpaz1.hot.corp.google.com [172.24.198.65]) by smtp-out.google.com with ESMTP id p1P4J2PS031883 for <hybi@ietf.org>; Thu, 24 Feb 2011 20:19:02 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298607542; bh=T5DjUNPzyEB00f/XAUuATvfzsYE=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=LhM3WDwch2v4YaGWpwaeVGlXtk9v+5Y0KV17iqT8fbHv5dtPAfaUuJrj+KCXSNJvK Otk4hkZ3YD8uJvSeLeCpw==
Received: from iyf40 (iyf40.prod.google.com [10.241.50.104]) by wpaz1.hot.corp.google.com with ESMTP id p1P4J1e1023573 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 20:19:01 -0800
Received: by iyf40 with SMTP id 40so681153iyf.30 for <hybi@ietf.org>; Thu, 24 Feb 2011 20:19:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=tynkxCL87sX9djORYvSnTrmmbVdL+Iq7ufQ8q5K6t1w=; b=tK7ZiO/5sC+8LDGvfP+4e0ft1NAUqyFZnl2oAzOjis7i3IASj4FLIitTc1QpNE0nGT J/VaubBuNMqZAIosPlJg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Qewc5cQmbV9FzOvwV9lID3ORCYwmXZwWCiGLSyBUWxhlpQGx+TG7C+te6inFjGwrqW UEltvK0tXKZrRb/HJyZQ==
Received: by 10.42.162.65 with SMTP id w1mr238113icx.298.1298607537467; Thu, 24 Feb 2011 20:18:57 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Thu, 24 Feb 2011 20:18:37 -0800 (PST)
In-Reply-To: <4D66CD88.2090106@callenish.com>
References: <4D6678C2.6000400@ericsson.com> <4D66CD88.2090106@callenish.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 25 Feb 2011 13:18:37 +0900
Message-ID: <AANLkTi=fRFha__zeYaWJXDD2PkHtsebvvotXZzQTv3iY@mail.gmail.com>
To: Salvatore Loreto <salvatore.loreto@ericsson.com>
Content-Type: multipart/alternative; boundary=90e6ba6e8b74f9308b049d13a0f2
X-System-Of-Record: true
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] how to better document FAQ and other stuff
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 04:18:13 -0000

--90e6ba6e8b74f9308b049d13a0f2
Content-Type: text/plain; charset=ISO-8859-1

I've copied my note to the wiki.

Takeshi


On Fri, Feb 25, 2011 at 06:28, Bruce Atherton <bruce@callenish.com> wrote:

> I've added a section on how the decision for masking was achieved.
> Hopefully it will clarify some things being discussed. I've tried to
> represent the majority of opinions expressed during the debates several
> months ago, but if someone feels I've misrepresented a position or left out
> something important, please edit it to make it more representative of the
> history.
>
>
> On 24/02/2011 7:26 AM, Salvatore Loreto wrote:
>
>> (as co-chair)
>>
>> Hi there,
>>
>> after reading the last two days mails,
>> I think that it would be good have a FAQ where newcomers can find some
>> information,
>> to understand a little better the rational behind some choice and other
>> stuff,
>> without be forced to go through all the HyBi mail archives... (more the
>> 6000mails)
>> or put on the editor and wg main contributors shoulders the responsibility
>> to provide the information.
>>
>> I have created a wiki page, within the IETF website, where we can start to
>> collect info:
>> http://trac.tools.ietf.org/wg/hybi/trac/wiki/FAQ
>>
>>
>> in order to update the page you need to login,
>> if you do not have a login/pw you can get one from here:
>> http://trac.tools.ietf.org/tools/loginmgr/newlogin
>>
>> anyone can contribute to build the FAQ.
>> I have already received mails from people interested to contribute,
>> so people interested/eager to contribute
>> can start to contribute and just notify the HyBi ml when they do some
>> change.
>>
>>
>> About the possibility to also document more information within a draft,
>> I don't think draft-ietf-hybi-thewebsocketprotocol is the right document
>> for that;
>> instead we can use the
>> http://tools.ietf.org/html/draft-ietf-hybi-design-space
>> as I have been suggested by Stefano Salsano
>>
>>
>> cheers
>> /Sal
>>
>>
>>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--90e6ba6e8b74f9308b049d13a0f2
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I&#39;ve copied my note to the wiki.<div><br clear=3D"all">Takeshi<br>
<br><br><div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 06:28, Bruce Ath=
erton <span dir=3D"ltr">&lt;<a href=3D"mailto:bruce@callenish.com">bruce@ca=
llenish.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" styl=
e=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

I&#39;ve added a section on how the decision for masking was achieved. Hope=
fully it will clarify some things being discussed. I&#39;ve tried to repres=
ent the majority of opinions expressed during the debates several months ag=
o, but if someone feels I&#39;ve misrepresented a position or left out some=
thing important, please edit it to make it more representative of the histo=
ry.<div class=3D"im">

<br>
<br>
On 24/02/2011 7:26 AM, Salvatore Loreto wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
(as co-chair)<br>
<br>
Hi there,<br>
<br>
after reading the last two days mails,<br>
I think that it would be good have a FAQ where newcomers can find some info=
rmation,<br>
to understand a little better the rational behind some choice and other stu=
ff,<br>
without be forced to go through all the HyBi mail archives... (more the 600=
0mails)<br>
or put on the editor and wg main contributors shoulders the responsibility =
to provide the information.<br>
<br>
I have created a wiki page, within the IETF website, where we can start to =
collect info:<br>
<a href=3D"http://trac.tools.ietf.org/wg/hybi/trac/wiki/FAQ" target=3D"_bla=
nk">http://trac.tools.ietf.org/wg/hybi/trac/wiki/FAQ</a><br>
<br>
<br>
in order to update the page you need to login,<br>
if you do not have a login/pw you can get one from here: <a href=3D"http://=
trac.tools.ietf.org/tools/loginmgr/newlogin" target=3D"_blank">http://trac.=
tools.ietf.org/tools/loginmgr/newlogin</a><br>
<br>
anyone can contribute to build the FAQ.<br>
I have already received mails from people interested to contribute,<br>
so people interested/eager to contribute<br>
can start to contribute and just notify the HyBi ml when they do some chang=
e.<br>
<br>
<br>
About the possibility to also document more information within a draft,<br>
I don&#39;t think draft-ietf-hybi-thewebsocketprotocol is the right documen=
t for that;<br>
instead we can use the <a href=3D"http://tools.ietf.org/html/draft-ietf-hyb=
i-design-space" target=3D"_blank">http://tools.ietf.org/html/draft-ietf-hyb=
i-design-space</a><br>
as I have been suggested by Stefano Salsano<br>
<br>
<br>
cheers<br>
/Sal<br>
<br>
<br>
</blockquote>
<br></div><div><div></div><div class=3D"h5">
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br></div>

--90e6ba6e8b74f9308b049d13a0f2--

From Yutaka_Takeda@PlayStation.Sony.Com  Thu Feb 24 21:18:48 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED07A3A691E for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 21:18:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.967
X-Spam-Level: 
X-Spam-Status: No, score=-5.967 tagged_above=-999 required=5 tests=[AWL=0.297,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BcP2hBBqo+gw for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 21:18:48 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 1F82E3A6801 for <hybi@ietf.org>; Thu, 24 Feb 2011 21:18:47 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011022421193262-129703 ; Thu, 24 Feb 2011 21:19:32 -0800 
In-Reply-To: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
MIME-Version: 1.0
X-KeepSent: ED4F78E9:C77C54B8-88257842:001A696A; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Thu, 24 Feb 2011 21:19:18 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/24/2011 09:19:32 PM, Serialize complete at 02/24/2011 09:19:32 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/24/2011 09:19:32 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/24/2011 09:19:40 PM, Serialize complete at 02/24/2011 09:19:40 PM
Content-Type: multipart/alternative; boundary="=_alternative 001D41F988257842_="
Cc: hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 05:18:49 -0000

This is a multipart message in MIME format.
--=_alternative 001D41F988257842_=
Content-Type: text/plain; charset="US-ASCII"

Hi,

If we could apply deflate-stream only to payload, that would solve 
the problem. I was looking for reasons why entire stream has to be
compressed, and found only one here:

http://www.ietf.org/mail-archive/web/hybi/current/msg04117.html

>From layering aspects, I would prefer any compression taking place
on top of framing layer from the other way around:

   +-------------+
   | compression |
   +-------------+
   +-------------+
   | WS framing  |
   +-------------+
   +-------------+
   |     TCP     |
   +-------------+

where, current draft -05 sugggests:

   +-------------+
   | WS framing  |
   +-------------+
   +-------------+
   | compression |
   +-------------+
   +-------------+
   |     TCP     |
   +-------------+

Justifications for the former layering would be:

o  Framing is necessary because of the underlying transport
   layer is in fact 'streaming', or TCP. (TCP and WS-framing 
   are more tightly coupled)
o  WS-layer needs to buffer entire message (passed by app/JS)
   anyway.
o  Text and binary do not interleave fragments, hence there
   needs only one context for compression / decompression in
   memory.
o  Overhead (frame headers and control frames) are much smaller
   than payload of text/binary frames and negligible as to 
   compression ratio.
o  Close frame appears at the end of stream with no traling
   bytes. (Can remove requirement for TCP graceful shutdown).

Please let me know if I am missing something...

Best.
- Yutaka


--=_alternative 001D41F988257842_=
Content-Type: text/html; charset="US-ASCII"


<br><tt><font size=2>Hi,</font></tt>
<br>
<br><tt><font size=2>If we could apply deflate-stream only to payload,
that would solve </font></tt>
<br><tt><font size=2>the problem. I was looking for reasons why entire
stream has to be</font></tt>
<br><tt><font size=2>compressed, and found only one here:</font></tt>
<br>
<br><tt><font size=2>http://www.ietf.org/mail-archive/web/hybi/current/msg04117.html</font></tt>
<br>
<br><tt><font size=2>From layering aspects, I would prefer any compression
taking place</font></tt>
<br><tt><font size=2>on top of framing layer from the other way around:</font></tt>
<br>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;| compression |</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;| WS framing &nbsp;|</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;| &nbsp; &nbsp; TCP &nbsp; &nbsp; |</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br>
<br><tt><font size=2>where, current draft -05 sugggests:</font></tt>
<br>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;| WS framing &nbsp;|</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;| compression |</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;| &nbsp; &nbsp; TCP &nbsp; &nbsp; |</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;+-------------+</font></tt>
<br>
<br><tt><font size=2>Justifications for the former layering would be:</font></tt>
<br>
<br><tt><font size=2>o &nbsp;Framing is necessary because of the underlying
transport</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;layer is in fact 'streaming', or TCP.
(TCP and WS-framing </font></tt>
<br><tt><font size=2>&nbsp; &nbsp;are more tightly coupled)</font></tt>
<br><tt><font size=2>o &nbsp;WS-layer needs to buffer entire message (passed
by app/JS)</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;anyway.</font></tt>
<br><tt><font size=2>o &nbsp;Text and binary do not interleave fragments,
hence there</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;needs only one context for compression
/ decompression in</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;memory.</font></tt>
<br><tt><font size=2>o &nbsp;Overhead (frame headers and control frames)
are much smaller</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;than payload of text/binary frames and
negligible as to </font></tt>
<br><tt><font size=2>&nbsp; &nbsp;compression ratio.</font></tt>
<br><tt><font size=2>o &nbsp;Close frame appears at the end of stream with
no traling</font></tt>
<br><tt><font size=2>&nbsp; &nbsp;bytes. (Can remove requirement for TCP
graceful shutdown).</font></tt>
<br>
<br><tt><font size=2>Please let me know if I am missing something...</font></tt>
<br>
<br><tt><font size=2>Best.</font></tt>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
<br>
--=_alternative 001D41F988257842_=--

From salvatore.loreto@ericsson.com  Thu Feb 24 22:31:01 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C70FA3A6821 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 22:31:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.59
X-Spam-Level: 
X-Spam-Status: No, score=-106.59 tagged_above=-999 required=5 tests=[AWL=0.009, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hdXwAwuDKaAn for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 22:30:55 -0800 (PST)
Received: from mailgw10.se.ericsson.net (mailgw10.se.ericsson.net [193.180.251.61]) by core3.amsl.com (Postfix) with ESMTP id 9B0BF3A6938 for <hybi@ietf.org>; Thu, 24 Feb 2011 22:30:54 -0800 (PST)
X-AuditID: c1b4fb3d-b7c78ae000005844-cf-4d674cd1b0cd
Received: from esessmw0191.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw10.se.ericsson.net (Symantec Mail Security) with SMTP id 0F.89.22596.1DC476D4; Fri, 25 Feb 2011 07:31:45 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0191.eemea.ericsson.se (153.88.115.85) with Microsoft SMTP Server id 8.2.234.1; Fri, 25 Feb 2011 07:31:44 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id A985E25C4; Fri, 25 Feb 2011 08:31:44 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 6F87850844; Fri, 25 Feb 2011 08:31:44 +0200 (EET)
Received: from n211.nomadiclab.com (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 1DE164FE40; Fri, 25 Feb 2011 08:31:44 +0200 (EET)
Message-ID: <4D674CCF.9000309@ericsson.com>
Date: Fri, 25 Feb 2011 08:31:43 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: "hybi@ietf.org" <hybi@ietf.org>
Content-Type: multipart/alternative; boundary="------------030307070709010103010104"
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, SM <sm+ietf@elandsys.com>
Subject: [hybi] Fwd: HYBI - Requested session has been scheduled for IETF 80
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 06:31:01 -0000

--------------030307070709010103010104
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit

The HyBi meeting has been scheduled for Tuesday afternoon (1300-1500 CET),
after the RTCWeb BOF



here all the IETF week agenda 
https://datatracker.ietf.org/meeting/80/agenda.txt
note: the agenda is still preliminary, the final one will be published 
next Friday March 04th

cheers
/Sal

-- 
Salvatore Loreto
www.sloreto.com


-------- Original Message --------
Subject: 	HYBI - Requested session has been scheduled for IETF 80
Date: 	Thu, 24 Feb 2011 23:46:07 +0100
From: 	IETF Secretariat <agenda@ietf.org>
To: 	Salvatore Loreto <salvatore.loreto@ericsson.com>
CC: 	jhildebr@cisco.com <jhildebr@cisco.com>, presnick@qualcomm.com 
<presnick@qualcomm.com>, alexey.melnikov@isode.com 
<alexey.melnikov@isode.com>, stpeter@stpeter.im <stpeter@stpeter.im>, 
session-request@ietf.org <session-request@ietf.org>



Dear Salvatore Loreto,

The sessions that you have requested have been scheduled.
Below is the scheduled session information followed by
the information of sessions that you have requested.

HYBI Session 1 (2 hours)
Tuesday, Afternoon Session I 1300-1500
Room Name: Congress Hall III
----------------------------------------------



Requested Information:


---------------------------------------------------------
Working Group Name: hybi
Area Name: Applications Area
Session Requester: Salvatore Loreto

Number of Sessions: 1
Length of Session(s):  2 hours


Number of Attendees: 100
Conflicts to Avoid:
   First Priority:  soc httpbis httpstate websec apparea atoca dispatch sipcore xmpp oauth core

Special Requests:

---------------------------------------------------------





--------------030307070709010103010104
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    The HyBi meeting has been scheduled for Tuesday afternoon (1300-1500
    CET),<br>
    after the RTCWeb BOF<br>
    <br>
    <br>
    <br>
    here all the IETF week agenda
    <a class="moz-txt-link-freetext" href="https://datatracker.ietf.org/meeting/80/agenda.txt">https://datatracker.ietf.org/meeting/80/agenda.txt</a><br>
    note: the agenda is still preliminary, the final one will be
    published next Friday March 04th<br>
    <br>
    cheers<br>
    /Sal<br>
    <pre>-- 
Salvatore Loreto
<a class="moz-txt-link-abbreviated" href="http://www.sloreto.com">www.sloreto.com</a></pre>
    <br>
    -------- Original Message --------
    <table class="moz-email-headers-table" border="0" cellpadding="0"
      cellspacing="0">
      <tbody>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject: </th>
          <td>HYBI - Requested session has been scheduled for IETF 80</td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
          <td>Thu, 24 Feb 2011 23:46:07 +0100</td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
          <td>IETF Secretariat <a class="moz-txt-link-rfc2396E" href="mailto:agenda@ietf.org">&lt;agenda@ietf.org&gt;</a></td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
          <td>Salvatore Loreto <a class="moz-txt-link-rfc2396E" href="mailto:salvatore.loreto@ericsson.com">&lt;salvatore.loreto@ericsson.com&gt;</a></td>
        </tr>
        <tr>
          <th align="RIGHT" nowrap="nowrap" valign="BASELINE">CC: </th>
          <td><a class="moz-txt-link-abbreviated" href="mailto:jhildebr@cisco.com">jhildebr@cisco.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:jhildebr@cisco.com">&lt;jhildebr@cisco.com&gt;</a>,
            <a class="moz-txt-link-abbreviated" href="mailto:presnick@qualcomm.com">presnick@qualcomm.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:presnick@qualcomm.com">&lt;presnick@qualcomm.com&gt;</a>,
            <a class="moz-txt-link-abbreviated" href="mailto:alexey.melnikov@isode.com">alexey.melnikov@isode.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:alexey.melnikov@isode.com">&lt;alexey.melnikov@isode.com&gt;</a>,
            <a class="moz-txt-link-abbreviated" href="mailto:stpeter@stpeter.im">stpeter@stpeter.im</a> <a class="moz-txt-link-rfc2396E" href="mailto:stpeter@stpeter.im">&lt;stpeter@stpeter.im&gt;</a>,
            <a class="moz-txt-link-abbreviated" href="mailto:session-request@ietf.org">session-request@ietf.org</a> <a class="moz-txt-link-rfc2396E" href="mailto:session-request@ietf.org">&lt;session-request@ietf.org&gt;</a></td>
        </tr>
      </tbody>
    </table>
    <br>
    <br>
    <pre>Dear Salvatore Loreto,

The sessions that you have requested have been scheduled.
Below is the scheduled session information followed by 
the information of sessions that you have requested.

HYBI Session 1 (2 hours)
Tuesday, Afternoon Session I 1300-1500
Room Name: Congress Hall III
----------------------------------------------



Requested Information:


---------------------------------------------------------
Working Group Name: hybi
Area Name: Applications Area
Session Requester: Salvatore Loreto

Number of Sessions: 1
Length of Session(s):  2 hours
                       
                       
Number of Attendees: 100
Conflicts to Avoid:
  First Priority:  soc httpbis httpstate websec apparea atoca dispatch sipcore xmpp oauth core

Special Requests:
  
---------------------------------------------------------



</pre>
  </body>
</html>

--------------030307070709010103010104--

From salvatore.loreto@ericsson.com  Thu Feb 24 22:38:35 2011
Return-Path: <salvatore.loreto@ericsson.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3DB603A6935 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 22:38:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.59
X-Spam-Level: 
X-Spam-Status: No, score=-106.59 tagged_above=-999 required=5 tests=[AWL=0.009, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tSuQ4fqnaP-u for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 22:38:33 -0800 (PST)
Received: from mailgw9.se.ericsson.net (mailgw9.se.ericsson.net [193.180.251.57]) by core3.amsl.com (Postfix) with ESMTP id 49E653A6822 for <hybi@ietf.org>; Thu, 24 Feb 2011 22:38:33 -0800 (PST)
X-AuditID: c1b4fb39-b7b76ae00000276e-7f-4d674e9ba593
Received: from esessmw0184.eemea.ericsson.se (Unknown_Domain [153.88.253.125]) by mailgw9.se.ericsson.net (Symantec Mail Security) with SMTP id 67.88.10094.B9E476D4; Fri, 25 Feb 2011 07:39:24 +0100 (CET)
Received: from mail.lmf.ericsson.se (153.88.115.8) by esessmw0184.eemea.ericsson.se (153.88.115.82) with Microsoft SMTP Server id 8.2.234.1; Fri, 25 Feb 2011 07:39:23 +0100
Received: from nomadiclab.lmf.ericsson.se (nomadiclab.lmf.ericsson.se [131.160.33.3])	by mail.lmf.ericsson.se (Postfix) with ESMTP id 3D4FF25C4; Fri, 25 Feb 2011 08:39:23 +0200 (EET)
Received: from nomadiclab.lmf.ericsson.se (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id F083650844; Fri, 25 Feb 2011 08:39:22 +0200 (EET)
Received: from n211.nomadiclab.com (localhost [127.0.0.1])	by nomadiclab.lmf.ericsson.se (Postfix) with ESMTP id 9FE174FE40; Fri, 25 Feb 2011 08:39:22 +0200 (EET)
Message-ID: <4D674E9A.8010702@ericsson.com>
Date: Fri, 25 Feb 2011 08:39:22 +0200
From: Salvatore Loreto <salvatore.loreto@ericsson.com>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7
MIME-Version: 1.0
To: "hybi@ietf.org" <hybi@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: ClamAV using ClamSMTP
X-Brightmail-Tracker: AAAAAA==
Cc: Joe Hildebrand <Joe.Hildebrand@webex.com>, SM <sm+ietf@elandsys.com>
Subject: [hybi] Agenda requests for IETF 80
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 06:38:35 -0000

Hi all,

if you are interested in getting a slot
on the agenda of the next HYBI meeting (Tuesday, March 29th, 1300-1500 CET),
please send the chairs a request by Monday March 14th.

Please provide also:
- a title for the agenda slot
- the requested amount of time
- a list of the issues that will be addressed during the allocated time

cheers
/Sal

-- 
Salvatore Loreto
www.sloreto.com


From tyoshino@google.com  Thu Feb 24 22:58:06 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E2C53A6938 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 22:58:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.376
X-Spam-Level: 
X-Spam-Status: No, score=-105.376 tagged_above=-999 required=5 tests=[AWL=0.600, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id enux1LeAmQc3 for <hybi@core3.amsl.com>; Thu, 24 Feb 2011 22:58:04 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id E82B03A691E for <hybi@ietf.org>; Thu, 24 Feb 2011 22:58:03 -0800 (PST)
Received: from kpbe17.cbf.corp.google.com (kpbe17.cbf.corp.google.com [172.25.105.81]) by smtp-out.google.com with ESMTP id p1P6wrbK030404 for <hybi@ietf.org>; Thu, 24 Feb 2011 22:58:54 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298617134; bh=lecIfdwlHsD70yO0c0W17z5WSgc=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=I13DSZgbfAkLnF+YJg0npzLtKVQ/80TrLRZcgVwm4H/n7p9OOURXOinqXDKOVDA5g yXuen8nZNWkU5/gqxlG+w==
Received: from iwl42 (iwl42.prod.google.com [10.241.67.234]) by kpbe17.cbf.corp.google.com with ESMTP id p1P6wqAT018409 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Thu, 24 Feb 2011 22:58:52 -0800
Received: by iwl42 with SMTP id 42so1125043iwl.18 for <hybi@ietf.org>; Thu, 24 Feb 2011 22:58:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=//zSbNSlSJzNQCyaFANKQ9ArxNgmjB7H5DdD+HdfE78=; b=hrDDw3+be8HJ9AXOvdO4C/cIsrr1OXCWdrrWOlns6/YnnVZY2TdURHyKPutxxLt7ui 3gDPH+hftR4wBJrF59Zw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=IMB+8UFFuz/SKU/bq0Pj0VI/GW+ooGiJCU6mStEB77wz7ysvWDbNX5x5BbgwjNoxY7 sqhLuZadRYjHs2C/vqcA==
Received: by 10.42.229.135 with SMTP id ji7mr385216icb.365.1298617132131; Thu, 24 Feb 2011 22:58:52 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Thu, 24 Feb 2011 22:58:32 -0800 (PST)
In-Reply-To: <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com>
References: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com> <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com>
From: Takeshi Yoshino <tyoshino@google.com>
Date: Fri, 25 Feb 2011 15:58:32 +0900
Message-ID: <AANLkTikE9zarwuRURCcPLU-QOgDt4UsaaWNWv4U7=hQ6@mail.gmail.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: multipart/alternative; boundary=90e6ba476b39dc250a049d15dc2f
X-System-Of-Record: true
Cc: hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 06:58:06 -0000

--90e6ba476b39dc250a049d15dc2f
Content-Type: text/plain; charset=ISO-8859-1

Hi,

On Fri, Feb 25, 2011 at 14:19, <Yutaka_Takeda@playstation.sony.com> wrote:

>
> Hi,
>
> If we could apply deflate-stream only to payload, that would solve
> the problem. I was looking for reasons why entire stream has to be
> compressed, and found only one here:
>
> http://www.ietf.org/mail-archive/web/hybi/current/msg04117.html
>
> From layering aspects, I would prefer any compression taking place
> on top of framing layer from the other way around:
>
>
Yeah, Patrick initially proposed compression using that approach
http://www.ietf.org/mail-archive/web/hybi/current/msg04071.html

The options we can take are basically
a) compress only application data not keeping compression state
b) compress only application data while keeping compression state between
multiple frame
c) compress entire stream

John, Dave objected a) since it's degrading compression rate. I agree that.
So, b) and c) are left. Patrick wrote up c) as deflate-stream extension.

The name deflate-stream was given for c) (see
http://www.ietf.org/mail-archive/web/hybi/current/msg04129.html). I think
it's OK to leave deflate-stream extension as is. I'm also fine with this
built-in in the initial version of the WebSocket protocol spec. What we
should do now is try to define some "better-deflate" which convinces people.
These threads is in a kind of suspended state. We should use them or create
a new thread for resuming discussion on some "better-deflate" there.

- Some said we need ability to disable compression on frame with
incompressible contents
- Coordination with mux is also problem
- If frame header is compressible/incompressible is still a question.
etc...


>    +-------------+
>    | compression |
>    +-------------+
>    +-------------+
>    | WS framing  |
>    +-------------+
>    +-------------+
>    |     TCP     |
>    +-------------+
>
> where, current draft -05 sugggests:
>
>    +-------------+
>    | WS framing  |
>    +-------------+
>    +-------------+
>    | compression |
>    +-------------+
>    +-------------+
>    |     TCP     |
>    +-------------+
>
> Justifications for the former layering would be:
>
> o  Framing is necessary because of the underlying transport
>    layer is in fact 'streaming', or TCP. (TCP and WS-framing
>    are more tightly coupled)
>

For endpoints/intermediaries which don't recognize deflate-stream, yes, it's
problematic.

Except for this, technically, it's ok since frame boundary can be
immediately told to the other peer by flush-ing e.g. Z_SYNC_FLUSH of zlib.


> o  WS-layer needs to buffer entire message (passed by app/JS)
>    anyway.
> o  Text and binary do not interleave fragments, hence there
>    needs only one context for compression / decompression in
>    memory.
>

People seemed to be more concerned about compression efficiency at that time
than the cost of compression state sharing. This is a point to revisit.


> o  Overhead (frame headers and control frames) are much smaller
>    than payload of text/binary frames and negligible as to
>    compression ratio.
>

Not sure.


> o  Close frame appears at the end of stream with no traling
>    bytes. (Can remove requirement for TCP graceful shutdown).
>
>
Yes, it's not a problem if we adopt payload only compression.


> Please let me know if I am missing something...
>
> Best.
> - Yutaka
>
>

--90e6ba476b39dc250a049d15dc2f
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Hi,</div><div><br></div><div>On Fri, Feb 25, 2011 at 14:19,  <span dir=
=3D"ltr">&lt;<a href=3D"mailto:Yutaka_Takeda@playstation.sony.com">Yutaka_T=
akeda@playstation.sony.com</a>&gt;</span> wrote:</div><div class=3D"gmail_q=
uote">

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">
<br><tt><font size=3D"2">Hi,</font></tt>
<br>
<br><tt><font size=3D"2">If we could apply deflate-stream only to payload,
that would solve </font></tt>
<br><tt><font size=3D"2">the problem. I was looking for reasons why entire
stream has to be</font></tt>
<br><tt><font size=3D"2">compressed, and found only one here:</font></tt>
<br>
<br><tt><font size=3D"2"><a href=3D"http://www.ietf.org/mail-archive/web/hy=
bi/current/msg04117.html" target=3D"_blank">http://www.ietf.org/mail-archiv=
e/web/hybi/current/msg04117.html</a></font></tt>
<br>
<br><tt><font size=3D"2">From layering aspects, I would prefer any compress=
ion
taking place</font></tt>
<br><tt><font size=3D"2">on top of framing layer from the other way around:=
</font></tt>
<br>
<br></blockquote><div><br></div><div>Yeah, Patrick initially proposed compr=
ession using that approach</div><div><a href=3D"http://www.ietf.org/mail-ar=
chive/web/hybi/current/msg04071.html">http://www.ietf.org/mail-archive/web/=
hybi/current/msg04071.html</a></div>

<div><br></div><div>The options we can take are basically</div><div>a) comp=
ress only application data not keeping compression state</div><div>b) compr=
ess only application data while keeping compression state between multiple =
frame</div>

<div>c) compress entire stream</div><div><br></div><div>John, Dave objected=
 a) since it&#39;s degrading compression rate. I agree that. So, b) and c) =
are left. Patrick wrote up c) as deflate-stream extension.</div><div><br>

</div><div>The name deflate-stream was given for c) (see=A0<a href=3D"http:=
//www.ietf.org/mail-archive/web/hybi/current/msg04129.html">http://www.ietf=
.org/mail-archive/web/hybi/current/msg04129.html</a>). I think it&#39;s OK =
to leave deflate-stream extension as is. I&#39;m also fine with this built-=
in in the initial version of the WebSocket protocol spec. What we should do=
 now is try to define some &quot;better-deflate&quot; which convinces peopl=
e. These threads is in a kind of suspended state. We should use them or cre=
ate a new thread for resuming discussion on some &quot;better-deflate&quot;=
 there.</div>

<div><br></div><div>- Some said we need ability to disable compression on f=
rame with incompressible contents</div><div>- Coordination with mux is also=
 problem</div><div>- If frame header is compressible/incompressible is stil=
l a question.</div>

<div>etc...</div><div>=A0</div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><tt><font si=
ze=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0| compression |</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0| WS framing =A0|</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0| =A0 =A0 TCP =A0 =A0 |</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br>
<br><tt><font size=3D"2">where, current draft -05 sugggests:</font></tt>
<br>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0| WS framing =A0|</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0| compression |</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br><tt><font size=3D"2">=A0 =A0| =A0 =A0 TCP =A0 =A0 |</font></tt>
<br><tt><font size=3D"2">=A0 =A0+-------------+</font></tt>
<br>
<br><tt><font size=3D"2">Justifications for the former layering would be:</=
font></tt>
<br>
<br><tt><font size=3D"2">o =A0Framing is necessary because of the underlyin=
g
transport</font></tt>
<br><tt><font size=3D"2">=A0 =A0layer is in fact &#39;streaming&#39;, or TC=
P.
(TCP and WS-framing </font></tt>
<br><tt><font size=3D"2">=A0 =A0are more tightly coupled)</font></tt>
<br></blockquote><div><br></div><div>For endpoints/intermediaries which don=
&#39;t recognize deflate-stream, yes, it&#39;s problematic.</div><div><br><=
/div><div>Except for this, technically, it&#39;s ok since frame boundary ca=
n be immediately told to the other peer by flush-ing e.g. Z_SYNC_FLUSH of z=
lib.</div>

<div>=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;=
border-left:1px #ccc solid;padding-left:1ex;"><tt><font size=3D"2">o =A0WS-=
layer needs to buffer entire message (passed
by app/JS)</font></tt>
<br><tt><font size=3D"2">=A0 =A0anyway.</font></tt>
<br><tt><font size=3D"2">o =A0Text and binary do not interleave fragments,
hence there</font></tt>
<br><tt><font size=3D"2">=A0 =A0needs only one context for compression
/ decompression in</font></tt>
<br><tt><font size=3D"2">=A0 =A0memory.</font></tt>
<br></blockquote><div><br></div><div>People seemed to be more concerned abo=
ut compression efficiency at that time than the cost of compression state s=
haring. This is a point to revisit.</div><div>=A0</div><blockquote class=3D=
"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding=
-left:1ex;">

<tt><font size=3D"2">o =A0Overhead (frame headers and control frames)
are much smaller</font></tt>
<br><tt><font size=3D"2">=A0 =A0than payload of text/binary frames and
negligible as to </font></tt>
<br><tt><font size=3D"2">=A0 =A0compression ratio.</font></tt>
<br></blockquote><div><br></div><div>Not sure.</div><div>=A0</div><blockquo=
te class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc so=
lid;padding-left:1ex;"><tt><font size=3D"2">o =A0Close frame appears at the=
 end of stream with
no traling</font></tt>
<br><tt><font size=3D"2">=A0 =A0bytes. (Can remove requirement for TCP
graceful shutdown).</font></tt>
<br>
<br></blockquote><div><br></div><div>Yes, it&#39;s not a problem if we adop=
t payload only compression.</div><div>=A0</div><blockquote class=3D"gmail_q=
uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e=
x;">

<tt><font size=3D"2">Please let me know if I am missing something...</font>=
</tt>
<br>
<br><tt><font size=3D"2">Best.</font></tt>
<br><tt><font size=3D"2">- Yutaka</font></tt>
<br>
<br></blockquote></div><br>

--90e6ba476b39dc250a049d15dc2f--

From Yutaka_Takeda@PlayStation.Sony.Com  Fri Feb 25 00:02:25 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6AE9A3A6929; Fri, 25 Feb 2011 00:02:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.982
X-Spam-Level: 
X-Spam-Status: No, score=-5.982 tagged_above=-999 required=5 tests=[AWL=0.283,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LBywW2I2Dfyh; Fri, 25 Feb 2011 00:02:19 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id BA6133A681D; Fri, 25 Feb 2011 00:02:19 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011022500030518-134850 ; Fri, 25 Feb 2011 00:03:05 -0800 
In-Reply-To: <AANLkTikE9zarwuRURCcPLU-QOgDt4UsaaWNWv4U7=hQ6@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
MIME-Version: 1.0
X-KeepSent: 9EDDF2DA:D45B4501-88257842:0027DEB4; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OF9EDDF2DA.D45B4501-ON88257842.0027DEB4-88257842.002C3B97@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Fri, 25 Feb 2011 00:02:52 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/25/2011 12:03:04 AM, Serialize complete at 02/25/2011 12:03:04 AM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/25/2011 12:03:05 AM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/25/2011 12:03:11 AM, Serialize complete at 02/25/2011 12:03:11 AM
Content-Type: multipart/alternative; boundary="=_alternative 002C3B9688257842_="
Cc: hybi-bounces@ietf.org, hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 08:02:25 -0000

This is a multipart message in MIME format.
--=_alternative 002C3B9688257842_=
Content-Type: text/plain; charset="US-ASCII"

Hi Takeshi, my comments below...


> o  Framing is necessary because of the underlying transport 
>    layer is in fact 'streaming', or TCP. (TCP and WS-framing 
>    are more tightly coupled) 
> 
> For endpoints/intermediaries which don't recognize deflate-stream, 
> yes, it's problematic.

What if we'd like to introduce a new control frame that is intended
to communicate with intermediaries (imagine, trace-route mechanism, 
etc.) in the future, then the 'compression' layer gets in the way 
and all intermediaries have to decompress stream all the time. 

This is clearly another consequence of having compression under the 
framing layer. We should avoid this, IMO.


> o  WS-layer needs to buffer entire message (passed by app/JS) 
>    anyway. 
> o  Text and binary do not interleave fragments, hence there 
>    needs only one context for compression / decompression in 
>    memory. 
> 
> People seemed to be more concerned about compression efficiency at 
> that time than the cost of compression state sharing. This is a 
> point to revisit.

Yeah... as now we see downside of the current direction.

>  
> o  Overhead (frame headers and control frames) are much smaller 
>    than payload of text/binary frames and negligible as to 
>    compression ratio. 
> 
> Not sure.

We may need more quantitative evidence here, though I agree 
larger scope (~32KB in case of gzip) for compression by
references for recurring texts would make compression ratio 
better. I also imagine that recurring texts may appear more in
the same message (or channel) than in the other channel. In mux'd
case for example, I am not sure how the current approach would
help.


> o  Close frame appears at the end of stream with no traling 
>    bytes. (Can remove requirement for TCP graceful shutdown). 

I think this benefit is significant. We do not want to worry
about another trailing bytes in the future again when a new 
compression algorithm needs to be introduced.

Per message compression has another benefit of shrinking the 
size of buffer for storing application messages in memory.


- Yutaka

--=_alternative 002C3B9688257842_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">Hi Takeshi, my comments below...</font>
<br>
<br><tt><font size=2><br>
&gt; o &nbsp;Framing is necessary because of the underlying transport <br>
&gt; &nbsp; &nbsp;layer is in fact 'streaming', or TCP. (TCP and WS-framing
<br>
&gt; &nbsp; &nbsp;are more tightly coupled) </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; For endpoints/intermediaries which don't recognize deflate-stream,
<br>
&gt; yes, it's problematic.</font></tt>
<br>
<br><tt><font size=2>What if we'd like to introduce a new control frame
that is intended</font></tt>
<br><tt><font size=2>to communicate with intermediaries (imagine, trace-route
mechanism, </font></tt>
<br><tt><font size=2>etc.) in the future, then the 'compression' layer
gets in the way </font></tt>
<br><tt><font size=2>and all intermediaries have to decompress stream all
the time. </font></tt>
<br>
<br><tt><font size=2>This is clearly another consequence of having compression
under the </font></tt>
<br><tt><font size=2>framing layer. We should avoid this, IMO.</font></tt>
<br>
<br>
<br><tt><font size=2>&gt; o &nbsp;WS-layer needs to buffer entire message
(passed by app/JS) <br>
&gt; &nbsp; &nbsp;anyway. <br>
&gt; o &nbsp;Text and binary do not interleave fragments, hence there <br>
&gt; &nbsp; &nbsp;needs only one context for compression / decompression
in <br>
&gt; &nbsp; &nbsp;memory. </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; People seemed to be more concerned about compression efficiency at
<br>
&gt; that time than the cost of compression state sharing. This is a <br>
&gt; point to revisit.</font></tt>
<br>
<br><tt><font size=2>Yeah... as now we see downside of the current direction.</font></tt>
<br>
<br><tt><font size=2>&gt; &nbsp;</font></tt>
<br><tt><font size=2>&gt; o &nbsp;Overhead (frame headers and control frames)
are much smaller <br>
&gt; &nbsp; &nbsp;than payload of text/binary frames and negligible as
to <br>
&gt; &nbsp; &nbsp;compression ratio. </font></tt>
<br><tt><font size=2>&gt; <br>
&gt; Not sure.</font></tt>
<br>
<br><tt><font size=2>We may need more quantitative evidence here, though
I agree </font></tt>
<br><tt><font size=2>larger scope (~32KB in case of gzip) for compression
by</font></tt>
<br><tt><font size=2>references for recurring texts would make compression
ratio </font></tt>
<br><tt><font size=2>better. I also imagine that recurring texts may appear
more in</font></tt>
<br><tt><font size=2>the same message (or channel) than in the other channel.
In mux'd</font></tt>
<br><tt><font size=2>case for example, I am not sure how the current approach
would</font></tt>
<br><tt><font size=2>help.</font></tt>
<br>
<br>
<br><tt><font size=2>&gt; o &nbsp;Close frame appears at the end of stream
with no traling <br>
&gt; &nbsp; &nbsp;bytes. (Can remove requirement for TCP graceful shutdown).
<br>
</font></tt>
<br><tt><font size=2>I think this benefit is significant. We do not want
to worry</font></tt>
<br><tt><font size=2>about another trailing bytes in the future again when
a new </font></tt>
<br><tt><font size=2>compression algorithm needs to be introduced.</font></tt>
<br>
<br><tt><font size=2>Per message compression has another benefit of shrinking
the </font></tt>
<br><tt><font size=2>size of buffer for storing application messages in
memory.</font></tt>
<br>
<br>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
--=_alternative 002C3B9688257842_=--

From andy.warmcat.com@googlemail.com  Fri Feb 25 01:34:07 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8F6333A6828; Fri, 25 Feb 2011 01:34:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.584
X-Spam-Level: 
X-Spam-Status: No, score=-3.584 tagged_above=-999 required=5 tests=[AWL=0.015,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hJbAo72SAw9E; Fri, 25 Feb 2011 01:34:02 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 19BE73A67CF; Fri, 25 Feb 2011 01:34:01 -0800 (PST)
Received: by wyb42 with SMTP id 42so1502516wyb.31 for <multiple recipients>; Fri, 25 Feb 2011 01:34:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=AHIYr6mPMtSzWI4TkkNhUtBkMGztOXEr9QN7rtxLaDo=; b=mWWhc2KaJaZMcZPMECz4vxk0HtkUbtyWlwn1t6L6P18Pw7CYF8y39iRNqFOtx+uIIl Ut3YueKwoXKahib3iL3xXC2QHrS7S1OgAkm4zUjzTGnpkRqTi7dyUZTgbW13KkQz0gmK etVPgPZ4+4cEozDzQpYw7HzxUfSw14sgLJ88k=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=TwVE+dMk1JoKs073NWx+E6FAayz7XWxNSt4wiibBrPoHMYjVWBgnYZc5FZwuAqK5Yl GYhC4Q29DEwuI5PJ6tufQiMVSEDxf3mWucieDHxxDhyaYQzzbeZVHTbuTLzva2XAoZJQ 3Mn1ltULckLC7Hc8BAlMzjNe7TAVCgz0NiOyE=
Received: by 10.227.152.11 with SMTP id e11mr1864933wbw.85.1298626493487; Fri, 25 Feb 2011 01:34:53 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id x1sm409091wbh.8.2011.02.25.01.34.52 (version=SSLv3 cipher=OTHER); Fri, 25 Feb 2011 01:34:52 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6777BB.4070605@warmcat.com>
Date: Fri, 25 Feb 2011 09:34:51 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Yutaka_Takeda@PlayStation.Sony.Com
References: <OF9EDDF2DA.D45B4501-ON88257842.0027DEB4-88257842.002C3B97@playstation.sony.com>
In-Reply-To: <OF9EDDF2DA.D45B4501-ON88257842.0027DEB4-88257842.002C3B97@playstation.sony.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org, hybi-bounces@ietf.org
Subject: Re: [hybi] With deflate-stream / websocket traceroute action
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 09:34:07 -0000

On 02/25/2011 08:02 AM, Somebody in the thread at some point said:

Hi -

> What if we'd like to introduce a new control frame that is intended
> to communicate with intermediaries (imagine, trace-route mechanism,
> etc.) in the future, then the 'compression' layer gets in the way
> and all intermediaries have to decompress stream all the time.

The intermediaries have to rewrite the compression too if there's ever 
anything they don't pass through, if the compression has any state held 
at both ends.


I thought about traceroute a bit when I wrote libwebsockets-test-ping 
which uses PING / PONG control frames just like normal ping app.

In fact you can do traceroute just with PING / PONG if the standard 
allowed for

  1) PONG MAY contain additional text after the PING payload echo

  2) PING MUST contain a TTL byte at the start

  3) Intermediaries MAY decrement the TTL when passing on PING

  4) PONG SHOULD be issued by intermediary IF TTL = 0 after the 
decrement and MUST be by the endpoint regardless of TTL

  5) When PONG issued, intermediary or endpoint MAY append its ID text

-Andy

From gregw@intalio.com  Fri Feb 25 03:02:03 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CDE263A696B for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:02:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aeJUsye5vdWG for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:02:02 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id BA4013A683E for <hybi@ietf.org>; Fri, 25 Feb 2011 03:02:02 -0800 (PST)
Received: by vws6 with SMTP id 6so1403493vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 03:02:54 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr3705464vdb.230.1298631767084; Fri, 25 Feb 2011 03:02:47 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Fri, 25 Feb 2011 03:02:46 -0800 (PST)
In-Reply-To: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>
Date: Fri, 25 Feb 2011 22:02:46 +1100
Message-ID: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Hybi <hybi@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 11:02:03 -0000

So is there any support for changing away from masked framed to masked payl=
oads?
or should I just accept that we will be building masking into framing
for all time?

cheers


On 1 February 2011 08:47, Greg Wilkins <gregw@intalio.com> wrote:
> I think we still have a fundamental divide in opinions between masked fra=
ming:
>
> =A0 [ key1][masked frame1] [key2][masked frame 2] ..... [keyN][masked fra=
me N]
>
> vs mask in frame:
>
> =A0 [ key1, masked payload 1 ] =A0[ key2, masked payload 2] =A0... =A0[ke=
yN,
> masked payload N]
>
>
> I'd like to eventually call for a straw poll on this, but would first
> like to have a thread dedicated to the pros and cons of each.
>
>
>
> IMNSHO:
>
>
> Masked Frames PROS:
> =A0+ all bytes other than the key are masked. =A0This prevents an attacke=
r
> from using frame fields like the length to send "clear text"
>
> Masked Frame CONS:
> =A0- Masking is not independent of framing - poor layered protocol design=
.
> =A0- all WS handling that needs to be aware of frame boundaries will
> need to implement masking. =A0This will mean that more infrastructure
> will have masking hard coded into it, thus it will soon become very
> difficult, if not impossible to change framing as it will be baked
> into WS aware intermediaries.
> =A0- Intermediaries that do not care about content will still need to
> unmask and remask the frames.
> =A0- the parser/generator code for WS becomes more complex and
> asymmetric because it must implement masking for some WS streams but
> not for others.
> =A0- unmasking cannot be done as single optimised pass over the data,
> but must be done on-the-fly in the parsing code.
> =A0- the options for masking algorithms is limited. =A0For example sessio=
n
> based keys could not be used in a MUX environment as the session key
> would need to be known to access the extension data to know the stream
> ID, so the session ID could be known so you can't know the session
> key. =A0 While session based masking may not be desirable for other
> reasons, this limitation indicates a fundamental limitation of the
> masked frame approach.
>
>
>
> Mask in Frame PROS:
> =A0+ Masking is independent of framing. =A0 Good layered protocol design.
> =A0+ Intermediaries that do not process the payload will not need to
> implement masking. This saves CPU, memory and also will make it easier
> to change and/or remove masking in future.
> =A0+ WS parsing code is simple and symmetric.
> =A0+ session based masking algorithms can be used if desired
> =A0+ Can utilise the extension data space to carry the key - thus
> testing the implementation of the parsing of extension data length and
> preventing implementations assuming this will be zero.
>
> Mask in Frame CONS:
> =A0- The frame op-code, flags and length are sent in the clear. =A0Of
> these, an attacker has reasonable control over the length field, so
> could conceivably send 8 characters including "GET\n" as the length
> (although this would be very difficult to do via the current
> javascript API. =A0There are also simple heuristic defences for this,
> such as fragmenting any frame that has a length that is all ascii and
> has a CR)
>
>
>
> In summary, =A0 mask in frame is far more flexible, low cost and
> demonstrable better design, at cost of exposing a very very unlikely
> subcase of an already very very unlikely vulnerability to an as of yet
> undiscovered threat, of which an exploitable variation is already in
> the wild using non ws clients.
>

From julian.reschke@gmx.de  Fri Feb 25 03:11:15 2011
Return-Path: <julian.reschke@gmx.de>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 840493A696E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:11:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.985
X-Spam-Level: 
X-Spam-Status: No, score=-103.985 tagged_above=-999 required=5 tests=[AWL=-1.386, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vHNY+8aBe8pN for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:11:14 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 4600C3A696D for <hybi@ietf.org>; Fri, 25 Feb 2011 03:11:13 -0800 (PST)
Received: (qmail invoked by alias); 25 Feb 2011 11:12:05 -0000
Received: from mail.greenbytes.de (EHLO [192.168.1.134]) [217.91.35.233] by mail.gmx.net (mp070) with SMTP; 25 Feb 2011 12:12:05 +0100
X-Authenticated: #1915285
X-Provags-ID: V01U2FsdGVkX1/W7CQm6JfWhC88ipkr1gOCr67VB8/zrcAQjnx6d5 whfuAZCd58E+K+
Message-ID: <4D678E7B.8030009@gmx.de>
Date: Fri, 25 Feb 2011 12:11:55 +0100
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Greg Wilkins <gregw@intalio.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Y-GMX-Trusted: 0
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 11:11:15 -0000

On 25.02.2011 12:02, Greg Wilkins wrote:
> So is there any support for changing away from masked framed to masked payloads?
> or should I just accept that we will be building masking into framing
> for all time?
> ...

I would support it, if this helps ;-)

From w@1wt.eu  Fri Feb 25 03:22:33 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B19F83A6973 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:22:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.94
X-Spam-Level: 
X-Spam-Status: No, score=-1.94 tagged_above=-999 required=5 tests=[AWL=0.103,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9obdxIv6+wU2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:22:33 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 933C33A6981 for <hybi@ietf.org>; Fri, 25 Feb 2011 03:22:32 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PBNKl2024421; Fri, 25 Feb 2011 12:23:20 +0100
Date: Fri, 25 Feb 2011 12:23:20 +0100
From: Willy Tarreau <w@1wt.eu>
To: Julian Reschke <julian.reschke@gmx.de>
Message-ID: <20110225112320.GA23570@1wt.eu>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <4D678E7B.8030009@gmx.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4D678E7B.8030009@gmx.de>
User-Agent: Mutt/1.4.2.3i
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 11:22:33 -0000

On Fri, Feb 25, 2011 at 12:11:55PM +0100, Julian Reschke wrote:
> On 25.02.2011 12:02, Greg Wilkins wrote:
> >So is there any support for changing away from masked framed to masked 
> >payloads?
> >or should I just accept that we will be building masking into framing
> >for all time?
> >...
> 
> I would support it, if this helps ;-)

count me in too :-)

Willy


From andy.warmcat.com@googlemail.com  Fri Feb 25 03:24:27 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EE883A693F for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:24:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.585
X-Spam-Level: 
X-Spam-Status: No, score=-3.585 tagged_above=-999 required=5 tests=[AWL=0.014,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K402SZHL-3r9 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 03:24:26 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id B90843A6828 for <hybi@ietf.org>; Fri, 25 Feb 2011 03:24:25 -0800 (PST)
Received: by wwb22 with SMTP id 22so147344wwb.13 for <hybi@ietf.org>; Fri, 25 Feb 2011 03:25:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=EHUCyiVSrnfAj1PvmMACWhTVOkACY9Bz8/bEMhHCXo8=; b=mepiEwLoUqKzsNt2iFx2aBdIpZmxJjCcuxIhP4UUcN4TY86lUz4j5jJarhHD7CTPXj S30L4g0n/eIpsBm9yQuulsB9W67hmFhsvkfGGduOb/aNhHn0UMNUD/zWj+84Tvimz2io 3zPCNPggWYs5LsUA2DpGCvU6kloO2RJP1bvX4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=l2X/bF7w9xXOvB4ZqQy01nXFVI41KXQzXIXJF/6cNqYc1AswGNzXcUEUSt18w5Rzb0 QptAoDjmprapGXP0pivNq0KZNWgCfJ5bSzpVc+SrQZ54DxDGl3AGuNi0Wy5NpkdtWS2k u1To4zOiVOJfxVJxNNW0euTDpoYUK4Chu0Q8g=
Received: by 10.227.137.197 with SMTP id x5mr1987052wbt.199.1298633117142; Fri, 25 Feb 2011 03:25:17 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id x1sm481029wbh.2.2011.02.25.03.25.16 (version=SSLv3 cipher=OTHER); Fri, 25 Feb 2011 03:25:16 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D67919B.4030301@warmcat.com>
Date: Fri, 25 Feb 2011 11:25:15 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Greg Wilkins <gregw@intalio.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 11:24:27 -0000

On 02/25/2011 11:02 AM, Somebody in the thread at some point said:

> So is there any support for changing away from masked framed to masked payloads?
> or should I just accept that we will be building masking into framing
> for all time?

Yes it would be a nice improvement.  It's not deadly if it doesn't 
happen but there are obvious advantages and it's pretty cheap to define 
in the spec.

-Andy

From ibc@aliax.net  Fri Feb 25 04:09:20 2011
Return-Path: <ibc@aliax.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C12203A69A4 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 04:09:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.654
X-Spam-Level: 
X-Spam-Status: No, score=-2.654 tagged_above=-999 required=5 tests=[AWL=0.023,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mDxQg1e1Impb for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 04:09:20 -0800 (PST)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id EC72D3A699C for <hybi@ietf.org>; Fri, 25 Feb 2011 04:09:19 -0800 (PST)
Received: by qwh6 with SMTP id 6so1327602qwh.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 04:10:11 -0800 (PST)
MIME-Version: 1.0
Received: by 10.224.37.81 with SMTP id w17mr1988728qad.132.1298635811369; Fri, 25 Feb 2011 04:10:11 -0800 (PST)
Received: by 10.229.89.77 with HTTP; Fri, 25 Feb 2011 04:10:11 -0800 (PST)
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
Date: Fri, 25 Feb 2011 13:10:11 +0100
Message-ID: <AANLkTinQaTX+o8NFm4hcV2+fqAbpbJC3mKWr+stvLpVq@mail.gmail.com>
From: =?UTF-8?Q?I=C3=B1aki_Baz_Castillo?= <ibc@aliax.net>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 12:09:20 -0000

2011/2/25 Greg Wilkins <gregw@intalio.com>:
> So is there any support for changing away from masked framed to masked pa=
yloads?
> or should I just accept that we will be building masking into framing
> for all time?

I do agree with your proposal. Mask in frame is obviously much better.

I've documented it in the wiki:

  http://trac.tools.ietf.org/wg/hybi/trac/wiki/MaskingProposals

--=20
I=C3=B1aki Baz Castillo
<ibc@aliax.net>

From alex@noemax.com  Fri Feb 25 04:15:16 2011
Return-Path: <alex@noemax.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E84E3A699A for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 04:15:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QS2Qm3HprikF for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 04:15:15 -0800 (PST)
Received: from mail.noemax.com (mail.noemax.com [64.34.201.8]) by core3.amsl.com (Postfix) with ESMTP id 305213A6841 for <hybi@ietf.org>; Fri, 25 Feb 2011 04:15:15 -0800 (PST)
Received: from HPdv73190ev by mail.noemax.com (IceWarp 9.4.1) with ASMTP (SSL) id IOP00403; Fri, 25 Feb 2011 14:16:03 +0200
From: "Alexander Philippou" <alex@noemax.com>
To: "'Greg Wilkins'" <gregw@intalio.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>	<AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>	<4D678E7B.8030009@gmx.de> <20110225112320.GA23570@1wt.eu>
In-Reply-To: <20110225112320.GA23570@1wt.eu>
Date: Fri, 25 Feb 2011 14:15:53 +0200
Message-ID: <00c501cbd4e5$c3c10fc0$4b432f40$@noemax.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
thread-index: AQMDbRuH8Ho82HltZyRQKzbr8jmYwAJbf+ohAmk4KWIB9JPefpFtJgnQ
Content-Language: en-us
Cc: 'Hybi' <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 12:15:16 -0000

> On Fri, Feb 25, 2011 at 12:11:55PM +0100, Julian Reschke wrote:
> > On 25.02.2011 12:02, Greg Wilkins wrote:
> > >So is there any support for changing away from masked framed to
> > >masked payloads?
> > >or should I just accept that we will be building masking into
framing
> > >for all time?
> > >...
> >
> > I would support it, if this helps ;-)
> 
> count me in too :-)

You have my +1 as well.

Alexander


From jat@google.com  Fri Feb 25 05:34:14 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 726453A69C1 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 05:34:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.87
X-Spam-Level: 
X-Spam-Status: No, score=-105.87 tagged_above=-999 required=5 tests=[AWL=0.106, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g18KPRACepF8 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 05:34:13 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id DBD7E3A69BA for <hybi@ietf.org>; Fri, 25 Feb 2011 05:34:12 -0800 (PST)
Received: from wpaz29.hot.corp.google.com (wpaz29.hot.corp.google.com [172.24.198.93]) by smtp-out.google.com with ESMTP id p1PDZ4v5000430 for <hybi@ietf.org>; Fri, 25 Feb 2011 05:35:04 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298640904; bh=FpujIpF0ZDlFNy7YZDpGxJeGwcA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=ZoS5FneD4V1t17+MLkQIMV+iH7EXwCcCVM2Y2MD+O7QTRn5GkJ3PX2mftckNuQ1hJ kISftJjrZbU6cTao3tWPA==
Received: from yxt33 (yxt33.prod.google.com [10.190.5.225]) by wpaz29.hot.corp.google.com with ESMTP id p1PDZ3FU014500 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 05:35:03 -0800
Received: by yxt33 with SMTP id 33so784913yxt.28 for <hybi@ietf.org>; Fri, 25 Feb 2011 05:35:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=5V9W9A/0Lx3vus/N1EQ5DIO6mPgiemx6niWVu6mA9f8=; b=QTEd8OM9xloyQq56Q3fMPper5isgpNmBAWvcFQVpFpHtVVoVxUu1QTX6/XLCa87306 sL9bfg4yShuvpSThZhTA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=FBonb9+fknyM/dTWYkffANGN8XrqTqq9rv6X8ojuvwiAjjJFEdOMWivetwbNBew+81 V5qK+NXVVQAQqiTATUHw==
Received: by 10.150.198.11 with SMTP id v11mr3545484ybf.388.1298640903235; Fri, 25 Feb 2011 05:35:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 05:34:42 -0800 (PST)
In-Reply-To: <4D6777BB.4070605@warmcat.com>
References: <OF9EDDF2DA.D45B4501-ON88257842.0027DEB4-88257842.002C3B97@playstation.sony.com> <4D6777BB.4070605@warmcat.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 08:34:42 -0500
Message-ID: <AANLkTinCzHU+qKd9oPNX_eUEFNTkoNH_hadCsGa3YSpn@mail.gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: multipart/alternative; boundary=000e0cd34888ba6813049d1b6501
X-System-Of-Record: true
Cc: hybi-bounces@ietf.org, hybi@ietf.org, Yutaka_Takeda@playstation.sony.com
Subject: Re: [hybi] With deflate-stream / websocket traceroute action
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 13:34:14 -0000

--000e0cd34888ba6813049d1b6501
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 4:34 AM, Andy Green <andy@warmcat.com> wrote:

> In fact you can do traceroute just with PING / PONG if the standard allowed
> for
>
>  1) PONG MAY contain additional text after the PING payload echo
>
>  2) PING MUST contain a TTL byte at the start
>
>  3) Intermediaries MAY decrement the TTL when passing on PING
>
>  4) PONG SHOULD be issued by intermediary IF TTL = 0 after the decrement
> and MUST be by the endpoint regardless of TTL
>
>  5) When PONG issued, intermediary or endpoint MAY append its ID text
>

I am not sure how useful it would be if all these are MAY's -- in particular
the TTL seems useless if you don't require that it be decremented at each
hop.

However, requiring this would be complicate some simple intermediaries
dramatically -- I don't know if the value gained is worth anything.  Also,
there would seem to be a problem exposing this to JS -- you wouldn't want
hostile JS to be able to get a layout of the network behind the firewall.

What does this gain over using ICMP or UDP-based traceroute?

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd34888ba6813049d1b6501
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 4:34 AM, Andy Green <spa=
n dir=3D"ltr">&lt;<a href=3D"mailto:andy@warmcat.com">andy@warmcat.com</a>&=
gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

In fact you can do traceroute just with PING / PONG if the standard allowed=
 for<br>
<br>
=C2=A01) PONG MAY contain additional text after the PING payload echo<br>
<br>
=C2=A02) PING MUST contain a TTL byte at the start<br>
<br>
=C2=A03) Intermediaries MAY decrement the TTL when passing on PING<br>
<br>
=C2=A04) PONG SHOULD be issued by intermediary IF TTL =3D 0 after the decre=
ment and MUST be by the endpoint regardless of TTL<br>
<br>
=C2=A05) When PONG issued, intermediary or endpoint MAY append its ID text<=
br></blockquote><div><br></div><div>I am not sure how useful it would be if=
 all these are MAY&#39;s -- in particular the TTL seems useless if you don&=
#39;t require that it be decremented at each hop.</div>

<div><br></div><div>However, requiring this would be complicate some simple=
 intermediaries dramatically -- I don&#39;t know if the value gained is wor=
th anything. =C2=A0Also, there would seem to be a problem exposing this to =
JS -- you wouldn&#39;t want hostile JS to be able to get a layout of the ne=
twork behind the firewall.</div>

<div><br></div><div>What does this gain over using ICMP or UDP-based tracer=
oute?</div></div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Goo=
gle<br>

--000e0cd34888ba6813049d1b6501--

From andy.warmcat.com@googlemail.com  Fri Feb 25 05:57:19 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B66543A69CC; Fri, 25 Feb 2011 05:57:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.562
X-Spam-Level: 
X-Spam-Status: No, score=-3.562 tagged_above=-999 required=5 tests=[AWL=0.038,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zn1dLLexbJVu; Fri, 25 Feb 2011 05:57:18 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id DAE453A69C7; Fri, 25 Feb 2011 05:57:17 -0800 (PST)
Received: by wwb22 with SMTP id 22so276367wwb.13 for <multiple recipients>; Fri, 25 Feb 2011 05:58:09 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=2KelKs5PsUEubFuqiBY6AsJylpppPvbhsg8nKL3KlUs=; b=keIH0H9XyXGIRcg7WTFe0FnOYAK+c3z6HoeNnt6l1p3PagrjtvkxyAJ2b6KKjiPlLM 0aP1/cp1U236hQVRwNKGnWgk21G/jheZA/EzmUJZOIyCjS62pha4UTrvB1Wmpeogfq+d 8f0MfaVzzySZfbU1gx0BLyhKb+8qVh5ds5e0s=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=ZWLGAwqAvyVGpIL3kobKI0AKyqh6ooL/O2jr/R96GtSqpdBI5WFoRQf3gOVuZtl3ZR upMBgJMuCz8w7+g0GDVg/et1RRo7oit5Z4dYYoECX2FzzkqffYtDmj3as4slsIZGO7MT OaxqKvkjLUbn3RMlVdLy6IQqnsWEj7Cfw3lME=
Received: by 10.227.195.137 with SMTP id ec9mr2101881wbb.218.1298642289562; Fri, 25 Feb 2011 05:58:09 -0800 (PST)
Received: from otae.warmcat.com (s15404224.onlinehome-server.info [87.106.134.80]) by mx.google.com with ESMTPS id f27sm570503wbf.7.2011.02.25.05.58.08 (version=SSLv3 cipher=OTHER); Fri, 25 Feb 2011 05:58:08 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D67B56F.8090306@warmcat.com>
Date: Fri, 25 Feb 2011 13:58:07 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <OF9EDDF2DA.D45B4501-ON88257842.0027DEB4-88257842.002C3B97@playstation.sony.com> <4D6777BB.4070605@warmcat.com> <AANLkTinCzHU+qKd9oPNX_eUEFNTkoNH_hadCsGa3YSpn@mail.gmail.com>
In-Reply-To: <AANLkTinCzHU+qKd9oPNX_eUEFNTkoNH_hadCsGa3YSpn@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi-bounces@ietf.org, hybi@ietf.org, Yutaka_Takeda@playstation.sony.com
Subject: Re: [hybi] With deflate-stream / websocket traceroute action
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 13:57:19 -0000

On 02/25/2011 01:34 PM, Somebody in the thread at some point said:

> However, requiring this would be complicate some simple intermediaries
> dramatically -- I don't know if the value gained is worth anything.

Well if it made trouble it could just be ignored and your intermediary 
is invisible to it without breaking anything.  But I guess most 
intermediaries which could consider it are going to be parsing the 
websocket stuff enough to understand the opcode anyway, it doesn't seem 
like any radical complication to do it from that basis.

>   Also, there would seem to be a problem exposing this to JS -- you
> wouldn't want hostile JS to be able to get a layout of the network
> behind the firewall.

That's why it was a MAY, just like some places filter ICMP ECHO in and out.

Some ninja intermediaries might not want to participate in a headcount 
either for their own reasons.

> What does this gain over using ICMP or UDP-based traceroute?

Well, traceroute is telling you about things that at least perform a 
routing action whereas this websocket-traceroute is telling you about 
websocket intermediaries on your path that might be meddling with your 
websocket stuff AS websocket stuff.

It's not critical but since it's only a small addition to existing 
opcodes, I thought I would describe it since adding opcodes to do it was 
mentioned.

-Andy

From dendicott@gmail.com  Fri Feb 25 05:59:49 2011
Return-Path: <dendicott@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 638223A69CF for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 05:59:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.598
X-Spam-Level: 
X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0dnXMR0c0SRg for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 05:59:48 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id C69D83A69C7 for <hybi@ietf.org>; Fri, 25 Feb 2011 05:59:47 -0800 (PST)
Received: by wyb42 with SMTP id 42so1728105wyb.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 06:00:39 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=dM/g43tKHa9P91KWcmgIAX+yjBKw40jduEUgN55uvek=; b=SWO5JvbV3PfM9Fz41k62qWn+Qx6kVor2LZ6zRF9S4iU/okipGlT9cbWidxZOGVlpTN kJmvwWSx5XeDxZRx2tlr2jIxtMZNpjKmN3puZCp9Wn/6vPlBXHYoOv62swLB1kHHq8Dv e6TksiCJ8RyBPe79EM47Gmu2SOfnsUPXcIqZE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=AT5UcZ4Dmsb7XSP7JubjNinf70U7Vl3vlffFeYjjtOZ/2mAtALwl5q8zNgiVOxJk7Y SaCTjkM9ZrstIGf/5qaY9HTyHz7/GFZ59PKiaharnqT/1AYIVgaR7zCUjtoLKzOMjgOo p6calfU0jOYiT6Unzcvenq9Zsi64WSd7WThro=
MIME-Version: 1.0
Received: by 10.216.121.132 with SMTP id r4mr286472weh.16.1298642439636; Fri, 25 Feb 2011 06:00:39 -0800 (PST)
Received: by 10.217.1.84 with HTTP; Fri, 25 Feb 2011 06:00:39 -0800 (PST)
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
Date: Fri, 25 Feb 2011 09:00:39 -0500
Message-ID: <AANLkTim8ksbcuR2xdxm8+XR-X8z+azgFj8iaXhHYWoiG@mail.gmail.com>
From: David Endicott <dendicott@gmail.com>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: multipart/alternative; boundary=0026188776c64e05c8049d1bc16f
Cc: hybi@ietf.org
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 13:59:49 -0000

--0026188776c64e05c8049d1bc16f
Content-Type: text/plain; charset=ISO-8859-1

+1 from the lurking contingent.


On Fri, Feb 25, 2011 at 6:02 AM, Greg Wilkins <gregw@intalio.com> wrote:

> So is there any support for changing away from masked framed to masked
> payloads?
> or should I just accept that we will be building masking into framing
> for all time?
>
> cheers
>
>
> On 1 February 2011 08:47, Greg Wilkins <gregw@intalio.com> wrote:
> > I think we still have a fundamental divide in opinions between masked
> framing:
> >
> >   [ key1][masked frame1] [key2][masked frame 2] ..... [keyN][masked frame
> N]
> >
> > vs mask in frame:
> >
> >   [ key1, masked payload 1 ]  [ key2, masked payload 2]  ...  [keyN,
> > masked payload N]
> >
> >
> > I'd like to eventually call for a straw poll on this, but would first
> > like to have a thread dedicated to the pros and cons of each.
> >
> >
> >
> > IMNSHO:
> >
> >
> > Masked Frames PROS:
> >  + all bytes other than the key are masked.  This prevents an attacker
> > from using frame fields like the length to send "clear text"
> >
> > Masked Frame CONS:
> >  - Masking is not independent of framing - poor layered protocol design.
> >  - all WS handling that needs to be aware of frame boundaries will
> > need to implement masking.  This will mean that more infrastructure
> > will have masking hard coded into it, thus it will soon become very
> > difficult, if not impossible to change framing as it will be baked
> > into WS aware intermediaries.
> >  - Intermediaries that do not care about content will still need to
> > unmask and remask the frames.
> >  - the parser/generator code for WS becomes more complex and
> > asymmetric because it must implement masking for some WS streams but
> > not for others.
> >  - unmasking cannot be done as single optimised pass over the data,
> > but must be done on-the-fly in the parsing code.
> >  - the options for masking algorithms is limited.  For example session
> > based keys could not be used in a MUX environment as the session key
> > would need to be known to access the extension data to know the stream
> > ID, so the session ID could be known so you can't know the session
> > key.   While session based masking may not be desirable for other
> > reasons, this limitation indicates a fundamental limitation of the
> > masked frame approach.
> >
> >
> >
> > Mask in Frame PROS:
> >  + Masking is independent of framing.   Good layered protocol design.
> >  + Intermediaries that do not process the payload will not need to
> > implement masking. This saves CPU, memory and also will make it easier
> > to change and/or remove masking in future.
> >  + WS parsing code is simple and symmetric.
> >  + session based masking algorithms can be used if desired
> >  + Can utilise the extension data space to carry the key - thus
> > testing the implementation of the parsing of extension data length and
> > preventing implementations assuming this will be zero.
> >
> > Mask in Frame CONS:
> >  - The frame op-code, flags and length are sent in the clear.  Of
> > these, an attacker has reasonable control over the length field, so
> > could conceivably send 8 characters including "GET\n" as the length
> > (although this would be very difficult to do via the current
> > javascript API.  There are also simple heuristic defences for this,
> > such as fragmenting any frame that has a length that is all ascii and
> > has a CR)
> >
> >
> >
> > In summary,   mask in frame is far more flexible, low cost and
> > demonstrable better design, at cost of exposing a very very unlikely
> > subcase of an already very very unlikely vulnerability to an as of yet
> > undiscovered threat, of which an exploitable variation is already in
> > the wild using non ws clients.
> >
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--0026188776c64e05c8049d1bc16f
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

+1 from the lurking contingent.<div><br><br><div class=3D"gmail_quote">On F=
ri, Feb 25, 2011 at 6:02 AM, Greg Wilkins <span dir=3D"ltr">&lt;<a href=3D"=
mailto:gregw@intalio.com">gregw@intalio.com</a>&gt;</span> wrote:<br><block=
quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=
 solid;padding-left:1ex;">
So is there any support for changing away from masked framed to masked payl=
oads?<br>
or should I just accept that we will be building masking into framing<br>
for all time?<br>
<br>
cheers<br>
<br>
<br>
On 1 February 2011 08:47, Greg Wilkins &lt;<a href=3D"mailto:gregw@intalio.=
com">gregw@intalio.com</a>&gt; wrote:<br>
&gt; I think we still have a fundamental divide in opinions between masked =
framing:<br>
&gt;<br>
&gt; =A0 [ key1][masked frame1] [key2][masked frame 2] ..... [keyN][masked =
frame N]<br>
&gt;<br>
&gt; vs mask in frame:<br>
&gt;<br>
&gt; =A0 [ key1, masked payload 1 ] =A0[ key2, masked payload 2] =A0... =A0=
[keyN,<br>
&gt; masked payload N]<br>
&gt;<br>
&gt;<br>
&gt; I&#39;d like to eventually call for a straw poll on this, but would fi=
rst<br>
&gt; like to have a thread dedicated to the pros and cons of each.<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; IMNSHO:<br>
&gt;<br>
&gt;<br>
&gt; Masked Frames PROS:<br>
&gt; =A0+ all bytes other than the key are masked. =A0This prevents an atta=
cker<br>
&gt; from using frame fields like the length to send &quot;clear text&quot;=
<br>
&gt;<br>
&gt; Masked Frame CONS:<br>
&gt; =A0- Masking is not independent of framing - poor layered protocol des=
ign.<br>
&gt; =A0- all WS handling that needs to be aware of frame boundaries will<b=
r>
&gt; need to implement masking. =A0This will mean that more infrastructure<=
br>
&gt; will have masking hard coded into it, thus it will soon become very<br=
>
&gt; difficult, if not impossible to change framing as it will be baked<br>
&gt; into WS aware intermediaries.<br>
&gt; =A0- Intermediaries that do not care about content will still need to<=
br>
&gt; unmask and remask the frames.<br>
&gt; =A0- the parser/generator code for WS becomes more complex and<br>
&gt; asymmetric because it must implement masking for some WS streams but<b=
r>
&gt; not for others.<br>
&gt; =A0- unmasking cannot be done as single optimised pass over the data,<=
br>
&gt; but must be done on-the-fly in the parsing code.<br>
&gt; =A0- the options for masking algorithms is limited. =A0For example ses=
sion<br>
&gt; based keys could not be used in a MUX environment as the session key<b=
r>
&gt; would need to be known to access the extension data to know the stream=
<br>
&gt; ID, so the session ID could be known so you can&#39;t know the session=
<br>
&gt; key. =A0 While session based masking may not be desirable for other<br=
>
&gt; reasons, this limitation indicates a fundamental limitation of the<br>
&gt; masked frame approach.<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; Mask in Frame PROS:<br>
&gt; =A0+ Masking is independent of framing. =A0 Good layered protocol desi=
gn.<br>
&gt; =A0+ Intermediaries that do not process the payload will not need to<b=
r>
&gt; implement masking. This saves CPU, memory and also will make it easier=
<br>
&gt; to change and/or remove masking in future.<br>
&gt; =A0+ WS parsing code is simple and symmetric.<br>
&gt; =A0+ session based masking algorithms can be used if desired<br>
&gt; =A0+ Can utilise the extension data space to carry the key - thus<br>
&gt; testing the implementation of the parsing of extension data length and=
<br>
&gt; preventing implementations assuming this will be zero.<br>
&gt;<br>
&gt; Mask in Frame CONS:<br>
&gt; =A0- The frame op-code, flags and length are sent in the clear. =A0Of<=
br>
&gt; these, an attacker has reasonable control over the length field, so<br=
>
&gt; could conceivably send 8 characters including &quot;GET\n&quot; as the=
 length<br>
&gt; (although this would be very difficult to do via the current<br>
&gt; javascript API. =A0There are also simple heuristic defences for this,<=
br>
&gt; such as fragmenting any frame that has a length that is all ascii and<=
br>
&gt; has a CR)<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; In summary, =A0 mask in frame is far more flexible, low cost and<br>
&gt; demonstrable better design, at cost of exposing a very very unlikely<b=
r>
&gt; subcase of an already very very unlikely vulnerability to an as of yet=
<br>
&gt; undiscovered threat, of which an exploitable variation is already in<b=
r>
&gt; the wild using non ws clients.<br>
&gt;<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</blockquote></div><br></div>

--0026188776c64e05c8049d1bc16f--

From jat@google.com  Fri Feb 25 06:41:02 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 454133A69DD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 06:41:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.386
X-Spam-Level: 
X-Spam-Status: No, score=-105.386 tagged_above=-999 required=5 tests=[AWL=0.591, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zM-gPp4401ES for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 06:41:01 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 368363A69D9 for <hybi@ietf.org>; Fri, 25 Feb 2011 06:41:01 -0800 (PST)
Received: from wpaz9.hot.corp.google.com (wpaz9.hot.corp.google.com [172.24.198.73]) by smtp-out.google.com with ESMTP id p1PEfqJO018370 for <hybi@ietf.org>; Fri, 25 Feb 2011 06:41:52 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298644913; bh=FxXMwX1Zlnh3oAo2oMBC++COJUA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=nUGwH8uEfGMopOVNDKI1KyThB3Bwerge7e96ZD9+2jkPL464CcRRfKA6nRSxc5LGn qCqWHCjrDZCgc0qsaa7MA==
Received: from gxk3 (gxk3.prod.google.com [10.202.11.3]) by wpaz9.hot.corp.google.com with ESMTP id p1PEfirn014054 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 06:41:50 -0800
Received: by gxk3 with SMTP id 3so499604gxk.12 for <hybi@ietf.org>; Fri, 25 Feb 2011 06:41:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=FQu1aoW+NxoMwkWCbAQr3GVAozMBvUey7I3Mje7jBjg=; b=bRJJHxvvoJOb6gXbWrmXIz3W9E2aIfDEotGuOI2k3f1TaIyFsioKKPQzcees9ZnD9i rac4d2xCCh2KbaDMZKhQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=K633jxhtTfG8g5ANkPscNdLpqW6D6LpquAsHPurAMXL9Nd88YJH0XKuP/RugNGCU15 CzwL+IJFBYTpa26+sjiw==
Received: by 10.151.142.6 with SMTP id u6mr3742207ybn.46.1298644910121; Fri, 25 Feb 2011 06:41:50 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 06:41:30 -0800 (PST)
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 09:41:30 -0500
Message-ID: <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 14:41:02 -0000

On Fri, Feb 25, 2011 at 6:02 AM, Greg Wilkins <gregw@intalio.com> wrote:
>
> So is there any support for changing away from masked framed to masked pa=
yloads?
> or should I just accept that we will be building masking into framing
> for all time?

I am willing to support it, but I think there are a few complications
that need to be addressed:
=C2=A0- you point out attacker control over the length - we would need to
codify exactly what would
   be done about it
 - I would not support use of any reserved bits to indicate the mask
is in the extension data
   portion of the frame - instead, it should simply be defined to be
the first 4 bytes if masking is
   present (ie, client->server frames)
 - it will complicate how mux and other extensions are defined, but I
think we can deal with that
   when we define those extensions

--
John A. Tamplin
Software Engineer (GWT), Google

From silvio.ventres@gmail.com  Fri Feb 25 07:31:21 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 904C93A69E6 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:31:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.322
X-Spam-Level: 
X-Spam-Status: No, score=-3.322 tagged_above=-999 required=5 tests=[AWL=0.277,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bnQwpP-mPfDg for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:31:20 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id AABCB3A68F1 for <hybi@ietf.org>; Fri, 25 Feb 2011 07:31:20 -0800 (PST)
Received: by vws6 with SMTP id 6so1630122vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 07:32:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=BFIvI6tE7uhsTbXQlj6oBKjje3ttld0YkxQjhtyZXeA=; b=hjG7/aM9WoNvSeiMZvyuZQ2cG1ermC+AK0psS6C6uQrheoylMKFy2PUHvz2myN19Ne qNsd7tJCOP+E9KX/EayOH/NMVtnHOWjuxYmmv6Sdatg6xPFRoyYqdwf+ex4IjNrZiyvj wFhCDzWWc/8MYEAKzALpWUlJ2TQUdt/psKOmU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=rshL3u63nv9hMDOVM/pVyrChCB3qOPqcjxzMGCPFT/Ibe+PBdUnlZMAFOLBpVgyzJJ mokEWlm8jcq2CribWr2ykZsj1I3QAshhgtWh7UkJXC0JIEu6VSILBr84NqSzB5T3aibg pge8CyisKZcm2Bvw9+LJnqqL9hLsnzNFTXbjo=
MIME-Version: 1.0
Received: by 10.52.174.38 with SMTP id bp6mr771368vdc.270.1298647931762; Fri, 25 Feb 2011 07:32:11 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 07:32:11 -0800 (PST)
In-Reply-To: <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com>
Date: Fri, 25 Feb 2011 17:32:11 +0200
Message-ID: <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 15:31:21 -0000

> One of the assumptions made as part of the security model is that there are
> non-WS endpoints that you can get to echo things. As such, if you (attacker
> JS) send that "magic string" as part of your attack, you could potentially
> get the attacked-server to echo that.


The original "magic-string" and "echo" solutions focused on the
requirement to make sure
the WS clients don't _inadvertently_ , by chance, stumble upon an HTTP
server and try to
communicate with it as if it was WS-compliant.

If you think that there is an attack vector in making an HTTP server
seem WS-compliant,
please elaborate on what you perceive as a likely attack scenario.

--
 silvio

From dave@cridland.net  Fri Feb 25 07:34:12 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 88FA73A69E6 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:34:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.449
X-Spam-Level: 
X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h8qtPAYjKTGI for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:34:11 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id 461683A69D5 for <hybi@ietf.org>; Fri, 25 Feb 2011 07:34:11 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id EFD9B116808F; Fri, 25 Feb 2011 15:35:02 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GFpgwrz9CSDs; Fri, 25 Feb 2011 15:35:00 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id DBC931168067; Fri, 25 Feb 2011 15:35:00 +0000 (GMT)
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com> <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com>
In-Reply-To: <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <2745.1298648100.749273@puncture>
Date: Fri, 25 Feb 2011 15:35:00 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, Server-Initiated HTTP <hybi@ietf.org>, =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed"
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 15:34:13 -0000

On Fri Feb 25 15:32:11 2011, Silvio Ventres wrote:
> > One of the assumptions made as part of the security model is that  
> there are
> > non-WS endpoints that you can get to echo things. As such, if you  
> (attacker
> > JS) send that "magic string" as part of your attack, you could  
> potentially
> > get the attacked-server to echo that.
> 
> 
> The original "magic-string" and "echo" solutions focused on the
> requirement to make sure
> the WS clients don't _inadvertently_ , by chance, stumble upon an  
> HTTP
> server and try to
> communicate with it as if it was WS-compliant.

That's the attack.

The idea is that an attacker uses websockets to communicate with a  
pure-HTTP server, and manages to mount a cross-protocol attack  
against it.

This mechanism prevents that attack by forcing the attacker's target  
to understand at least this much of the WS handshake.

Dave
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From silvio.ventres@gmail.com  Fri Feb 25 07:52:38 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4783B3A6A00 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:52:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.829
X-Spam-Level: 
X-Spam-Status: No, score=-2.829 tagged_above=-999 required=5 tests=[AWL=-0.230, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8frCOT7IMnm for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:52:36 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id D5C2F3A69FC for <hybi@ietf.org>; Fri, 25 Feb 2011 07:52:35 -0800 (PST)
Received: by vxg33 with SMTP id 33so1584462vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 07:53:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=3pZ8N3Axza4dk72z/9Lq12/0mIDyNPLN637rv8dMt28=; b=ANQRaTVql/z7xqM/OfSta0vNnhnLahBzzVrkYoBH2g/ziJZLlC3PKL5ncnSzzQOEq2 WGlpXZQ7x3Udmg008CzqHmMxjJ1lmeR0/87q3hIOey50KBQjs9KJzI7OwANKeKWfuLzD ZUULqj7onopP+AjAM5iZABo464BFidWwJ/LZQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=VCyMWD8bm5e+A+5E0D7pXyhGq9zWAhCtH69q+KY7STijWt0mGe0x0K4TZL0jSpku8T DuwfWDXoqt1xWiPgYEMqhO91QKKNr9ythh1sJLXfIM/+BADhcsa64SEqaCuwSoZZ2tWf 0neAHvaPwh4YNr7oEKbRxwDPgjMfbmKkm8sdg=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr4311247vdb.230.1298649207814; Fri, 25 Feb 2011 07:53:27 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 07:53:27 -0800 (PST)
In-Reply-To: <2745.1298648100.749273@puncture>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com> <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com> <2745.1298648100.749273@puncture>
Date: Fri, 25 Feb 2011 17:53:27 +0200
Message-ID: <AANLkTimWTsdzF9O+G6xuMd+gB-J0YW94Dgmq=o+qXoce@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 15:52:38 -0000

>> The original "magic-string" and "echo" solutions focused on the
>> requirement to make sure
>> the WS clients don't _inadvertently_ , by chance, stumble upon an HTTP
>> server and try to
>> communicate with it as if it was WS-compliant.
>
> That's the attack.

Dave, where is the attack here ?
The HTTP server would've provided the data anyway, so there is no
problem getting it by WS.
The JS writer already has the control of the JS execution, so he gets
no additional benefit from
the server response.

If an HTTP server, which sends data by HTTP normally, is made by some
smart web developer
to provide data in a compliant way to a WS client without changing the
HTTP server binary, that's
an ingenious solution that should be applauded.

What is the probable attack _scenario_ that you envision if the
computation part is removed?

--
 silvio

From theturtle32@gmail.com  Fri Feb 25 07:54:34 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E67D23A6A03 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:54:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QEkT6q8062CP for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 07:54:34 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id 3C6F83A6A00 for <hybi@ietf.org>; Fri, 25 Feb 2011 07:54:34 -0800 (PST)
Received: by iyj8 with SMTP id 8so1145344iyj.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 07:55:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:subject:references:from:content-type:x-mailer :in-reply-to:message-id:date:to:content-transfer-encoding :mime-version; bh=mZScRe/81em1Hh6LB6WjlkR2S9s3EBARO0WOCXMO3rM=; b=Acwylbt8zhnFsSC4Cxajd/B4D9T4wTNiwR/bMa7tzrHGPR+S4FDjU4QoTdtzq0LkVH +AECrzKw1wXZEc1giz5Y7yXDlt5cY2t8a51WmYLklao/+3PFvfz+U/zVAaVieDfkaAO+ 053GSmqBHLiEnPNMEIOu6+9UDl8rBmsiYljIQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:references:from:content-type:x-mailer:in-reply-to :message-id:date:to:content-transfer-encoding:mime-version; b=TGtKSrQUiiirA2k6NwsfNyv+rOYtgkmYaBuvKJoEn58ZZxGCiGgjSpE5ZdVMvsgyzw nWQCfjuh7HZ89/+zguePsYJ974ishlOOjPeKrsM2z5clTXssxMqxhtJMJ/ArEXLrPVrR gAZy/B2axSFABuofMBySLtkhhdmvWl898i2is=
Received: by 10.42.221.8 with SMTP id ia8mr922978icb.348.1298649326231; Fri, 25 Feb 2011 07:55:26 -0800 (PST)
Received: from [10.68.149.112] ([166.205.138.188]) by mx.google.com with ESMTPS id xa8sm542743icb.10.2011.02.25.07.55.24 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 25 Feb 2011 07:55:24 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
From: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=us-ascii
X-Mailer: iPhone Mail (8C148)
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
Message-Id: <04CCEEE1-2D2A-455E-8541-7FB72F412D9B@gmail.com>
Date: Fri, 25 Feb 2011 07:55:17 -0800
To: hybi <hybi@ietf.org>
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (iPhone Mail 8C148)
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 15:54:35 -0000

Yes, absolutely!!  Count me in.

Sent from my iPhone

On Feb 25, 2011, at 3:02 AM, Greg Wilkins <gregw@intalio.com> wrote:

> So is there any support for changing away from masked framed to masked pay=
loads?

From dave@cridland.net  Fri Feb 25 08:00:02 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 23EA73A67C2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:00:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.424
X-Spam-Level: 
X-Spam-Status: No, score=-2.424 tagged_above=-999 required=5 tests=[AWL=-0.125, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CoCRjswVyV2K for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:00:01 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id ABE7F3A69FC for <hybi@ietf.org>; Fri, 25 Feb 2011 08:00:00 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 527DF1168087; Fri, 25 Feb 2011 16:00:52 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BSWmOiEtuJmA; Fri, 25 Feb 2011 16:00:49 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id 902761168067; Fri, 25 Feb 2011 16:00:49 +0000 (GMT)
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com> <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com> <2745.1298648100.749273@puncture> <AANLkTimWTsdzF9O+G6xuMd+gB-J0YW94Dgmq=o+qXoce@mail.gmail.com>
In-Reply-To: <AANLkTimWTsdzF9O+G6xuMd+gB-J0YW94Dgmq=o+qXoce@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <2745.1298649649.571581@puncture>
Date: Fri, 25 Feb 2011 16:00:49 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, Server-Initiated HTTP <hybi@ietf.org>, =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
Content-Type: text/plain; delsp="yes"; charset="iso-8859-1"; format="flowed"
Content-Transfer-Encoding: 8Bit
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:00:02 -0000

On Fri Feb 25 15:53:27 2011, Silvio Ventres wrote:
> What is the probable attack _scenario_ that you envision if the
> computation part is removed?

The attack is a naïve HTTP server being deliberately confused by the  
(mis)use of the websocket API in the browser.

If you search through the archives for discussions concerning  
cross-protocol attacks, you should find the original discussion -  
you'll note that this was rehashed in entirety shortly after the IETF  
adopted the protocol, and so has gone through two sets of scruitiny  
and survived.

I'm highly skeptical about most of the security complexity added to  
this protocol, but the original arguments on this convinced me - I  
recommend you find them.

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From silvio.ventres@gmail.com  Fri Feb 25 08:05:09 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E3DB23A6A0E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:05:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.824
X-Spam-Level: 
X-Spam-Status: No, score=-2.824 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Df6ck2jSeLZD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:05:08 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id A1E573A69FE for <hybi@ietf.org>; Fri, 25 Feb 2011 08:05:08 -0800 (PST)
Received: by vxg33 with SMTP id 33so1597553vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:06:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=Ad00wiFXCENsqNzPmrhMEd9YEF3F0T+cGp/VOXaQkWY=; b=C4PPVqETKpHCqAqM4CZVGlfHYR3NuFHg+ebTS85V+pmaJJDkQZwFBh2MmPirTj7bWi ZQCmOfv2Lbkfe6qZHkAj6SMGD0pFQaZaSY91/ACUcpN/wH1rr4oM8sDVRmfRrkLLLeVj IWWjZ0DfKwGwM4yUAQjDcbiankS2ACIkETy4k=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=hk7z1ZvNYnqyBVC7Hy4VT47At5zYJnz5GTl9013m7b+keUuL1eMiSKBowVRkkIjYxS 4OR0Kx5NNNdaOkz+yLaEqEiSwtEnXPYkLYwsGJTvpNrzwiI4s6iORZd+q5LGXHKgeOtJ wYxCuPLK7kDAxPKunYBYQH+l5/bdC59mJqUS0=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr4338536vdb.230.1298649961076; Fri, 25 Feb 2011 08:06:01 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 08:06:01 -0800 (PST)
In-Reply-To: <2745.1298649649.571581@puncture>
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com> <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com> <2745.1298648100.749273@puncture> <AANLkTimWTsdzF9O+G6xuMd+gB-J0YW94Dgmq=o+qXoce@mail.gmail.com> <2745.1298649649.571581@puncture>
Date: Fri, 25 Feb 2011 18:06:01 +0200
Message-ID: <AANLkTimqNEDgxgVOHmE_nRDFKggus89-LA8KeopJy+Kk@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:05:10 -0000

>> What is the probable attack _scenario_ that you envision if the
>> computation part is removed?
>
> The attack is a na=EFve HTTP server being deliberately confused by the
> (mis)use of the websocket API in the browser.

Why did you respond to this request if you don't remember or don't want to
quote the attack _scenario_ ?

> I'm highly skeptical about most of the security complexity added to this
> protocol, but the original arguments on this convinced me - I recommend y=
ou
> find them.

If the attacks were actually probable and convincing, you should have remem=
bered
and quoted them, instead of pulling the "go read archives" card again.

--
 silvio

From theturtle32@gmail.com  Fri Feb 25 08:06:46 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B3BA63A69BA for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:06:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bgiRSWobxB3m for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:06:45 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id A10B43A69EC for <hybi@ietf.org>; Fri, 25 Feb 2011 08:06:45 -0800 (PST)
Received: by iwl42 with SMTP id 42so1367805iwl.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:07:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:subject:references:from:content-type:x-mailer :in-reply-to:message-id:date:to:content-transfer-encoding :mime-version; bh=ib9InoIOasHkLDh2SPFI+Fr3MGq73ys9dbXrkAKduNU=; b=f8yZK57U769C7NqOcFKCPaekujIalFG99FAgqjML+Pme6BeDuR7JHDlGmzgwO0WJ8d u6wKdRU6gmrCPfSvVFzUeYc0XWA/RV7N0rteEHzxOiiDS9D0eOhN+CqAd1riT8Z5OLAn 35tK9yr8YYox4B7kUmaSptnDekwh9kdDLQt40=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:references:from:content-type:x-mailer:in-reply-to :message-id:date:to:content-transfer-encoding:mime-version; b=A5vWe1TQRWezW6Szftj7Kz+br35j4RVJvqSp7DzajRmrSI2//IcjPNLuyhMjUBUVTS uSa7pCHim2aGyv6k4eUcveKeXU+37natzsEQNnPk1TnytseHrAyn45hWIC5Tmow2ziAq fVq2AB/u331tMiumuRStP3llOZvtAnh1P3E9c=
Received: by 10.42.173.130 with SMTP id r2mr936888icz.273.1298650058181; Fri, 25 Feb 2011 08:07:38 -0800 (PST)
Received: from [10.68.149.112] ([166.205.138.188]) by mx.google.com with ESMTPS id wt14sm550321icb.4.2011.02.25.08.07.36 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 25 Feb 2011 08:07:37 -0800 (PST)
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com> <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com> <2745.1298648100.749273@puncture> <AANLkTimWTsdzF9O+G6xuMd+gB-J0YW94Dgmq=o+qXoce@mail.gmail.com> <2745.1298649649.571581@puncture>
From: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=utf-8
X-Mailer: iPhone Mail (8C148)
In-Reply-To: <2745.1298649649.571581@puncture>
Message-Id: <105684EC-0F14-483E-865F-C7886720366E@gmail.com>
Date: Fri, 25 Feb 2011 08:07:30 -0800
To: hybi <hybi@ietf.org>
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (iPhone Mail 8C148)
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:06:46 -0000

Also, websockets significantly relaxes the same-origin policy that binds xhr=
.  If you *could* gain access to data from another non-consenting domain via=
 a cross-protocol attack against http, that represents a cross-site-scriptin=
g vulnerability as well.

That said, I think this scenario highly unlikely.  The handshake we have in p=
lace now is simple enough and at the same time categorically protects agains=
t this kind of attack. It's a good compromise.

Brian

Sent from my iPhone

On Feb 25, 2011, at 8:00 AM, Dave Cridland <dave@cridland.net> wrote:

> On Fri Feb 25 15:53:27 2011, Silvio Ventres wrote:
>> What is the probable attack _scenario_ that you envision if the
>> computation part is removed?
>=20
> The attack is a na=C3=AFve HTTP server being deliberately confused by the (=
mis)use of the websocket API in the browser.
>=20
> If you search through the archives for discussions concerning cross-protoc=
ol attacks, you should find the original discussion - you'll note that this w=
as rehashed in entirety shortly after the IETF adopted the protocol, and so h=
as gone through two sets of scruitiny and survived.
>=20
> I'm highly skeptical about most of the security complexity added to this p=
rotocol, but the original arguments on this convinced me - I recommend you f=
ind them.
>=20
> Dave.
> --=20
> Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
> - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
> - http://dave.cridland.net/
> Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

From silvio.ventres@gmail.com  Fri Feb 25 08:07:01 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE20D3A6A0E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:07:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.319
X-Spam-Level: 
X-Spam-Status: No, score=-3.319 tagged_above=-999 required=5 tests=[AWL=0.280,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9S0fblpKHiEb for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:07:00 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 821713A69BA for <hybi@ietf.org>; Fri, 25 Feb 2011 08:07:00 -0800 (PST)
Received: by vws6 with SMTP id 6so1667314vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:07:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=X4sL7jPpm2Lnyp9Tq1K5wYXyYMy9wZMVrSAg+HlgL6I=; b=xXfuV71im4PZqsko+HKFVKOuTPY0okK2r5nSEW9qcgFtssywLQA5e4Kxike5n7sTs7 e70RZDQPqMBVZpYNIwnyeOL7IF35lQhRkQPZz3t+uwsu9Cg64FoghLxzF7X50OHZM1Jd lPy5I+yj8Vef1rueLrX64ih0mJyNJLEsgjuVg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=l/5FBc+lILE222dGusWyswF6RYxhdWkmRIF+vavnspc/IcWNVNxBIbLufra1rkFqIF wwocJUGaWc4lMXQFUPfGH7/vDS68GypmdZUNO/r9WcJr/Tx32Vme9zQF6sYX6CNhxAnx ZU7q+b+Vkr26ItRYCAvjXUs5ii6DhqH0i5cEk=
MIME-Version: 1.0
Received: by 10.52.159.163 with SMTP id xd3mr4280514vdb.30.1298649823151; Fri, 25 Feb 2011 08:03:43 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 08:03:42 -0800 (PST)
In-Reply-To: <1298586760.2498.603.camel@ds9.ducksong.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com>
Date: Fri, 25 Feb 2011 18:03:42 +0200
Message-ID: <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: "Pat McManus @Mozilla" <mcmanus@ducksong.com>,  =?ISO-2022-JP?B?SWFuIEZldHRlICgbJEIlJCUiJXMlVSUnJUMlRiUjGyhCKQ==?= <ifette@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:07:02 -0000

> consider this:
> http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpTransaction.cpp#683

Let's start from the attack vector itself. The one prevented by masking.

Is the subject attack vector possible with POST requests ?

If the answer is YES, than there is no point protecting from it in WS,
as the POST request is much more supported in the wild and can be
used as a medium to mount the attack _right now_.

If the answer is NO, than, as proposed before, the WS can get to the
_same_ level of protection from this attack as HTTP, by making each
request look like an HTTP POST request.

Thus, _regardless_ of the answer, the masking has no reason to exist.

The point is that there is absolutely _no reason_ to make WS more secure
than HTTP, and thus, if an attack vector is found, bringing the protection
to the level of HTTP is enough.

Why sacrifice _actually-useful_ features, such as low computational complexity,
source code simplicity and debug ability for protections from attacks
that, if they
will ever happen, will happen in the _other_ protocol ?

<sarcasm>
Why not add elliptic-curve crypto to the whole stream ? That will make it
look even _more_ random than XOR masking ? Why not add a dependency
that the endpoint take a random number from a known-good PRNG, and
specify that a PRNG with parameters less than X,Y,Z are not compliant ?
Then for each reply, the endpoint would verify the entropy of the stream on
the wire and discard it in case it's not random enough ?
</sarcasm>

--
 silvio

From theturtle32@gmail.com  Fri Feb 25 08:13:18 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AC5043A6452 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:13:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1jBjk2qEcEmz for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:13:18 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id 0843E3A63C9 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:13:17 -0800 (PST)
Received: by iyj8 with SMTP id 8so1162106iyj.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:14:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:subject:references:from:content-type:x-mailer :in-reply-to:message-id:date:to:content-transfer-encoding :mime-version; bh=BhoHDjdYa3VLyt+7dPOJugEA2XrQGi6Rb9lI/XDfBao=; b=qLSnQOOaorw2hG9VoP2SUU1iwYxXeKVycafwjbrcgeim/R8xdpu0o/uLOYja9SgK/n WlSypcCvNX2XgeYRCrIsLMJTNYbmxWrCi/FJ5cWMygWfam9+cWal4SZ+rNaIlB7z3IVY AH16ZYCpKOxQHSmJfohSWVogz6r2SbE+tzVnM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:references:from:content-type:x-mailer:in-reply-to :message-id:date:to:content-transfer-encoding:mime-version; b=wPF2kJG7g5t3PyuWw+MkeKerPL1jbK62knHfbecVl0WtyiAcRXTsmxXNKF3skKMYwx 3M/SAjevA5BOzY/zdJIV2NIm6CCDdxkJ8BrVoXuH38ITPtJjJCAv2n8ua0IzEJuBXB+z BKaYy3ILCHBhQorybItBeCo0i7jIuTDDzbICM=
Received: by 10.42.224.136 with SMTP id io8mr965612icb.202.1298650450622; Fri, 25 Feb 2011 08:14:10 -0800 (PST)
Received: from [10.68.149.112] ([166.205.138.188]) by mx.google.com with ESMTPS id k38sm556256ick.21.2011.02.25.08.14.09 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 25 Feb 2011 08:14:09 -0800 (PST)
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com>
From: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=us-ascii
X-Mailer: iPhone Mail (8C148)
In-Reply-To: <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com>
Message-Id: <771C3A12-ABA2-45B5-9763-81F0AA2F50EB@gmail.com>
Date: Fri, 25 Feb 2011 08:14:02 -0800
To: hybi <hybi@ietf.org>
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (iPhone Mail 8C148)
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:13:18 -0000

You jest, but we had a very long discussion where some members of the wg str=
ongly advocated full aes encryption for the exact reason of making all the b=
ytes that much more random looking.  We eventually settled on the per-frame X=
OR as a compromise.

Brian

Sent from my iPhone

On Feb 25, 2011, at 8:03 AM, Silvio Ventres <silvio.ventres@gmail.com> wrote=
:

> <sarcasm>

From dave@cridland.net  Fri Feb 25 08:21:26 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D56083A69E9 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:21:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.406
X-Spam-Level: 
X-Spam-Status: No, score=-2.406 tagged_above=-999 required=5 tests=[AWL=-0.107, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HWIu0VW33jPM for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:21:25 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id 67C643A63D2 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:21:25 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 701D71168087; Fri, 25 Feb 2011 16:22:13 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j0S1CYOA0ekk; Fri, 25 Feb 2011 16:21:29 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id DA97F1168067; Fri, 25 Feb 2011 16:21:28 +0000 (GMT)
References: <AANLkTimHk1xxB-RZzJ5157ut_UVUKTL3HXp0qtE_899V@mail.gmail.com> <AANLkTim2bZwjgBX=xRXxXd4o24ptv8947YueTSNsam0p@mail.gmail.com> <AANLkTikaj9n8tVBbUUm-DqTPGpEwcjBDBJNtOC41BAbe@mail.gmail.com> <AANLkTikHxVX8GZ=irM2dQPAEBw-OTZVrheD6fS7V-qLg@mail.gmail.com> <AANLkTi=nb-GLZ=MOf9K1UbxZfdhi-Btz63Seayfcm2tN@mail.gmail.com> <2745.1298648100.749273@puncture> <AANLkTimWTsdzF9O+G6xuMd+gB-J0YW94Dgmq=o+qXoce@mail.gmail.com> <2745.1298649649.571581@puncture> <AANLkTimqNEDgxgVOHmE_nRDFKggus89-LA8KeopJy+Kk@mail.gmail.com>
In-Reply-To: <AANLkTimqNEDgxgVOHmE_nRDFKggus89-LA8KeopJy+Kk@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <2745.1298650888.862021@puncture>
Date: Fri, 25 Feb 2011 16:21:28 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, Server-Initiated HTTP <hybi@ietf.org>, =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
Content-Type: text/plain; delsp="yes"; charset="iso-8859-1"; format="flowed"
Content-Transfer-Encoding: 8Bit
Subject: Re: [hybi] Computation requirement in the handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:21:26 -0000

On Fri Feb 25 16:06:01 2011, Silvio Ventres wrote:
> >> What is the probable attack _scenario_ that you envision if the
> >> computation part is removed?
> >
> > The attack is a naïve HTTP server being deliberately confused by  
> the
> > (mis)use of the websocket API in the browser.
> 
> Why did you respond to this request if you don't remember or don't  
> want to
> quote the attack _scenario_ ?
> 
> 
But I did. There isn't a detailed exploit documented for a number of  
reasons - not least because the framing was still up in the air at  
that point. It may not even be possible, but it's a terribly simple,  
and one-off, bit of code.

It might be true that masking also protects against this particular  
pattern, mind, but I'm choosing to remain optimistic we'll eventually  
be able to discard masking, so having this protected against  
separately seems beneficial to me.


> > I'm highly skeptical about most of the security complexity added  
> to this
> > protocol, but the original arguments on this convinced me - I  
> recommend you
> > find them.
> 
> If the attacks were actually probable and convincing, you should  
> have remembered
> and quoted them, instead of pulling the "go read archives" card  
> again.

Nope, because it was discussed over a period of several weeks around  
a year ago, and I've long-since put it out of my mind. I can barely  
recall the people involved in the thread, I'm afraid. I do remember  
enough to summarize the essentials, though, which I did for you. If  
you care about the original discussions, please do the digging  
yourself.

Besdies which, whether I've forgotten something has no bearing on its  
importance, otherwise my wife's birthday would rank equivalent with  
whether I've fed the cats this morning. ;-)

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From bruce@callenish.com  Fri Feb 25 08:22:16 2011
Return-Path: <bruce@callenish.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 92F893A63EB for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:22:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wtVipNis0MQn for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:22:14 -0800 (PST)
Received: from biz82.inmotionhosting.com (biz82.inmotionhosting.com [74.124.202.87]) by core3.amsl.com (Postfix) with ESMTP id 7A1A53A63D2 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:22:14 -0800 (PST)
Received: from [24.108.133.142] (helo=[192.168.145.101]) by biz82.inmotionhosting.com with esmtpa (Exim 4.69) (envelope-from <bruce@callenish.com>) id 1Pt0RQ-0003hD-UU for hybi@ietf.org; Fri, 25 Feb 2011 08:22:53 -0800
Message-ID: <4D67D76C.4030209@callenish.com>
Date: Fri, 25 Feb 2011 08:23:08 -0800
From: Bruce Atherton <bruce@callenish.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Hybi <hybi@ietf.org>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - biz82.inmotionhosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - callenish.com
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:22:16 -0000

On 25/02/2011 3:02 AM, Greg Wilkins wrote:
> So is there any support for changing away from masked framed to masked payloads?
> or should I just accept that we will be building masking into framing
> for all time?
>

+1.

From silvio.ventres@gmail.com  Fri Feb 25 08:43:39 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BBB663A63EB for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:43:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.325
X-Spam-Level: 
X-Spam-Status: No, score=-3.325 tagged_above=-999 required=5 tests=[AWL=0.274,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SWhbUjR-tqbh for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:43:39 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id E77723A6781 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:43:38 -0800 (PST)
Received: by vws6 with SMTP id 6so1704081vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:44:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=nOYHVb5cbQynaUyMyPjoaQio/RiLlUm/1gMcphoHSOs=; b=LGJI8bvtHs2nhRPP9oC1ho7yC8+wr/DWX73QMutPxMp01Wpo38wxigfCJe0KAGrD2l TGiiiceDeNyeTwuvw8USZW/eHb3Nv15nEbcz+KR+7cUn0tIgXu3ihNGEsGow5PF2QsB2 o4Qpso3tHdqLMkOEGewxuOxwO6nRF6kjNBI6s=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=CgnXGHkkQPAzEXAOIPEOAvK8vuoOBELfNufbwJhuAfgq2YnaRCVtReWaSQ6d5F8/tR Btg1weE3mdMnYyCrMzOtizvfv7x0n6GVlQAzIXXqKme+Rdng0YE9S865EPKMqYOIS/eJ wao03I7nBdOoIuoXo5kFflsU2z2LQ8fzUnmDs=
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr4432613vdb.150.1298652271138; Fri, 25 Feb 2011 08:44:31 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 08:44:31 -0800 (PST)
Date: Fri, 25 Feb 2011 18:44:31 +0200
Message-ID: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com, Salvatore.Loreto@ericsson.com, jhildebr@cisco.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:43:39 -0000

Hello, Ian.

Since both prior threads have been swamped in meta-discussions,
starting a new thread to clear up the question.

Based on your (Ian Fette's) comments, the handshake is meant to serve 2 goals:

1. Prevent WS client from _mistakenly_ identifying an HTTP server as
WS-compliant
2. Prevent WS client from _intentfully_ communicating with an HTTP
server via WS protocol.


The first goal is indeed a good idea to prevent confusing WS clients
connecting to legacy HTTP servers.
It is accomplished by using the WS-specific "magic string" and "echo procedure".

The second goal is argued to protect from some kind of an attack.
Since it is not readily apparent what attack vector is being
considered here, and, indeed,
the request from the point-of-view of HTTP server is a standard HTTP request,
this is a formal request:

REQUEST: Please provide an example of an actual attack scenario
possible in case WS does not implement computational-handshake.

Unless such attack scenario cannot be provided, strongly recommend:

RECOMMEND to remove the handshake-computation feature from the specification.

--
 silvio

From jat@google.com  Fri Feb 25 08:44:44 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2439A3A6A01 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:44:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.451
X-Spam-Level: 
X-Spam-Status: No, score=-105.451 tagged_above=-999 required=5 tests=[AWL=0.526, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CrmI5L1wq3P9 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:44:43 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 18F323A6781 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:44:42 -0800 (PST)
Received: from wpaz1.hot.corp.google.com (wpaz1.hot.corp.google.com [172.24.198.65]) by smtp-out.google.com with ESMTP id p1PGjY33006490 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:45:34 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298652335; bh=SuPSoYmgXEqItI+Ysf+QW1Js2Ak=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=qYfUlMq82FRrxiD2WKTkmzOk2UfVkdVtQXxIxqo39OufJO/PMs564j+/tdzkq/91P 0YFHoxQ2m71RnnSxp4J5g==
Received: from gyd10 (gyd10.prod.google.com [10.243.49.202]) by wpaz1.hot.corp.google.com with ESMTP id p1PGjXsL028396 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 08:45:33 -0800
Received: by gyd10 with SMTP id 10so1217466gyd.40 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:45:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=sQPWwsg/YaDC2MwjBVt3U9vGpNOk5WNkxGw1Iqf7jeo=; b=IFuuYZUBF+dIKGEIZ9TcwIA+Hsq4gOuES80uhPfFbF/z2pMy0kKstx2Dkc1K4b20/U f2p71mkmUbnDzXpctOYg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=iyhkp+DGFW50xGuNFd5U+uveANkJRJe8A645dAPmSt5XkD/t4IUYRMjerPwYNbYIs5 3zCsW3dOlBcHJwfbPsjA==
Received: by 10.150.195.3 with SMTP id s3mr3794576ybf.274.1298652333101; Fri, 25 Feb 2011 08:45:33 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 08:45:12 -0800 (PST)
In-Reply-To: <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 11:45:12 -0500
Message-ID: <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=UTF-8
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:44:44 -0000

On Fri, Feb 25, 2011 at 11:03 AM, Silvio Ventres
<silvio.ventres@gmail.com> wrote:
> If the answer is NO, than, as proposed before, the WS can get to the
> _same_ level of protection from this attack as HTTP, by making each
> request look like an HTTP POST request.

How does making it look like a POST apply?   WebSockets is a
bidirectional communication, so you can't send individual frames in
POST messages because there is no way for the server to initiate a
response to a POST that hasn't been sent yet.  The alternative, which
I mentioned before, would be to do a POST of unknown length using
chunked encoding, and each frame is sent as a chunk.  The problem is
that many intermediaries do things based on the current usage of POST,
such as not opening the connection to the server until it receives the
complete request which would never happen in the case of WebSockets.

-- 
John A. Tamplin
Software Engineer (GWT), Google

From silvio.ventres@gmail.com  Fri Feb 25 08:53:42 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E53ED3A6781 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:53:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.83
X-Spam-Level: 
X-Spam-Status: No, score=-2.83 tagged_above=-999 required=5 tests=[AWL=-0.231,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EG6VDElX9T5M for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 08:53:40 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 56B213A67B0 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:53:40 -0800 (PST)
Received: by vxg33 with SMTP id 33so1645862vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 08:54:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=GK1ljoISTTxvTOtE512eyw3i24fVcEYM7iWlT8iz+js=; b=yDtr+V05blLCwCMW8iU1Lhv4ETmm3KYTcSKcZE0X4TGaXVjBZYJ2Hygm+wfcMtxbqx iaJLy858tS2XY8aYHis3Yc5g9e7Lz6v7y11TXEj47LL51RK2P09EwvaIm5Ny2u38babp 9vT5cVA3thLxcx3TmtzUX+LoCr6h9ziJNuK80=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=S7UtYVMHSU0hWpAkw5KtMer1TQ8qgTMsQUB+dhx5EuSNhNILsvF3oYr9gAeEBakLvG U3lWGJgUYW7OPZ0krWT8nos+FHYdA7p44Ss+J8ml2mtDno7uCrIMbNkx15ITDvIXFIRO XFKrQLsfmDWCg/WVEy1IOTiGPE7PMpidiW8ek=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr4451557vdb.230.1298652860058; Fri, 25 Feb 2011 08:54:20 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 08:54:20 -0800 (PST)
Date: Fri, 25 Feb 2011 18:54:20 +0200
Message-ID: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com, Salvatore.Loreto@ericsson.com, jhildebr@cisco.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 16:53:42 -0000

Hello, Ian.

As the previous threads have been swamped in meta discussions, here is
a clear request "for comments" :)

The masking feature as used in the current spec, has, as one of the
subgoals, prevention of a family of attacks
where the attacker can cause mischief by control of actual
"data-on-the-wire" plaintext.

While this family of attacks may well exist, here is the counterargument:

1. HTTP POST currently has the ability to send binary data of arbitrary content.
2. HTTP POST is much more widely deployed than WS
3. HTTP POST headers can be faked in each WS message

Given the above, and that there is no reason to have WS provide "more"
security than HTTP,
since HTTP will be preferred medium in practice,

REQUEST: Is there a reason to not use fake POST-like headers in each WS message,
thus bringing the security to the same level as HTTP POST ?

This would preserve sendfile() as well as easy debug and make
implementations simpler.

If there is no such reason,
RECOMMEND: removal of masking feature and addition of fake HTTP-POST
headers to each
outgoing WS frame.
OR: make this security mechanism OPTIONAL.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 09:00:23 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E03E33A67BD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:00:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.326
X-Spam-Level: 
X-Spam-Status: No, score=-3.326 tagged_above=-999 required=5 tests=[AWL=0.273,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WjhSTw0LOPe7 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:00:21 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id EFB7F3A67B0 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:00:20 -0800 (PST)
Received: by vws6 with SMTP id 6so1720833vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:01:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=I9RQvcKRq/yn74lZ3k0ZPqYPUa3oJmtpEzu8NIsk3/8=; b=WuLsJU/jZyniU21Om7pugegrPpBEAFJizN0cHKtiPUcDow6ytl+/0sSoTigW7UchbW mil6G2oMjebHHIWYtLTmB5WMwncTYrePvsUkr0KVpu1fAz/EPaUoG2PDwNiWCUGUKmFC r7bKWA8YacLADD+J9naq9Vim/JsIclDUgk5zs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=Ga53M3xqDLgKyXmv5SbeV9g/8W+0byOMSIeDWyeA/vvEBAComo3S9NmOX690+8fDjO FVIO1brHMHAkn0yv65/pW/NBRmj2qAlVaNW6W0UK0vh3vgSyBtErJCLZ0AVnoBip77YC hzkWLat5JzyP6L8VWKETOFOx2VWB72VSgSZOY=
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr4466609vdb.190.1298653272886; Fri, 25 Feb 2011 09:01:12 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:01:12 -0800 (PST)
In-Reply-To: <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com>
Date: Fri, 25 Feb 2011 19:01:12 +0200
Message-ID: <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:00:23 -0000

> How does making it look like a POST apply? =A0 WebSockets is a
> bidirectional communication, so you can't send individual frames in
> POST messages because there is no way for the server to initiate a
> response to a POST that hasn't been sent yet. =A0The alternative, which

What is the exact problem that you envision here ?
The client would include POST headers in each request.

If the proxy does not allow server to reply multiple times to the client,
whether you use POST or not is irrelevant.

"POST .... <ws control-start> ... <ws control-end>"

> I mentioned before, would be to do a POST of unknown length using
> chunked encoding, and each frame is sent as a chunk.

How about a POST of a known length of the frame, and each frame is
sent as a separate
POST message ?

> The problem is
> that many intermediaries do things based on the current usage of POST,
> such as not opening the connection to the server until it receives the
> complete request which would never happen in the case of WebSockets.

Well, then make each message a complete request.

--
 silvio

From jat@google.com  Fri Feb 25 09:00:28 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 86A773A6781 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:00:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.878
X-Spam-Level: 
X-Spam-Status: No, score=-105.878 tagged_above=-999 required=5 tests=[AWL=0.099, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rz9kaoBYqiJt for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:00:27 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 8685C3A67B0 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:00:27 -0800 (PST)
Received: from kpbe11.cbf.corp.google.com (kpbe11.cbf.corp.google.com [172.25.105.75]) by smtp-out.google.com with ESMTP id p1PH1JaT032020 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:01:19 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298653280; bh=i+z0kZrzZhRG306rVlmx9URDCJg=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=LN6+IsxkmXTdVIGpwkbE90hZtpl/GV9yQ2lS8DSpRyxg2jZdWB1uhJ9Lyv5rZ9DuP coqR+13NXzFmhScmQLemA==
Received: from gxk8 (gxk8.prod.google.com [10.202.11.8]) by kpbe11.cbf.corp.google.com with ESMTP id p1PH1I1s006586 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 09:01:18 -0800
Received: by gxk8 with SMTP id 8so782468gxk.19 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:01:18 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=r1K/n10zeW9HbV6nUvVXUV93PmpY4m2Ln9aXbvVLZSk=; b=psu641WU6AToX1oois4eslG2DfHz2k4q1A1ngQJllFbj1B9FtyXbhaTInsaas+x8db WhlGOjKG2NiCBarKVMOA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=eqNr9WtSSSBwxWcjAg/0vVVCKGWh9zNaWpzytZSxt2QgNzrkbg6t6oEDWu7LI0/CCe IUlhtSD+vFthGc8qoW/w==
Received: by 10.150.195.3 with SMTP id s3mr3815677ybf.274.1298653277868; Fri, 25 Feb 2011 09:01:17 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 09:00:57 -0800 (PST)
In-Reply-To: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 12:00:57 -0500
Message-ID: <AANLkTim7apXF-qs5W1n6yivzPALxFWizypMXPJmQfpjj@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=UTF-8
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:00:28 -0000

On Fri, Feb 25, 2011 at 11:44 AM, Silvio Ventres
<silvio.ventres@gmail.com> wrote:
> 2. Prevent WS client from _intentfully_ communicating with an HTTP
> server via WS protocol.

This is actually a whole family of cross-protocol attacks.  Using
WebSockets to avoid the same-origin restrictions of HTTP as accessed
from a browser is just one category of this attack.  As an example of
the sort of cross-protocol attacks we want to avoid, see where HTTP
POST was used to send spam via vulnerable SMTP servers.  Imagine if
hostile JS could communicate with an SMTP server to send spam just by
browsing to the attacker's web page.

> RECOMMEND to remove the handshake-computation feature from the specification.

As a newcomer, constantly asking us to provide you with proof of
everything that has been decided so far is getting tiresome.  Do you
really think everyone involved here just decided to make things up to
put in the protocol and that someone showing up at the last minute is
the only one that can point out these obvious flaws?  Additional
contributions are certainly welcome, but so far the tone has simply
been "this is ridiculous and I don't see why it is there, please
remove it".

-- 
John A. Tamplin
Software Engineer (GWT), Google

From w@1wt.eu  Fri Feb 25 09:01:37 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0C1F43A6781 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:01:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.946
X-Spam-Level: 
X-Spam-Status: No, score=-1.946 tagged_above=-999 required=5 tests=[AWL=0.097,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kBCxAE5vceaq for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:01:36 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 6B6A73A6407 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:01:35 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PH2EEa025829; Fri, 25 Feb 2011 18:02:14 +0100
Date: Fri, 25 Feb 2011 18:02:14 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225170214.GE23570@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:01:37 -0000

On Fri, Feb 25, 2011 at 06:44:31PM +0200, Silvio Ventres wrote:
> Hello, Ian.
> 
> Since both prior threads have been swamped in meta-discussions,
> starting a new thread to clear up the question.
> 
> Based on your (Ian Fette's) comments, the handshake is meant to serve 2 goals:
> 
> 1. Prevent WS client from _mistakenly_ identifying an HTTP server as
> WS-compliant
> 2. Prevent WS client from _intentfully_ communicating with an HTTP
> server via WS protocol.
> 
> 
> The first goal is indeed a good idea to prevent confusing WS clients
> connecting to legacy HTTP servers.
> It is accomplished by using the WS-specific "magic string" and "echo procedure".
> 
> The second goal is argued to protect from some kind of an attack.
> Since it is not readily apparent what attack vector is being
> considered here, and, indeed,
> the request from the point-of-view of HTTP server is a standard HTTP request,
> this is a formal request:
> 
> REQUEST: Please provide an example of an actual attack scenario
> possible in case WS does not implement computational-handshake.

It prevents a client from accidentely validating a handshake with a
caching intermediary which would have cached a WS server's response.

> Unless such attack scenario cannot be provided, strongly recommend:
> 
> RECOMMEND to remove the handshake-computation feature from the specification.

Please keep in mind that many more combinations of compliant, buggy, broken
and malicious clients, intermediaries and servers have been studied to reach
what is written in the draft. You won't make it change just because it does
not optimally satisfy your specific needs without considering all the traps
we've tried to avoid.

However you may help things change by proving yourself that the
simplifications you're proposing are possible because they're now already
covered by something else in all possible scenarios. But the number of
possible scenarios is huge, it's not just a compliant browser and a compliant
server.

Regards,
Willy


From w@1wt.eu  Fri Feb 25 09:06:01 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67A9F3A67BD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:06:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.951
X-Spam-Level: 
X-Spam-Status: No, score=-1.951 tagged_above=-999 required=5 tests=[AWL=0.092,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uCxMg7TDp-rB for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:06:00 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 30E9E3A67B2 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:06:00 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PH6kld025847; Fri, 25 Feb 2011 18:06:46 +0100
Date: Fri, 25 Feb 2011 18:06:46 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225170646.GF23570@1wt.eu>
References: <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:06:01 -0000

On Fri, Feb 25, 2011 at 07:01:12PM +0200, Silvio Ventres wrote:
> > How does making it look like a POST apply?   WebSockets is a
> > bidirectional communication, so you can't send individual frames in
> > POST messages because there is no way for the server to initiate a
> > response to a POST that hasn't been sent yet.  The alternative, which
> 
> What is the exact problem that you envision here ?
> The client would include POST headers in each request.
> 
> If the proxy does not allow server to reply multiple times to the client,
> whether you use POST or not is irrelevant.
> 
> "POST .... <ws control-start> ... <ws control-end>"
> 
> > I mentioned before, would be to do a POST of unknown length using
> > chunked encoding, and each frame is sent as a chunk.
> 
> How about a POST of a known length of the frame, and each frame is
> sent as a separate
> POST message ?

Because that does not allow the server to talk without a client request.

I think you really did not get the principle of establishing a bidirectional
communication between the client and the server. It's not WS which makes it
bidirectional, it's the HTTP handshake based on the Upgrade header and the
101+Upgrade in the response. The method is irrelevant. WS is used on top of
that to provide framing and to ensure that HTTP and WS don't accidently mix.

Willy


From jat@google.com  Fri Feb 25 09:06:08 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5DB9E3A6853 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:06:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.885
X-Spam-Level: 
X-Spam-Status: No, score=-105.885 tagged_above=-999 required=5 tests=[AWL=0.092, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r4x-d8SFtYuc for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:06:07 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 6B20E3A67B2 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:06:07 -0800 (PST)
Received: from kpbe19.cbf.corp.google.com (kpbe19.cbf.corp.google.com [172.25.105.83]) by smtp-out.google.com with ESMTP id p1PH6xbA007810 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:07:00 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298653620; bh=SI21WyDw5GduScNlG/CfzeucHrA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=Q3KPN9HI6sJU+kB3l3xycTMWqpXpDlH4ZI/uOFwVC6dAnO5dV0thwOoc7rgk/p2U7 gZa/LPFV9oUNuQa0/mbqg==
Received: from yic13 (yic13.prod.google.com [10.243.65.141]) by kpbe19.cbf.corp.google.com with ESMTP id p1PH6w6p014874 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 09:06:58 -0800
Received: by yic13 with SMTP id 13so1152332yic.17 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:06:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=zAWSo185sGKHf+qMzLnB9+nMOmDBM8YSxSpTA9p6Zm8=; b=uE7mTJyRqtCyKHVTaZMfvCieaGz3L5x7iYemqdy1P0hdYKrQ2gJbxVQQGu0KeR3fZ+ +TGKqZ5zZXJH0wQiSCMw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=r9Yt4cBR+ZECWy6EBWszKD8uJCDJlmPLALJkSe1KUiIsMyLCQjmgfT8opaRaQ1F6A0 FIl9jathApi9WjjsY7gA==
Received: by 10.150.69.5 with SMTP id r5mr2664373yba.217.1298653618089; Fri, 25 Feb 2011 09:06:58 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 09:06:38 -0800 (PST)
In-Reply-To: <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 12:06:38 -0500
Message-ID: <AANLkTi=A4r+RayTfRZGyyGMHUbuJvLK4KTNkqX-JHthc@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:06:08 -0000

On Fri, Feb 25, 2011 at 12:01 PM, Silvio Ventres
<silvio.ventres@gmail.com> wrote:
>> How does making it look like a POST apply? =C2=A0 WebSockets is a
>> bidirectional communication, so you can't send individual frames in
>> POST messages because there is no way for the server to initiate a
>> response to a POST that hasn't been sent yet. =C2=A0The alternative, whi=
ch
>
> What is the exact problem that you envision here ?
> The client would include POST headers in each request.

Imagine a chat client using WebSockets.  It connects and authenticates
to a server, then doesn't send anything until the user types a
message.  However, it needs to know when new messages from other users
are sent, so the server sends a message on the connection.  If using
separate POST messages for each frame (which can only be initiated
from the client), how does the server send that message?  The best you
could do is what is currently done without WebSockets, such as hanging
get.  There are a number of problems associated with that, but if that
is sufficient for you then just use that instead of WebSockets --
there is no need to make WebSockets no improvement over hanging gets.

> If the proxy does not allow server to reply multiple times to the client,
> whether you use POST or not is irrelevant.

WebSockets as currently specified achieves this.

> How about a POST of a known length of the frame, and each frame is
> sent as a separate
> POST message ?

Again, that does not allow server-initiated messages.

--=20
John A. Tamplin
Software Engineer (GWT), Google

From silvio.ventres@gmail.com  Fri Feb 25 09:07:41 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D95F3A67BD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:07:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.831
X-Spam-Level: 
X-Spam-Status: No, score=-2.831 tagged_above=-999 required=5 tests=[AWL=-0.232, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oVZNeJS40K2W for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:07:40 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 43F953A679F for <hybi@ietf.org>; Fri, 25 Feb 2011 09:07:40 -0800 (PST)
Received: by vxg33 with SMTP id 33so1659193vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:08:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type:content-transfer-encoding; bh=H1yTbXBv2VEzTytLGdxdh0EGYnuNoIOCFy0sfJE2PoM=; b=kZn/uI4FS4TmXSZLgsciVFdH8DRNoc+cXqnPCOflaVzeSFw6q7LmtXfxN03LLvWeCZ zMy85ndLwgC2n3kzlGQR5kOMaTLPoVK1jIt8COK5DKHqsb2Ke6gP9H/vyvwipgMTa6Kt 5jv4Fin7MNt3ya4bKnPCun3yWleXip8kvwM40=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=K9Co0LkAU2lY9s8YUVINzC1RSGTqL4Xiso7KOArwJWQfm7fL7cUNch474Yd+zr4ZN0 Asgq+yHyLAXSMhO5U8vLLcHXAkfj275l8FMnSsICcJ4lX52E52X3XOi+350E5gun/4Mk X6Xu0i398F2mH0kVTOqjgeoNuw6fQJzfwHtWA=
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr4483499vdb.190.1298653712202; Fri, 25 Feb 2011 09:08:32 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:08:32 -0800 (PST)
Date: Fri, 25 Feb 2011 19:08:32 +0200
Message-ID: <AANLkTikhh7wNYckPWoECLkPpfroxCpkQ8f3=WGi8az_c@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: [hybi] Discussion with John Tamplin (was Re: Computation part of handshake)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:07:41 -0000

> This is actually a whole family of cross-protocol attacks. =A0Using
> WebSockets to avoid the same-origin restrictions of HTTP as accessed
> from a browser is just one category of this attack. =A0As an example of
> the sort of cross-protocol attacks we want to avoid, see where HTTP
> POST was used to send spam via vulnerable SMTP servers. =A0Imagine if
> hostile JS could communicate with an SMTP server to send spam just by
> browsing to the attacker's web page.

If POST can do that, there's no reason to prevent WS from doing that.
If POST cannot do that, using POST headers in WS will prevent that too.

---- rant ----

> As a newcomer, constantly asking us to provide you with proof of
> everything that has been decided so far is getting tiresome. =A0Do you

You waste more time fighting that it would take to actually answer the
questions.

> contributions are certainly welcome, but so far the tone has simply
> been "this is ridiculous and I don't see why it is there, please
> remove it".

The tone has been:
"please provide an example of why this is useful. If examples cannot
be provided,
and thus it is not useful, please remove it".

If you have any actual information to provide, please do that.
If you want to rant, please do it in private.

--
 silvio

From dave@cridland.net  Fri Feb 25 09:08:46 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 728243A679F for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:08:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.393
X-Spam-Level: 
X-Spam-Status: No, score=-2.393 tagged_above=-999 required=5 tests=[AWL=-0.094, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t41n64j4AEK7 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:08:45 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id 362513A67BD for <hybi@ietf.org>; Fri, 25 Feb 2011 09:08:45 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 25B38116808D; Fri, 25 Feb 2011 17:09:34 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cNgph+AUK3yy; Fri, 25 Feb 2011 17:09:32 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id C44CD1168067; Fri, 25 Feb 2011 17:09:31 +0000 (GMT)
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
In-Reply-To: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <2745.1298653771.804659@puncture>
Date: Fri, 25 Feb 2011 17:09:31 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, Server-Initiated HTTP <hybi@ietf.org>, =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>,  "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed"
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:08:46 -0000

On Fri Feb 25 16:54:20 2011, Silvio Ventres wrote:
> REQUEST: Is there a reason to not use fake POST-like headers in  
> each WS message,
> thus bringing the security to the same level as HTTP POST ?

The problem with this particular proposal is that a proxy is likely  
to then assume it really is POST requests, and handle accordingly -  
this may well include sending the requests via different TCP  
connections, amongst other things. There are ways of handling this,  
for example by including metadata in the body in order to handle  
ordering, and using "long response", pipelining, and multiple  
connections in order to keep latency low for both send and receive -  
all of these techniques have been deployed very successfully within  
the XMPP/BOSH framework documented as XEP-0124/XEP-0206.

But then you may as well not bother with WebSockets at all, and just  
use BOSH itself, which can be done perfectly well in existing  
Javascript anyway, with the inevitable cost of the multiple  
connections and POST header overhead.

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From w@1wt.eu  Fri Feb 25 09:12:06 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 030603A67C0 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:12:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.956
X-Spam-Level: 
X-Spam-Status: No, score=-1.956 tagged_above=-999 required=5 tests=[AWL=0.087,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DoGZxVSZa8b7 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:12:05 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id C18EB3A67A5 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:12:04 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PHCbtN025956; Fri, 25 Feb 2011 18:12:37 +0100
Date: Fri, 25 Feb 2011 18:12:37 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225171237.GG23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:12:06 -0000

On Fri, Feb 25, 2011 at 06:54:20PM +0200, Silvio Ventres wrote:
> Hello, Ian.
> 
> As the previous threads have been swamped in meta discussions, here is
> a clear request "for comments" :)
> 
> The masking feature as used in the current spec, has, as one of the
> subgoals, prevention of a family of attacks
> where the attacker can cause mischief by control of actual
> "data-on-the-wire" plaintext.
> 
> While this family of attacks may well exist, here is the counterargument:
> 
> 1. HTTP POST currently has the ability to send binary data of arbitrary content.
> 2. HTTP POST is much more widely deployed than WS
> 3. HTTP POST headers can be faked in each WS message

4. HTTP POST only allows the server to talk once the client asks it to. The
   server is not able to send frames to the client when it wants to do so.

> Given the above, and that there is no reason to have WS provide "more"
> security than HTTP,
> since HTTP will be preferred medium in practice,

There's no reason to make WS more secure than HTTP however there are reasons
to ensure that once deployed, WS preserves browser security, so what is not
covered by current HTTP implementations must be covered by WS.

> REQUEST: Is there a reason to not use fake POST-like headers in each WS message,
> thus bringing the security to the same level as HTTP POST ?

There's no "POST-like headers". Please be specific. You talk as someone who
doesn't know the HTTP protocol at all, which makes it very hard to understand
your concepts or how they would apply.

Regards,
Willy


From jat@google.com  Fri Feb 25 09:12:50 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B334B3A6939 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:12:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.892
X-Spam-Level: 
X-Spam-Status: No, score=-105.892 tagged_above=-999 required=5 tests=[AWL=0.086, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7KTSzTd9mOT for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:12:50 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id D3D423A6975 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:12:49 -0800 (PST)
Received: from hpaq2.eem.corp.google.com (hpaq2.eem.corp.google.com [172.25.149.2]) by smtp-out.google.com with ESMTP id p1PHDfif002802 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:13:42 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298654022; bh=4/VDXkRqXYOiYSIq6mCQ43vPpxg=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Its7Wa99c+SVcRG0h1NVCLWe2Iw1iAZy1dW6TCvQ5pbV+XkkxG2hgcK/PIPPF5fov 3IcN3k3OGY9Rnr8hZi1ZA==
Received: from yia13 (yia13.prod.google.com [10.243.65.13]) by hpaq2.eem.corp.google.com with ESMTP id p1PHDdED025324 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 09:13:40 -0800
Received: by yia13 with SMTP id 13so969780yia.16 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:13:39 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=4A5uGKKTOkkNmiAz3Sm3FEvH31T2JesV5E3t1jMPAdY=; b=ARP/wUdfXa2pxYSzhM+y7FHpA7ZcbNfyQ0ZmPY4TkflhzPNIH55/449noGCrrdo3a0 gWKc9pV/lrqb4G2W+1TA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=ArUH4fGs9+QyxmAOgFYIAWJJkiFXdel4zXwgHqv6Ed5Z1Sjre+TRg8gM57atF5i4KY 2Nqeei1L2JQlqRR2nVWw==
Received: by 10.150.140.6 with SMTP id n6mr3801585ybd.160.1298654019228; Fri, 25 Feb 2011 09:13:39 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 09:13:19 -0800 (PST)
In-Reply-To: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 12:13:19 -0500
Message-ID: <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=UTF-8
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:12:50 -0000

On Fri, Feb 25, 2011 at 11:54 AM, Silvio Ventres
<silvio.ventres@gmail.com> wrote:
> REQUEST: Is there a reason to not use fake POST-like headers in each WS message,
> thus bringing the security to the same level as HTTP POST ?
>
> This would preserve sendfile() as well as easy debug and make
> implementations simpler.

The overhead of including a fake POST request in every WebSocket frame
would be far larger than a 4-byte masking key and the overhead of
doing XOR.

-- 
John A. Tamplin
Software Engineer (GWT), Google

From derhoermi@gmx.net  Fri Feb 25 09:13:34 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 651283A68B1 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:13:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.19
X-Spam-Level: 
X-Spam-Status: No, score=-3.19 tagged_above=-999 required=5 tests=[AWL=-0.591,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 95Oy+d2bmsOq for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:13:33 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 962193A67E1 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:13:32 -0800 (PST)
Received: (qmail invoked by alias); 25 Feb 2011 17:14:23 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp062) with SMTP; 25 Feb 2011 18:14:23 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+wHRI2WnmwOQPVtj7HhwcjZjHBpVrAMbIbG3kk+l pVOFdZ62yvbDtU
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Fri, 25 Feb 2011 18:14:26 +0100
Message-ID: <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
In-Reply-To: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:13:34 -0000

* Silvio Ventres wrote:
>REQUEST: Please provide an example of an actual attack scenario
>possible in case WS does not implement computational-handshake.

The scenario is quite simply this:

  1. A WS client sends X to a non-WS server to make a WS connection
  2. The server sends f(X) to the client to confirm the connection
  3. The client sends Y to the server which results in harm

This is prevented if the client cannot be made to send Y or if f(X) can
not be computed by servers with no knowledge of Websockets, within some
reasonable limits. The Working Group has decided to do both, making it
hard to send some attacker-chosen Y by masking with a random value, and
making it very unlikely that f(X) is already implemented somewhere by
making f(X) complicated and Websocket-specific.

If f(X) was just something like "echo some part of X" or "send a magic
string independent of X" there would be little reason to believe there
is not now nor is there likely to be a server that sends out f(X) with-
out explicitly choosing to do so, since we know there are servers that
can be made to echo parts of some input.

Again, if you have some suggestion how the specification can communicate
this better, please share it, I certainly agree that these things need
to be clear from the specification and agree they can be summarized
easily without asking people to read over 6,000 mostly unrelated emails.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From w@1wt.eu  Fri Feb 25 09:19:55 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C3F783A6781 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:19:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.961
X-Spam-Level: 
X-Spam-Status: No, score=-1.961 tagged_above=-999 required=5 tests=[AWL=0.083,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dqwYa+DxtF+l for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:19:55 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 922543A65A5 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:19:54 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PHJuql026019; Fri, 25 Feb 2011 18:19:56 +0100
Date: Fri, 25 Feb 2011 18:19:56 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225171956.GH23570@1wt.eu>
References: <AANLkTikhh7wNYckPWoECLkPpfroxCpkQ8f3=WGi8az_c@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTikhh7wNYckPWoECLkPpfroxCpkQ8f3=WGi8az_c@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Discussion with John Tamplin (was Re: Computation part of handshake)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:19:55 -0000

[ first, maybe we could remove Chairs from this {end|use}less thread ? ]

On Fri, Feb 25, 2011 at 07:08:32PM +0200, Silvio Ventres wrote:
> > As a newcomer, constantly asking us to provide you with proof of
> > everything that has been decided so far is getting tiresome.  Do you
> 
> You waste more time fighting that it would take to actually answer the
> questions.

I think John is not fighting but has tried to do the same as several other
WG members : try to give you simple and understandable examples. Either
you can't understand them or you don't want to. I think the later. Your
questions are extremely vague and you got several precise responses. What
else do you want ?

> > contributions are certainly welcome, but so far the tone has simply
> > been "this is ridiculous and I don't see why it is there, please
> > remove it".
> 
> The tone has been:
> "please provide an example of why this is useful. If examples cannot
> be provided, and thus it is not useful, please remove it".

What make you think you could expect that a few tens of persons are
suddenly forced to try to educate you ? All you could show till now
is that you don't want to understand the protocol basics. Please get
a bit more knowledge on how HTTP works and what of its limits WS is
trying to overcome, then I think your requests will be received with
more care because they will become a bit more understandable.

Thanks,
Willy


From silvio.ventres@gmail.com  Fri Feb 25 09:21:26 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7A3233A6939 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:21:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.827
X-Spam-Level: 
X-Spam-Status: No, score=-2.827 tagged_above=-999 required=5 tests=[AWL=-0.228, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vYDn231baHRC for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:21:25 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id D37F93A679F for <hybi@ietf.org>; Fri, 25 Feb 2011 09:21:24 -0800 (PST)
Received: by vxg33 with SMTP id 33so1672569vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:22:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=NWII963teFGhZeonQaqtLNsGy+nkkVQeGXMyEUMp17E=; b=iXKdA+p4k2/gy+olXUIyOlD1gcgMpY4d/CuDAuSiKNqK0lulHbNVdoYZpFjX2dCp/g vUmuO8YJxbtgWNyrsZv9OLz5QKnUvLoOFBCmlaKG4O3Eq/IbPvdBYHOdYsDtQt1lJmbo ZEPOIlSdu8x/XxTtkWxMQLuhGs+m3Lt0ZkWrQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=nxhexta6rm/La7oB/vAe5HpeD5heGAkWk4M58osbT7htxjmT0Aj4WnQY6CXB2eQdCx pcDL90B3GBW22lQlyGAO80kw7tbBFLWjqI3VOGiqLrFxouRLtGIyLCH+fpvQeRd/GIYn CGevfqotKdT3VY0++y2D/nRRwVcPB27+8x4Gg=
MIME-Version: 1.0
Received: by 10.52.160.8 with SMTP id xg8mr4218858vdb.310.1298654205393; Fri, 25 Feb 2011 09:16:45 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:16:45 -0800 (PST)
In-Reply-To: <20110225170214.GE23570@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu>
Date: Fri, 25 Feb 2011 19:16:45 +0200
Message-ID: <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:21:26 -0000

>> REQUEST: Please provide an example of an actual attack scenario
>> possible in case WS does not implement computational-handshake.
>
> It prevents a client from accidentely validating a handshake with a
> caching intermediary which would have cached a WS server's response.

The goal (2) does not prevent a caching intermediary from caching the
response in any case.

So the attack scenario you provided has to do with the "echo" being a
static value.
To prevent it, you can add a dynamic part to the handshake, for
example, a timestamp
that should be echoed by the remote endpoint.
There is still no need for the computation here.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 09:25:18 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9E6683A6781 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:25:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.822
X-Spam-Level: 
X-Spam-Status: No, score=-2.822 tagged_above=-999 required=5 tests=[AWL=-0.223, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfdpAsvgCBla for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:25:17 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 8DD863A65A5 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:25:17 -0800 (PST)
Received: by vxg33 with SMTP id 33so1676144vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:26:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=Jt2zd1oCetOwDND7WmUOA7B1MIwlWSbrZevFLbC9rQU=; b=V0lbNxTYdnHn8V+bvZrw0LHlmWbVgjQt4p7LsNzKqtdDcOAS2EFJ5hsyvDHOXFDTBQ 8h79JmhWop6BgocjXEDZpQsjYSkVYVHRZsb4TLFXzl/7whwO9VxVwPQsuZQfsXPKQVAw xpqxAAupNY1gSq+jNxJEiaNA+IuZjWjSRAZNk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=Izkeo/alPES4tig8jwX6BpxpERU4V01bhteFSsDq0A+Zc3GoSTrk+g6OzFq5L98VSV kA5c7ooCznnRjX1h13wBNOD3lhKGvidpN+bxKprMBikExBiTa5w4gwkatOgfggJzF/I6 GdCAABWXESBg74CDcAgbVSakFn+6iO27HMYLY=
MIME-Version: 1.0
Received: by 10.52.68.175 with SMTP id x15mr1541564vdt.70.1298654751755; Fri, 25 Feb 2011 09:25:51 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:25:51 -0800 (PST)
In-Reply-To: <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de>
Date: Fri, 25 Feb 2011 19:25:51 +0200
Message-ID: <AANLkTimi-MBT9=sKkNuPTNvkJOKckMsBSgWaiu+nWsdV@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:25:18 -0000

>>REQUEST: Please provide an example of an actual attack scenario
>>possible in case WS does not implement computational-handshake.
>
> The scenario is quite simply this:
>
> =A01. A WS client sends X to a non-WS server to make a WS connection
> =A02. The server sends f(X) to the client to confirm the connection
> =A03. The client sends Y to the server which results in harm

If the step "3" results in harm, and the server is a non-WS server,
what prevents
the JS attacker from simply issuing an HTTP GET request to the same server =
?

If the attacker can force the remote end-point to echo values of his choice=
,
then similarly, he can precompute the correct handshake answer and force
the remote endpoint to echo that, making it look as if the computation
took place.

--
 silvio

From w@1wt.eu  Fri Feb 25 09:29:19 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 36D0B3A67AE for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:29:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.964
X-Spam-Level: 
X-Spam-Status: No, score=-1.964 tagged_above=-999 required=5 tests=[AWL=0.079,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P20XISIXrzIk for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:29:17 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 0A30C3A6781 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:29:14 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PHTwlp026076; Fri, 25 Feb 2011 18:29:58 +0100
Date: Fri, 25 Feb 2011 18:29:58 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225172958.GI23570@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:29:19 -0000

On Fri, Feb 25, 2011 at 07:16:45PM +0200, Silvio Ventres wrote:
> >> REQUEST: Please provide an example of an actual attack scenario
> >> possible in case WS does not implement computational-handshake.
> >
> > It prevents a client from accidentely validating a handshake with a
> > caching intermediary which would have cached a WS server's response.
> 
> The goal (2) does not prevent a caching intermediary from caching the
> response in any case.

If you're talking about the Sec-WebSocket-Accept header, then it's a hash
of the Sec-WebSocket-Key provided by the client. The client is supposed
to use a random key, so there is almost no chance that the same key will
be emitted twice, so a cache will return a hash from a previous key, which
the client will detect.

Willy


From silvio.ventres@gmail.com  Fri Feb 25 09:34:03 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B1B73A69E7 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:34:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.318
X-Spam-Level: 
X-Spam-Status: No, score=-3.318 tagged_above=-999 required=5 tests=[AWL=0.281,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mk+hiLf+i5li for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:34:02 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 7AA8D3A6968 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:34:02 -0800 (PST)
Received: by vws6 with SMTP id 6so1752812vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:34:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=vK5PhanDYo0Lf2OEYxPdsT4j5oqHqXRSDvuixsmGyOY=; b=Ge0JKiQ1FbNoakYHJ/X7p4T40wSfwaIsXgpTefqpKdWxmLHEXLdoh9e3OZFHBIAvOD KyoxOo2RJKH0rw2qHRS0gdSv2BSAFtaawLUkCoZg6KAJwTD56B+1O08DWn7F8112+68z 2cZ4uXvqJvDkMBPT1rIu49lVCtWMcwCZVXcqg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=OM5WPNmTOzYujyR6EMEHA0qswaZA26XDgJ7xE0cPSbna6wX0qsSmvr5TnOVrVJEzKe DlLxETJ7IyF1haN3PpwnlroPEZMGqUXk5IrAONKMFBKymZS8RZheZxBj+SMY64gCA+KF ++K5R0zlsSkoXKHelMNL/dGXBr5x3m+GRMA5s=
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr4549882vdb.150.1298655294864; Fri, 25 Feb 2011 09:34:54 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:34:54 -0800 (PST)
In-Reply-To: <20110225172958.GI23570@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu>
Date: Fri, 25 Feb 2011 19:34:54 +0200
Message-ID: <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:34:03 -0000

>> The goal (2) does not prevent a caching intermediary from caching the
>> response in any case.
>
> If you're talking about the Sec-WebSocket-Accept header, then it's a hash
> of the Sec-WebSocket-Key provided by the client. The client is supposed
> to use a random key, so there is almost no chance that the same key will
> be emitted twice, so a cache will return a hash from a previous key, which
> the client will detect.

The question is, why use hashing at all ?
Use some simple math, why add complexity ?

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 09:38:04 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB4D03A69EC for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:38:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.523
X-Spam-Level: 
X-Spam-Status: No, score=-2.523 tagged_above=-999 required=5 tests=[AWL=-0.524, BAYES_00=-2.599, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f9tScu638ROQ for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:38:04 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 041173A69E9 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:38:03 -0800 (PST)
Received: by vxg33 with SMTP id 33so1688196vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:38:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=mmI0Jc5A9qju/+fmcXj2ErUUe9IWTfvKLyu6HKIyEDI=; b=Q2vUXA5zLDjd0A25hUGY/HIT5FaZCDPxG2iMhxUt8RJH/oIvMLxDwWyZf/N8pxdjXU xrVnG2MT3TXOrnkTcv03asxzk6yuyjlaypB62pwtKpCPL+jMCJrv0U/GSO2Aw2cZAZ+5 SbKgMY8SP5Cve0rmf2PLoJIer3bCkVpxKqu4I=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=bvUHmxgLy+8FlVlcJ26Eelf9CZllMB58aYj9kdg6A8V8HiGdsQxEdWKzZS3B28nvu1 GiyBE/Wq7/sykvQuS2pKzL1O1xItdfU+1tLf7qZnelKhemX0eylA4jDzZfIW/OhubqrV bRSLuhOZrkJ1jmQbFNEO8JgSoNeOPnnI5QcQw=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr4554804vdb.230.1298655533145; Fri, 25 Feb 2011 09:38:53 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:38:53 -0800 (PST)
In-Reply-To: <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com>
Date: Fri, 25 Feb 2011 19:38:53 +0200
Message-ID: <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:38:05 -0000

>> REQUEST: Is there a reason to not use fake POST-like headers in each WS message,
>> thus bringing the security to the same level as HTTP POST ?
>>
>> This would preserve sendfile() as well as easy debug and make
>> implementations simpler.
>
> The overhead of including a fake POST request in every WebSocket frame
> would be far larger than a 4-byte masking key and the overhead of
> doing XOR.

... and the overhead of not being able to use sendfile()
... and the overhead of no HTTP-style debug capability
... and the overhead of having to pass over the data multiple times

Really, are you suggesting XOR'ing the entire data frame
has less impact than a short HTTP-POST header ?

--
 silvio

From w@1wt.eu  Fri Feb 25 09:44:05 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 824F93A69EF for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:44:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.668
X-Spam-Level: 
X-Spam-Status: No, score=-1.668 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SdAOZPxIn1ex for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:44:04 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 59D023A69F4 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:44:04 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PHinRU026198; Fri, 25 Feb 2011 18:44:49 +0100
Date: Fri, 25 Feb 2011 18:44:49 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225174449.GL23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com> <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:44:05 -0000

On Fri, Feb 25, 2011 at 07:38:53PM +0200, Silvio Ventres wrote:
> >> REQUEST: Is there a reason to not use fake POST-like headers in each WS message,
> >> thus bringing the security to the same level as HTTP POST ?
> >>
> >> This would preserve sendfile() as well as easy debug and make
> >> implementations simpler.
> >
> > The overhead of including a fake POST request in every WebSocket frame
> > would be far larger than a 4-byte masking key and the overhead of
> > doing XOR.
> 
> ... and the overhead of not being able to use sendfile()

This one was considered not critical since sendfile() is not commonly
used from the client to the server.

> ... and the overhead of no HTTP-style debug capability

That was the main reason why we finally opted for a per-frame mask instead
of a per-session+frame mask.

> ... and the overhead of having to pass over the data multiple times

Huh ?

> Really, are you suggesting XOR'ing the entire data frame
> has less impact than a short HTTP-POST header ?

You're still comparing apples to oranges. A POST works only one way and
for one single message. WS allows any number of messages to flow in any
direction at any time.

Certainly if I want to remain connected to the server in a chat discussion
WS will be much more efficient than sending as many POST requests as I
expect to receive characters, words or lines !

Willy


From jat@google.com  Fri Feb 25 09:52:30 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4095A3A67F2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:52:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.204
X-Spam-Level: 
X-Spam-Status: No, score=-105.204 tagged_above=-999 required=5 tests=[AWL=0.173, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VMtfZ8yyAEQK for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:52:28 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 965193A67ED for <hybi@ietf.org>; Fri, 25 Feb 2011 09:52:27 -0800 (PST)
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13]) by smtp-out.google.com with ESMTP id p1PHrJhB025248 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:53:19 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298656399; bh=zXvmEEGcOgiRnwpygHbtnXwkodk=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=krrbtxk+NRChCqEVfv2DAU7DBzCSLCARvStbBWMJccDUz4zL1n5EjZUhDYLyDMAXL i14A6Rtrbx93bVzG7xoHw==
Received: from gyf3 (gyf3.prod.google.com [10.243.50.67]) by hpaq13.eem.corp.google.com with ESMTP id p1PHr3mv012934 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 09:53:18 -0800
Received: by gyf3 with SMTP id 3so1295628gyf.1 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:53:18 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=sLnJJnzMr8wO/oARxlQCdNljbMEcGk4L/c4UXkpjrSc=; b=U3dVBSz4exPVDqT0BGFY6OHlN2k5CmLN4R4GL0dRB+04Xe3DaJ9oiSrJiL7tCdLE/D dtQtFjushQyIoMSathHw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=sDOB/hOj2QSnZU7mD+YWfhipSktwJyeCmQzhjwT3sIAfol5wIFpWFL84kRjEkMjJKP sgBJjoJ4b5L0bVq35Gbg==
Received: by 10.151.14.8 with SMTP id r8mr3873869ybi.331.1298656398134; Fri, 25 Feb 2011 09:53:18 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 09:52:58 -0800 (PST)
In-Reply-To: <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com> <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 12:52:58 -0500
Message-ID: <AANLkTimNrxCRi4FWFxhTug=ncjpet61wm-qGCbXPcXzp@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: text/plain; charset=UTF-8
X-System-Of-Record: true
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:52:30 -0000

On Fri, Feb 25, 2011 at 12:38 PM, Silvio Ventres
<silvio.ventres@gmail.com> wrote:
> ... and the overhead of not being able to use sendfile()

Existing browsers do not use sendfile to send an in-memory string
supplied by JS.  Even if they were to add that in the future, the loss
of sendfile on the client was deemed an acceptable compromise.

> ... and the overhead of no HTTP-style debug capability

It is already a binary protocol, and hopefully be commonplace.

> ... and the overhead of having to pass over the data multiple times

It depends on how your code is structured whether you would need to do
so (for example, if you are converting UTF16 from JS to UTF8 you could
do the XOR at the same time), but even if you do then yes.

> Really, are you suggesting XOR'ing the entire data frame
> has less impact than a short HTTP-POST header ?

Expected uses of WebSockets are likely to be small frames (see the
thread about compression from last May).  Adding a fake POST header of
dozens of bytes at a minimum would easily add a significant size
overhead to every frame.  Consider chat-like applications where you
are sending a few keystrokes at a time -- those currently can be sent
in 6+n bytes, compared to maybe 40+n.

Sizes are also extremely important for mobile applications, where the
low-power radio mode can only be used for packets of around 128-256
bytes (depending on carrier settings), and adding a large fixed
overhead to every frame (in addition to TCP/IP overhead until ROHC is
widely deployed) means very few frames can be sent without fully
powering up the radio (which also has latency issues aside from
battery issues).

-- 
John A. Tamplin
Software Engineer (GWT), Google

From derhoermi@gmx.net  Fri Feb 25 09:53:41 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B51493A67F2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:53:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.106
X-Spam-Level: 
X-Spam-Status: No, score=-3.106 tagged_above=-999 required=5 tests=[AWL=-0.507, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30AjBlzoi3VV for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:53:40 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 798D63A67ED for <hybi@ietf.org>; Fri, 25 Feb 2011 09:53:39 -0800 (PST)
Received: (qmail invoked by alias); 25 Feb 2011 17:54:31 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp046) with SMTP; 25 Feb 2011 18:54:31 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX19nDDhL4n9n2AcCVvBeSEd0x/utV7IgIAy6Sa8mgJ 9dyYvi3FsM0hse
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Fri, 25 Feb 2011 18:54:33 +0100
Message-ID: <diqfm6lck4hcbaekjf4es1a6v9s9bocael@hive.bjoern.hoehrmann.de>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de> <AANLkTimi-MBT9=sKkNuPTNvkJOKckMsBSgWaiu+nWsdV@mail.gmail.com>
In-Reply-To: <AANLkTimi-MBT9=sKkNuPTNvkJOKckMsBSgWaiu+nWsdV@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:53:41 -0000

* Silvio Ventres wrote:
>>>REQUEST: Please provide an example of an actual attack scenario
>>>possible in case WS does not implement computational-handshake.
>>
>> The scenario is quite simply this:
>>
>>  1. A WS client sends X to a non-WS server to make a WS connection
>>  2. The server sends f(X) to the client to confirm the connection
>>  3. The client sends Y to the server which results in harm
>
>If the step "3" results in harm, and the server is a non-WS server,
>what prevents
>the JS attacker from simply issuing an HTTP GET request to the same server ?

The bytes on the wire are a bit different for HTTP GET requests and he
would, generally speaking, have less control over them, so it is quite
possible an attacker could do something with one method but not the
other.

>If the attacker can force the remote end-point to echo values of his choice,
>then similarly, he can precompute the correct handshake answer and force
>the remote endpoint to echo that, making it look as if the computation
>took place.

As I recall, the client picks a random value the server needs to mani-
pulate after the JavaScript code asked the browser to attempt making a
Websocket connection. If the random number generator is unpredictable
to the script, the attacker cannot pre-compute the response.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From silvio.ventres@gmail.com  Fri Feb 25 09:54:29 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1337F3A67F2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:54:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.313
X-Spam-Level: 
X-Spam-Status: No, score=-3.313 tagged_above=-999 required=5 tests=[AWL=0.286,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p5zXf2SJy4sE for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:54:27 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id D10813A67ED for <hybi@ietf.org>; Fri, 25 Feb 2011 09:54:26 -0800 (PST)
Received: by vws6 with SMTP id 6so1772699vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:55:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=qjBHKJOoWC69VzmBF1HdtB2532qRu5Gdlc7xM7kSWV4=; b=NlwKsVV11zYUmEJGNjHNT9h6tdJx+3UDipujuSkEckqUjWM1ANgDaSnhMLinJVkK3g Zeox/2g7PdPPC+zkjlLeUhIBpaaKETmG5Ia4Tfu0gu86pn3EoWKqYu79/hPbuxUS9DmZ TT+zacrUgMT1VXG0lXcTDSSmrYhQ7IK7ZV/xI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=g6Fv/Xlri3W1iTt9/VSrSS5bx/WO8Jt1hdQ7V3ELGwNRHcMyjffl5cADo0oUxE/WoL SU98iLgGOBUrHZ68urdqQ33s6K4PcqkWCiUYHfO3qRA2OGuD+uVVYfmerLWzfrFFBi4C l6iyMTDIjDKckmBv4YBDoW2APEz1sBSTJPZl4=
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr4587700vdb.190.1298656518433; Fri, 25 Feb 2011 09:55:18 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:55:18 -0800 (PST)
In-Reply-To: <20110225171237.GG23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <20110225171237.GG23570@1wt.eu>
Date: Fri, 25 Feb 2011 19:55:18 +0200
Message-ID: <AANLkTi=gif1oL_m4nh1m4oHOOCcukUO-e7BR+AJcWUs0@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:54:29 -0000

>> 1. HTTP POST currently has the ability to send binary data of arbitrary =
content.
>> 2. HTTP POST is much more widely deployed than WS
>> 3. HTTP POST headers can be faked in each WS message
>
> 4. HTTP POST only allows the server to talk once the client asks it to. T=
he
> =A0 server is not able to send frames to the client when it wants to do s=
o.

If the server is a compliant WS endpoint, the server will ignore the POST
header and send the frames to the client when it wants to.

If the connection is made through an intermediate that doesn't allow server=
 to
reply to client when it wants to do so, it is irrelevant whether POST or an=
y
other header is used.


> There's no reason to make WS more secure than HTTP however there are reas=
ons
> to ensure that once deployed, WS preserves browser security, so what is n=
ot
> covered by current HTTP implementations must be covered by WS.

Agreed. Point is that WS should be "as secure" as HTTP, but there is
no reason to
make it "more" secure, sacrificing useful features such as debug simplicity=
.

> There's no "POST-like headers". Please be specific. You talk as someone w=
ho
> doesn't know the HTTP protocol at all, which makes it very hard to unders=
tand
> your concepts or how they would apply.

"POST-like" in the meaning that they are intended to look like valid
POST headers
for consumption by intermediaries, but not by non-WS HTTP servers.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 09:57:45 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E8DC13A67F2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:57:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.019
X-Spam-Level: 
X-Spam-Status: No, score=-3.019 tagged_above=-999 required=5 tests=[AWL=-0.020, BAYES_00=-2.599, J_CHICKENPOX_33=0.6, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bIyN0aOZ-JAI for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 09:57:45 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 12F623A67ED for <hybi@ietf.org>; Fri, 25 Feb 2011 09:57:44 -0800 (PST)
Received: by vws6 with SMTP id 6so1775848vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 09:58:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=k6uhvO1nNI3wMyUnONbKN4UnzgzhYx1bFcKOahXVQNA=; b=jUntF7VdtErb+fNbluV4UXLfaY9CLJ+BjuI+UKMnsJJnHBRv6bxFwVJvrY+KLnmFpH 0O7qyL+UGhO1UHLBuhMbXxgGdwZkwBKVoym247G2mC3ki/5zYMmSP20RG2zsNCVbhJGC uiy87lQDzCmmZIInmUWqXHR/kn8+wEcOKaN50=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=b+VUsbC8QneFeFLIm43+0Fu3SfD+ReFaPR6cYrH0iTIqAip8PDqFoU7i6A6B1XzSoZ Vg1JcgxCP5D+gHA4HPCLpWCv0HJSKVPbmm/sIY/+x/JAxNfhk2ADc+o9NWjLyHSu0QGG 351iHgbhvS+saPEji2dWvPvVadcQaLgIWkflg=
MIME-Version: 1.0
Received: by 10.52.68.175 with SMTP id x15mr1613486vdt.70.1298656717815; Fri, 25 Feb 2011 09:58:37 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 09:58:37 -0800 (PST)
In-Reply-To: <20110225174449.GL23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com> <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com> <20110225174449.GL23570@1wt.eu>
Date: Fri, 25 Feb 2011 19:58:37 +0200
Message-ID: <AANLkTikDBBzF0YMm+T=Ouhtc_bPScxa-ppgQdpPgD-ve@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 17:57:46 -0000

>> Really, are you suggesting XOR'ing the entire data frame
>> has less impact than a short HTTP-POST header ?
>
> You're still comparing apples to oranges. A POST works only one way and
> for one single message. WS allows any number of messages to flow in any
> direction at any time.
>
> Certainly if I want to remain connected to the server in a chat discussion
> WS will be much more efficient than sending as many POST requests as I
> expect to receive characters, words or lines !

It seems you are talking about HTTP and not WS.

The discussion was about WS protocol, using POST headers just to make sure that
the security implications of binary data in the frame are same as for HTTP POST.

The actual communication is normal WS, the POST header is not supposed to even
be parsed by the WS endpoint.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 10:17:24 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD0183A69F3 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:17:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.518
X-Spam-Level: 
X-Spam-Status: No, score=-2.518 tagged_above=-999 required=5 tests=[AWL=-0.519, BAYES_00=-2.599, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B+KF3RU0Em3k for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:17:24 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id CAE8D3A67B5 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:17:23 -0800 (PST)
Received: by vxg33 with SMTP id 33so1724027vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:18:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=lgMzwsFC4nbmOPXrDCrc4ZHYNjss3A3YadqCkCO+M/A=; b=bPZmSIBHwQw0yH/KjbGsltHv4jza40OFHS4sa+3nZH1gEzpYb5Go3TUpVj1GyzsWnK yxbGjmfwTjEJRWjHpDdGTvB0eonoWLvkgCfpD84orvV6+fN9NaDs5CLHbnk6eNKC8Cdg Kvq2GbBJJxdhSYvLAVLGLNtdxp7oe7ZM3fstk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=I3Cbgo8ahfrMATNuQcuFwrRT5F5PYa5eGld2YGA4ti9BMB0UQrEw7B382gaomgtFr2 J8UGpiR+70AGQzbi8oqXh1HanOa8TBirsCTQZz+NSlxOmUYqJle3H31VumLg/+mrJHGI oxivK8oQfFIxKtcmRD0a5Q3H3GJnP0ilV2QMk=
MIME-Version: 1.0
Received: by 10.52.174.38 with SMTP id bp6mr1145020vdc.270.1298657895908; Fri, 25 Feb 2011 10:18:15 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 10:18:15 -0800 (PST)
In-Reply-To: <AANLkTimNrxCRi4FWFxhTug=ncjpet61wm-qGCbXPcXzp@mail.gmail.com>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com> <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com> <AANLkTimNrxCRi4FWFxhTug=ncjpet61wm-qGCbXPcXzp@mail.gmail.com>
Date: Fri, 25 Feb 2011 20:18:15 +0200
Message-ID: <AANLkTi=x16KzXG698UN3xwbKzPcwQiXaes7TSp3fYqWt@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 18:17:24 -0000

>> ... and the overhead of no HTTP-style debug capability
>
> It is already a binary protocol, and hopefully be commonplace.

Hopefully it will, but that doesn't remove the fact that plaintext protocol=
s are
much easier to debug than encoded ones.
As an example, a binary data stream in WS message would be very hard to
debug, with or without WireShark decoder, while a simple netcat script
to strip the WS control bits, if rest of data is sent plaintext, is
very easy to write.


>> Really, are you suggesting XOR'ing the entire data frame
>> has less impact than a short HTTP-POST header ?
>
> Expected uses of WebSockets are likely to be small frames (see the
> thread about compression from last May). =A0Adding a fake POST header of
> dozens of bytes at a minimum would easily add a significant size
> overhead to every frame. =A0Consider chat-like applications where you
> are sending a few keystrokes at a time -- those currently can be sent
> in 6+n bytes, compared to maybe 40+n.

The tradeoff between considerable complexity in both normal operation and d=
ebug,
against slightly increased bandwidth. Look at HTTP: it's so prevalent
today because
it's so simple and easy to debug, while sacrificing bandwidth.


> Sizes are also extremely important for mobile applications, where the
> low-power radio mode can only be used for packets of around 128-256
> bytes (depending on carrier settings), and adding a large fixed
> overhead to every frame (in addition to TCP/IP overhead until ROHC is
> widely deployed) means very few frames can be sent without fully
> powering up the radio (which also has latency issues aside from
> battery issues).

It seems that  HTTP with similar or worse overhead does not have much
troubles in mobile space.

Let's try to save a resource that is actually scarce on current servers:
cpu time, memory, cache locality. Bandwidth at these scales is not scarce
by any definition.
When a reasonably average WS server can saturate a 100Mbit connection at
lower than 50% cpu usage, _then_, and only then should cpu time be
traded for bandwidth.

--
 silvio

>
> --
> John A. Tamplin
> Software Engineer (GWT), Google
>

From silvio.ventres@gmail.com  Fri Feb 25 10:35:41 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 06F2B3A683B for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:35:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.309
X-Spam-Level: 
X-Spam-Status: No, score=-3.309 tagged_above=-999 required=5 tests=[AWL=0.290,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2+cWTJT+HEk5 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:35:40 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 1195E3A67F8 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:35:39 -0800 (PST)
Received: by vws6 with SMTP id 6so1810721vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:36:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=cc3wGtrtci4u5iUJWM0X2BWH+nYXllM7ImpyI4Vn1vs=; b=joP2Uxkjfq4tCPhCxnpTk17DvHxyjuwhOrf9NVuajRXgoQiGgPNXuBlCDugdFlj5K+ LZTLZbZmEAh6P9wBYHup6lRt+lzrNPo8bTKGHD989mQc7WjyiiOtiQBFgseHM7+uTX5j hMJUPg2QI1jVur0MiCAWWy+BhHyfCb8N5QNeI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=ehwZ23SrfCHazbU4tcYZuR/vHeZrzIbWg0OooNVskL64bicNZ/8AGf7/HeH/TdAZxI qjguAnzjiUggcaVWaBy8BHTHL5ntVharO0wNwLy69SWvJVXDy691WrFmjvJZJAfq5UoL oYDC4iWwBwky/5oAvXSQl2QZfgVB/Z8DbIYic=
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr4654246vdc.110.1298658992368; Fri, 25 Feb 2011 10:36:32 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 10:36:32 -0800 (PST)
In-Reply-To: <diqfm6lck4hcbaekjf4es1a6v9s9bocael@hive.bjoern.hoehrmann.de>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de> <AANLkTimi-MBT9=sKkNuPTNvkJOKckMsBSgWaiu+nWsdV@mail.gmail.com> <diqfm6lck4hcbaekjf4es1a6v9s9bocael@hive.bjoern.hoehrmann.de>
Date: Fri, 25 Feb 2011 20:36:32 +0200
Message-ID: <AANLkTimdC9G3+pbJEzp6y27Y4+CQb0r5aKH75ifqRWuG@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 18:35:41 -0000

>>> =A01. A WS client sends X to a non-WS server to make a WS connection
>>> =A02. The server sends f(X) to the client to confirm the connection
>>> =A03. The client sends Y to the server which results in harm
>>
>>If the step "3" results in harm, and the server is a non-WS server,
>>what prevents
>>the JS attacker from simply issuing an HTTP GET request to the same serve=
r ?
>
> The bytes on the wire are a bit different for HTTP GET requests and he
> would, generally speaking, have less control over them, so it is quite
> possible an attacker could do something with one method but not the
> other.

Arguably, it's a _very_ questionable attack vector, as if the attacker
can make the server behave
as WS, he can make the server behave as HTTP also, or any other
protocol, and cause similar harm.

Anyway, understanding that you don't want the attacker from within a
JS script to be
able to make the server pass the handshake, without looking into why
the server would allow that.

A valid point made by someone else was that a caching intermediary
might cache the WS server
response and the client needs to have a way to know such from a real
response. _That_ requires some
dynamic challenge/response from WS in the browser to the server.

But to do that you don't need to add computation complexity. Indeed,
hashing is not a free operation.

--
 silvio

From derhoermi@gmx.net  Fri Feb 25 10:38:37 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D6C33A683B for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:38:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.043
X-Spam-Level: 
X-Spam-Status: No, score=-3.043 tagged_above=-999 required=5 tests=[AWL=-0.444, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JCeeKt9j7+c5 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:38:36 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 0BDBD3A67B0 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:38:35 -0800 (PST)
Received: (qmail invoked by alias); 25 Feb 2011 18:39:27 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp016) with SMTP; 25 Feb 2011 19:39:27 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+StNlRCtKSBLbaI5u2gm4wrZoFb40OFywHOuXmGa L2zKsw1CsFl8Ds
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Fri, 25 Feb 2011 19:39:29 +0100
Message-ID: <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
In-Reply-To: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 18:38:37 -0000

* Silvio Ventres wrote:
>The masking feature as used in the current spec, has, as one of the
>subgoals, prevention of a family of attacks
>where the attacker can cause mischief by control of actual
>"data-on-the-wire" plaintext.

We have masking because people wanted to initiate the protocol over port
80 where usually HTTP is spoken but'd not want to stick to HTTP framing.
However, there is no method to switch from the HTTP protocol to some
other protocol that is universally implemented, which can lead to a
situation where traffic that is meant to be Websocket communication is
interpreted as HTTP communication. To ensure such confusion cannot be
abused, traffic is masked with an unpredictable masking key.

No masking would mean you cannot use ports commonly used for HTTP or you
have to stick to HTTP framing or you have to tolerate some considerable
risk that someone will find a setup that is vulnerable to attack using
Websocket implementations.

>REQUEST: Is there a reason to not use fake POST-like headers in each WS
>message, thus bringing the security to the same level as HTTP POST ?

Making all communication conform to the HTTP protocol specifications is
indeed an alternative as far as security goes, but this would not play
very nicely with other HTTP uses (compare timeouts in request->response
use versus fully bidirectional uses, for instance) and would have higher
overhead than Websocket as it is being proposed at the moment.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From w@1wt.eu  Fri Feb 25 10:54:31 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CFAA3A67F8 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:54:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.958
X-Spam-Level: 
X-Spam-Status: No, score=-1.958 tagged_above=-999 required=5 tests=[AWL=0.085,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kx4jymE+as36 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:54:30 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id D6AA93A66B4 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:54:29 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PIsnUr026662; Fri, 25 Feb 2011 19:54:49 +0100
Date: Fri, 25 Feb 2011 19:54:49 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225185449.GM23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <20110225171237.GG23570@1wt.eu> <AANLkTi=gif1oL_m4nh1m4oHOOCcukUO-e7BR+AJcWUs0@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTi=gif1oL_m4nh1m4oHOOCcukUO-e7BR+AJcWUs0@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 18:54:31 -0000

On Fri, Feb 25, 2011 at 07:55:18PM +0200, Silvio Ventres wrote:
> >> 1. HTTP POST currently has the ability to send binary data of arbitrary content.
> >> 2. HTTP POST is much more widely deployed than WS
> >> 3. HTTP POST headers can be faked in each WS message
> >
> > 4. HTTP POST only allows the server to talk once the client asks it to. The
> >   server is not able to send frames to the client when it wants to do so.
> 
> If the server is a compliant WS endpoint, the server will ignore the POST
> header and send the frames to the client when it wants to.
> 
> If the connection is made through an intermediate that doesn't allow server to
> reply to client when it wants to do so, it is irrelevant whether POST or any
> other header is used.

Please stop talking about that magical "header", once again there is no such
"header". There is a well-defined connection setup handshake which guarantees
that if it succeeds, you have a bidirectional connection between both ends,
this is called HTTP Upgrade. And it is irrelevant to the method (POST, GET,
...). Your POST method will not work because the server can't send anything
to the client before it gets the request. Also, many intermediaries will
buffer the request body as well as the response body.

Silvio, please take the time to look at what an HTTP request looks like,
especially how a message is defined (request/status line, headers, body).
This is very important and is the only way to understand why WS works and
why your POST-based proposals don't work.

Regards,
Willy


From w@1wt.eu  Fri Feb 25 10:58:25 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 766383A67F8 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:58:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.662
X-Spam-Level: 
X-Spam-Status: No, score=-1.662 tagged_above=-999 required=5 tests=[AWL=-0.219, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, J_CHICKENPOX_33=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GE9KtPj3wpuc for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 10:58:24 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 391E23A66B4 for <hybi@ietf.org>; Fri, 25 Feb 2011 10:58:24 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PIx3ql026712; Fri, 25 Feb 2011 19:59:03 +0100
Date: Fri, 25 Feb 2011 19:59:03 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225185903.GN23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <AANLkTinjhYp3bc=woWwby65QwJv9v0=PjAC5kY6MaUyd@mail.gmail.com> <AANLkTimzE+AfPh7=LkesAevLkVDiykuo_=xBakYdW8+z@mail.gmail.com> <20110225174449.GL23570@1wt.eu> <AANLkTikDBBzF0YMm+T=Ouhtc_bPScxa-ppgQdpPgD-ve@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikDBBzF0YMm+T=Ouhtc_bPScxa-ppgQdpPgD-ve@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Salvatore.Loreto@ericsson.com, Server-Initiated HTTP <hybi@ietf.org>, jhildebr@cisco.com
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 18:58:25 -0000

On Fri, Feb 25, 2011 at 07:58:37PM +0200, Silvio Ventres wrote:
> >> Really, are you suggesting XOR'ing the entire data frame
> >> has less impact than a short HTTP-POST header ?
> >
> > You're still comparing apples to oranges. A POST works only one way and
> > for one single message. WS allows any number of messages to flow in any
> > direction at any time.
> >
> > Certainly if I want to remain connected to the server in a chat discussion
> > WS will be much more efficient than sending as many POST requests as I
> > expect to receive characters, words or lines !
> 
> It seems you are talking about HTTP and not WS.

WS works on top of HTTP infrastructure. It is designed to be compatible with
HTTP-compliant clients, firewalls, proxies, caches, intercepting intermediaries,
load balancers, servers (dedicated or shared), etc... All the complexity that
you perceive comes from the fact that we're making use of the already deployed
infrastructure. Otherwise we could as well decide to work on a new port with a
very simple protocol and wonder why nobody adopts it.

So when I'm talking about WS, yes I'm also talking about HTTP and that's on
purpose, because a connection request must be able to pass through all the
chain described above, and we want to be able to safely detect dirty failures.

Willy


From silvio.ventres@gmail.com  Fri Feb 25 11:03:12 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0D1173A69F5 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:03:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.314
X-Spam-Level: 
X-Spam-Status: No, score=-3.314 tagged_above=-999 required=5 tests=[AWL=0.285,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7CptMj3bPifl for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:03:11 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 1D2153A66B4 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:03:11 -0800 (PST)
Received: by vws6 with SMTP id 6so1835148vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:04:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=/mObu4tZjwSTnwwdRw6XiWi9JTs+32qM+U/+pCuQ89Y=; b=Eg4nRL6B1Jodmk4cYiXNUAvSYN2Qg3/WK9KzBKzJFovw7vu+xMXzK4yUtAlx4ljg5z Wctt0JmHOhtYBquOIBc1ViXlb8rp8iVYXuM5NiKB/BUyG8RroTj/166iufdMUhToZojA klCEaVnyJBOCCq3vYgkJeGxYdOYJzdXEHnkMA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=ohZSDdXIA1G1mZtQbJUWDGkCHJOnWP1wqqYSEfMDisvKkPvFcWWLaGQh1Yja3qvti2 7WXqINosqYmrVJqQqCiWz4l+7i/2SWOZO8kq3Ll7nVtQmessnMcJcEO/Cvn9Csw0JF3O Qo5r5MJAHhPWtWG55zzwI1OC5ZylJkuQWJSB4=
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr4741367vdb.150.1298660643122; Fri, 25 Feb 2011 11:04:03 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 11:04:02 -0800 (PST)
In-Reply-To: <20110225170646.GF23570@1wt.eu>
References: <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu>
Date: Fri, 25 Feb 2011 21:04:02 +0200
Message-ID: <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:03:12 -0000

> I think you really did not get the principle of establishing a bidirectional
> communication between the client and the server. It's not WS which makes it
> bidirectional, it's the HTTP handshake based on the Upgrade header and the
> 101+Upgrade in the response. The method is irrelevant. WS is used on top of
> that to provide framing and to ensure that HTTP and WS don't accidently mix.

The bidirectional capability of WS is provided by either the server
being a WS-server
from the start, or by HTTP server forwarding the request to its
WS-compliant part after
sensing WS-specific headers. Whether those headers are HTTP Upgrade or
any others
is irrelevant, as these have to be defined explicitly in any case.

Thus, whether WS uses GET, POST or any other headers is a matter of
specification.

If you're talking about caching intermediaries, if they don't support
WS specifically,
whether you use Upgrade or not won't matter much. HTTP semantics apply.

If the above is not correct, please enlighten.

--
 silvio

From w@1wt.eu  Fri Feb 25 11:03:31 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0969B3A6A0E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:03:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.796
X-Spam-Level: 
X-Spam-Status: No, score=-1.796 tagged_above=-999 required=5 tests=[AWL=-0.068, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, SARE_MILLIONSOF=0.315]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7THCXs-sy4yS for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:03:30 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 024B93A69F5 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:03:29 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PJ4Jlv026745; Fri, 25 Feb 2011 20:04:19 +0100
Date: Fri, 25 Feb 2011 20:04:19 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225190419.GO23570@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de> <AANLkTimi-MBT9=sKkNuPTNvkJOKckMsBSgWaiu+nWsdV@mail.gmail.com> <diqfm6lck4hcbaekjf4es1a6v9s9bocael@hive.bjoern.hoehrmann.de> <AANLkTimdC9G3+pbJEzp6y27Y4+CQb0r5aKH75ifqRWuG@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimdC9G3+pbJEzp6y27Y4+CQb0r5aKH75ifqRWuG@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:03:31 -0000

On Fri, Feb 25, 2011 at 08:36:32PM +0200, Silvio Ventres wrote:
> A valid point made by someone else was that a caching intermediary
> might cache the WS server
> response and the client needs to have a way to know such from a real
> response. _That_ requires some
> dynamic challenge/response from WS in the browser to the server.

Ah, at last !

> But to do that you don't need to add computation complexity. Indeed,
> hashing is not a free operation.

Maybe cheaper alternatives can be proposed, as long as the purpose is
as efficient. The hash only applies to first incoming connections, so
its cost is estimated low, compared to the cost of accepting a new
connection. We've fought on some proposals where it was needed to
compute a hash on each frame, and still some members considered it
not too expensive. So probably that one hash per connection is cheap.

Are you expecting to process millions of new connections per second
on a sub-$1K system ? If so, I'm wondering what usage you're targetting,
maybe you need to use native TCP instead for your application ?

Willy


From silvio.ventres@gmail.com  Fri Feb 25 11:07:09 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0C0FD3A69F5 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:07:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.819
X-Spam-Level: 
X-Spam-Status: No, score=-2.819 tagged_above=-999 required=5 tests=[AWL=-0.220, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ns3DfEs3dUkJ for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:07:07 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id C29B53A67E2 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:07:07 -0800 (PST)
Received: by vxg33 with SMTP id 33so1767237vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:08:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=P16DUkpxS+E+4MQS/BOW9QElrV3NTZfuTaKJijZUwUM=; b=CsIaBWl2unO6l+HiUVb5Vqnp++9S0VhAcMLWfXRXcT8DZqVYPE8TQFJ/Q+NnzEK2yt Di7WczWQz9Fs+lv9JCHyHWtlKP5TQ+OtukQ+AzychkPVtpH3ExSG04CPTlnlfsjJ/2bD DWxrLkemtj4fsEknpg+dJYVP5meQpSJdUsAHg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=sbHrFt/0QwlAY03UYfzH6R9/XAmxtJItCzAr1m1IY5eKWEa3Nz/U3fhtkOv7cUfVCQ axA8QBauHZZf5qMriSaHuYZp+GEZByYugeFrX6RgZjByJva/mgtJlG+nrUQS7QP7VjVk WOEtC5fQHCLTj9eHxjDK5LWEDageP2YaSwhSg=
MIME-Version: 1.0
Received: by 10.52.174.38 with SMTP id bp6mr1249907vdc.270.1298660880028; Fri, 25 Feb 2011 11:08:00 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 11:07:59 -0800 (PST)
In-Reply-To: <AANLkTi=A4r+RayTfRZGyyGMHUbuJvLK4KTNkqX-JHthc@mail.gmail.com>
References: <AANLkTiniXugsHKDBSvmrHyj3GDqv1cnCiVU5v+0aARAL@mail.gmail.com> <AANLkTikN_QWwkdLQPT2xS5S815de-svfEjK0QEs=fwXR@mail.gmail.com> <20110224150451.GG17386@1wt.eu> <AANLkTi=-yM91JCh_ZZd+QP6yMCxvvV-SZ=dAO2jZq4Ka@mail.gmail.com> <15283.1298561939.804809@puncture> <AANLkTi=K6GGPZyCrZ3BE3dekY=wxW2608Cx6H+_8whH+@mail.gmail.com> <20110224161926.GJ17386@1wt.eu> <AANLkTi=k6W-D0=bJPRFFkWzd+a-qs_0GYJX68dEg7_52@mail.gmail.com> <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <AANLkTi=A4r+RayTfRZGyyGMHUbuJvLK4KTNkqX-JHthc@mail.gmail.com>
Date: Fri, 25 Feb 2011 21:07:59 +0200
Message-ID: <AANLkTik0DYMLEVt1eZ5UJibwb3BDyRqo95a8McofTSod@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:07:09 -0000

> Imagine a chat client using WebSockets. =A0It connects and authenticates
> to a server, then doesn't send anything until the user types a
> message. =A0However, it needs to know when new messages from other users
> are sent, so the server sends a message on the connection. =A0If using
> separate POST messages for each frame (which can only be initiated
> from the client), how does the server send that message? =A0The best you

The POST headers are there to provide POST-like security. The server is a
WS server, not an HTTP server. Thus, it'll send replies whenever it wants t=
o.
And if it's an HTTP server with a separate WS-module, than the message woul=
d
be forwarded to that WS-module anyway.

>> If the proxy does not allow server to reply multiple times to the client=
,
>> whether you use POST or not is irrelevant.
>
> WebSockets as currently specified achieves this.

Achieves what ? Does WS as currently specified achieve
"one request, multiple replies" over legacy http proxies ?

--
 silvio

From w@1wt.eu  Fri Feb 25 11:09:37 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 153553A69F5 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:09:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.95
X-Spam-Level: 
X-Spam-Status: No, score=-1.95 tagged_above=-999 required=5 tests=[AWL=0.093,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IOixVFAma1V for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:09:36 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id E415F3A67E2 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:09:35 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PJANYg026784; Fri, 25 Feb 2011 20:10:23 +0100
Date: Fri, 25 Feb 2011 20:10:23 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225191023.GP23570@1wt.eu>
References: <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:09:37 -0000

On Fri, Feb 25, 2011 at 09:04:02PM +0200, Silvio Ventres wrote:
> > I think you really did not get the principle of establishing a bidirectional
> > communication between the client and the server. It's not WS which makes it
> > bidirectional, it's the HTTP handshake based on the Upgrade header and the
> > 101+Upgrade in the response. The method is irrelevant. WS is used on top of
> > that to provide framing and to ensure that HTTP and WS don't accidently mix.
> 
> The bidirectional capability of WS is provided by either the server
> being a WS-server
> from the start, or by HTTP server forwarding the request to its
> WS-compliant part after
> sensing WS-specific headers. Whether those headers are HTTP Upgrade or
> any others
> is irrelevant, as these have to be defined explicitly in any case.

No, the Upgrade header is the most important part. In HTTP, it means
"please don't use HTTP after that request, and upgrade to the protocol
I'm naming here if you can". HTTP-compliant intermediaries will
automatically switch to a tunnel between the client and the server
when they see status 101 in response to that header. This is what
transforms your HTTP connection into an established TCP connection
that WS can make use of.

> Thus, whether WS uses GET, POST or any other headers is a matter of
> specification.
> 
> If you're talking about caching intermediaries, if they don't support
> WS specifically,
> whether you use Upgrade or not won't matter much. HTTP semantics apply.

Yes it does matter because if they follow HTTP semantics, they will
provide you with this tunnel you need between the client and the server.

Please read section 9.8 of the HTTP spec here :

   http://datatracker.ietf.org/doc/draft-ietf-httpbis-p1-messaging/?include_text=1

Regards,
Willy


From w@1wt.eu  Fri Feb 25 11:14:32 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 46ED23A6A16 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:14:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.954
X-Spam-Level: 
X-Spam-Status: No, score=-1.954 tagged_above=-999 required=5 tests=[AWL=0.089,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2mh1GU71Swyh for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:14:31 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 2C1223A6A15 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:14:30 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PJFEkZ026820; Fri, 25 Feb 2011 20:15:14 +0100
Date: Fri, 25 Feb 2011 20:15:14 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225191514.GQ23570@1wt.eu>
References: <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <AANLkTi=A4r+RayTfRZGyyGMHUbuJvLK4KTNkqX-JHthc@mail.gmail.com> <AANLkTik0DYMLEVt1eZ5UJibwb3BDyRqo95a8McofTSod@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <AANLkTik0DYMLEVt1eZ5UJibwb3BDyRqo95a8McofTSod@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:14:32 -0000

On Fri, Feb 25, 2011 at 09:07:59PM +0200, Silvio Ventres wrote:
> > Imagine a chat client using WebSockets.  It connects and authenticates
> > to a server, then doesn't send anything until the user types a
> > message.  However, it needs to know when new messages from other users
> > are sent, so the server sends a message on the connection.  If using
> > separate POST messages for each frame (which can only be initiated
> > from the client), how does the server send that message?  The best you
> 
> The POST headers are there to provide POST-like security.

It is very frustrating to see that you still insist on talking about those
supposted "POST headers" which at best don't exist, or at worst don't mean
anything. And I think that all your reasoning is based on what idea you
have about this imaginary entity.

> The server is a
> WS server, not an HTTP server.

Yes it is.

> Thus, it'll send replies whenever it wants to.

Even if it tries to, the reply will not reach the client through any
possible intermediary because that is not compatible with HTTP. Why use
an HTTP handshake if you have the ability to talk whatever protocol you
want ? WS provides you with the protocol you want on top of HTTP precisely
because in most environments, only HTTP can pass through.

> And if it's an HTTP server with a separate WS-module, than the message would
> be forwarded to that WS-module anyway.

That's irrelevant.

> >> If the proxy does not allow server to reply multiple times to the client,
> >> whether you use POST or not is irrelevant.
> >
> > WebSockets as currently specified achieves this.
> 
> Achieves what ? Does WS as currently specified achieve
> "one request, multiple replies" over legacy http proxies ?

Yes. Even "zero request, multiple replies" if you want.

Willy


From silvio.ventres@gmail.com  Fri Feb 25 11:29:18 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4DB833A69F2 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:29:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.315
X-Spam-Level: 
X-Spam-Status: No, score=-3.315 tagged_above=-999 required=5 tests=[AWL=0.284,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VTS7tPJy+izP for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:29:17 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 6441E3A6831 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:29:17 -0800 (PST)
Received: by vws6 with SMTP id 6so1857979vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:30:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Wdelz8U565oQt25mtLvgCTpvxZuZkYEKe8ev6C42iOI=; b=yFf0EPtJFsR2mXTBxRV8EL15IS0FlRvZoyGeZ+Wh8clN2Sn3Gqu6FEKuVdvxe+Gkw8 xbB1EkxPGJl0MON6aKvtsnUCUw7O41KNsIqOXOS7KVJg4Ute5MJS5FGVUsq+8wkTq6dJ FC8kpME78BRQRv+pt75hLRkcKjrNWePU70xIg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Y92MTxEXWTW0R6z2WbrIK8N6CVkJkl+Wm4Ki2g5kS0Ta0LCumxrOl3LsKnTMRKrCEy 8x+EvAbzwjtGLxA3Vy/Gbmb+5HYUQq4odc7fOt0jYWH+pWZpHlQHyCyWfHxlkuY403jK /32nZk5PqsFYaKaJ6p3EdV8C2QIlM/mvlHlog=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr4789313vdb.230.1298662210140; Fri, 25 Feb 2011 11:30:10 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 11:30:10 -0800 (PST)
In-Reply-To: <20110225191023.GP23570@1wt.eu>
References: <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu>
Date: Fri, 25 Feb 2011 21:30:10 +0200
Message-ID: <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:29:18 -0000

> No, the Upgrade header is the most important part. In HTTP, it means
> "please don't use HTTP after that request, and upgrade to the protocol
> I'm naming here if you can". HTTP-compliant intermediaries will
> automatically switch to a tunnel between the client and the server
> when they see status 101 in response to that header. This is what
> transforms your HTTP connection into an established TCP connection
> that WS can make use of.

>From a quick look at squid, as an example of caching proxy, it does not support
HTTP/1.1 Upgrade. The code actually falls through to a break.

Thus, this is not really useful for caching intermediaries.

For HTTP servers, although the Upgrade mechanism is custom-made anyway,
if you want to leave the HTTP GET/Upgrade intact, leave it, but, to get HTTP
level of security regarding the data contents, add fake-POST headers to each
successive message after handshake.

> Yes it does matter because if they follow HTTP semantics, they will
> provide you with this tunnel you need between the client and the server.

Most proxies don't. The minority that do shouldn't be a considered the norm.
Actually, if you can name that minority, that would be useful.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 11:40:51 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7D4623A6A26 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:40:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.32
X-Spam-Level: 
X-Spam-Status: No, score=-3.32 tagged_above=-999 required=5 tests=[AWL=0.279,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4dqDlPMJWuAt for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:40:50 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 8487D3A6A22 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:40:50 -0800 (PST)
Received: by vws6 with SMTP id 6so1867835vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 11:41:43 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=1GejWCCK0OvOBD2Lri9kRQhSdHPycQNxpqRxEnDimfM=; b=Qg02QGSSnH2B4AquGCJOEqYYOw5gTrergVwkXHlnXdtU2N3EkfMhYwtxuahSEnLO+o BFb3sngPOf1kElvWtJPxIm5e1yVer2vnfclKb/MohEeLqC+Nv1ologHE+ehMEi5/+AcT C7wap3GuSH+yULEQStaymWaRuSJ5Pw4WRS1hs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=hgKjIxn8a7ct7ef7ppvvo+R2TeKZ72T60NM7F9qXjAEZLj83ZdZzvQ4EZanQVAeBg4 INP+3SQaklfbLGi/kk65+fqqPACJzma6tOlJ52j537xe8OeUlJBAbknQ5LRGk9e+S7LK I+ZNiYz7op8cvVHTt0/jMAMv6rQPZ8an+kHDg=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr4810790vdb.230.1298662903000; Fri, 25 Feb 2011 11:41:43 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 11:41:42 -0800 (PST)
In-Reply-To: <20110225191514.GQ23570@1wt.eu>
References: <4D668F66.8060607@caucho.com> <AANLkTikwve6SY5pQOo-cPc-0D6mRjaDu2rrOsTe9ZkA2@mail.gmail.com> <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <AANLkTi=A4r+RayTfRZGyyGMHUbuJvLK4KTNkqX-JHthc@mail.gmail.com> <AANLkTik0DYMLEVt1eZ5UJibwb3BDyRqo95a8McofTSod@mail.gmail.com> <20110225191514.GQ23570@1wt.eu>
Date: Fri, 25 Feb 2011 21:41:42 +0200
Message-ID: <AANLkTimKT6B1+zAki2rs-J9KX0YySV=n_iyknK52ia3Y@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:40:51 -0000

> It is very frustrating to see that you still insist on talking about those
> supposted "POST headers" which at best don't exist, or at worst don't mean
> anything. And I think that all your reasoning is based on what idea you
> have about this imaginary entity.

What is meant by "POST headers" is that you make each successive message
to the HTTP server _look like_ a POST request. If you have a direct connection
or a proxy-provided raw-socket tunnel to the WS server, it doesn't hurt.
If you have a connection over a proxy that might get harmed by data contents
of your message by whatever means (as shown by Adam Barth), then this
request, being considered a POST request by the proxy, will do no more harm
to the proxy than a regular POST request, thus obviating the need for masking.

>> WS server, not an HTTP server.
>
> Yes it is.

That's an interesting argument. An HTTP server that is not supporting WS is not
discussed here. If an HTTP server supports WS, and provides WS an Upgrade
tunnel to the WS-implementing module, the POST headers will  be stripped there.
The HTTP server will never see those POST headers as they are part of
the upgraded
protocol.


> Even if it tries to, the reply will not reach the client through any
> possible intermediary because that is not compatible with HTTP. Why use
> an HTTP handshake if you have the ability to talk whatever protocol you
> want ? WS provides you with the protocol you want on top of HTTP precisely
> because in most environments, only HTTP can pass through.

If Upgrade header guarantees that it will pass through, by all means, use it.

The discussion was about masking. And a solution proposed that instead of
masking, each successive message include a header that will make it look like
a POST request.
In case the initial HTTP/1.1 Upgrade established a tunnel, the POST headers
will simply be ignored by the WS-server.


>> Achieves what ? Does WS as currently specified achieve
>> "one request, multiple replies" over legacy http proxies ?
>
> Yes. Even "zero request, multiple replies" if you want.

What are those magical proxies that support HTTP/1.1 Upgrade ?

--
 silvio

From w@1wt.eu  Fri Feb 25 11:46:30 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ACEE93A6A19 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:46:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.957
X-Spam-Level: 
X-Spam-Status: No, score=-1.957 tagged_above=-999 required=5 tests=[AWL=0.086,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H+gzAjvLbOr7 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 11:46:29 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 532EF3A67FB for <hybi@ietf.org>; Fri, 25 Feb 2011 11:46:28 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PJlFk9027059; Fri, 25 Feb 2011 20:47:15 +0100
Date: Fri, 25 Feb 2011 20:47:15 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225194715.GS23570@1wt.eu>
References: <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 19:46:30 -0000

On Fri, Feb 25, 2011 at 09:30:10PM +0200, Silvio Ventres wrote:
> > No, the Upgrade header is the most important part. In HTTP, it means
> > "please don't use HTTP after that request, and upgrade to the protocol
> > I'm naming here if you can". HTTP-compliant intermediaries will
> > automatically switch to a tunnel between the client and the server
> > when they see status 101 in response to that header. This is what
> > transforms your HTTP connection into an established TCP connection
> > that WS can make use of.
> 
> >From a quick look at squid, as an example of caching proxy, it does not support
> HTTP/1.1 Upgrade. The code actually falls through to a break.

Indeed, and you'll also find others which break because they don't full
implement the HTTP/1.1 specification. That does not mean they won't be
fixed for that. Also, Squid is mostly used as an explicit proxy so it
generally will not be asked to support Upgrade, it will only receive
normal CONNECT-based proxy requests which do already work. And once again
as already explained, a big part of the handshake work is to ensure that
incompatible intermediaries are quickly detected instead of leaving a
connection hanging.

> For HTTP servers, although the Upgrade mechanism is custom-made anyway,
> if you want to leave the HTTP GET/Upgrade intact, leave it, but, to get HTTP
> level of security regarding the data contents, add fake-POST headers to each
> successive message after handshake.

You're still talking about those "POST headers". Care to explain them to
us one day ? It's really getting annoying to read about them in all your
mails without having them presented.

> > Yes it does matter because if they follow HTTP semantics, they will
> > provide you with this tunnel you need between the client and the server.
> 
> Most proxies don't.

Most proxies don't need to either. Reverse-proxies need that. Load balancers
need that.

> The minority that do shouldn't be a considered the norm.

The norm is defined as the HTTP/1.1 specification (RFC2616). Those who don't
implement it right now have probably not done it because there was no
immediate use. When users ask for fixing, they'll do, and it's quite easy
for many reverse-proxies.

> Actually, if you can name that minority, that would be useful.

At least I know that haproxy does support it if that helps. I don't know
all products, but if you're worried about one you find that does not support
it (and you'll find), please contact its author to kindly ask when support
is planned. It's possible that the author has never heard about Upgrade and
will take some time to discover how it works and what it implies for him.

In my case, adding it to haproxy was just a matter of a few hours, tests
included. And given the reports we seldom get on the list from people
implementing both a client and a server, I guess that's the average to
expect.

Regards,
Willy


From jat@google.com  Fri Feb 25 12:00:31 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 551753A6A57 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:00:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.219
X-Spam-Level: 
X-Spam-Status: No, score=-105.219 tagged_above=-999 required=5 tests=[AWL=0.157, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_37=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4LpCJFV7w7FI for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:00:29 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id BD0DF3A6A47 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:00:28 -0800 (PST)
Received: from hpaq1.eem.corp.google.com (hpaq1.eem.corp.google.com [172.25.149.1]) by smtp-out.google.com with ESMTP id p1PK1LIX011471 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:01:21 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298664081; bh=3eyMpStL9qg1sE+1uRY6QsGQ3Yc=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=O2w0r6QrVxJqgptWFN1lbooibFjZMauhG1Dkq71nYlsmcX4JHIQYyyF3KtXGZ2y9z UhmAXyoVNouT6kS8y5k1w==
Received: from gye5 (gye5.prod.google.com [10.243.50.5]) by hpaq1.eem.corp.google.com with ESMTP id p1PK115T026590 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 12:01:19 -0800
Received: by gye5 with SMTP id 5so991017gye.38 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:01:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=9a0tOz2BW4tmCg0ZIbusThxxdbaXYRt/sKfEguLveY8=; b=NZhDYY+Uozih0Qnh4PTQrrTBnwm+gw7wfGjv3kJ5BPh7xxW1D4AIP0+Iv56CIFuFSv +tjZ0EQx/IJVkpFUyLJQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Ehco5pQAAFDc4AwkSu2fejxPAz2wTg1FN+PywoqYCPKaA9WYgqcrWpckPv1vt1Tqc6 fer4peYGGOgCHPCTf7Ng==
Received: by 10.150.43.37 with SMTP id q37mr4100729ybq.103.1298664079158; Fri, 25 Feb 2011 12:01:19 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 12:00:59 -0800 (PST)
In-Reply-To: <20110225194715.GS23570@1wt.eu>
References: <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 15:00:59 -0500
Message-ID: <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: multipart/alternative; boundary=000e0cd5f1401ef590049d20cb7e
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:00:32 -0000

--000e0cd5f1401ef590049d20cb7e
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 2:47 PM, Willy Tarreau <w@1wt.eu> wrote:

> > For HTTP servers, although the Upgrade mechanism is custom-made anyway,
> > if you want to leave the HTTP GET/Upgrade intact, leave it, but, to get
> HTTP
> > level of security regarding the data contents, add fake-POST headers to
> each
> > successive message after handshake.
>
> You're still talking about those "POST headers". Care to explain them to
> us one day ? It's really getting annoying to read about them in all your
> mails without having them presented.


IIUC, he is suggesting changing the client->server WebSocket framing to
something like:

"POST /bogus HTTP/1.1\r\nContent-length: <length>\r\n<other
headers>\r\n\r\n" <websocket payload>

So that a transparent intermediary that doesn't understand GET+Upgrade will
not see any attacker-controlled data as an HTTP request.   While I believe
that will work, I believe the overhead is excessive and would preclude any
advantage WebSockets has over something like BOSH for small messages.  I
also think the tons of repeated content would impede debuggability at least
as much as having to do an XOR.

If I am reading a binary protocol, I am not going to (generally) look at the
bytes on the wire, but rather than decoded protocol output, such as from a
Wireshark dissector.  Even if you assume the payload will all be text
initially, hopefully most implementations will use compression so you still
have to do some decoding, and once you are doing that applying the XOR at
the same time you decompress it is trivial.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd5f1401ef590049d20cb7e
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 2:47 PM, Willy Tarreau <=
span dir=3D"ltr">&lt;<a href=3D"mailto:w@1wt.eu">w@1wt.eu</a>&gt;</span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">&gt; For HTTP servers, although the Upgrade mechanism is =
custom-made anyway,</div><div class=3D"im">
&gt; if you want to leave the HTTP GET/Upgrade intact, leave it, but, to ge=
t HTTP<br>
&gt; level of security regarding the data contents, add fake-POST headers t=
o each<br>
&gt; successive message after handshake.<br>
<br>
</div>You&#39;re still talking about those &quot;POST headers&quot;. Care t=
o explain them to<br>
us one day ? It&#39;s really getting annoying to read about them in all you=
r<br>
mails without having them presented.</blockquote><div><br></div><div>IIUC, =
he is suggesting changing the client-&gt;server WebSocket framing to someth=
ing like:</div><div><br></div><div>&quot;POST /bogus HTTP/1.1\r\nContent-le=
ngth: &lt;length&gt;\r\n&lt;other headers&gt;\r\n\r\n&quot; &lt;websocket p=
ayload&gt;</div>

<div><br></div><div>So that a transparent intermediary that doesn&#39;t und=
erstand GET+Upgrade will not see any attacker-controlled data as an HTTP re=
quest. =C2=A0 While I believe that will work, I believe the overhead is exc=
essive and would preclude any advantage WebSockets has over something like =
BOSH for small messages. =C2=A0I also think the tons of repeated content wo=
uld impede debuggability at least as much as having to do an XOR.</div>

<div><br></div><div>If I am reading a binary protocol, I am not going to (g=
enerally) look at the bytes on the wire, but rather than decoded protocol o=
utput, such as from a Wireshark dissector. =C2=A0Even if you assume the pay=
load will all be text initially, hopefully most implementations will use co=
mpression so you still have to do some decoding, and once you are doing tha=
t applying the XOR at the same time you decompress it is trivial.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd5f1401ef590049d20cb7e--

From w@1wt.eu  Fri Feb 25 12:03:05 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51CD63A6A0E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:03:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.96
X-Spam-Level: 
X-Spam-Status: No, score=-1.96 tagged_above=-999 required=5 tests=[AWL=0.083,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Nq2qX+gtp+C for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:03:03 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 718663A6817 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:03:02 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PK3ndp027144; Fri, 25 Feb 2011 21:03:49 +0100
Date: Fri, 25 Feb 2011 21:03:48 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225200348.GT23570@1wt.eu>
References: <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <AANLkTi=A4r+RayTfRZGyyGMHUbuJvLK4KTNkqX-JHthc@mail.gmail.com> <AANLkTik0DYMLEVt1eZ5UJibwb3BDyRqo95a8McofTSod@mail.gmail.com> <20110225191514.GQ23570@1wt.eu> <AANLkTimKT6B1+zAki2rs-J9KX0YySV=n_iyknK52ia3Y@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimKT6B1+zAki2rs-J9KX0YySV=n_iyknK52ia3Y@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:03:05 -0000

On Fri, Feb 25, 2011 at 09:41:42PM +0200, Silvio Ventres wrote:
> > It is very frustrating to see that you still insist on talking about those
> > supposted "POST headers" which at best don't exist, or at worst don't mean
> > anything. And I think that all your reasoning is based on what idea you
> > have about this imaginary entity.
> 
> What is meant by "POST headers" is that you make each successive message
> to the HTTP server _look like_ a POST request.

That's still very vague, you'll agree. Could you please post an example of
what such a request would look like ? It's not clear to me if you mean to
use the POST method or not, if you want to post a body or not, how you would
indicate it (content-length, transfer-encoding), if you intend to follow it
by an Upgrade or not, nor how you expect the request to be processed, or if
you expect both the request and response messages to simultaneously flow or
just one at a time.

The only thing I seem to understand is that with your proposal, a chat
application would require the client to send a full POST request for each
char or line typed, and I still don't get how you'd get the server's
asynchronous response without a hanging request.

So please take the time to describe the request(s) and the client-to-server
and server-to-client flows for the following sequence :

     client                               server
 1)  "Hello" ---->
 2)                                <---- "Hello"
 3)                                <---- "My name is Willy"
 4)  "Wait a minute!" ---->
 5)  "I'm back, my name is Silvio" ---->
 6)                                <---- "Pleased to meet you Silvio."


I don't see how you make that work with your "POST-like" requests. It's
possible with something like BOSH using multiple connections but with
one single connection without an Upgrade I don't see.

> >> WS server, not an HTTP server.
> >
> > Yes it is.
> 
> That's an interesting argument. An HTTP server that is not supporting WS is not
> discussed here.

it's been discussed quite a lot and is the reason for the way the handshake
looks like.

> If an HTTP server supports WS, and provides WS an Upgrade
> tunnel to the WS-implementing module, the POST headers will  be stripped there.
> The HTTP server will never see those POST headers as they are part of
> the upgraded protocol.

I don't get you without a clear example as requested above.

> 
> > Even if it tries to, the reply will not reach the client through any
> > possible intermediary because that is not compatible with HTTP. Why use
> > an HTTP handshake if you have the ability to talk whatever protocol you
> > want ? WS provides you with the protocol you want on top of HTTP precisely
> > because in most environments, only HTTP can pass through.
> 
> If Upgrade header guarantees that it will pass through, by all means, use it.

That's the point. It does not guarantee it will pass everywhere, however
when it passes, it has the precise semantics we're looking for.

> The discussion was about masking. And a solution proposed that instead of
> masking, each successive message include a header that will make it look like
> a POST request.
> In case the initial HTTP/1.1 Upgrade established a tunnel, the POST headers
> will simply be ignored by the WS-server.

Still confused.

Willy


From silvio.ventres@gmail.com  Fri Feb 25 12:04:37 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 620B23A6A28 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:04:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.824
X-Spam-Level: 
X-Spam-Status: No, score=-2.824 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cqw7gS2LMDTB for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:04:36 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 890CA3A67FB for <hybi@ietf.org>; Fri, 25 Feb 2011 12:04:36 -0800 (PST)
Received: by vxg33 with SMTP id 33so1818243vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:05:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=62HG1Nvwu25w//PCAdFYPNJzIBBWcDF5xcx4/FYWLeE=; b=NKio6vbRm+kq/Br8N0BD9/rdAQHVwLsEo08MCbKp/UbFhmpD/5TRDoNVou8BdBVTTp pcQNdagWzfkflxThQZaSXj/eVL4jSu5T21ADGAtU1UVcrAg6HPyQlyRvTYPJjBB6qvMC I50hZuAfCfl7VvFWMD5C53A4/qsZ5IckllBxA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=w7kI3bUDuHcftjG1QlkAyq0NMX1SW+d7bpA0rqipmsV86dQCrPduUkUv+0xCPk+Iu9 mrRaJYbIIl6yV8lKPvX0/731Tuu5xfTeUQo21s0xuDEXmfv6acWmVmuxeljwekSzdNUW dUUAYYHABniuomCCuJxWEYHBcQ5+P3nUEYe7o=
MIME-Version: 1.0
Received: by 10.52.159.163 with SMTP id xd3mr4717330vdb.30.1298664213122; Fri, 25 Feb 2011 12:03:33 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 12:03:33 -0800 (PST)
In-Reply-To: <20110225194715.GS23570@1wt.eu>
References: <20110224205601.GB20927@1wt.eu> <AANLkTinmay=H1FYVYBME3L6k4MfDht3LkfM27_YfASnG@mail.gmail.com> <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu>
Date: Fri, 25 Feb 2011 22:03:33 +0200
Message-ID: <AANLkTimUyCT6Lakb_wgKaNETktqMqLH7yf1RXNRn6Vt=@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:04:37 -0000

> You're still talking about those "POST headers". Care to explain them to
> us one day ? It's really getting annoying to read about them in all your
> mails without having them presented.

Well, a simple
"POST /ws HTTP/1.1
Host: ws

"

Is enough. This identifies the request as part of an, albeit broken,
POST request.


> The norm is defined as the HTTP/1.1 specification (RFC2616). Those who don't
> implement it right now have probably not done it because there was no
> immediate use. When users ask for fixing, they'll do, and it's quite easy
> for many reverse-proxies.

Why would you set a dependency between WS and HTTP/1.1 ?
Anyway, as much as this is interesting, it has no impact on the
proposed solution.

The problem that masking is made to prevent is only relevant to the
data content,
thus only the messages _after_ the handshake need to be protected.
Thus, the initial handshake doesn't need to change from GET to POST or
whatever else.

The poposal is for the subsequent messages to include a simple POST header,
such as quoted above, to bring WS to the same security level as HTTP
POST, regarding
harming intermediates.

--
 silvio

From w@1wt.eu  Fri Feb 25 12:05:46 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54AA73A6A28 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:05:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.663
X-Spam-Level: 
X-Spam-Status: No, score=-1.663 tagged_above=-999 required=5 tests=[AWL=-0.220, BAYES_00=-2.599, HELO_IS_SMALL6=0.556, J_CHICKENPOX_37=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FQP5dg5s94+c for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:05:45 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 1AB423A67FB for <hybi@ietf.org>; Fri, 25 Feb 2011 12:05:44 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PK6VwK027184; Fri, 25 Feb 2011 21:06:31 +0100
Date: Fri, 25 Feb 2011 21:06:31 +0100
From: Willy Tarreau <w@1wt.eu>
To: John Tamplin <jat@google.com>
Message-ID: <20110225200631.GU23570@1wt.eu>
References: <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:05:46 -0000

On Fri, Feb 25, 2011 at 03:00:59PM -0500, John Tamplin wrote:
> IIUC, he is suggesting changing the client->server WebSocket framing to
> something like:
> 
> "POST /bogus HTTP/1.1\r\nContent-length: <length>\r\n<other
> headers>\r\n\r\n" <websocket payload>
> 
> So that a transparent intermediary that doesn't understand GET+Upgrade will
> not see any attacker-controlled data as an HTTP request.   While I believe
> that will work,

It does not allow the server to talk without being invited to do so,
which is quite the opposite of the bidirectionality principle.

> I believe the overhead is excessive and would preclude any
> advantage WebSockets has over something like BOSH for small messages.  I
> also think the tons of repeated content would impede debuggability at least
> as much as having to do an XOR.
> 
> If I am reading a binary protocol, I am not going to (generally) look at the
> bytes on the wire, but rather than decoded protocol output, such as from a
> Wireshark dissector.  Even if you assume the payload will all be text
> initially, hopefully most implementations will use compression so you still
> have to do some decoding, and once you are doing that applying the XOR at
> the same time you decompress it is trivial.

I agree with all your points!

Willy


From jlee@antwerkz.com  Fri Feb 25 12:09:07 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5FA923A6A1E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:09:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.731
X-Spam-Level: 
X-Spam-Status: No, score=-2.731 tagged_above=-999 required=5 tests=[AWL=0.245,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w7gPln6glRFi for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:09:06 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id F00623A6A26 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:09:05 -0800 (PST)
Received: by fxm15 with SMTP id 15so2092660fxm.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:09:58 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.85.208 with SMTP id p16mr3168959fal.107.1298664264654; Fri, 25 Feb 2011 12:04:24 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Fri, 25 Feb 2011 12:04:24 -0800 (PST)
Date: Fri, 25 Feb 2011 15:04:24 -0500
Message-ID: <AANLkTinQ4j7rjk3haRnpj7avi6e=wru2GteRkRx-tSkP@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: hybi <hybi@ietf.org>
Content-Type: multipart/alternative; boundary=20cf3054a66f2d601b049d20d6f8
Subject: [hybi] timeline
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:09:07 -0000

--20cf3054a66f2d601b049d20d6f8
Content-Type: text/plain; charset=ISO-8859-1

I hate to interrupt the Silvio show but I was wondering if we could get a
rundown of the remaining issues (as known today) and see what kind of
timeline we're looking at for a 1.0 of the spec.  I know it'd be speculative
but it'd help on my end if we at least had some ballpark estimates.  I can
see two issues being batted around at the moment:  the close/RST issue and
the masking frame vs payload question.  Is there anything else that needs
hashing out?

-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--20cf3054a66f2d601b049d20d6f8
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

I hate to interrupt the Silvio show but I was wondering if we could get a r=
undown of the remaining issues (as known today) and see what kind of timeli=
ne we&#39;re looking at for a 1.0 of the spec. =A0I know it&#39;d be specul=
ative but it&#39;d help on my end if we at least had some ballpark estimate=
s. =A0I can see two issues being batted around at the moment: =A0the close/=
RST issue and the masking frame vs payload question. =A0Is there anything e=
lse that needs hashing out?<br clear=3D"all">
<br>-- <br>You can find me on the net at:<div><a href=3D"http://antwerkz.co=
m" target=3D"_blank">http://antwerkz.com</a><br><a href=3D"http://www.linke=
din.com/in/justinlee" target=3D"_blank">http://www.linkedin.com/in/justinle=
e</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--20cf3054a66f2d601b049d20d6f8--

From w@1wt.eu  Fri Feb 25 12:12:18 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F01C3A6A26 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:12:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.956
X-Spam-Level: 
X-Spam-Status: No, score=-1.956 tagged_above=-999 required=5 tests=[AWL=0.087,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lRBS5aIA2GZV for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:12:17 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 152013A6A29 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:12:16 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PKD1Mo027224; Fri, 25 Feb 2011 21:13:01 +0100
Date: Fri, 25 Feb 2011 21:13:01 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225201301.GV23570@1wt.eu>
References: <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimUyCT6Lakb_wgKaNETktqMqLH7yf1RXNRn6Vt=@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTimUyCT6Lakb_wgKaNETktqMqLH7yf1RXNRn6Vt=@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:12:18 -0000

On Fri, Feb 25, 2011 at 10:03:33PM +0200, Silvio Ventres wrote:
> > You're still talking about those "POST headers". Care to explain them to
> > us one day ? It's really getting annoying to read about them in all your
> > mails without having them presented.
> 
> Well, a simple
> "POST /ws HTTP/1.1
> Host: ws
> 
> "
> 
> Is enough. This identifies the request as part of an, albeit broken,
> POST request.

This request has no body. The only thing you can send after it is another
request (provided that intermediaries accept it). So it does not provide
any support for sending any byte of data. It's just an empty request waiting
for a next request once the server responds. At best it adds a round-trip
which slows the handshake down, at worst it's rejected.

> > The norm is defined as the HTTP/1.1 specification (RFC2616). Those who don't
> > implement it right now have probably not done it because there was no
> > immediate use. When users ask for fixing, they'll do, and it's quite easy
> > for many reverse-proxies.
> 
> Why would you set a dependency between WS and HTTP/1.1 ?

I'm not setting a dependency. WS *is* HTTP/1.1 compliant, which means it can
pass through HTTP-compliant infrastructure, taking benefit of everything that
is already deployed. Some non-HTTP compliant components will probably need to
be fixed on the server-side but that's much less work than starting something
new from scratch.

> Anyway, as much as this is interesting, it has no impact on the
> proposed solution.

Yes it has because you *have to* talk HTTP/1.1 over the wire.

> The problem that masking is made to prevent is only relevant to the
> data content,
> thus only the messages _after_ the handshake need to be protected.
> Thus, the initial handshake doesn't need to change from GET to POST or
> whatever else.
> 
> The poposal is for the subsequent messages to include a simple POST header,
> such as quoted above, to bring WS to the same security level as HTTP
> POST, regarding harming intermediates.

did not catch that one either :-/

Willy


From w@1wt.eu  Fri Feb 25 12:15:31 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 66A563A6A26 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:15:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.958
X-Spam-Level: 
X-Spam-Status: No, score=-1.958 tagged_above=-999 required=5 tests=[AWL=0.085,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 19ungVL7uLdD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:15:30 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 563A23A6A29 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:15:30 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PKGGEo027235; Fri, 25 Feb 2011 21:16:16 +0100
Date: Fri, 25 Feb 2011 21:16:15 +0100
From: Willy Tarreau <w@1wt.eu>
To: John Tamplin <jat@google.com>
Message-ID: <20110225201615.GW23570@1wt.eu>
References: <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:15:31 -0000

On Fri, Feb 25, 2011 at 03:10:01PM -0500, John Tamplin wrote:
> On Fri, Feb 25, 2011 at 3:06 PM, Willy Tarreau <w@1wt.eu> wrote:
> 
> > It does not allow the server to talk without being invited to do so,
> > which is quite the opposite of the bidirectionality principle.
> 
> 
> No, not actually a POST request, but just changing the framing of
> client->server frames to prevent transparent intermediaries from being
> confused.  The server could still initiate frames as it does in -05.

Do you mean just inserting a fake POST request *after the handshake* and
*before* the framing ? That's been proposed several times (and not only
POST, also other invalid requests as well as Dave Cridland's CONNECT
proposal). That was never broadly accepted and the most scared ones
were not convinced about the inability for intermediaries to skip over
those requests and resync with whatever would look like the next request.

Regards,
Willy


From silvio.ventres@gmail.com  Fri Feb 25 12:16:23 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 922AF3A6A2C for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:16:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.321
X-Spam-Level: 
X-Spam-Status: No, score=-3.321 tagged_above=-999 required=5 tests=[AWL=0.278,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gKwjdVSOtnAd for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:16:22 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id AC7FF3A6A26 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:16:22 -0800 (PST)
Received: by vws6 with SMTP id 6so1899892vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:17:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=o2ChtXhmGK2S7w9nowWdo3176IMM5E1SItbBcxY6nn0=; b=ZXv572L189b08UM5kyo2+TcJ20sD5Pj2mdtoPg50O0dL8ev2cDP/8hmUVdGqm7keg8 SBLeybrv7fIzdewR8pB4ShREQgbE93LpIAACHPUcfN3Iu9YuIOgmraFCP0d/+MgLDkd6 /xt6njT+goiWn14lQ5m4T/IajFgTK7OqIeaPc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Qlv9s+3EY0tSc45MhUX5/DflBOov9GM8QG6kLpBq2bVWOF8WuJx9kg+2BcmG0txEVn Yxr7pi1xl81W6k+DL2Kw44F/ERUOC1TUenapuqoJiayJ7fVmm/YKE99rL5BSA4s41pfA 0pjzIuKOgM65A1hLcu+N58xasvRaCJuDwAA3A=
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr4881249vdb.150.1298665035578; Fri, 25 Feb 2011 12:17:15 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 12:17:15 -0800 (PST)
In-Reply-To: <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de>
Date: Fri, 25 Feb 2011 22:17:15 +0200
Message-ID: <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:16:23 -0000

>>REQUEST: Is there a reason to not use fake POST-like headers in each WS
>>message, thus bringing the security to the same level as HTTP POST ?
>
> Making all communication conform to the HTTP protocol specifications is
> indeed an alternative as far as security goes, but this would not play

You and Willy misunderstood.
The POST headers are not meant to be parsed by the server. They are added
when the server is already talking in WS protocol, not HTTP. Thus, these won't
actually mean anything to the server, and should be ignored.

The only reason to add them is to make sending any data content possible through
HTTP ports, with security implications _no worse_ than normal HTTP POST.

Again, the requests are _not_ HTTP requests. This is still WS, with a
"POST /ws HTTP/1.1\r\nHost: ws\r\n\rn" header attached in front.

This removes the need for masking, brings back debug and low
complexity and costs ~20 bytes overhead.

--
 silvio

From jat@google.com  Fri Feb 25 12:17:06 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9F1D83A6A26 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:17:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.532
X-Spam-Level: 
X-Spam-Status: No, score=-105.532 tagged_above=-999 required=5 tests=[AWL=0.444, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rFDV-906igWD for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:17:05 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 973943A6A0E for <hybi@ietf.org>; Fri, 25 Feb 2011 12:17:05 -0800 (PST)
Received: from hpaq14.eem.corp.google.com (hpaq14.eem.corp.google.com [172.25.149.14]) by smtp-out.google.com with ESMTP id p1PKHwWn022799 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:17:58 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298665078; bh=Yp05TY6wdgf149BGFh/cfZwOcio=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=SH3KqXOi+c/BJMRA1dQIpUxJMpsEBM+vcp/QZi1895hM1Fz0Vg9E7llx+m0a5UeVL EdtjtFs46nP0pmW68+NJA==
Received: from ywa1 (ywa1.prod.google.com [10.192.1.1]) by hpaq14.eem.corp.google.com with ESMTP id p1PKHuoA010894 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 12:17:57 -0800
Received: by ywa1 with SMTP id 1so747678ywa.11 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:17:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=8ILNmQiTR2yDBBW1dHHpXF257FrS7+due9bTOqENiFA=; b=HCeg+B3SqO4/PEOus8yMDIQwVF8tkwwa1vQjKQIYwpIUKO5tZQo3vRUwj6jZf3Ur0p tTx06aw1f720wCCXqnpA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=gFp2XxbyjYVSf9pDIBAVeZhK4ylsZGzi4jdS0lJoXqHkg/kL2MVtV9TdcI/79VLDDe aZHyvAftEvkKkoDAieFQ==
Received: by 10.151.142.6 with SMTP id u6mr4188426ybn.46.1298664621119; Fri, 25 Feb 2011 12:10:21 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 12:10:01 -0800 (PST)
In-Reply-To: <20110225200631.GU23570@1wt.eu>
References: <1298586760.2498.603.camel@ds9.ducksong.com> <AANLkTikLTU6dthv5D9qbt=BoHj7SrZei+UaGKf9YoKn1@mail.gmail.com> <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 15:10:01 -0500
Message-ID: <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: multipart/alternative; boundary=0015174bdd806c9a9c049d20ebc9
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:17:06 -0000

--0015174bdd806c9a9c049d20ebc9
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 3:06 PM, Willy Tarreau <w@1wt.eu> wrote:

> It does not allow the server to talk without being invited to do so,
> which is quite the opposite of the bidirectionality principle.


No, not actually a POST request, but just changing the framing of
client->server frames to prevent transparent intermediaries from being
confused.  The server could still initiate frames as it does in -05.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--0015174bdd806c9a9c049d20ebc9
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 3:06 PM, Willy Tarreau <=
span dir=3D"ltr">&lt;<a href=3D"mailto:w@1wt.eu">w@1wt.eu</a>&gt;</span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">It does not allow the server to talk without being invite=
d to do so,</div>
which is quite the opposite of the bidirectionality principle.</blockquote>=
<div><br></div><div>No, not actually a POST request, but just changing the =
framing of client-&gt;server frames to prevent transparent intermediaries f=
rom being confused. =C2=A0The server could still initiate frames as it does=
 in -05.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--0015174bdd806c9a9c049d20ebc9--

From jat@google.com  Fri Feb 25 12:19:50 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 63BE23A6A29 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:19:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.566
X-Spam-Level: 
X-Spam-Status: No, score=-105.566 tagged_above=-999 required=5 tests=[AWL=0.410, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g1dM-FSPuLG8 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:19:49 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 6CB093A6A0E for <hybi@ietf.org>; Fri, 25 Feb 2011 12:19:47 -0800 (PST)
Received: from wpaz1.hot.corp.google.com (wpaz1.hot.corp.google.com [172.24.198.65]) by smtp-out.google.com with ESMTP id p1PKKdwr003084 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:20:39 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298665240; bh=YwYQkTyJ+S+G8r/7VgJPVfohC0c=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=PMUdFhw3wcdmY/6QEzGvaoAHIOP+kQMs/88vK0Ys4YSlBoEsHr4qHk9yVvFcQjwic VH7ulM0rDS22eZ+Xq9rPg==
Received: from gyd10 (gyd10.prod.google.com [10.243.49.202]) by wpaz1.hot.corp.google.com with ESMTP id p1PKKKln001881 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 12:20:38 -0800
Received: by gyd10 with SMTP id 10so988940gyd.26 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:20:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=bAFARZoXZvwtNI16/NdBS8M1IL4Dw6nAE4xfGfTUzUw=; b=eDYWrBw34IfRaA5vl3DYPnT7vLQPCeBfFAA5ZnUUHdD4a0DZKEMc5uDSa87BFFVl9O KY6QaoYGLEoOLTWUvfaQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=ttJr2Iy2i5H+q8U2ec4+ltnTLbfNAmMOlXRqqRESVGzO/1mKGsvBJJHggkx0TrvyVF 1SqDLVvMIp++F94LebOQ==
Received: by 10.150.69.5 with SMTP id r5mr2919106yba.217.1298665238109; Fri, 25 Feb 2011 12:20:38 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 12:20:18 -0800 (PST)
In-Reply-To: <20110225201615.GW23570@1wt.eu>
References: <AANLkTim-_MpQGYkZLx3cWmcKZWA1GcTKTa74GtD8mWnX@mail.gmail.com> <AANLkTikrV9T190f37SDXdS44XbQWSXcDGK01kBjwvrRq@mail.gmail.com> <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 15:20:18 -0500
Message-ID: <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: multipart/alternative; boundary=000e0cd591b4331d7e049d211089
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:19:50 -0000

--000e0cd591b4331d7e049d211089
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 3:16 PM, Willy Tarreau <w@1wt.eu> wrote:

> Do you mean just inserting a fake POST request *after the handshake* and
> *before* the framing ? That's been proposed several times (and not only
> POST, also other invalid requests as well as Dave Cridland's CONNECT
> proposal). That was never broadly accepted and the most scared ones
> were not convinced about the inability for intermediaries to skip over
> those requests and resync with whatever would look like the next request.
>

I believe he means to insert the fake POST request before (or rather as part
of) each client->server WebSocket frame.  Since the POST request would
include the WS frame as part of the POST contents, intermediaries that were
interpreting the POST message as real would skip over any
attacker-controlled bytes.

So, I believe it would solve the problem just fine, but personally I think
the overhead is far too high.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd591b4331d7e049d211089
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 3:16 PM, Willy Tarreau <=
span dir=3D"ltr">&lt;<a href=3D"mailto:w@1wt.eu">w@1wt.eu</a>&gt;</span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">Do you mean just inserting a fake POST request *after the=
 handshake* and</div>
*before* the framing ? That&#39;s been proposed several times (and not only=
<br>
POST, also other invalid requests as well as Dave Cridland&#39;s CONNECT<br=
>
proposal). That was never broadly accepted and the most scared ones<br>
were not convinced about the inability for intermediaries to skip over<br>
those requests and resync with whatever would look like the next request.<b=
r></blockquote></div><div><br></div>I believe he means to insert the fake P=
OST request before (or rather as part of) each client-&gt;server WebSocket =
frame. =C2=A0Since the POST request would include the WS frame as part of t=
he POST contents, intermediaries that were interpreting the POST message as=
 real would skip over any attacker-controlled bytes.<div>

<br></div><div>So, I believe it would solve the problem just fine, but pers=
onally I think the overhead is far too high.<br clear=3D"all"><br>-- <br>Jo=
hn A. Tamplin<br>Software Engineer (GWT), Google<br>
</div>

--000e0cd591b4331d7e049d211089--

From jat@google.com  Fri Feb 25 12:22:45 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 284E73A6A29 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:22:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.596
X-Spam-Level: 
X-Spam-Status: No, score=-105.596 tagged_above=-999 required=5 tests=[AWL=0.380, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZfMetCskgTuO for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:22:44 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 113EB3A6A0E for <hybi@ietf.org>; Fri, 25 Feb 2011 12:22:43 -0800 (PST)
Received: from kpbe15.cbf.corp.google.com (kpbe15.cbf.corp.google.com [172.25.105.79]) by smtp-out.google.com with ESMTP id p1PKNZW8031680 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:23:36 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298665416; bh=R6qJcKgJ67zMOjHy5d5W86Ekpfg=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=BRZFGMNFGoO/VsYnRA10O5+WUt0Abrqbuu8ik458n1QHeljupwzZcp/KzkHmM2bev xrQNeG7I5N/LS0zVcNdOw==
Received: from yxp4 (yxp4.prod.google.com [10.190.4.196]) by kpbe15.cbf.corp.google.com with ESMTP id p1PKMxnI017703 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 12:23:34 -0800
Received: by yxp4 with SMTP id 4so1022713yxp.38 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:23:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=nsQqPafZLmjlOrjSvEb6zOcJRPYtObbVHiHzUaCE31E=; b=eYDwEY8yrsXZp1kPxkkkVduYxfpeUpi5Ln1EF0MyvGyzrEcmrBDApAUpkdfb6tKsiA Cqx7CHCs49Sa089uk4fw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=F79VTuZiqp5Wtu2KqDm0XNCmjKXtMemiF/kLCRoTppRt9WvzZpQwcWIBSvxObn6qzT JFBXvsvcsM2rnki4yR2A==
Received: by 10.150.43.37 with SMTP id q37mr4129151ybq.103.1298665414173; Fri, 25 Feb 2011 12:23:34 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 12:23:14 -0800 (PST)
In-Reply-To: <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 15:23:14 -0500
Message-ID: <AANLkTi=hCoKqcHJm4dHR19B496ae8yAaHjUvrxu8UgD+@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd5f140b1a56b049d211a8e
X-System-Of-Record: true
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:22:45 -0000

--000e0cd5f140b1a56b049d211a8e
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 3:17 PM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> Again, the requests are _not_ HTTP requests. This is still WS, with a
> "POST /ws HTTP/1.1\r\nHost: ws\r\n\rn" header attached in front.
>
> This removes the need for masking, brings back debug and low
> complexity and costs ~20 bytes overhead.
>

As I count your example, it is 31 bytes.  Also, I think you need a
Content-length header, and perhaps even a Content-type header, which raises
the overhead even further.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd5f140b1a56b049d211a8e
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 3:17 PM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">Again, the requests are _not_ HTTP requests. This is stil=
l WS, with a</div>
&quot;POST /ws HTTP/1.1\r\nHost: ws\r\n\rn&quot; header attached in front.<=
br>
<br>
This removes the need for masking, brings back debug and low<br>
complexity and costs ~20 bytes overhead.<br></blockquote></div><div><br></d=
iv><div>As I count your example, it is 31 bytes. =C2=A0Also, I think you ne=
ed a Content-length header, and perhaps even a Content-type header, which r=
aises the overhead even further.</div>

<br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd5f140b1a56b049d211a8e--

From w@1wt.eu  Fri Feb 25 12:30:54 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCC533A6A32 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:30:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.961
X-Spam-Level: 
X-Spam-Status: No, score=-1.961 tagged_above=-999 required=5 tests=[AWL=0.082,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id whOp9cyanhLq for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:30:54 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id BD9723A6A2C for <hybi@ietf.org>; Fri, 25 Feb 2011 12:30:53 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PKVb9V027326; Fri, 25 Feb 2011 21:31:37 +0100
Date: Fri, 25 Feb 2011 21:31:37 +0100
From: Willy Tarreau <w@1wt.eu>
To: John Tamplin <jat@google.com>
Message-ID: <20110225203137.GX23570@1wt.eu>
References: <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu> <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:30:55 -0000

On Fri, Feb 25, 2011 at 03:20:18PM -0500, John Tamplin wrote:
> On Fri, Feb 25, 2011 at 3:16 PM, Willy Tarreau <w@1wt.eu> wrote:
> 
> > Do you mean just inserting a fake POST request *after the handshake* and
> > *before* the framing ? That's been proposed several times (and not only
> > POST, also other invalid requests as well as Dave Cridland's CONNECT
> > proposal). That was never broadly accepted and the most scared ones
> > were not convinced about the inability for intermediaries to skip over
> > those requests and resync with whatever would look like the next request.
> >
> 
> I believe he means to insert the fake POST request before (or rather as part
> of) each client->server WebSocket frame.  Since the POST request would
> include the WS frame as part of the POST contents, intermediaries that were
> interpreting the POST message as real would skip over any
> attacker-controlled bytes.
> 
> So, I believe it would solve the problem just fine, but personally I think
> the overhead is far too high.

If you want my opinion, it solves the problem just as fine as not masking
at all, but the reasons why we got masking is that some of us wanted to
ensure that no request could be found wherever in the stream. I don't see
that the fake request as a big overhead, however it just pushes the issue
slightly further. It's supposed to force deeply broken intermediaries to
close, while we have no idea whether they'll simply parse that as a valid
request and go to the next byte to find a request again. It's not easy to
make a request appear as invalid to everyone. But well, let's not reopen
this smelly can of worms...

Anyway, thanks John for having enlightened me on Silvio's goal :-)

Regards,
Willy


From silvio.ventres@gmail.com  Fri Feb 25 12:34:58 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D6763A6A28 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:34:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.668
X-Spam-Level: 
X-Spam-Status: No, score=-2.668 tagged_above=-999 required=5 tests=[AWL=-0.384, BAYES_00=-2.599, SARE_MILLIONSOF=0.315]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lcki-nNqvdnm for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:34:57 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id AC2843A6A33 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:34:56 -0800 (PST)
Received: by vxg33 with SMTP id 33so1843516vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:35:49 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type; bh=ytNAec8mO45ipGnCvwUv+Rpd76bnHCniefgp9xMgaJM=; b=qTM2kda0CMx/0icX//Ilbj6oyxjeNWVdD4EdiPmrfEj69BUXLxkb6Qtpbv8KPa/xq2 7FgsGZNk6LLrl9hhh1wvqZA4c/f+VCIndnAYxGEn4FqBdn0TcY+kurYmvW+WrR+/y3Oj TfAO6atIfwf2bH1aNElvmSd8AkoHrDpdhXOHU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=Obxcb7QUtGUlF02QJBfUh8T5omm/fXzjo6rEcnlDcWK4ZkOIEPFSizhf0FxTECce28 pDDNXR+ybvl1SkLcfMA4VIUPza4OOeu+QGhdp8kzVKmf4zePppI+778962HXRxubpyIE WlI/K3gI2HeL7e3hgtow7EajbQtvmX1AKDkcQ=
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr4903516vdb.190.1298666149588; Fri, 25 Feb 2011 12:35:49 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 12:35:49 -0800 (PST)
In-Reply-To: <20110225192527.GR23570@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <j8nfm69ddj3q7h8gt7fnctaifns71r9g16@hive.bjoern.hoehrmann.de> <AANLkTimi-MBT9=sKkNuPTNvkJOKckMsBSgWaiu+nWsdV@mail.gmail.com> <diqfm6lck4hcbaekjf4es1a6v9s9bocael@hive.bjoern.hoehrmann.de> <AANLkTimdC9G3+pbJEzp6y27Y4+CQb0r5aKH75ifqRWuG@mail.gmail.com> <20110225190419.GO23570@1wt.eu> <AANLkTimJ5ymOiiSEamg_r=PPyHQAxUxAjLNau9Su8GXy@mail.gmail.com> <20110225192527.GR23570@1wt.eu>
Date: Fri, 25 Feb 2011 22:35:49 +0200
Message-ID: <AANLkTimDo2y9uz=ZJdkmbLDnOggvJ0Rt6i609HTFAfwJ@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>, Server-Initiated HTTP <hybi@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:34:58 -0000

> It's not a matter of being more or less secure but of safely ensuring
> that the response matches the request. I'm sure that for most server-side
> implementors, running a SHA-1 on a small string is much easier to implement
> than to perform multiplications or such operations.

Willy, the multiplication is simple multiplication, not some complex math.

Basically, instead of putting a function that does
some_lib_SHA1("ws-magic+server-challenge"),
you do (server_challenge + 192739733), or (server_challenge * 192763 mod 2^^32),
with 192739733 being some number
specified statically in the spec.


> Probably that a simple checksum would have been OK too, but those functions
> are rarely present in common frameworks while SHA-1 is available everywhere.
> So in my opinion it's really just a matter of making it easier for the
> developper. Fell free to propose something easier and at least as safe, and
> to defend it here, maybe it could be improved.

What "those functions" ?
Addition, multiplication and mod functions are basic stuff, no
libraries needed :)


> Not at all, I too am doing that all my time from dirt-cheap hardware. I'm
> just comparing numbers. People running millions of connections per second
> might be as big as Google and still could run this hash on a sub-$1K server,
> which itself could not stand the network traffic at all. Imagining that sites

Yes, but if they can do 10 Million connection handshakes per second compared
to 1 Million, why would you want to limit them to 1 Million ?
And, yes, hash is an expensive function.


> "more complex" than what alternative ? If an alternative is as easy to
> implement, as safe and cheaper, surely most people will accept it, feel
> free to present it.

Mod-Multiplication is easier to implement and cheaper.
It's on the same level of safety regarding the target goal, which is
to add dynamic element to the handshake to prevent cached replies.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 12:36:34 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF0853A6A28 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:36:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.319
X-Spam-Level: 
X-Spam-Status: No, score=-3.319 tagged_above=-999 required=5 tests=[AWL=0.280,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F9H6mJ5WnNUo for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:36:33 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 89D743A6A26 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:36:33 -0800 (PST)
Received: by vws6 with SMTP id 6so1916385vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:37:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=jAmjjh1CfzsKHvxCAGvEIZxNKN/BcsCOD1WwjPeSN58=; b=s+taquyIiU8y3VVot+cTLpcVWI4STE1j2GgskgvO7M/wi9GIG7UX5Z3YIEl+Sb0i+G OCApxTTfHL1t3MB9ZP4xBfKmNknvbTDtqxWbDPFj1w+idu2zM8nNbL7BsKc9LzL2D8aW LhxK2zLHUkIS+QIiGKWKLNFSPFxXfUjXGeSic=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=fFpo7L0Ku2Oweq/vDn1EhQdt9kJMJ9IW5pm6iM+wMNUDNzLFyp5dGRzhNePdCWjkr/ yb9G2DcszG+fDKNpDZPPD06w0uaWYZisp7wnOv+sC9xjtSW0MJfr5/c1ymlBOfPTzYbb ULMdYj/EBRNJFQIq2Y86VBkIx3abjhQUqabgo=
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr4915057vdb.150.1298666246294; Fri, 25 Feb 2011 12:37:26 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 12:37:26 -0800 (PST)
In-Reply-To: <20110225203137.GX23570@1wt.eu>
References: <20110225170646.GF23570@1wt.eu> <AANLkTikVa7ELM+yuNMEfX-1tHRw7AkWrz+pu9z0-ZvGb@mail.gmail.com> <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu> <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com> <20110225203137.GX23570@1wt.eu>
Date: Fri, 25 Feb 2011 22:37:26 +0200
Message-ID: <AANLkTikAiey+wg8H=UmCqKjhXyKLpWULx95hZ_8+oHsJ@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:36:34 -0000

>> So, I believe it would solve the problem just fine, but personally I think
>> the overhead is far too high.
>
> If you want my opinion, it solves the problem just as fine as not masking
> at all, but the reasons why we got masking is that some of us wanted to
> ensure that no request could be found wherever in the stream. I don't see
> that the fake request as a big overhead, however it just pushes the issue
> slightly further. It's supposed to force deeply broken intermediaries to
> close, while we have no idea whether they'll simply parse that as a valid
> request and go to the next byte to find a request again. It's not easy to

If they find the request again, they could do the same with a regular HTTP POST.
Which means WS is "safe" as it got to the same level of security as HTTP POST.

--
 silvio

From derhoermi@gmx.net  Fri Feb 25 12:43:49 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 76B613A6A2B for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:43:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.993
X-Spam-Level: 
X-Spam-Status: No, score=-2.993 tagged_above=-999 required=5 tests=[AWL=-0.394, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rP4nWKEo1Cnt for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:43:48 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id E56123A67FB for <hybi@ietf.org>; Fri, 25 Feb 2011 12:43:47 -0800 (PST)
Received: (qmail invoked by alias); 25 Feb 2011 20:44:39 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp014) with SMTP; 25 Feb 2011 21:44:39 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX18sQqcCQjEsbgFJzViop6oM5HbP7+LOM60ntQavsa /30kMTMe+XOXZb
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Fri, 25 Feb 2011 21:44:42 +0100
Message-ID: <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com>
In-Reply-To: <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:43:49 -0000

* Silvio Ventres wrote:
>The POST headers are not meant to be parsed by the server. They are added
>when the server is already talking in WS protocol, not HTTP. Thus, these won't
>actually mean anything to the server, and should be ignored.
>
>The only reason to add them is to make sending any data content possible through
>HTTP ports, with security implications _no worse_ than normal HTTP POST.
>
>Again, the requests are _not_ HTTP requests. This is still WS, with a
>"POST /ws HTTP/1.1\r\nHost: ws\r\n\rn" header attached in front.
>
>This removes the need for masking, brings back debug and low
>complexity and costs ~20 bytes overhead.

You need 20 bytes for a Content-Length or Transfer-Encoding header alone
so the overhead would be quite a bit more than that and you would have
to show that there are no vulnerabilities in intermediaries that go off
only under certain pipelined request situations (I am assuming that you
allow the client to send a second request while the server has not yet
responded to the last one) with a server that can be controlled by the
attacker, and probably also that they do not get confused after seeing a
Upgrade but then seeing what looks like more HTTP requests. In addition
to explaining how this would be much better than simply using HTTP POST
requests as they are available today.

Do note that these alternatives have been studied long before this group
was chartered and they have been discussed at lengths in the group too,
and it is not what the group ended up with for one reason or another. If
you want more than putting your opinion on record, you have to come up
with a very detailed and well-researched argument with new information
for the issue to be re-opened within this working group. You also have
the option to define a different protocol in an Internet-Draft and run
it by interested parties outside the working group.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From w@1wt.eu  Fri Feb 25 12:54:24 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 901FC3A6A48 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:54:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.963
X-Spam-Level: 
X-Spam-Status: No, score=-1.963 tagged_above=-999 required=5 tests=[AWL=0.080,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xyHGI2TraIuw for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:54:23 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 7A66C3A6A46 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:54:22 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PKt55s027489; Fri, 25 Feb 2011 21:55:05 +0100
Date: Fri, 25 Feb 2011 21:55:05 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225205505.GY23570@1wt.eu>
References: <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu> <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com> <20110225203137.GX23570@1wt.eu> <AANLkTikAiey+wg8H=UmCqKjhXyKLpWULx95hZ_8+oHsJ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikAiey+wg8H=UmCqKjhXyKLpWULx95hZ_8+oHsJ@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:54:24 -0000

On Fri, Feb 25, 2011 at 10:37:26PM +0200, Silvio Ventres wrote:
> >> So, I believe it would solve the problem just fine, but personally I think
> >> the overhead is far too high.
> >
> > If you want my opinion, it solves the problem just as fine as not masking
> > at all, but the reasons why we got masking is that some of us wanted to
> > ensure that no request could be found wherever in the stream. I don't see
> > that the fake request as a big overhead, however it just pushes the issue
> > slightly further. It's supposed to force deeply broken intermediaries to
> > close, while we have no idea whether they'll simply parse that as a valid
> > request and go to the next byte to find a request again. It's not easy to
> 
> If they find the request again, they could do the same with a regular HTTP POST.

Yes but after a regular HTTP POST, you have a valid HTTP request. Here after
the WS handshake we don't have HTTP anymore. So if a broken intermediary were
to unexpectedly look for a request and would find yours, after processing it
as a valid request, it would expect another one and process the WS stream as
a next request. We don't fix the issue, we're just shifting it by one request.

As Dave Cridland told us, we can't know how many intermediaries would
correctly block on such random requests, the only thing we know from Adam's
experiment is that less than among 50000 CONNECT requests to invalid hosts,
none of them managed to correclty process a second request after this one.
Still that's a small sample and that does not tell us what state the
connection is left in.

Regards,
Willy


From jat@google.com  Fri Feb 25 12:58:12 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B4D6F3A6A4A for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:58:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.621
X-Spam-Level: 
X-Spam-Status: No, score=-105.621 tagged_above=-999 required=5 tests=[AWL=0.355, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jyR9ueGfayCU for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:58:11 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 7F0123A6A49 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:58:11 -0800 (PST)
Received: from kpbe19.cbf.corp.google.com (kpbe19.cbf.corp.google.com [172.25.105.83]) by smtp-out.google.com with ESMTP id p1PKx2mF015617 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:59:03 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298667543; bh=t4t8oCPCMuqEv4/vxuv8hTfiQr8=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=yfTRFuuO5ene0rJiqsVtGA7u24ll8JSEm8g2PPbvVGp3FGsgDT+/+yRWqFeIdpPD2 nmUiP+lulM5fazJjfQE4A==
Received: from ywf9 (ywf9.prod.google.com [10.192.6.9]) by kpbe19.cbf.corp.google.com with ESMTP id p1PKw9MI012382 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 12:59:01 -0800
Received: by ywf9 with SMTP id 9so758969ywf.41 for <hybi@ietf.org>; Fri, 25 Feb 2011 12:59:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=Xs20szQuxedq8uDJEVjqL2/E+AEc7tP9v/J/WK904PI=; b=JHmCQuMQnf2gAFZ4TcMSu+GoJ1x8yZduwc5/eMgrZJ2tFcXXdmtmjdf/JgFKNnul4a 7pnSctaKAeA3mgDcupjw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=kpnlzae4E7pikdxUrkQ86UNv/5EqoBwQwCXYMk7qR4mxa8ehPZLDZzSKQxTVmVNsEv YDhThoyik3my1DNDg0/Q==
Received: by 10.150.69.5 with SMTP id r5mr2966060yba.217.1298667541276; Fri, 25 Feb 2011 12:59:01 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 12:58:41 -0800 (PST)
In-Reply-To: <20110225205505.GY23570@1wt.eu>
References: <20110225191023.GP23570@1wt.eu> <AANLkTimveZ6QcUDGydgydfTa8Ji4v=V+t-oatfN9YwQ3@mail.gmail.com> <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu> <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com> <20110225203137.GX23570@1wt.eu> <AANLkTikAiey+wg8H=UmCqKjhXyKLpWULx95hZ_8+oHsJ@mail.gmail.com> <20110225205505.GY23570@1wt.eu>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 15:58:41 -0500
Message-ID: <AANLkTi=fTP7TLa4DNaTCYFrMtTQF7Otz3ULfMp=HKEx8@mail.gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: multipart/alternative; boundary=000e0cd591b47aac18049d21995a
X-System-Of-Record: true
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:58:12 -0000

--000e0cd591b47aac18049d21995a
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 3:55 PM, Willy Tarreau <w@1wt.eu> wrote:

> Yes but after a regular HTTP POST, you have a valid HTTP request. Here
> after
> the WS handshake we don't have HTTP anymore. So if a broken intermediary
> were
> to unexpectedly look for a request and would find yours, after processing
> it
> as a valid request, it would expect another one and process the WS stream
> as
> a next request. We don't fix the issue, we're just shifting it by one
> request.
>

I assume in his proposal after the HTTP POST would be another valid HTTP
request (ie, the HTTP POST for the next frame) since *every* client->server
WebSocket frame has a fake POST request wrapping it.  So, a transparent
intermediary would be no more likely to treat attacker controlled data in
the POST body as an HTTP request than it is today.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd591b47aac18049d21995a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 3:55 PM, Willy Tarreau <=
span dir=3D"ltr">&lt;<a href=3D"mailto:w@1wt.eu">w@1wt.eu</a>&gt;</span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">Yes but after a regular HTTP POST, you have a valid HTTP =
request. Here after</div>
the WS handshake we don&#39;t have HTTP anymore. So if a broken intermediar=
y were<br>
to unexpectedly look for a request and would find yours, after processing i=
t<br>
as a valid request, it would expect another one and process the WS stream a=
s<br>
a next request. We don&#39;t fix the issue, we&#39;re just shifting it by o=
ne request.<br></blockquote><div><br></div><div>I assume in his proposal af=
ter the HTTP POST would be another valid HTTP request (ie, the HTTP POST fo=
r the next frame) since *every* client-&gt;server WebSocket frame has a fak=
e POST request wrapping it. =C2=A0So, a transparent intermediary would be n=
o more likely to treat attacker controlled data in the POST body as an HTTP=
 request than it is today.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd591b47aac18049d21995a--

From silvio.ventres@gmail.com  Fri Feb 25 12:59:42 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D8D13A6A49 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:59:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.824
X-Spam-Level: 
X-Spam-Status: No, score=-2.824 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yOOdIQN6dISJ for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 12:59:40 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id BCCDB3A67AB for <hybi@ietf.org>; Fri, 25 Feb 2011 12:59:39 -0800 (PST)
Received: by vxg33 with SMTP id 33so1863491vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:00:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=g0Dr6Rjed1IpDibweWbTXvO1FuWvLkg701WIyBgFWO8=; b=tr33T64C6BrnvUZKRvp8B+htYZUZ0GRxD4UExX3RFSIWDRWWbeQaBY5ChVfWbUNVCZ V3urJ8fUUtLGY7ejz2Vo8yyiGnnGUE8s5eQ4PdVuaFNspUkGRDqvmvKUtsvM5aCRGMjl Qc3K8QBX76FpbimWuQ9PCORwHWWZixxtwSrws=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=eqLBu6R74nOXMQvzI8iy/nYBKG1H7gq/mbG1INtWkV/S79zIRf6qx0f/z5zB4NHi0i OiL1tDz7rJiCUYWmmKCv6/GhwF+U3v3ftBRkXqYom7cUW7KH9JCqZIEe33CFK74uZviT WlDbZitR/1Hr9x3JJ2uwJgiBMFiD7a6/Ydpfg=
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr4940518vdb.190.1298667632670; Fri, 25 Feb 2011 13:00:32 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 13:00:32 -0800 (PST)
In-Reply-To: <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de>
Date: Fri, 25 Feb 2011 23:00:32 +0200
Message-ID: <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 20:59:42 -0000

>>This removes the need for masking, brings back debug and low
>>complexity and costs ~20 bytes overhead.
>
> You need 20 bytes for a Content-Length or Transfer-Encoding header alone
> so the overhead would be quite a bit more than that and you would have

For a caching intermediary, by HTTP/1.1, seeing a POST method should
be enough to stop trying to cache it, whether there are valid headers after
the first line or not. Indeed, "broken" UserAgents might use POST with
broken headers and still expect to _not_ be cached.
Whether the POST
Thus, based on the HTTP spec section 13.10, simply using "POST /ws HTTP/1.1" is
enough to bring WS security to the level of HTTP POST.


> attacker, and probably also that they do not get confused after seeing a
> Upgrade but then seeing what looks like more HTTP requests. In addition

If they were confused, than regular HTTP POST would have the same vulnerability.
As HTTP POST is much wider deployed, WS does not need to go beyond HTTP
level of security, especially sacrificing useful features such as debug and low
implementation complexity.

> to explaining how this would be much better than simply using HTTP POST
> requests as they are available today.

As available today, HTTP is a request-response protocol.
WS is a fully bidirectional communication protocol. Whether it adds static
POST-like headers on top of its frames to support broken proxies or not,
it remains bidirectional.

> Do note that these alternatives have been studied long before this group
> was chartered and they have been discussed at lengths in the group too,

It seems as this specific alternative was never discussed in this group before.
Also, it seems that this group does not include enough people with actual
real-world web development and operational experience, for which losing debug
capability will easily multiply the development time many times.

--
 silvio

From jat@google.com  Fri Feb 25 13:08:21 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5CB8C3A6A4C for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:08:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.643
X-Spam-Level: 
X-Spam-Status: No, score=-105.643 tagged_above=-999 required=5 tests=[AWL=0.333, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hR8TonGB-QAV for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:08:20 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 4B9433A6830 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:08:19 -0800 (PST)
Received: from hpaq7.eem.corp.google.com (hpaq7.eem.corp.google.com [172.25.149.7]) by smtp-out.google.com with ESMTP id p1PL9Ck0022699 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:09:12 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298668152; bh=ot20GZRfL8Par43Zbe+0G2J88Is=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=bG53TRBDObbaj6owPsahXYqW0V0ILRLacXvkfNXicuhI3nrzGT6nv4P7c6RzOAoD/ MiZjyvkSBiz3HPXHjK8QQ==
Received: from ywh1 (ywh1.prod.google.com [10.192.8.1]) by hpaq7.eem.corp.google.com with ESMTP id p1PL90ew014760 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 13:09:11 -0800
Received: by ywh1 with SMTP id 1so929300ywh.1 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:09:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=lMo4a1BLMZ3w/0ghhKt1U3QRz5FZQ2d9QoAU6LojYf4=; b=sO+RSaHvamcIEna+qwb9qt9hFsQ41K/xA2HAxRq1C2YQH+PlPCVuf2vyc20l+PSYav huX6RhyS/GEoElpWt70Q==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=dv79Sb85jCh1QolF0kniB2k2eGPihLTZrad7Hz4E15cZjPzFDtxuBZ7NiQyA/YqZ2H 1RtMKXxDPyMfLLSvvdeQ==
Received: by 10.151.14.8 with SMTP id r8mr4132514ybi.331.1298668151094; Fri, 25 Feb 2011 13:09:11 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 13:08:51 -0800 (PST)
In-Reply-To: <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 16:08:51 -0500
Message-ID: <AANLkTiksjo2vdRnB0DT5pSFNZ-t4LFC10uJ3jSU+Fbto@mail.gmail.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd6ea72d3befa049d21bd8b
X-System-Of-Record: true
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 21:08:21 -0000

--000e0cd6ea72d3befa049d21bd8b
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 4:00 PM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> Thus, based on the HTTP spec section 13.10, simply using "POST /ws
> HTTP/1.1" is
> enough to bring WS security to the level of HTTP POST.


No, because you have binary data in the POST (the WebSocket frame), so you
have to include a Content-length header to ensure that the intermediary
doesn't treat any WS payload data as an HTTP request (or else you have to
encode the WS payload, which will be at least as expensive as the XOR you
are trying to get rid of).

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6ea72d3befa049d21bd8b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 4:00 PM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">Thus, based on the HTTP spec section 13.10, simply using =
&quot;POST /ws HTTP/1.1&quot; is</div>
enough to bring WS security to the level of HTTP POST.</blockquote><div><br=
></div><div>No, because you have binary data in the POST (the WebSocket fra=
me), so you have to include a Content-length header to ensure that the inte=
rmediary doesn&#39;t treat any WS payload data as an HTTP request (or else =
you have to encode the WS payload, which will be at least as expensive as t=
he XOR you are trying to get rid of).</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd6ea72d3befa049d21bd8b--

From w@1wt.eu  Fri Feb 25 13:34:50 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 047353A6A48 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:34:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.966
X-Spam-Level: 
X-Spam-Status: No, score=-1.966 tagged_above=-999 required=5 tests=[AWL=0.077,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qm+AiYm-aS72 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:34:48 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 834703A6A44 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:34:48 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PLZYmc027680; Fri, 25 Feb 2011 22:35:34 +0100
Date: Fri, 25 Feb 2011 22:35:34 +0100
From: Willy Tarreau <w@1wt.eu>
To: John Tamplin <jat@google.com>
Message-ID: <20110225213534.GZ23570@1wt.eu>
References: <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu> <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com> <20110225203137.GX23570@1wt.eu> <AANLkTikAiey+wg8H=UmCqKjhXyKLpWULx95hZ_8+oHsJ@mail.gmail.com> <20110225205505.GY23570@1wt.eu> <AANLkTi=fTP7TLa4DNaTCYFrMtTQF7Otz3ULfMp=HKEx8@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=fTP7TLa4DNaTCYFrMtTQF7Otz3ULfMp=HKEx8@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 21:34:50 -0000

On Fri, Feb 25, 2011 at 03:58:41PM -0500, John Tamplin wrote:
> On Fri, Feb 25, 2011 at 3:55 PM, Willy Tarreau <w@1wt.eu> wrote:
> 
> > Yes but after a regular HTTP POST, you have a valid HTTP request. Here
> > after
> > the WS handshake we don't have HTTP anymore. So if a broken intermediary
> > were
> > to unexpectedly look for a request and would find yours, after processing
> > it
> > as a valid request, it would expect another one and process the WS stream
> > as
> > a next request. We don't fix the issue, we're just shifting it by one
> > request.
> >
> 
> I assume in his proposal after the HTTP POST would be another valid HTTP
> request (ie, the HTTP POST for the next frame) since *every* client->server
> WebSocket frame has a fake POST request wrapping it.  So, a transparent
> intermediary would be no more likely to treat attacker controlled data in
> the POST body as an HTTP request than it is today.

Ah so the POST request would also contain a content-length to cover the
framed data then ? This is different from what I understood (having a
single fake request after the handshake).

Silvio's explanation was so vague that multiple interpretations were
possible, but I think yours is the right one.

And then I agree with you that it represents a huge overhead ! At
least having a single fake chunked encoded POST with chunk size in
front of each frame would be much cheaper.  Still, those implementations
won't allow a server to respond if the intermediary thinks it's processing
a real POST request. It won't process a new one until it gets a response,
sometimes will not allow the server to respond until everything is sent,
and most of the time will return a "502 bad gateway" when the server
responds with valid WS framing that does not look like HTTP/1.1.

We're better off with trying to make such faulty intermediaries fast
fail so that alternative schemes can be used without noticeable delay.

Regards,
Willy


From w@1wt.eu  Fri Feb 25 13:36:59 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 44DF73A6A44 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:36:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.968
X-Spam-Level: 
X-Spam-Status: No, score=-1.968 tagged_above=-999 required=5 tests=[AWL=0.075,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Znonxx77bZNY for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:36:58 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id EE4023A6A48 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:36:57 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PLbk4e027694; Fri, 25 Feb 2011 22:37:46 +0100
Date: Fri, 25 Feb 2011 22:37:46 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225213746.GA23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 21:36:59 -0000

On Fri, Feb 25, 2011 at 11:00:32PM +0200, Silvio Ventres wrote:
> As available today, HTTP is a request-response protocol.
> WS is a fully bidirectional communication protocol. Whether it adds static
> POST-like headers on top of its frames to support broken proxies or not,
> it remains bidirectional.

It is only for valid intermediaries but will fail on non-compliant ones
since they'll expect a response before processing a second request.

Willy


From derhoermi@gmx.net  Fri Feb 25 13:44:09 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA30A3A6A5C for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:44:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.954
X-Spam-Level: 
X-Spam-Status: No, score=-2.954 tagged_above=-999 required=5 tests=[AWL=-0.355, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wu4gJloap1JT for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:44:08 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id 2E6393A6A53 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:44:08 -0800 (PST)
Received: (qmail invoked by alias); 25 Feb 2011 21:45:00 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp053) with SMTP; 25 Feb 2011 22:45:00 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+qCO8ha12q4EC1kMFPQup9gPqR48ybwFEWNZYv1v lKUVAHAL3/snuQ
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Fri, 25 Feb 2011 22:45:02 +0100
Message-ID: <3h6gm6ttjpgnugdhm426smmmhn1lm1abee@hive.bjoern.hoehrmann.de>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
In-Reply-To: <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 21:44:10 -0000

* Silvio Ventres wrote:
>For a caching intermediary, by HTTP/1.1, seeing a POST method should
>be enough to stop trying to cache it, whether there are valid headers after
>the first line or not. Indeed, "broken" UserAgents might use POST with
>broken headers and still expect to _not_ be cached.

Well, I would suggest you write down a protocol trace detailing which
bytes go over the wire and then show how an intermediary that does not
recognize the Upgrade mechanism will not pick up bytes controlled by an
attacker (who might also control the server) as HTTP request. That is
what masking is trying to prevent. You should find that you can put the
attacker controlled bytes only in either the pseudo-request header, and
that would require some form of escaping to handle CR LF bytes, or it
would have to go into the body of the pseudo-request, which requires a
Content-Length of Transfer-Encoding header.

Also note again that anything that's different from what is literally
possible today with the most widely deployed web browsers would have to
be shown reasonably risk-free, and while HTTP allows things like pipe-
lined requests, they are not in common use with the mainstream browsers
so there may well be security issues with them that would not surface
with masking until browsers make use of pipelined requests and similar
things your proposal would allow to be different from vanilla HTTP as
it is deployed with mainstream browsers.

Do keep in mind that the length encoding and frame flags are already
complicated to address various performance concerns, if there was no
problem with adding dozens of bytes of per-frame overhead, we'd have
a much simpler frame layout; it would very much unlikely that even if
you could address the security issues with your design that it would
gain considerable support in the working group. While you may value
plain text, others have other priorities, and you can't optimize for
all of them simultaneously.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From dave@cridland.net  Fri Feb 25 13:49:39 2011
Return-Path: <dave@cridland.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7D01F3A6A5A for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:49:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.532
X-Spam-Level: 
X-Spam-Status: No, score=-2.532 tagged_above=-999 required=5 tests=[AWL=0.067,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mWTcNpRWDuiZ for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 13:49:38 -0800 (PST)
Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [IPv6:2001:470:1f09:882:2e0:81ff:fe29:d16a]) by core3.amsl.com (Postfix) with ESMTP id 3BA903A6A48 for <hybi@ietf.org>; Fri, 25 Feb 2011 13:49:38 -0800 (PST)
Received: from localhost (peirce.dave.cridland.net [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id D90C41168087; Fri, 25 Feb 2011 21:50:29 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net
Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oSZfkLdOGUo1; Fri, 25 Feb 2011 21:50:26 +0000 (GMT)
Received: from puncture (puncture.dave.cridland.net [IPv6:2001:470:1f09:882:221:85ff:fe3f:1696]) by peirce.dave.cridland.net (Postfix) with ESMTPA id 7C0AA1168067; Fri, 25 Feb 2011 21:50:25 +0000 (GMT)
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com>
In-Reply-To: <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com>
MIME-Version: 1.0
Message-Id: <2745.1298670625.366666@puncture>
Date: Fri, 25 Feb 2011 21:50:25 +0000
From: Dave Cridland <dave@cridland.net>
To: Silvio Ventres <silvio.ventres@gmail.com>, "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>, Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed"
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 21:49:39 -0000

On Fri Feb 25 17:34:54 2011, Silvio Ventres wrote:
> The question is, why use hashing at all ?
> Use some simple math, why add complexity ?

Just thought I'd pick up on this.

It's just a very common method of taking an input and producing an  
output that is both verifiable and very unlikely to clash (ie,  
collide) with an output for a different input, even if the inputs are  
similar.

It's *really* hard to find "simple math" that gets even close to  
this, and hashes are very widely implemented even on hardware, and as  
such a useful building block. In addition, one hash operation is  
pretty cheap, these days.

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

From silvio.ventres@gmail.com  Fri Feb 25 14:38:41 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 252F83A6874 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 14:38:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.32
X-Spam-Level: 
X-Spam-Status: No, score=-3.32 tagged_above=-999 required=5 tests=[AWL=0.279,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3RgYkecqbfya for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 14:38:40 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 21D383A6A5B for <hybi@ietf.org>; Fri, 25 Feb 2011 14:38:40 -0800 (PST)
Received: by vws6 with SMTP id 6so2007876vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 14:39:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=ilyZHXyxP5Isph1DkjIuEQPqxqTQRwtwOyzrXLcfFhU=; b=xOwhV46sqgW9B3CnUUYRk6HPPBjiw66iy1bC0bo6LMjcWMSpk9ech/MbbB6J/L8NcB YZzNCaWka3tQl5VAWJDG/ns5y6Zb8eGmTYG2KAMIeHzY119OG5wQAiFP9Su5fvTnmzrQ Ib249PyS2MeNQkgrWJfFl1fsudwe7T6whXrxw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=SfCFtYY4sVqC8WOU+vIUItLKCRZ33tKIMysP2+iH/IxX2qFyFXSVlTM3IESD+6r25z 0USvAJqmYC02Djj3hovLqt3AviKLga07XN0yw0SDX4TMlKq5VAfUQzUAY4fsPmXxuk9K EFHyGJ3uQ6FaABzDOJ1UulFMt1nnFd8EYCwKc=
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr5063153vdc.110.1298673572999; Fri, 25 Feb 2011 14:39:32 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 14:39:32 -0800 (PST)
In-Reply-To: <20110225213534.GZ23570@1wt.eu>
References: <20110225194715.GS23570@1wt.eu> <AANLkTimaqJQHOVVxdnT5OH-7hiAotkvC=KJm-PM3-4Hc@mail.gmail.com> <20110225200631.GU23570@1wt.eu> <AANLkTikHX=LAw4n4b6XHDR2NB-HJ3cGS9OarrQuwJWtH@mail.gmail.com> <20110225201615.GW23570@1wt.eu> <AANLkTink+gaecUb2sN4dAgdsmdWA5eifYjKUozDUFgN=@mail.gmail.com> <20110225203137.GX23570@1wt.eu> <AANLkTikAiey+wg8H=UmCqKjhXyKLpWULx95hZ_8+oHsJ@mail.gmail.com> <20110225205505.GY23570@1wt.eu> <AANLkTi=fTP7TLa4DNaTCYFrMtTQF7Otz3ULfMp=HKEx8@mail.gmail.com> <20110225213534.GZ23570@1wt.eu>
Date: Sat, 26 Feb 2011 00:39:32 +0200
Message-ID: <AANLkTiky7OrnGQ3R=aXaHLXvniWXxUXHPEZ0=eRu2sVK@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Server-Initiated HTTP <hybi@ietf.org>
Subject: Re: [hybi] Comments to draft-ietf-hybi-thewebsocketprotocol-05
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 22:38:41 -0000

> least having a single fake chunked encoded POST with chunk size in
> front of each frame would be much cheaper. =A0Still, those implementation=
s
> won't allow a server to respond if the intermediary thinks it's processin=
g
> a real POST request. It won't process a new one until it gets a response,
> sometimes will not allow the server to respond until everything is sent,
> and most of the time will return a "502 bad gateway" when the server
> responds with valid WS framing that does not look like HTTP/1.1.

If some buggy intermediary would think that it processes a POST request,
and unable to open tunnel for WS during the GET/Upgrade stage,
such an intermediary would probably be incapable of tunelling the WS protoc=
ol
in any case, so the earlier such fault is found, the better.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 14:48:52 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 83EA53A6A5B for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 14:48:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.824
X-Spam-Level: 
X-Spam-Status: No, score=-2.824 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t+mOmTGW9PaW for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 14:48:51 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 507313A6A4E for <hybi@ietf.org>; Fri, 25 Feb 2011 14:48:51 -0800 (PST)
Received: by vxg33 with SMTP id 33so1945808vxg.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 14:49:44 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=s6tnhHida/elpqlM2yLDvSOJhnIi7tB4B+xIzlQV62k=; b=PbEBB7YubYO07qhQQWd3XOjwlhfWTMBk7YA7QisTsIeHHPEhGS18xgNhPhX86Fb/be fcML062HU4xnwQHgNBx2uFhVzVqGef9cCuv4N7zGZtK609V99qBgdk+Y7Ta5jJuMbQKr qkIxvbyXmBJikesS4sAmIRwjOP5BnkzWJhipw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=YSbbaLgMOwxr/iGd4OOC2SayL0p5KWmrlNFpk3STIepXlaSyNyRKC0uPmpQRFwV0Q/ jlCl99K3Gl1w53hZdDRW/5OM7o3hzcRioT21wImajvGDVcA6Bh5Lp0dxrAKEDvyT91mF pE5lWQ93JjurA2VuhTy+YMObiHYxfccJ6mBJo=
MIME-Version: 1.0
Received: by 10.52.68.175 with SMTP id x15mr2115547vdt.70.1298674184006; Fri, 25 Feb 2011 14:49:44 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 14:49:43 -0800 (PST)
In-Reply-To: <2745.1298670625.366666@puncture>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com> <2745.1298670625.366666@puncture>
Date: Sat, 26 Feb 2011 00:49:43 +0200
Message-ID: <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 22:48:52 -0000

>> Use some simple math, why add complexity ?
>
> It's just a very common method of taking an input and producing an output
> that is both verifiable and very unlikely to clash (ie, collide) with an
> output for a different input, even if the inputs are similar.

But there is no requirement for the results to be cryptographically hashed.

The only requirement is to make the handshake in some way dynamically
depend on the challenge provided by the connecting party.
Indeed, even the requirement above is only applicable to the _clients_
connecting to _servers_, as the problem being prevented lies in caching pro=
xies.

Thus, if the challenge issued by the client is _already_ random, there is
no need to "randomize" by hashing on the server side. Just make sure
the algorithm is easy to implement and verifiable.

Such an algorithm may be:
client_challenge XOR ws_static_32bit_integer
client_challenge * ws_static_32bit_integer mod 32 bit

or, even

client_challenge + ws_static_32bit_integer mod 32 bit

The point here is that the probability of any of these being correct
answers for a different challenge is NULL.
Indeed, take the case of "+". What is the client_challenge that would
be answered
correctly by the response 123456789 ? only (123456789 -
ws_static_32_bit_integer).

Hashing has no place here, serves no purpose and only makes the
handshake more complex.

--
 silvio






>
> It's *really* hard to find "simple math" that gets even close to this, an=
d
> hashes are very widely implemented even on hardware, and as such a useful
> building block. In addition, one hash operation is pretty cheap, these da=
ys.
>
> Dave.
> --
> Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
> =A0- acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
> =A0- http://dave.cridland.net/
> Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade
>

From silvio.ventres@gmail.com  Fri Feb 25 14:55:10 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E7593A6A68 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 14:55:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.321
X-Spam-Level: 
X-Spam-Status: No, score=-3.321 tagged_above=-999 required=5 tests=[AWL=0.278,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ho38RbmVOnhe for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 14:55:09 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id A064E3A6A67 for <hybi@ietf.org>; Fri, 25 Feb 2011 14:55:09 -0800 (PST)
Received: by vws6 with SMTP id 6so2019025vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 14:56:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=A8zX4/RZPq9Cj4FhdjsYfoGLMqm7lNksBVyqDmFktik=; b=IxrFEgzaf1p/3Bk7mybgoUvbbJ/rNSE+h6EQAfI66R5VFgwD1ztZkEsnUbLCG2Ohfv cU/muftqb4VaqrtmbGNRKrC3UpKGwwSQtaXCQrBnraPlT00ArqHGCFd4PVOiisrT4YRN P1KSxL3s6FV00XkZ/4hIltHWcLpZ99jhbY8a4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=lUW3QMamOgar/7ot8q68Zjn0SDQM5Y6erTDiN7AJXNYLbd2wOOa9zsJSXzVj4FFkhh Qgiee/3ZFRmgpTOfKDYKtLBHBBJBtSgmLwmSdaZVDZdSpsXbdmyrhnIQFnknarXlphWo 5V8MYeJmUwZR1/d1Krb9fw8GXIYyvDMUQC7Lg=
MIME-Version: 1.0
Received: by 10.52.68.175 with SMTP id x15mr2123142vdt.70.1298674562717; Fri, 25 Feb 2011 14:56:02 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 14:56:02 -0800 (PST)
In-Reply-To: <20110225213746.GA23570@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com> <20110225213746.GA23570@1wt.eu>
Date: Sat, 26 Feb 2011 00:56:02 +0200
Message-ID: <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 22:55:10 -0000

On Fri, Feb 25, 2011 at 11:37 PM, Willy Tarreau <w@1wt.eu> wrote:
> On Fri, Feb 25, 2011 at 11:00:32PM +0200, Silvio Ventres wrote:
>> As available today, HTTP is a request-response protocol.
>> WS is a fully bidirectional communication protocol. Whether it adds static
>> POST-like headers on top of its frames to support broken proxies or not,
>> it remains bidirectional.
>
> It is only for valid intermediaries but will fail on non-compliant ones
> since they'll expect a response before processing a second request.

There is no problem with intermediaries that are not HTTP/1.1 compliant.
These intermediaries, being non-deterministic, are not the targets of
the WS protocol spec. The only thing important with these is that they
don't accidentally come to any harm by being used by WS clients.
This is done by adding the POST header, which makes it impossible
for WS clients to cause _more harm_ than regular HTTP POST requests.
That's all that needs to be done with non-conforming proxies. There's no
need to think whether they would forward the request or not, as, being
non compliant to HTTP/1.1, they would not be able to work with the WS
protocol anyway.

Please keep the problem definition in mind.
The problem was never "work with broken proxies" but instead "cause no
harm to broken proxies".
Indeed, being broken, those proxies cannot be relied upon to do anything
deterministic, so there is no way to ensure the protocol to work with them.

--
 silvio

From w@1wt.eu  Fri Feb 25 15:04:36 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D9E293A6A71 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:04:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.97
X-Spam-Level: 
X-Spam-Status: No, score=-1.97 tagged_above=-999 required=5 tests=[AWL=0.073,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gOTTBYESZIjW for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:04:36 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 39D383A6A69 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:04:34 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PN5Mv7028041; Sat, 26 Feb 2011 00:05:22 +0100
Date: Sat, 26 Feb 2011 00:05:22 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225230522.GB21308@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com> <20110225213746.GA23570@1wt.eu> <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 23:04:36 -0000

On Sat, Feb 26, 2011 at 12:56:02AM +0200, Silvio Ventres wrote:
> On Fri, Feb 25, 2011 at 11:37 PM, Willy Tarreau <w@1wt.eu> wrote:
> > On Fri, Feb 25, 2011 at 11:00:32PM +0200, Silvio Ventres wrote:
> >> As available today, HTTP is a request-response protocol.
> >> WS is a fully bidirectional communication protocol. Whether it adds static
> >> POST-like headers on top of its frames to support broken proxies or not,
> >> it remains bidirectional.
> >
> > It is only for valid intermediaries but will fail on non-compliant ones
> > since they'll expect a response before processing a second request.
> 
> There is no problem with intermediaries that are not HTTP/1.1 compliant.
> These intermediaries, being non-deterministic, are not the targets of
> the WS protocol spec. The only thing important with these is that they
> don't accidentally come to any harm by being used by WS clients.

No this is not the only important thing. Another important thing is that
we ensure that non-working situations cause a quick failure that the client
can detect. Having a faulty request remain hanging is not an acceptable way
of handling the majority of the failure situations.

Willy


From silvio.ventres@gmail.com  Fri Feb 25 15:25:29 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B29EC3A6A7A for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:25:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.325
X-Spam-Level: 
X-Spam-Status: No, score=-3.325 tagged_above=-999 required=5 tests=[AWL=0.274,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oQQ4Dmfe+N3e for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:25:29 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id B04213A6A7E for <hybi@ietf.org>; Fri, 25 Feb 2011 15:25:28 -0800 (PST)
Received: by vws6 with SMTP id 6so2036917vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:26:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=W8pNBJxJ6SKOmxG5MQqoaaUESFL7IHmf35ONdwcm8ws=; b=swpxyi1epyUqWEYDtxRXQiv1kD0TDW2CHn1Jp4Qv8Bvk5O2SeN861Cf8gCwk1s3pe9 gQ+2aJbsS+d3vod1Kw0wG3OssyaAU6Ex173W2Un0CujKj8eH7Viy95G8kLYDsKRhtnTq vyRilDOjjNyVjTxuwHkj92zumZUi89Z6TfAWs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=muqBHjlPOPU9KAsOgawBbm1QdCPARVh0IQ+ilg3OyDZw/Ie53Kzf/+4UpYjRGHlr2k WsbR8TTS8AnKMydM/b8gbpF03U8liOgCbhjwrdSV+bwD4fpGEmfQ7xfUbRdve7hF8cv0 aJmI/enVfQT91THjWGz8XxxEFJfYHbmPGGDZM=
MIME-Version: 1.0
Received: by 10.52.157.7 with SMTP id wi7mr5137738vdb.230.1298676381640; Fri, 25 Feb 2011 15:26:21 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 15:26:21 -0800 (PST)
In-Reply-To: <20110225230522.GB21308@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com> <20110225213746.GA23570@1wt.eu> <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com> <20110225230522.GB21308@1wt.eu>
Date: Sat, 26 Feb 2011 01:26:21 +0200
Message-ID: <AANLkTinxBv61Dq5QUE5Q7ETMt5qLQyvyC3YpGjZtW+9B@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 23:25:29 -0000

> No this is not the only important thing. Another important thing is that
> we ensure that non-working situations cause a quick failure that the client
> can detect. Having a faulty request remain hanging is not an acceptable way
> of handling the majority of the failure situations.

A broken proxy is _broken_.
It's not deterministic. You cannot know or control what it may do
whatever you feed it.
Thus, however fast you might want to make it fail, you cannot force it
to happen.

--
 silvio

From ifette@google.com  Fri Feb 25 15:26:49 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E3F993A6A63 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:26:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.708
X-Spam-Level: 
X-Spam-Status: No, score=-105.708 tagged_above=-999 required=5 tests=[AWL=-0.032, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qvUWU6-ruYIh for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:26:48 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 6DB393A6A7A for <hybi@ietf.org>; Fri, 25 Feb 2011 15:26:48 -0800 (PST)
Received: from wpaz1.hot.corp.google.com (wpaz1.hot.corp.google.com [172.24.198.65]) by smtp-out.google.com with ESMTP id p1PNRfIp009905 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:27:41 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298676461; bh=nQeEuqYqrFRNvknBDysXxyHo6gA=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=DhYPQnFVmGvxnwzG9j+DKLRmqPji8kSSKB6e+nmOwyL/a+T1Z/D/Z3I1bsPznPHcQ TRXQr2XfO9enyjgv7e6BA==
Received: from iwn10 (iwn10.prod.google.com [10.241.68.74]) by wpaz1.hot.corp.google.com with ESMTP id p1PNRe9h014984 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 15:27:40 -0800
Received: by iwn10 with SMTP id 10so1598644iwn.20 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:27:40 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=GOy7q/QCx/s87SFDU3I/NI7X4VPf8q/vZ91l2I3Wp6o=; b=IIbORE0qYKMUKBSWjjXswvz8pIjPGDftExbobQ9OLyX0Bg0Qr5Ar/PeotR8LdiQIkL I0KcUZSNtBz3kjZzk2tA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=V2qByxs35TvbJLIXF+B6ArK3q3Cr9LwIOts6b/Q+eNPJefb/7Blov0XXPHB8xFTdox GcuBd2eav/ralTghdXrQ==
MIME-Version: 1.0
Received: by 10.231.200.134 with SMTP id ew6mr3223224ibb.164.1298676458573; Fri, 25 Feb 2011 15:27:38 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Fri, 25 Feb 2011 15:27:38 -0800 (PST)
In-Reply-To: <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com> <2745.1298670625.366666@puncture> <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com>
Date: Fri, 25 Feb 2011 15:27:38 -0800
Message-ID: <AANLkTi=fWWd8XV15kpe0=e-9NL06jEZLkASSvF4xnZ4J@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Silvio Ventres <silvio.ventres@gmail.com>
Content-Type: multipart/alternative; boundary=90e6ba181c28fdcfec049d23accb
X-System-Of-Record: true
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 23:26:50 -0000

--90e6ba181c28fdcfec049d23accb
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 2:49 PM, Silvio Ventres <silvio.ventres@gmail.com>wrote:

> >> Use some simple math, why add complexity ?
> >
> > It's just a very common method of taking an input and producing an output
> > that is both verifiable and very unlikely to clash (ie, collide) with an
> > output for a different input, even if the inputs are similar.
>
> But there is no requirement for the results to be cryptographically hashed.
>
> The only requirement is to make the handshake in some way dynamically
> depend on the challenge provided by the connecting party.
> Indeed, even the requirement above is only applicable to the _clients_
> connecting to _servers_, as the problem being prevented lies in caching
> proxies.
>
> Thus, if the challenge issued by the client is _already_ random, there is
> no need to "randomize" by hashing on the server side. Just make sure
> the algorithm is easy to implement and verifiable.
>
> Such an algorithm may be:
> client_challenge XOR ws_static_32bit_integer
> client_challenge * ws_static_32bit_integer mod 32 bit
>
> or, even
>
> client_challenge + ws_static_32bit_integer mod 32 bit
>
> The point here is that the probability of any of these being correct
> answers for a different challenge is NULL.
> Indeed, take the case of "+". What is the client_challenge that would
> be answered
> correctly by the response 123456789 ? only (123456789 -
> ws_static_32_bit_integer).
>
> Hashing has no place here, serves no purpose and only makes the
> handshake more complex.
>

This is not getting anywhere. Hashing is straight forward, well understood,
and relatively cheap compared to the overall cost of establishing a
connection. Please stop wasting everyone's time. You are not contributing
anything useful to this group.


>
> --
>  silvio
>
>
>
>
>
>
> >
> > It's *really* hard to find "simple math" that gets even close to this,
> and
> > hashes are very widely implemented even on hardware, and as such a useful
> > building block. In addition, one hash operation is pretty cheap, these
> days.
> >
> > Dave.
> > --
> > Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net
> >  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
> >  - http://dave.cridland.net/
> > Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade
> >
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

--90e6ba181c28fdcfec049d23accb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 2:49 PM, Silvio Ventres =
<span dir=3D"ltr">&lt;<a href=3D"mailto:silvio.ventres@gmail.com">silvio.ve=
ntres@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">&gt;&gt; Use some simple math, why add complexity ?<br>
&gt;<br>
</div><div class=3D"im">&gt; It&#39;s just a very common method of taking a=
n input and producing an output<br>
&gt; that is both verifiable and very unlikely to clash (ie, collide) with =
an<br>
&gt; output for a different input, even if the inputs are similar.<br>
<br>
</div>But there is no requirement for the results to be cryptographically h=
ashed.<br>
<br>
The only requirement is to make the handshake in some way dynamically<br>
depend on the challenge provided by the connecting party.<br>
Indeed, even the requirement above is only applicable to the _clients_<br>
connecting to _servers_, as the problem being prevented lies in caching pro=
xies.<br>
<br>
Thus, if the challenge issued by the client is _already_ random, there is<b=
r>
no need to &quot;randomize&quot; by hashing on the server side. Just make s=
ure<br>
the algorithm is easy to implement and verifiable.<br>
<br>
Such an algorithm may be:<br>
client_challenge XOR ws_static_32bit_integer<br>
client_challenge * ws_static_32bit_integer mod 32 bit<br>
<br>
or, even<br>
<br>
client_challenge + ws_static_32bit_integer mod 32 bit<br>
<br>
The point here is that the probability of any of these being correct<br>
answers for a different challenge is NULL.<br>
Indeed, take the case of &quot;+&quot;. What is the client_challenge that w=
ould<br>
be answered<br>
correctly by the response 123456789 ? only (123456789 -<br>
ws_static_32_bit_integer).<br>
<br>
Hashing has no place here, serves no purpose and only makes the<br>
handshake more complex.<br></blockquote><div><br></div><div>This is not get=
ting anywhere. Hashing is straight forward, well understood, and relatively=
 cheap compared to the overall cost of establishing a connection. Please st=
op wasting everyone&#39;s time. You are not contributing anything useful to=
 this group.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
--<br>
<font color=3D"#888888">=C2=A0silvio<br>
</font><div><div></div><div class=3D"h5"><br>
<br>
<br>
<br>
<br>
<br>
&gt;<br>
&gt; It&#39;s *really* hard to find &quot;simple math&quot; that gets even =
close to this, and<br>
&gt; hashes are very widely implemented even on hardware, and as such a use=
ful<br>
&gt; building block. In addition, one hash operation is pretty cheap, these=
 days.<br>
&gt;<br>
&gt; Dave.<br>
&gt; --<br>
&gt; Dave Cridland - mailto:<a href=3D"mailto:dave@cridland.net">dave@cridl=
and.net</a> - <a href=3D"mailto:xmpp%3Adwd@dave.cridland.net">xmpp:dwd@dave=
.cridland.net</a><br>
&gt; =C2=A0- acap://<a href=3D"http://acap.dave.cridland.net/byowner/user/d=
wd/bookmarks/" target=3D"_blank">acap.dave.cridland.net/byowner/user/dwd/bo=
okmarks/</a><br>
&gt; =C2=A0- <a href=3D"http://dave.cridland.net/" target=3D"_blank">http:/=
/dave.cridland.net/</a><br>
&gt; Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade<br>
&gt;<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br>

--90e6ba181c28fdcfec049d23accb--

From w@1wt.eu  Fri Feb 25 15:48:42 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 44A503A6A7D for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:48:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.972
X-Spam-Level: 
X-Spam-Status: No, score=-1.972 tagged_above=-999 required=5 tests=[AWL=0.071,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qmLl8n-Kg1VB for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:48:41 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 28DC63A6A7C for <hybi@ietf.org>; Fri, 25 Feb 2011 15:48:40 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1PNnSwe028537; Sat, 26 Feb 2011 00:49:28 +0100
Date: Sat, 26 Feb 2011 00:49:28 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110225234928.GA28054@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com> <20110225213746.GA23570@1wt.eu> <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com> <20110225230522.GB21308@1wt.eu> <AANLkTinxBv61Dq5QUE5Q7ETMt5qLQyvyC3YpGjZtW+9B@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTinxBv61Dq5QUE5Q7ETMt5qLQyvyC3YpGjZtW+9B@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 23:48:42 -0000

On Sat, Feb 26, 2011 at 01:26:21AM +0200, Silvio Ventres wrote:
> > No this is not the only important thing. Another important thing is that
> > we ensure that non-working situations cause a quick failure that the client
> > can detect. Having a faulty request remain hanging is not an acceptable way
> > of handling the majority of the failure situations.
> 
> A broken proxy is _broken_.
> It's not deterministic. You cannot know or control what it may do
> whatever you feed it.
> Thus, however fast you might want to make it fail, you cannot force it
> to happen.

Agreed, and that's why you can't claim that your discutable workaround
will fix every broken proxy. Also, you are deciding that you'd want many
deterministic proxies to randomly misbehave, and I don't find that
acceptable. For many months, WG participants have suggested minor
changes to help get the most possible deterministic behaviour because
this is what most of us are looking for. You can't get there and decide
that this is useless and let the broken situation fail the dirty way for
many users. That would definitely stop adoption.

Willy


From silvio.ventres@gmail.com  Fri Feb 25 15:49:31 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7BE403A6A7C for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:49:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.329
X-Spam-Level: 
X-Spam-Status: No, score=-3.329 tagged_above=-999 required=5 tests=[AWL=0.270,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YzyPQDyRQzyR for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:49:30 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 8DDEB3A6A78 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:49:28 -0800 (PST)
Received: by vws6 with SMTP id 6so2049621vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:50:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=X5uWdhltj28h3YJCndCdm1M39KoulwMoCJ75z000YZE=; b=nBffCUuVCY7WR7c1GAHAmXM4dlP5idWRvUl8qClQY6XWy5WuasNYisW9lZD3EdDpKj 3UyXoUmHDOYgm2FAjtAohBdQRDAZSeH47g7gstahE4jMZJeUx4DwhIEJim06mMWEELKA vW3JYis8YfP27gNevxlD622N0mCKqsXJQoDD0=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=X5xBCz8w32owO0PUv3bG7AFMPyaEQrZM1ri7B9p50QFwZBYVFCArBXLHNaL+u+wGWI IG5WXlfeWl9C1RrUuUkzzwbYMRt7Key+jbSaPxds/ONwmoZA2tykVGLtMP1IfOBdIPJh utinl/EHAJ7G0g4tFwENNxAQtqdL8OQ8AfQMU=
MIME-Version: 1.0
Received: by 10.52.160.8 with SMTP id xg8mr4836940vdb.310.1298677821519; Fri, 25 Feb 2011 15:50:21 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 15:50:21 -0800 (PST)
In-Reply-To: <AANLkTi=fWWd8XV15kpe0=e-9NL06jEZLkASSvF4xnZ4J@mail.gmail.com>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com> <2745.1298670625.366666@puncture> <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com> <AANLkTi=fWWd8XV15kpe0=e-9NL06jEZLkASSvF4xnZ4J@mail.gmail.com>
Date: Sat, 26 Feb 2011 01:50:21 +0200
Message-ID: <AANLkTik8LGU+LHOjf11ofXLnUvM=A6KHAd4wvhWqrUB8@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 23:49:31 -0000

>> Hashing has no place here, serves no purpose and only makes the
>> handshake more complex.
>
> This is not getting anywhere. Hashing is straight forward, well understood,
> and relatively cheap compared to the overall cost of establishing a
> connection. Please stop wasting everyone's time. You are not contributing
> anything useful to this group.

Ian, as was shown in the previous post, hashing serves no purpose here.
Why are you comparing it to the overall cost and not to cost of
alternative solutions ?

Why would you force the server implementer to include an MD5 library
_just_ for the
WS handshake, although it serves no purpose ?

Does it have any benefits over an operation of addition,
multiplication, even XOR ?

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 15:54:22 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F7493A6A7D for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:54:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.333
X-Spam-Level: 
X-Spam-Status: No, score=-3.333 tagged_above=-999 required=5 tests=[AWL=0.266,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hxrAqi-6lCEH for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 15:54:21 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 2BBEE3A6A7A for <hybi@ietf.org>; Fri, 25 Feb 2011 15:54:20 -0800 (PST)
Received: by vws6 with SMTP id 6so2052106vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 15:55:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=YHDqmYdXbXAhkbVwHYGIA6jGS0ZvZ0oSVwuCbsTAWEI=; b=V5j0i+mYyIvj5AUuUhXFTbAELlVbh6764ncnzBeqXyXTfb2enCIlEosCgSSmvtAZWi fDn+bCzWwdn/wbxCclqQkQ6PuKaNxU7QKgVjMyeh2JDeG/NgPydfF4EzkZDa3LxkI1Cb qxbLx2iLA0amAkvVsZavL9otVXwC0/M64Iewo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=fYeBM1gxZqOYoWouo8VpWfX2CsRlHK9vBdVLdIltvGjfst6SGL/TDQq+fSeHQlDZuG xP8gr5NvsGCtGKNd0HlVS7/87y0PIIjPsYeKl0mlw4wcxA5LcvpmtqPyE4vVWqHlGRRQ iB5yP3WhugzOAUpcJigDEsW4iWN6ovHODpSoc=
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr5150761vdc.110.1298678114331; Fri, 25 Feb 2011 15:55:14 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 15:55:14 -0800 (PST)
In-Reply-To: <20110225234928.GA28054@1wt.eu>
References: <AANLkTinxFHLyMsmTHm4a5Jqg2_PQoqL+wf-g8QwP8vJH@mail.gmail.com> <vnrfm6pcpqmddb0tehfod4ap70ns0a8d88@hive.bjoern.hoehrmann.de> <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com> <20110225213746.GA23570@1wt.eu> <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com> <20110225230522.GB21308@1wt.eu> <AANLkTinxBv61Dq5QUE5Q7ETMt5qLQyvyC3YpGjZtW+9B@mail.gmail.com> <20110225234928.GA28054@1wt.eu>
Date: Sat, 26 Feb 2011 01:55:14 +0200
Message-ID: <AANLkTi=tYTHijYGRzZs1VPfhWgBVeVkF=2p5+Q9w_mO3@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2011 23:54:22 -0000

>> A broken proxy is _broken_.
>> It's not deterministic. You cannot know or control what it may do
>> whatever you feed it.
>> Thus, however fast you might want to make it fail, you cannot force it
>> to happen.
>
> Agreed, and that's why you can't claim that your discutable workaround
> will fix every broken proxy. Also, you are deciding that you'd want many

The workaround doesn't claim to _fix_ anything.
It only brings the security level of WS, in regards to causing harm to
misbehaving
proxies, to the level of HTTP protocol using POST.
After taking care of that problem, there's nothing else to do with
_broken_ proxies.

> acceptable. For many months, WG participants have suggested minor
> changes to help get the most possible deterministic behaviour because
> this is what most of us are looking for. You can't get there and decide
> that this is useless and let the broken situation fail the dirty way for
> many users. That would definitely stop adoption.

You cannot claim that you support operation over broken software. The "broken"
part means that you cannot possibly know what is broken in it.
You can try not to cause harm to it, and that's what is done, by masking in the
current WS spec, and by POST-header attachment in the proposed solution.
In both cases, if the proxy is not broken, and is compliant with HTTP/1.1,
there's no need neither for the POST-header workaround nor for masking.

--
 silvio

From silvio.ventres@gmail.com  Fri Feb 25 16:05:27 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 20F7C3A6A7E for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 16:05:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.336
X-Spam-Level: 
X-Spam-Status: No, score=-3.336 tagged_above=-999 required=5 tests=[AWL=0.263,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H5eepq3oeY3Q for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 16:05:26 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 1B1963A6A83 for <hybi@ietf.org>; Fri, 25 Feb 2011 16:05:26 -0800 (PST)
Received: by vws6 with SMTP id 6so2057462vws.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 16:06:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=bUulAVYXu3AyH9k5f3x8YWQUNIptmVIc0Jaxcv7zYj4=; b=bFKqa2f1if+PAfQpwfAP19q6r2aAFmJ9t9G13xgK5s3yA6fS446D7pRyczWfygAWY1 FmXmInO+RuuvMWljylfGnC6lbsBwFuTmOFX6D3jMv0BbeRTN9mMnH9puarKZ48s3UDed GdFWi8qW9+3zULAaG52ogAgmAsbCksoICJmro=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=ZlqmY1k+RrFDnhJMJllbUBz8bilvSzLvUvZXQ98pBMoDCM0Iq2tmppcMa8KerhoFzy 280llsHVprhehUiN3DRYnWXNp6lGdt/kSYJ2QKMDStdZxerbHU8HlEub0y9oXgOwJoWq 1uvKTF+eL5h0xYBlv27hdDQSIJWTzasY2F3SM=
MIME-Version: 1.0
Received: by 10.52.159.163 with SMTP id xd3mr5051176vdb.30.1298678778986; Fri, 25 Feb 2011 16:06:18 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Fri, 25 Feb 2011 16:06:18 -0800 (PST)
In-Reply-To: <AANLkTik8LGU+LHOjf11ofXLnUvM=A6KHAd4wvhWqrUB8@mail.gmail.com>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com> <2745.1298670625.366666@puncture> <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com> <AANLkTi=fWWd8XV15kpe0=e-9NL06jEZLkASSvF4xnZ4J@mail.gmail.com> <AANLkTik8LGU+LHOjf11ofXLnUvM=A6KHAd4wvhWqrUB8@mail.gmail.com>
Date: Sat, 26 Feb 2011 02:06:18 +0200
Message-ID: <AANLkTinACJMJWAHOhc_uBY9e9tfwUNUdPiZUcx3feA6r@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: ifette@google.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 00:05:27 -0000

>> This is not getting anywhere. Hashing is straight forward, well understood,
>> and relatively cheap compared to the overall cost of establishing a
>> connection. Please stop wasting everyone's time. You are not contributing
>> anything useful to this group.
>

Actually, Maciej said himself in the post:
http://www.ietf.org/mail-archive/web/hybi/current/msg01198.html
"There is no need for the hash to be cryptographically strong."
and then:
"the hash used here is MD5; we could use a weaker hash that is faster
to compute however".
The actual procedure is not meant to hash anything, but simply make
the response differ from the challenge
in a predictable and verifiable way.
Any operation such as addition, multiplication or XOR can do that.

How did this become an SHA-1 when Maciej accepted that even MD5 was an
overkill ?
Why would you want to burden both the client and a server with
computations that have no practical benefit?

--
 silvio

From ifette@google.com  Fri Feb 25 16:11:28 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 52EA03A6A8B for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 16:11:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.704
X-Spam-Level: 
X-Spam-Status: No, score=-105.704 tagged_above=-999 required=5 tests=[AWL=-0.028, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hnDdVCSkHQtX for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 16:11:27 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 24A0E3A6A8A for <hybi@ietf.org>; Fri, 25 Feb 2011 16:11:27 -0800 (PST)
Received: from hpaq2.eem.corp.google.com (hpaq2.eem.corp.google.com [172.25.149.2]) by smtp-out.google.com with ESMTP id p1Q0CJDp013272 for <hybi@ietf.org>; Fri, 25 Feb 2011 16:12:20 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298679140; bh=ftcgILfquSWS34EGSSC8bABVZ/g=; h=MIME-Version:Reply-To:Date:Message-ID:Subject:From:To: Content-Type; b=hEjKlAAgJIA0JAg2MorhpPP5Bu29vuE0ld1oIUL+8SKt15V3ToJNVvJ+bpUO5gLbI DRCsK4t6+5rC8H/mWuWHw==
Received: from iyb12 (iyb12.prod.google.com [10.241.49.76]) by hpaq2.eem.corp.google.com with ESMTP id p1Q0CHYN000830 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 16:12:18 -0800
Received: by iyb12 with SMTP id 12so1407807iyb.29 for <hybi@ietf.org>; Fri, 25 Feb 2011 16:12:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:date:message-id:subject :from:to:content-type; bh=npxJnz1xiJHvPcbpXdrIzk51wluZQ+r1wA4xi2Fn+qs=; b=tPpvZZKnhZhbBz+P0KmcDlYtJsNxKw5CBgGNT5Nj/q7kq2Szyf+YWconAzdKZhalgN Ujo3sQ7A4LmVHK9wWqGg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:date:message-id:subject:from:to:content-type; b=LVG+Mh1N9cGwcS+CGcTTRRnzBUN3lGePi0beabCO5oZnydG9DDGnmV6qE4h0Jq/kXt q2StFMa5UnElmV7ZHByQ==
MIME-Version: 1.0
Received: by 10.43.62.9 with SMTP id wy9mr900042icb.109.1298679137314; Fri, 25 Feb 2011 16:12:17 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Fri, 25 Feb 2011 16:12:17 -0800 (PST)
Date: Fri, 25 Feb 2011 16:12:17 -0800
Message-ID: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=bcaec51f990ba828c8049d244c21
X-System-Of-Record: true
Subject: [hybi] -06 posted
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 00:11:28 -0000

--bcaec51f990ba828c8049d244c21
Content-Type: text/plain; charset=UTF-8

As an FYI, -06 was just posted. There was some discussion about wanting to
resolve a few more issues and hold off on posting -06. In discussion with
the chairs, I noted that there are already a large number of changes in -06,
and given that people are implementing I would like to keep the draft as up
to date as possible in areas where we have consensus.

There is a March 14th cutoff for drafts to be considered at IETF80 as a
final submission. Whether we will be final or not is not for me to say, but
I do expect that we will be able to resolve additional issues between now
and March 14th. As such, I am aiming to release a -07 by the March 14th
deadline.

-Ian

--bcaec51f990ba828c8049d244c21
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

As an FYI, -06 was just posted. There was some discussion about wanting to =
resolve a few more issues and hold off on posting -06. In discussion with t=
he chairs, I noted that there are already a large number of changes in -06,=
 and given that people are implementing I would like to keep the draft as u=
p to date as possible in areas where we have consensus.=C2=A0<div>
<br></div><div>There is a March 14th cutoff for drafts to be considered at =
IETF80 as a final submission. Whether we will be final or not is not for me=
 to say, but I do expect that we will be able to resolve additional issues =
between now and March 14th. As such, I am aiming to release a -07 by the Ma=
rch 14th deadline.</div>
<div><br></div><div>-Ian</div>

--bcaec51f990ba828c8049d244c21--

From Internet-Drafts@ietf.org  Fri Feb 25 16:15:03 2011
Return-Path: <Internet-Drafts@ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 564A73A6A8C; Fri, 25 Feb 2011 16:15:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.564
X-Spam-Level: 
X-Spam-Status: No, score=-102.564 tagged_above=-999 required=5 tests=[AWL=0.035, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j5-Oq2zif+2z; Fri, 25 Feb 2011 16:15:02 -0800 (PST)
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 54D9E3A6A8B; Fri, 25 Feb 2011 16:15:02 -0800 (PST)
MIME-Version: 1.0
Content-Type: Multipart/Mixed; Boundary="NextPart"
From: Internet-Drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 3.12
Message-ID: <20110226001502.30051.83553.idtracker@localhost>
Date: Fri, 25 Feb 2011 16:15:02 -0800
Cc: hybi@ietf.org
Subject: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-06.txt
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 00:15:03 -0000

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the BiDirectional or Server-Initiated HTTP Working Group of the IETF.


	Title           : The WebSocket protocol
	Author(s)       : I. Fette
	Filename        : draft-ietf-hybi-thewebsocketprotocol-06.txt
	Pages           : 55
	Date            : 2011-02-25

The WebSocket protocol enables two-way communication between a user
agent running untrusted code running in a controlled environment to a
remote host that has opted-in to communications from that code.  The
security model used for this is the Origin-based security model
commonly used by Web browsers.  The protocol consists of an initial
handshake followed by basic message framing, layered over TCP.  The
goal of this technology is to provide a mechanism for browser-based
applications that need two-way communication with servers that does
not rely on opening multiple HTTP connections (e.g. using
XMLHttpRequest or <iframe>s and long polling).

Please send feedback to the hybi@ietf.org mailing list.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-hybi-thewebsocketprotocol-06.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Message/External-body;
	name="draft-ietf-hybi-thewebsocketprotocol-06.txt";
	site="ftp.ietf.org"; access-type="anon-ftp";
	directory="internet-drafts"

Content-Type: text/plain
Content-ID: <2011-02-25160831.I-D@ietf.org>


--NextPart--

From w@1wt.eu  Fri Feb 25 16:53:26 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC4713A6A99 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 16:53:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.974
X-Spam-Level: 
X-Spam-Status: No, score=-1.974 tagged_above=-999 required=5 tests=[AWL=0.069,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gnvu24-YrrOH for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 16:53:26 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 9E0973A6A98 for <hybi@ietf.org>; Fri, 25 Feb 2011 16:53:25 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p1Q0s7t2028843; Sat, 26 Feb 2011 01:54:07 +0100
Date: Sat, 26 Feb 2011 01:54:07 +0100
From: Willy Tarreau <w@1wt.eu>
To: Silvio Ventres <silvio.ventres@gmail.com>
Message-ID: <20110226005407.GB28054@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com> <2745.1298670625.366666@puncture> <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com> <AANLkTi=fWWd8XV15kpe0=e-9NL06jEZLkASSvF4xnZ4J@mail.gmail.com> <AANLkTik8LGU+LHOjf11ofXLnUvM=A6KHAd4wvhWqrUB8@mail.gmail.com> <AANLkTinACJMJWAHOhc_uBY9e9tfwUNUdPiZUcx3feA6r@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTinACJMJWAHOhc_uBY9e9tfwUNUdPiZUcx3feA6r@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 00:53:27 -0000

On Sat, Feb 26, 2011 at 02:06:18AM +0200, Silvio Ventres wrote:
> >> This is not getting anywhere. Hashing is straight forward, well understood,
> >> and relatively cheap compared to the overall cost of establishing a
> >> connection. Please stop wasting everyone's time. You are not contributing
> >> anything useful to this group.
> >
> 
> Actually, Maciej said himself in the post:
> http://www.ietf.org/mail-archive/web/hybi/current/msg01198.html
> "There is no need for the hash to be cryptographically strong."
> and then:
> "the hash used here is MD5; we could use a weaker hash that is faster
> to compute however".
> The actual procedure is not meant to hash anything, but simply make
> the response differ from the challenge
> in a predictable and verifiable way.
> Any operation such as addition, multiplication or XOR can do that.
> 
> How did this become an SHA-1 when Maciej accepted that even MD5 was an
> overkill ?

As some of us already told you, simply because it appeared simpler
without any noticeable additional cost. Hashes were used at several
places anyway when this choice was made.

> Why would you want to burden both the client and a server with
> computations that have no practical benefit?

Why don't you propose an alternative that looks like something everybody
can understand and discuss, with a minimum analysis of benefits vs risks
compared to what it's supposed to replace ? I mean, something concrete,
not just random ideas with and sentences all beginning with "Why".

There's nothing wrong with proposing argumented improvements, the WG is
there for this reason. What's wrong is to constantly harrass participants
asking them to justify some choices that were made months ago and that
you don't accept.

Maybe your idea will be accepted, maybe it will be rejected with strong
arguments but at least it will have been developped and discussed.

Willy


From Gabriel.Montenegro@microsoft.com  Fri Feb 25 17:59:46 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 322EF3A6ABC for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 17:59:46 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.453
X-Spam-Level: 
X-Spam-Status: No, score=-10.453 tagged_above=-999 required=5 tests=[AWL=0.146, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ERjhoOGXqFfk for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 17:59:43 -0800 (PST)
Received: from smtp.microsoft.com (smtp.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id B2C933A6AB9 for <hybi@ietf.org>; Fri, 25 Feb 2011 17:59:43 -0800 (PST)
Received: from TK5EX14HUBC103.redmond.corp.microsoft.com (157.54.86.9) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Fri, 25 Feb 2011 18:00:37 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14HUBC103.redmond.corp.microsoft.com (157.54.86.9) with Microsoft SMTP Server (TLS) id 14.1.270.2; Fri, 25 Feb 2011 18:00:37 -0800
Received: from TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com ([169.254.2.139]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi id 14.01.0270.002; Fri, 25 Feb 2011 18:00:35 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: "hybi@ietf.org" <hybi@ietf.org>
Thread-Topic: HTML5 Labs rev 05 prototype available
Thread-Index: AcvVWMFP1srAPpZTRcCzX1XastEn8Q==
Date: Sat, 26 Feb 2011 02:00:36 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126EAD139@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [157.54.51.90]
Content-Type: multipart/alternative; boundary="_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126EAD139TK5EX14MBXW602w_"
MIME-Version: 1.0
Subject: [hybi] HTML5 Labs rev 05 prototype available
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 01:59:46 -0000

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126EAD139TK5EX14MBXW602w_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Here's the blog announcement:
http://blogs.msdn.com/b/interoperability/archive/2011/02/22/the-websockets-=
prototype-gets-another-update.aspx

download site:
http://html5labs.interoperabilitybridges.com/prototypes/available-for-downl=
oad/websockets/html5protos_Download

Gabriel

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126EAD139TK5EX14MBXW602w_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:"MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:"\@MS Mincho";
	panose-1:2 2 6 9 4 2 5 8 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";
	mso-fareast-language:JA;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";
	mso-fareast-language:JA;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Here&#8217;s the blog announcement:<o:p></o:p></p>
<p class=3D"MsoNormal"><a href=3D"http://blogs.msdn.com/b/interoperability/=
archive/2011/02/22/the-websockets-prototype-gets-another-update.aspx">http:=
//blogs.msdn.com/b/interoperability/archive/2011/02/22/the-websockets-proto=
type-gets-another-update.aspx</a><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">download site:<o:p></o:p></p>
<p class=3D"MsoNormal"><a href=3D"http://html5labs.interoperabilitybridges.=
com/prototypes/available-for-download/websockets/html5protos_Download">http=
://html5labs.interoperabilitybridges.com/prototypes/available-for-download/=
websockets/html5protos_Download</a><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Gabriel<o:p></o:p></p>
</div>
</body>
</html>

--_000_CA566BAEAD6B3F4E8B5C5C4F61710C1126EAD139TK5EX14MBXW602w_--

From bruce@callenish.com  Fri Feb 25 18:18:45 2011
Return-Path: <bruce@callenish.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD5003A6A57 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 18:18:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yzf-lNomYnxk for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 18:18:42 -0800 (PST)
Received: from biz82.inmotionhosting.com (biz82.inmotionhosting.com [74.124.202.87]) by core3.amsl.com (Postfix) with ESMTP id 9A5F73A6AC1 for <hybi@ietf.org>; Fri, 25 Feb 2011 18:18:42 -0800 (PST)
Received: from [24.108.133.142] (helo=[192.168.145.101]) by biz82.inmotionhosting.com with esmtpa (Exim 4.69) (envelope-from <bruce@callenish.com>) id 1Pt9kf-0001b2-I6 for hybi@ietf.org; Fri, 25 Feb 2011 18:19:21 -0800
Message-ID: <4D68633A.1070902@callenish.com>
Date: Fri, 25 Feb 2011 18:19:38 -0800
From: Bruce Atherton <bruce@callenish.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Hybi <hybi@ietf.org>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>	<AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>
In-Reply-To: <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - biz82.inmotionhosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - callenish.com
Subject: [hybi] Indicator in frame whether it is masked (was Masked framing VS mask in frame)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 02:18:46 -0000

Right now there is no way to tell whether a particular Websocket frame 
is travelling from client to server or server to client without knowing 
which end sent the packet and whether that end is acting as the client 
or the server. This complicates decoding as, just given the packet data, 
you can't tell whether a frame key is present and demasking needs to be 
done. Even with human intervention this can get a little confusing given 
that a server can act both as a client and a server on different 
connections.

If the framing is not masked then one solution would be to use one of 
the reserved bits to indicate whether the frame originated at a client 
or not. Would your objection to using a reserved bit to indicate a mask 
in the extension data extend to this use as well? I realize that the 
reserved bits are very limited, but masking and its omission does seem 
rather fundamental to the protocol as it affects the parsing of the 
frame (ie. read 4 extra bytes at the beginnning, or don't).

On 25/02/2011 6:41 AM, John Tamplin wrote:
>   - I would not support use of any reserved bits to indicate the mask
> is in the extension data
>     portion of the frame - instead, it should simply be defined to be
> the first 4 bytes if masking is
>     present (ie, client->server frames)
>   - it will complicate how mux and other extensions are defined, but I
> think we can deal with that
>     when we define those extensions
>


From derhoermi@gmx.net  Fri Feb 25 18:23:44 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A19063A6AC1 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 18:23:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.922
X-Spam-Level: 
X-Spam-Status: No, score=-2.922 tagged_above=-999 required=5 tests=[AWL=-0.323, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3MttW0L8ZmEk for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 18:23:43 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id 0EA4E3A6ABA for <hybi@ietf.org>; Fri, 25 Feb 2011 18:23:42 -0800 (PST)
Received: (qmail invoked by alias); 26 Feb 2011 02:24:34 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp004) with SMTP; 26 Feb 2011 03:24:34 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX19lU0gdKRllDz6hb9P2jmxzInzrnLw74AVWCC6cCu Ve0v2kY+Lz8DVM
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Justin Lee <jlee@antwerkz.com>
Date: Sat, 26 Feb 2011 03:24:36 +0100
Message-ID: <f3igm6pmr7ri8484aia7s8qqmpi6m533o3@hive.bjoern.hoehrmann.de>
References: <AANLkTinQ4j7rjk3haRnpj7avi6e=wru2GteRkRx-tSkP@mail.gmail.com>
In-Reply-To: <AANLkTinQ4j7rjk3haRnpj7avi6e=wru2GteRkRx-tSkP@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] timeline
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 02:23:44 -0000

* Justin Lee wrote:
>I hate to interrupt the Silvio show but I was wondering if we could get a
>rundown of the remaining issues (as known today) and see what kind of
>timeline we're looking at for a 1.0 of the spec.  I know it'd be speculative
>but it'd help on my end if we at least had some ballpark estimates.  I can
>see two issues being batted around at the moment:  the close/RST issue and
>the masking frame vs payload question.  Is there anything else that needs
>hashing out?

I would expect that at some point we'll have a draft that addresses the
many issues that have come up over the past couple of months and then we
will have some people who followed the discussions but did not comment
on individual revisions knowing they are incomplete review the draft and
fix whatever issues come up. With some luck that will happen in March.

After that we would have a Working Group Last Call review where we would
also, at the latest, invite other parties, like W3C's Web Applications
Group who work on the JavaScript API, to review the draft. When that is
done it'll likely by May, so at this point I would expect the group to
be one to two months late compared to the charter, which is remarkably
good.

Note that there are a fair share of lingering issues, for instance, in
the latest draft Ian Hickson is still listed, incorrectly, as Change
Controller for the URI schemes, I will at some point suggest once more
that implementations should not attempt to recover from UTF-8 errors,
and so on.

The crucial point, to me, is getting a draft out that pretty much fixes
"all known issues" so we get people to review it without them running
into issues like "this example hasn't been updated" so we can get issues
people have had on their minds but didn't feel like raising properly out
in the open. If we can get that by the cutoff date, that would be great.

As far as major technical issues are concerned, I think the main risk is
that we might end up re-opening the debate around the basic frame layout
with people arguing the current frame length, flag, extension encoding
needs to be simplified. If we get into that, and also fail to properly
separate "review from well-known good" and "working group last call" I'd
probably add 2 months of delay.

Also, obviously the specification we are producing is not the best place
to explain the reasoning behind important features, so we won't be able 
to respond to further criticism of, say, masking, simply by pointing out
where in the Security Considerations this is discussed, and instead ex-
change a couple of hundreds of mails telling reviewers to read the list
archives, which they won't because it is infeasible, so adding another
month to compensate for that might be wise aswell.

So, to summarize, I would expect Last Call in Q2 2011, and if we aren't
in IESG review, or past that, in Q3, something must have gone wrong more
than expected. The way to speed things up is by making sure the protocol
design is easy to understand by skimming the specification and by making
sure people review it somewhere between "early" and "when appropriate",
rather than when it's "almost too late".
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From jlee@antwerkz.com  Fri Feb 25 18:38:21 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 981023A680F for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 18:38:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.78
X-Spam-Level: 
X-Spam-Status: No, score=-2.78 tagged_above=-999 required=5 tests=[AWL=0.196,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uQeesWXEqox0 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 18:38:19 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 75C393A67A3 for <hybi@ietf.org>; Fri, 25 Feb 2011 18:38:19 -0800 (PST)
Received: by fxm15 with SMTP id 15so2322649fxm.31 for <hybi@ietf.org>; Fri, 25 Feb 2011 18:39:12 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.73.206 with SMTP id r14mr3491080faj.126.1298687951109; Fri, 25 Feb 2011 18:39:11 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Fri, 25 Feb 2011 18:39:11 -0800 (PST)
In-Reply-To: <f3igm6pmr7ri8484aia7s8qqmpi6m533o3@hive.bjoern.hoehrmann.de>
References: <AANLkTinQ4j7rjk3haRnpj7avi6e=wru2GteRkRx-tSkP@mail.gmail.com> <f3igm6pmr7ri8484aia7s8qqmpi6m533o3@hive.bjoern.hoehrmann.de>
Date: Fri, 25 Feb 2011 21:39:11 -0500
Message-ID: <AANLkTik3sC=otkjy-sVRbcr1VWToAVnQmHzM7GzeJCUx@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Content-Type: multipart/alternative; boundary=20cf30433ec800003b049d265ac2
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] timeline
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 02:38:21 -0000

--20cf30433ec800003b049d265ac2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

OK.  That more or less squares with how I read Ian's statements earlier
about the -07 draft.  For what it's worth, I updated the grizzly/glassfish
implementation from -76 to -05 in just a couple of days (around some releas=
e
drama) and found the spec pretty clear.  I had to reread a couple of
sections just to clear things up but it was rather easy to update to the ne=
w
version.  For me, there is still some ambiguity about the server nonce in
the reply (is it used for anything other than just to verify its presence,
e.g.) and the ping/pong types.  I don't see anything specifying if an
implementation is required to send these with any regularity or just respon=
d
appropriately when encountered.  I suppose requiring regular ping heartbeat=
s
might start to consume too many network resources for larger sites but it
was just one question that popped up when implementing those frame types.

Other than that, I'm actually pretty pleased with the current state.  It wa=
s
simpler than I expected it to be from following all the discussions and
performance seems to be really high based on my admittedly simplistic
benchmark unit test.  In any case, I'll pass on what you've said to
management in hopes it will move things along on our end.  Thanks for such =
a
detailed response.

On Fri, Feb 25, 2011 at 9:24 PM, Bjoern Hoehrmann <derhoermi@gmx.net> wrote=
:

> * Justin Lee wrote:
> >I hate to interrupt the Silvio show but I was wondering if we could get =
a
> >rundown of the remaining issues (as known today) and see what kind of
> >timeline we're looking at for a 1.0 of the spec.  I know it'd be
> speculative
> >but it'd help on my end if we at least had some ballpark estimates.  I c=
an
> >see two issues being batted around at the moment:  the close/RST issue a=
nd
> >the masking frame vs payload question.  Is there anything else that need=
s
> >hashing out?
>
> I would expect that at some point we'll have a draft that addresses the
> many issues that have come up over the past couple of months and then we
> will have some people who followed the discussions but did not comment
> on individual revisions knowing they are incomplete review the draft and
> fix whatever issues come up. With some luck that will happen in March.
>
> After that we would have a Working Group Last Call review where we would
> also, at the latest, invite other parties, like W3C's Web Applications
> Group who work on the JavaScript API, to review the draft. When that is
> done it'll likely by May, so at this point I would expect the group to
> be one to two months late compared to the charter, which is remarkably
> good.
>
> Note that there are a fair share of lingering issues, for instance, in
> the latest draft Ian Hickson is still listed, incorrectly, as Change
> Controller for the URI schemes, I will at some point suggest once more
> that implementations should not attempt to recover from UTF-8 errors,
> and so on.
>
> The crucial point, to me, is getting a draft out that pretty much fixes
> "all known issues" so we get people to review it without them running
> into issues like "this example hasn't been updated" so we can get issues
> people have had on their minds but didn't feel like raising properly out
> in the open. If we can get that by the cutoff date, that would be great.
>
> As far as major technical issues are concerned, I think the main risk is
> that we might end up re-opening the debate around the basic frame layout
> with people arguing the current frame length, flag, extension encoding
> needs to be simplified. If we get into that, and also fail to properly
> separate "review from well-known good" and "working group last call" I'd
> probably add 2 months of delay.
>
> Also, obviously the specification we are producing is not the best place
> to explain the reasoning behind important features, so we won't be able
> to respond to further criticism of, say, masking, simply by pointing out
> where in the Security Considerations this is discussed, and instead ex-
> change a couple of hundreds of mails telling reviewers to read the list
> archives, which they won't because it is infeasible, so adding another
> month to compensate for that might be wise aswell.
>
> So, to summarize, I would expect Last Call in Q2 2011, and if we aren't
> in IESG review, or past that, in Q3, something must have gone wrong more
> than expected. The way to speed things up is by making sure the protocol
> design is easy to understand by skimming the specification and by making
> sure people review it somewhere between "early" and "when appropriate",
> rather than when it's "almost too late".
> --
> Bj=F6rn H=F6hrmann =B7 mailto:bjoern@hoehrmann.de =B7 http://bjoern.hoehr=
mann.de
> Am Badedeich 7 =B7 Telefon: +49(0)160/4415681 =B7 http://www.bjoernsworld=
.de
> 25899 Dageb=FCll =B7 PGP Pub. KeyID: 0xA4357E78 =B7 http://www.websitedev=
.de/
>



--=20
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--20cf30433ec800003b049d265ac2
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

OK. =A0That more or less squares with how I read Ian&#39;s statements earli=
er about the -07 draft. =A0For what it&#39;s worth, I updated the grizzly/g=
lassfish implementation from -76 to -05 in just a couple of days (around so=
me release drama) and found the spec pretty clear. =A0I had to reread a cou=
ple of sections just to clear things up but it was rather easy to update to=
 the new version. =A0For me, there is still some ambiguity about the server=
 nonce in the reply (is it used for anything other than just to verify its =
presence, e.g.) and the ping/pong types. =A0I don&#39;t see anything specif=
ying if an implementation is required to send these with any regularity or =
just respond appropriately when encountered. =A0I suppose requiring regular=
 ping heartbeats might start to consume too many network resources for larg=
er sites but it was just one question that popped up when implementing thos=
e frame types.<div>
<br></div><div>Other than that, I&#39;m actually pretty pleased with the cu=
rrent state. =A0It was simpler than I expected it to be from following all =
the discussions and performance seems to be really high based on my admitte=
dly simplistic benchmark unit test. =A0In any case, I&#39;ll pass on what y=
ou&#39;ve said to management in hopes it will move things along on our end.=
 =A0Thanks for such a detailed response.<br>
<br><div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 9:24 PM, Bjoern Hoeh=
rmann <span dir=3D"ltr">&lt;<a href=3D"mailto:derhoermi@gmx.net">derhoermi@=
gmx.net</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D=
"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">* Justin Lee wrote:<br>
&gt;I hate to interrupt the Silvio show but I was wondering if we could get=
 a<br>
&gt;rundown of the remaining issues (as known today) and see what kind of<b=
r>
&gt;timeline we&#39;re looking at for a 1.0 of the spec. =A0I know it&#39;d=
 be speculative<br>
&gt;but it&#39;d help on my end if we at least had some ballpark estimates.=
 =A0I can<br>
&gt;see two issues being batted around at the moment: =A0the close/RST issu=
e and<br>
&gt;the masking frame vs payload question. =A0Is there anything else that n=
eeds<br>
&gt;hashing out?<br>
<br>
</div>I would expect that at some point we&#39;ll have a draft that address=
es the<br>
many issues that have come up over the past couple of months and then we<br=
>
will have some people who followed the discussions but did not comment<br>
on individual revisions knowing they are incomplete review the draft and<br=
>
fix whatever issues come up. With some luck that will happen in March.<br>
<br>
After that we would have a Working Group Last Call review where we would<br=
>
also, at the latest, invite other parties, like W3C&#39;s Web Applications<=
br>
Group who work on the JavaScript API, to review the draft. When that is<br>
done it&#39;ll likely by May, so at this point I would expect the group to<=
br>
be one to two months late compared to the charter, which is remarkably<br>
good.<br>
<br>
Note that there are a fair share of lingering issues, for instance, in<br>
the latest draft Ian Hickson is still listed, incorrectly, as Change<br>
Controller for the URI schemes, I will at some point suggest once more<br>
that implementations should not attempt to recover from UTF-8 errors,<br>
and so on.<br>
<br>
The crucial point, to me, is getting a draft out that pretty much fixes<br>
&quot;all known issues&quot; so we get people to review it without them run=
ning<br>
into issues like &quot;this example hasn&#39;t been updated&quot; so we can=
 get issues<br>
people have had on their minds but didn&#39;t feel like raising properly ou=
t<br>
in the open. If we can get that by the cutoff date, that would be great.<br=
>
<br>
As far as major technical issues are concerned, I think the main risk is<br=
>
that we might end up re-opening the debate around the basic frame layout<br=
>
with people arguing the current frame length, flag, extension encoding<br>
needs to be simplified. If we get into that, and also fail to properly<br>
separate &quot;review from well-known good&quot; and &quot;working group la=
st call&quot; I&#39;d<br>
probably add 2 months of delay.<br>
<br>
Also, obviously the specification we are producing is not the best place<br=
>
to explain the reasoning behind important features, so we won&#39;t be able=
<br>
to respond to further criticism of, say, masking, simply by pointing out<br=
>
where in the Security Considerations this is discussed, and instead ex-<br>
change a couple of hundreds of mails telling reviewers to read the list<br>
archives, which they won&#39;t because it is infeasible, so adding another<=
br>
month to compensate for that might be wise aswell.<br>
<br>
So, to summarize, I would expect Last Call in Q2 2011, and if we aren&#39;t=
<br>
in IESG review, or past that, in Q3, something must have gone wrong more<br=
>
than expected. The way to speed things up is by making sure the protocol<br=
>
design is easy to understand by skimming the specification and by making<br=
>
sure people review it somewhere between &quot;early&quot; and &quot;when ap=
propriate&quot;,<br>
rather than when it&#39;s &quot;almost too late&quot;.<br>
<font color=3D"#888888">--<br>
Bj=F6rn H=F6hrmann =B7 mailto:<a href=3D"mailto:bjoern@hoehrmann.de">bjoern=
@hoehrmann.de</a> =B7 <a href=3D"http://bjoern.hoehrmann.de" target=3D"_bla=
nk">http://bjoern.hoehrmann.de</a><br>
Am Badedeich 7 =B7 Telefon: +49(0)160/4415681 =B7 <a href=3D"http://www.bjo=
ernsworld.de" target=3D"_blank">http://www.bjoernsworld.de</a><br>
25899 Dageb=FCll =B7 PGP Pub. KeyID: 0xA4357E78 =B7 <a href=3D"http://www.w=
ebsitedev.de/" target=3D"_blank">http://www.websitedev.de/</a><br>
</font></blockquote></div><br><br clear=3D"all"><br>-- <br>You can find me =
on the net at:<div><a href=3D"http://antwerkz.com" target=3D"_blank">http:/=
/antwerkz.com</a><br><a href=3D"http://www.linkedin.com/in/justinlee" targe=
t=3D"_blank">http://www.linkedin.com/in/justinlee</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>
</div>

--20cf30433ec800003b049d265ac2--

From derhoermi@gmx.net  Fri Feb 25 19:00:47 2011
Return-Path: <derhoermi@gmx.net>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6776E3A68B0 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 19:00:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.895
X-Spam-Level: 
X-Spam-Status: No, score=-2.895 tagged_above=-999 required=5 tests=[AWL=-0.296, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 93WhgFjfuPY9 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 19:00:46 -0800 (PST)
Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by core3.amsl.com (Postfix) with SMTP id C4FB63A6833 for <hybi@ietf.org>; Fri, 25 Feb 2011 19:00:45 -0800 (PST)
Received: (qmail invoked by alias); 26 Feb 2011 03:01:37 -0000
Received: from dslb-094-223-158-170.pools.arcor-ip.net (EHLO HIVE) [94.223.158.170] by mail.gmx.net (mp038) with SMTP; 26 Feb 2011 04:01:37 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX18+P3At5MA+02M+BezID9x5s/77Ihk3Ut6K1pQl/t Lw7KEEBEoqUG0w
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Silvio Ventres <silvio.ventres@gmail.com>
Date: Sat, 26 Feb 2011 04:01:40 +0100
Message-ID: <k2qgm6tqn4o9umf5irbdnle3rdv9bbli4i@hive.bjoern.hoehrmann.de>
References: <AANLkTimit=EeguN8c5FJ2bEHA1dVG2aqgf_eGAJVMSBF@mail.gmail.com> <nl3gm6p4g6ondfd56tcupp02hc656ltlql@hive.bjoern.hoehrmann.de> <AANLkTi=0G2BBLRvLRmY=D3=o5U-vE1itgcaDyzE_UavW@mail.gmail.com> <20110225213746.GA23570@1wt.eu> <AANLkTi=pODCOdrU+nRexiQkyq_He40iNFok+chif8GPA@mail.gmail.com> <20110225230522.GB21308@1wt.eu> <AANLkTinxBv61Dq5QUE5Q7ETMt5qLQyvyC3YpGjZtW+9B@mail.gmail.com> <20110225234928.GA28054@1wt.eu> <AANLkTi=tYTHijYGRzZs1VPfhWgBVeVkF=2p5+Q9w_mO3@mail.gmail.com>
In-Reply-To: <AANLkTi=tYTHijYGRzZs1VPfhWgBVeVkF=2p5+Q9w_mO3@mail.gmail.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: hybi@ietf.org
Subject: Re: [hybi] Masking for WS data content
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 03:00:47 -0000

* Silvio Ventres wrote:
>The workaround doesn't claim to _fix_ anything.
>It only brings the security level of WS, in regards to causing harm to
>misbehaving
>proxies, to the level of HTTP protocol using POST.

There are only two possibilities here, either we abandon the Websockets
effort, in which case there are no new security issues, or we propose to
change something by continuing the Websockets effort, in which case we'd
have new security issues to deal with. There is no way to do something
that is not already possible without, for sure, introducing any new se-
curity issues.

If you want to continue discussing alternatives to masking, at the very
least you will have to make a proposal that can be implemented without
ambiguity whether an implementation conforms to your specification, and
without ambiguity whether there might be some security issue or not. So
far your suggestions are nowhere near that standard.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 

From jat@google.com  Fri Feb 25 19:22:24 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 580283A6833 for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 19:22:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.896
X-Spam-Level: 
X-Spam-Status: No, score=-105.896 tagged_above=-999 required=5 tests=[AWL=0.080, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ox3TpPm75Lqz for <hybi@core3.amsl.com>; Fri, 25 Feb 2011 19:22:23 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 111243A68B0 for <hybi@ietf.org>; Fri, 25 Feb 2011 19:22:22 -0800 (PST)
Received: from kpbe16.cbf.corp.google.com (kpbe16.cbf.corp.google.com [172.25.105.80]) by smtp-out.google.com with ESMTP id p1Q3NGj7003512 for <hybi@ietf.org>; Fri, 25 Feb 2011 19:23:16 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298690596; bh=kCs+cPhPqr7dSbqiQGcEEOLXUR8=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=w1MBLplgvSOkH9w4oGL/MzgUArUx56/xtpWeDU5aa4OSRl1RgJ8bi2YC2yvIeSdNl 9HaizdeWOUYVY8s+2EM9Q==
Received: from gwj20 (gwj20.prod.google.com [10.200.10.20]) by kpbe16.cbf.corp.google.com with ESMTP id p1Q3NENM027960 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Fri, 25 Feb 2011 19:23:15 -0800
Received: by gwj20 with SMTP id 20so1229428gwj.7 for <hybi@ietf.org>; Fri, 25 Feb 2011 19:23:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=MS7uC96EOGhybLkKYRKp+q6IHbN+HBDDr/iGEL5cr0U=; b=Pp79b+bZZuKKZM91RPlAIROAkFSL6n2u1IOk43LdvcfA3DYgjzWpm+M0waGR9r2uzr EdZhUzMylbqYhqJ/KLYA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Nt//lVXb3519KB5cRMlEBsXTt6oiGQxOtWFLNAO3uzUHHZ6OLFSidPkdFbZPuH6tFU iiWxAQfvT6EETC/rbCRg==
Received: by 10.150.43.37 with SMTP id q37mr4504986ybq.103.1298690594664; Fri, 25 Feb 2011 19:23:14 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Fri, 25 Feb 2011 19:22:09 -0800 (PST)
In-Reply-To: <4D68633A.1070902@callenish.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <4D68633A.1070902@callenish.com>
From: John Tamplin <jat@google.com>
Date: Fri, 25 Feb 2011 22:22:09 -0500
Message-ID: <AANLkTikKZKhp2j7OPr4-V5MZ6QEvQyz2QSqjmmu_DHfW@mail.gmail.com>
To: Bruce Atherton <bruce@callenish.com>
Content-Type: multipart/alternative; boundary=000e0cd5f140917025049d26f720
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Indicator in frame whether it is masked (was Masked framing VS mask in frame)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 03:22:24 -0000

--000e0cd5f140917025049d26f720
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 25, 2011 at 9:19 PM, Bruce Atherton <bruce@callenish.com> wrote:

> Right now there is no way to tell whether a particular Websocket frame is
> travelling from client to server or server to client without knowing which
> end sent the packet and whether that end is acting as the client or the
> server. This complicates decoding as, just given the packet data, you can't
> tell whether a frame key is present and demasking needs to be done. Even
> with human intervention this can get a little confusing given that a server
> can act both as a client and a server on different connections.
>
> If the framing is not masked then one solution would be to use one of the
> reserved bits to indicate whether the frame originated at a client or not.
> Would your objection to using a reserved bit to indicate a mask in the
> extension data extend to this use as well? I realize that the reserved bits
> are very limited, but masking and its omission does seem rather fundamental
> to the protocol as it affects the parsing of the frame (ie. read 4 extra
> bytes at the beginnning, or don't).
>

I agree it is unfortunate that the framing is no longer symmetric now that
we have added client->server masking, but I don't think there is sufficient
value to justify using one of a very few reserved bits to distinguish them.
 There are a number of cases which already require a protocol decoder to
maintain state about which side of the communication is involved:
 - the initial handshake is asymmetric, so you have to know when side
initiated the connection to interpret it
 - if compression is being used, there are separate compression states for
each direction
 - fragmentation requires maintaining state about each side of the
connection separately

There are also other protocols which have asymmetric framing, including HTTP
(though you can get at least the basic structure of the message), and it
doesn't seem to have imposed much burden in that case.

I wouldn't object to a final protocol including it if many others wanted it,
but personally I feel it would be a horrible waste.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd5f140917025049d26f720
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Fri, Feb 25, 2011 at 9:19 PM, Bruce Atherton =
<span dir=3D"ltr">&lt;<a href=3D"mailto:bruce@callenish.com">bruce@callenis=
h.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"m=
argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

Right now there is no way to tell whether a particular Websocket frame is t=
ravelling from client to server or server to client without knowing which e=
nd sent the packet and whether that end is acting as the client or the serv=
er. This complicates decoding as, just given the packet data, you can&#39;t=
 tell whether a frame key is present and demasking needs to be done. Even w=
ith human intervention this can get a little confusing given that a server =
can act both as a client and a server on different connections.<br>


<br>
If the framing is not masked then one solution would be to use one of the r=
eserved bits to indicate whether the frame originated at a client or not. W=
ould your objection to using a reserved bit to indicate a mask in the exten=
sion data extend to this use as well? I realize that the reserved bits are =
very limited, but masking and its omission does seem rather fundamental to =
the protocol as it affects the parsing of the frame (ie. read 4 extra bytes=
 at the beginnning, or don&#39;t).<br>

</blockquote><div><br></div><div>I agree it is unfortunate that the framing=
 is no longer symmetric now that we have added client-&gt;server masking, b=
ut I don&#39;t think there is sufficient value to justify using one of a ve=
ry few reserved bits to distinguish them. =C2=A0There are a number of cases=
 which already require a protocol decoder to maintain state about which sid=
e of the communication is involved:</div>

<div>=C2=A0- the initial handshake is asymmetric, so you have to know when =
side initiated the connection to interpret it</div><div>=C2=A0- if compress=
ion is being used, there are separate compression states for each direction=
</div>

<div>=C2=A0- fragmentation requires maintaining state about each side of th=
e connection separately</div><div><br></div><div>There are also other proto=
cols which have asymmetric framing, including HTTP (though you can get at l=
east the basic structure of the message), and it doesn&#39;t seem to have i=
mposed much burden in that case.</div>

</div><div><br></div><div>I wouldn&#39;t object to a final protocol includi=
ng it if many others wanted it, but personally I feel it would be a horribl=
e waste.</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google=
<br>



--000e0cd5f140917025049d26f720--

From andy.warmcat.com@googlemail.com  Sat Feb 26 03:24:04 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 73A183A6908 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 03:24:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.587
X-Spam-Level: 
X-Spam-Status: No, score=-3.587 tagged_above=-999 required=5 tests=[AWL=0.013,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cN8l4i53GyWY for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 03:24:03 -0800 (PST)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 38C683A67D4 for <hybi@ietf.org>; Sat, 26 Feb 2011 03:24:03 -0800 (PST)
Received: by wwb22 with SMTP id 22so1100283wwb.13 for <hybi@ietf.org>; Sat, 26 Feb 2011 03:24:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=moaW6EhMa3ERBs0o3K4ixHOo2gPElx437bogDS+KgxM=; b=Ej21Vr1ZAdDjk3FIlNHFlv/zd1NQpkZid1cjxXEpf3BpGau3qA2Xh6AicQppXHvy9W 3nOEBhQ+Ot6AAofG6RhdUS9xj7XMAiUz3xFrzC247X3CCJjuWWDUb6ReDKOGUBOxuhal 6uFMsiOcNvxv1Xb0iNMfMQI8PErIxB0CxMcZQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=bMYw9tc1O/343kH/H6nzPaell6o3u7h/QdBQIxZWUmCHSb9/yF3n8LV5/9WvOkel9V 2bEp2S/c+vJIFgpb5BZLhwx5zk7CYAr7hpCJuG+1tdVlq14gx2sLyK43UAuRhLAxo3Po ihCr+/UVkK2/QsW0et8fZ9KqjtaYORuY23rwA=
Received: by 10.227.195.79 with SMTP id eb15mr3026493wbb.192.1298719497184; Sat, 26 Feb 2011 03:24:57 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id f27sm1407898wbf.13.2011.02.26.03.24.55 (version=SSLv3 cipher=OTHER); Sat, 26 Feb 2011 03:24:56 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D68E306.9010704@warmcat.com>
Date: Sat, 26 Feb 2011 11:24:54 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: ifette@google.com
References: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com>
In-Reply-To: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: hybi@ietf.org
Subject: Re: [hybi] -06 posted
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 11:24:04 -0000

On 02/26/2011 12:12 AM, Somebody in the thread at some point said:

> As an FYI, -06 was just posted. There was some discussion about wanting

I upgraded libwebsockets to support 06: the new close codes and putting 
them in CLOSE payload, stop requiring nonce and origin, that seemed to 
be all that was needed from 05.

http://git.warmcat.com/cgi-bin/cgit/libwebsockets

-Andy

From jlee@antwerkz.com  Sat Feb 26 06:21:39 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 20E913A6943 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 06:21:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.813
X-Spam-Level: 
X-Spam-Status: No, score=-2.813 tagged_above=-999 required=5 tests=[AWL=0.163,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2WySnkKRpn8e for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 06:21:38 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id E56223A6929 for <hybi@ietf.org>; Sat, 26 Feb 2011 06:21:36 -0800 (PST)
Received: by fxm15 with SMTP id 15so2570142fxm.31 for <hybi@ietf.org>; Sat, 26 Feb 2011 06:22:31 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.144.81 with SMTP id y17mr15348fau.69.1298730151233; Sat, 26 Feb 2011 06:22:31 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Sat, 26 Feb 2011 06:22:31 -0800 (PST)
In-Reply-To: <4D68E306.9010704@warmcat.com>
References: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com> <4D68E306.9010704@warmcat.com>
Date: Sat, 26 Feb 2011 09:22:31 -0500
Message-ID: <AANLkTi=L3Fi=0mAaS-ekG-NhsabxQ+6ZHjwuVu4EvXjw@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: ifette@google.com, hybi <hybi@ietf.org>
Content-Type: multipart/alternative; boundary=0023545bd64452ca0d049d302df6
Subject: Re: [hybi] -06 posted
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 14:21:39 -0000

--0023545bd64452ca0d049d302df6
Content-Type: text/plain; charset=ISO-8859-1

Section 1.4 ends midsentence.

On Sat, Feb 26, 2011 at 6:24 AM, Andy Green <andy@warmcat.com> wrote:

> On 02/26/2011 12:12 AM, Somebody in the thread at some point said:
>
>  As an FYI, -06 was just posted. There was some discussion about wanting
>>
>
> I upgraded libwebsockets to support 06: the new close codes and putting
> them in CLOSE payload, stop requiring nonce and origin, that seemed to be
> all that was needed from 05.
>
> http://git.warmcat.com/cgi-bin/cgit/libwebsockets
>
> -Andy
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>



-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--0023545bd64452ca0d049d302df6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Section 1.4 ends midsentence.<br><br><div class=3D"gmail_quote">On Sat, Feb=
 26, 2011 at 6:24 AM, Andy Green <span dir=3D"ltr">&lt;<a href=3D"mailto:an=
dy@warmcat.com">andy@warmcat.com</a>&gt;</span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex;">
<div class=3D"im">On 02/26/2011 12:12 AM, Somebody in the thread at some po=
int said:<br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
As an FYI, -06 was just posted. There was some discussion about wanting<br>
</blockquote>
<br></div>
I upgraded libwebsockets to support 06: the new close codes and putting the=
m in CLOSE payload, stop requiring nonce and origin, that seemed to be all =
that was needed from 05.<br>
<br>
<a href=3D"http://git.warmcat.com/cgi-bin/cgit/libwebsockets" target=3D"_bl=
ank">http://git.warmcat.com/cgi-bin/cgit/libwebsockets</a><br>
<br>
-Andy<br>
_______________________________________________<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org" target=3D"_blank">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</blockquote></div><br><br clear=3D"all"><br>-- <br>You can find me on the =
net at:<div><a href=3D"http://antwerkz.com" target=3D"_blank">http://antwer=
kz.com</a><br><a href=3D"http://www.linkedin.com/in/justinlee" target=3D"_b=
lank">http://www.linkedin.com/in/justinlee</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--0023545bd64452ca0d049d302df6--

From trac@tools.ietf.org  Sat Feb 26 09:58:35 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 499353A67E1 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 09:58:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.553
X-Spam-Level: 
X-Spam-Status: No, score=-102.553 tagged_above=-999 required=5 tests=[AWL=0.047, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UAtCrCfY7GVu for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 09:58:33 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 9B5603A67D6 for <hybi@ietf.org>; Sat, 26 Feb 2011 09:58:33 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtOQJ-0008Sr-W0; Sat, 26 Feb 2011 09:59:19 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: gregw@webtide.com, ian@hixie.ch, ifette@google.com, salvatore.loreto@ericsson.com, sm+ietf@elandsys.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 17:59:19 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/4#comment:6
Message-ID: <077.ff1b9c437126851bdf3ad40f653a52d4@tools.ietf.org>
References: <068.da8db0c773647cb0ed73d576f39e93ee@tools.ietf.org>
X-Trac-Ticket-ID: 4
In-Reply-To: <068.da8db0c773647cb0ed73d576f39e93ee@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: gregw@webtide.com, ian@hixie.ch, ifette@google.com, salvatore.loreto@ericsson.com, sm+ietf@elandsys.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #4: handshake does not work properly with HTTP reverse proxy.
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 17:58:35 -0000

#4: handshake does not work properly with HTTP reverse proxy.

Changes (by salvatore.loreto@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 this has been solved in 05

-- 
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@â€¦             |        Owner:        
     Type:  defect                         |       Status:  closed
 Priority:  critical                       |    Milestone:        
Component:  thewebsocketprotocol           |      Version:        
 Severity:  Active WG Document             |   Resolution:  fixed 
 Keywords:                                 |  
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/4#comment:6>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Sat Feb 26 09:59:30 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 58DDF3A67C0 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 09:59:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.556
X-Spam-Level: 
X-Spam-Status: No, score=-102.556 tagged_above=-999 required=5 tests=[AWL=0.044, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 90yjGfjxORsE for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 09:59:29 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 80FA23A67A5 for <hybi@ietf.org>; Sat, 26 Feb 2011 09:59:29 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtORN-0004ce-5O; Sat, 26 Feb 2011 10:00:25 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 18:00:25 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/25#comment:1
Message-ID: <068.68e8fca08b764e896bd0aa5ab1f58362@tools.ietf.org>
References: <059.90514deccb7cdb7da502d526650befea@tools.ietf.org>
X-Trac-Ticket-ID: 25
In-Reply-To: <059.90514deccb7cdb7da502d526650befea@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #25: A WebSocket handshake strawman
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 17:59:30 -0000

#25: A WebSocket handshake strawman

Changes (by salvatore.loreto@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 this has been solved in 05

-- 
----------------------------------+-----------------------------------------
 Reporter:  sm+ietf@â€¦             |        Owner:        
     Type:  defect                |       Status:  closed
 Priority:  major                 |    Milestone:        
Component:  thewebsocketprotocol  |      Version:        
 Severity:  Active WG Document    |   Resolution:  fixed 
 Keywords:                        |  
----------------------------------+-----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/25#comment:1>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Sat Feb 26 10:00:41 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED4B33A67C0 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:00:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.558
X-Spam-Level: 
X-Spam-Status: No, score=-102.558 tagged_above=-999 required=5 tests=[AWL=0.042, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aX7TK5fB-C-Y for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:00:41 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 415943A67A5 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:00:41 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtOSU-0000ds-4I; Sat, 26 Feb 2011 10:01:34 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: jat@google.com, salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 18:01:34 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/28#comment:2
Message-ID: <068.9d37b8953df1aee0bdcb458b33910e88@tools.ietf.org>
References: <059.5b3c3b280c1320a26d9c11c25e067e06@tools.ietf.org>
X-Trac-Ticket-ID: 28
In-Reply-To: <059.5b3c3b280c1320a26d9c11c25e067e06@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: jat@google.com, salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #28: Fragmentation
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:00:42 -0000

#28: Fragmentation

Changes (by salvatore.loreto@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 clarified and solved in 06

-- 
----------------------------------+-----------------------------------------
 Reporter:  sm+ietf@â€¦             |        Owner:        
     Type:  defect                |       Status:  closed
 Priority:  major                 |    Milestone:        
Component:  thewebsocketprotocol  |      Version:        
 Severity:  -                     |   Resolution:  fixed 
 Keywords:                        |  
----------------------------------+-----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/28#comment:2>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Sat Feb 26 10:01:38 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD2173A67C0 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:01:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.56
X-Spam-Level: 
X-Spam-Status: No, score=-102.56 tagged_above=-999 required=5 tests=[AWL=0.040, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vuq2leFDlJew for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:01:38 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 1145B3A67D6 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:01:38 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtOTO-0000jE-SH; Sat, 26 Feb 2011 10:02:30 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: g_e_montenegro@yahoo.com, ifette@google.com, salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 18:02:30 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/35#comment:3
Message-ID: <072.6c8cd4db4f63016c5b00252dc49d3ed6@tools.ietf.org>
References: <063.1eec032ca0db73dba1b467c65224b70a@tools.ietf.org>
X-Trac-Ticket-ID: 35
In-Reply-To: <063.1eec032ca0db73dba1b467c65224b70a@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: g_e_montenegro@yahoo.com, ifette@google.com, salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #35: Clarify Ping/Pong processing
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:01:38 -0000

#35: Clarify Ping/Pong processing

Changes (by salvatore.loreto@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 this has been solved in 05

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |        Owner:        
     Type:  defect                    |       Status:  closed
 Priority:  major                     |    Milestone:        
Component:  thewebsocketprotocol      |      Version:        
 Severity:  -                         |   Resolution:  fixed 
 Keywords:                            |  
--------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/35#comment:3>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Sat Feb 26 10:02:50 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D83B83A67C0 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:02:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.562
X-Spam-Level: 
X-Spam-Status: No, score=-102.562 tagged_above=-999 required=5 tests=[AWL=0.038, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fApt3UW4UBXD for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:02:50 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 076833A67BD for <hybi@ietf.org>; Sat, 26 Feb 2011 10:02:50 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtOUY-00010D-0g; Sat, 26 Feb 2011 10:03:42 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: g_e_montenegro@yahoo.com, ifette@google.com, salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 18:03:41 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/37#comment:3
Message-ID: <072.fb5728a08f834dbcf6a2f74d8fbe68f9@tools.ietf.org>
References: <063.338ebd927dce058fbc3263bc72ce6885@tools.ietf.org>
X-Trac-Ticket-ID: 37
In-Reply-To: <063.338ebd927dce058fbc3263bc72ce6885@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: g_e_montenegro@yahoo.com, ifette@google.com, salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #37: header for negotiating extensions
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:02:50 -0000

#37: header for negotiating extensions

Changes (by salvatore.loreto@â€¦):

  * status:  new => closed
  * resolution:  => fixed


Comment:

 this has been solved in 05

-- 
--------------------------------------+-------------------------------------
 Reporter:  g_e_montenegro@â€¦          |        Owner:        
     Type:  defect                    |       Status:  closed
 Priority:  major                     |    Milestone:        
Component:  thewebsocketprotocol      |      Version:        
 Severity:  -                         |   Resolution:  fixed 
 Keywords:                            |  
--------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/37#comment:3>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Sat Feb 26 10:11:39 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D47C13A65A5 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:11:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.564
X-Spam-Level: 
X-Spam-Status: No, score=-102.564 tagged_above=-999 required=5 tests=[AWL=0.036, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R2Qoay2hiyTn for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:11:39 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 3AABC3A6781 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:11:39 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtOd8-0003bj-TD; Sat, 26 Feb 2011 10:12:34 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 18:12:34 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/43
Message-ID: <068.16430c4408eb99a9174fbb05df09311b@tools.ietf.org>
X-Trac-Ticket-ID: 43
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: [hybi]  #43: Section 1.4  ends with a mid sentence:
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:11:40 -0000

#43: Section 1.4  ends with a mid sentence:

 Justin Lee has rightly pointed that
 "Section 1.4. Closing handshake" ends with a mid sentence:

 "By sending a close frame and waiting for a close frame in response,"

-- 
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@â€¦             |       Owner:     
     Type:  defect                         |      Status:  new
 Priority:  trivial                        |   Milestone:     
Component:  thewebsocketprotocol           |     Version:     
 Severity:  Active WG Document             |    Keywords:     
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/43>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From trac@tools.ietf.org  Sat Feb 26 10:12:36 2011
Return-Path: <trac@tools.ietf.org>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 086113A6781 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:12:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.565
X-Spam-Level: 
X-Spam-Status: No, score=-102.565 tagged_above=-999 required=5 tests=[AWL=0.035, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QeQg1GBapeaE for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:12:35 -0800 (PST)
Received: from zinfandel.tools.ietf.org (unknown [IPv6:2001:1890:1112:1::2a]) by core3.amsl.com (Postfix) with ESMTP id 56B823A65A5 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:12:33 -0800 (PST)
Received: from localhost ([::1] helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.72) (envelope-from <trac@tools.ietf.org>) id 1PtOdy-0004DM-TU; Sat, 26 Feb 2011 10:13:26 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: "hybi issue tracker" <trac@tools.ietf.org>
X-Trac-Version: 0.11.7
Precedence: bulk
Auto-Submitted: auto-generated
X-Mailer: Trac 0.11.7, by Edgewall Software
To: ifette@google.com, salvatore.loreto@ericsson.com
X-Trac-Project: hybi
Date: Sat, 26 Feb 2011 18:13:26 -0000
X-URL: http://tools.ietf.org/hybi/
X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/hybi/trac/ticket/43#comment:1
Message-ID: <077.075d8280179d755142407e6f6da08b22@tools.ietf.org>
References: <068.16430c4408eb99a9174fbb05df09311b@tools.ietf.org>
X-Trac-Ticket-ID: 43
In-Reply-To: <068.16430c4408eb99a9174fbb05df09311b@tools.ietf.org>
X-SA-Exim-Connect-IP: ::1
X-SA-Exim-Rcpt-To: ifette@google.com, salvatore.loreto@ericsson.com, hybi@ietf.org
X-SA-Exim-Mail-From: trac@tools.ietf.org
X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false
Cc: hybi@ietf.org
Subject: Re: [hybi] #43: Section 1.4  ends with a mid sentence:
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:12:36 -0000

#43: Section 1.4  ends with a mid sentence:

Changes (by salvatore.loreto@â€¦):

  * owner:  => ifette@â€¦


-- 
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@â€¦             |       Owner:  ifette@â€¦         
     Type:  defect                         |      Status:  new              
 Priority:  trivial                        |   Milestone:                   
Component:  thewebsocketprotocol           |     Version:                   
 Severity:  Active WG Document             |    Keywords:                   
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/43#comment:1>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

From ifette@google.com  Sat Feb 26 10:16:45 2011
Return-Path: <ifette@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E0D323A67AE for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:16:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.489
X-Spam-Level: 
X-Spam-Status: No, score=-105.489 tagged_above=-999 required=5 tests=[AWL=0.188, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qouSsq2SdFPj for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:16:44 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 581843A6781 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:16:44 -0800 (PST)
Received: from kpbe17.cbf.corp.google.com (kpbe17.cbf.corp.google.com [172.25.105.81]) by smtp-out.google.com with ESMTP id p1QIHcPo008446 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:17:38 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298744259; bh=zLcc6Fum4+CzjSmf3U0Ne1CZimA=; h=MIME-Version:Reply-To:In-Reply-To:References:Date:Message-ID: Subject:From:To:Cc:Content-Type; b=Qnnq+gW7cpEWdBRSmbZ2RjkxhZFeB+8AsQMVpSVeXyvdAoTEHC/1gZcYtTMu9ki5v +2cBF+ZV8lB5cMtMq5rNg==
Received: from iwn36 (iwn36.prod.google.com [10.241.68.100]) by kpbe17.cbf.corp.google.com with ESMTP id p1QIHa1J020120 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Sat, 26 Feb 2011 10:17:37 -0800
Received: by iwn36 with SMTP id 36so3095827iwn.22 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:17:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:reply-to:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=ZpVm952b+j1BRCy9Vx5uk1R6l+09M92tQrB7qkDPVlE=; b=gYjvOZt43RwGx4voUn0ieCTCaVWGp460uXNhQt1V29kvyGqIJYE6DSfYXnSqCkCken dv8FQU6xEl0UvmlGn86w==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=nHqab4F6aFAwnkkI+2tiOW5F7VH3sHlrUaugYZRCZoDOxePsajV3tj7fJtkCBtDMY8 RFcLzMmV5faUQsP7Qjxg==
MIME-Version: 1.0
Received: by 10.42.222.74 with SMTP id if10mr2552264icb.243.1298744256348; Sat, 26 Feb 2011 10:17:36 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Sat, 26 Feb 2011 10:17:36 -0800 (PST)
Received: by 10.231.34.131 with HTTP; Sat, 26 Feb 2011 10:17:36 -0800 (PST)
In-Reply-To: <AANLkTi=L3Fi=0mAaS-ekG-NhsabxQ+6ZHjwuVu4EvXjw@mail.gmail.com>
References: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com> <4D68E306.9010704@warmcat.com> <AANLkTi=L3Fi=0mAaS-ekG-NhsabxQ+6ZHjwuVu4EvXjw@mail.gmail.com>
Date: Sat, 26 Feb 2011 10:17:36 -0800
Message-ID: <AANLkTimHNa1dr71JYkuLe6X33OqogHFLQ66UgDMXtA0f@mail.gmail.com>
From: =?UTF-8?B?SWFuIEZldHRlICjjgqTjgqLjg7Pjg5Xjgqfjg4Pjg4bjgqMp?= <ifette@google.com>
To: Justin Lee <jlee@antwerkz.com>
Content-Type: multipart/alternative; boundary=20cf30549b0f0dc1aa049d3376fa
X-System-Of-Record: true
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] -06 posted
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ifette@google.com
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:16:46 -0000

--20cf30549b0f0dc1aa049d3376fa
Content-Type: text/plain; charset=UTF-8

No one is perfect :-) thanks, will fix in -07
On Feb 26, 2011 6:22 AM, "Justin Lee" <jlee@antwerkz.com> wrote:
> Section 1.4 ends midsentence.
>
> On Sat, Feb 26, 2011 at 6:24 AM, Andy Green <andy@warmcat.com> wrote:
>
>> On 02/26/2011 12:12 AM, Somebody in the thread at some point said:
>>
>> As an FYI, -06 was just posted. There was some discussion about wanting
>>>
>>
>> I upgraded libwebsockets to support 06: the new close codes and putting
>> them in CLOSE payload, stop requiring nonce and origin, that seemed to be
>> all that was needed from 05.
>>
>> http://git.warmcat.com/cgi-bin/cgit/libwebsockets
>>
>> -Andy
>> _______________________________________________
>> hybi mailing list
>> hybi@ietf.org
>> https://www.ietf.org/mailman/listinfo/hybi
>>
>
>
>
> --
> You can find me on the net at:
> http://antwerkz.com
> http://www.linkedin.com/in/justinlee
> http://www.twitter.com/evanchooly

--20cf30549b0f0dc1aa049d3376fa
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p>No one is perfect :-) thanks, will fix in -07</p>
<div class=3D"gmail_quote">On Feb 26, 2011 6:22 AM, &quot;Justin Lee&quot; =
&lt;<a href=3D"mailto:jlee@antwerkz.com">jlee@antwerkz.com</a>&gt; wrote:<b=
r type=3D"attribution">&gt; Section 1.4 ends midsentence.<br>&gt; <br>&gt; =
On Sat, Feb 26, 2011 at 6:24 AM, Andy Green &lt;<a href=3D"mailto:andy@warm=
cat.com">andy@warmcat.com</a>&gt; wrote:<br>
&gt; <br>&gt;&gt; On 02/26/2011 12:12 AM, Somebody in the thread at some po=
int said:<br>&gt;&gt;<br>&gt;&gt;  As an FYI, -06 was just posted. There wa=
s some discussion about wanting<br>&gt;&gt;&gt;<br>&gt;&gt;<br>&gt;&gt; I u=
pgraded libwebsockets to support 06: the new close codes and putting<br>
&gt;&gt; them in CLOSE payload, stop requiring nonce and origin, that seeme=
d to be<br>&gt;&gt; all that was needed from 05.<br>&gt;&gt;<br>&gt;&gt; <a=
 href=3D"http://git.warmcat.com/cgi-bin/cgit/libwebsockets">http://git.warm=
cat.com/cgi-bin/cgit/libwebsockets</a><br>
&gt;&gt;<br>&gt;&gt; -Andy<br>&gt;&gt; ____________________________________=
___________<br>&gt;&gt; hybi mailing list<br>&gt;&gt; <a href=3D"mailto:hyb=
i@ietf.org">hybi@ietf.org</a><br>&gt;&gt; <a href=3D"https://www.ietf.org/m=
ailman/listinfo/hybi">https://www.ietf.org/mailman/listinfo/hybi</a><br>
&gt;&gt;<br>&gt; <br>&gt; <br>&gt; <br>&gt; -- <br>&gt; You can find me on =
the net at:<br>&gt; <a href=3D"http://antwerkz.com">http://antwerkz.com</a>=
<br>&gt; <a href=3D"http://www.linkedin.com/in/justinlee">http://www.linked=
in.com/in/justinlee</a><br>
&gt; <a href=3D"http://www.twitter.com/evanchooly">http://www.twitter.com/e=
vanchooly</a><br></div>

--20cf30549b0f0dc1aa049d3376fa--

From silvio.ventres@gmail.com  Sat Feb 26 10:55:43 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD60A3A67B0 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:55:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.34
X-Spam-Level: 
X-Spam-Status: No, score=-3.34 tagged_above=-999 required=5 tests=[AWL=0.259,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8yQ20qmJ+MU3 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 10:55:43 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id C959F3A6781 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:55:42 -0800 (PST)
Received: by vws6 with SMTP id 6so2472933vws.31 for <hybi@ietf.org>; Sat, 26 Feb 2011 10:56:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=5bKBoVMvQIU+KcGNJtUxuxbjq8A8yFjyJrOXC4mQl2Q=; b=rOIycBroXbI41AlqV7o1j0Swmo2niOQ4/R0Yulz0C9qBKhf1nPZ5UfWGbEwy6kltIh bPF/lao8K5+aLCrfaPN7DDdmaF7wren7AVr3HQLQuajvyFbUdR1sInR6wRl6uoOc0s2z LsBoFtEQRtdhSYMHfLMEYq+LDBjmMVWBMU7hY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=bjVAF/Ekn/EQIrEhyr6sj1QZFPrXhkhi9b2q4KpGFF38CZ/ImXU42uQsKmJuzo5AfB N/9Tu/lcSiLTb4Khhqvdr7a/YDZf8MrN2mVWLCKgCQ379g0hPk8B5L1AdiE5v6daJ1N7 1l6XfMogxTlwXZBmCOv5vrBbtkyCwfHlGp5lU=
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr6335301vdb.190.1298746598010; Sat, 26 Feb 2011 10:56:38 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Sat, 26 Feb 2011 10:56:37 -0800 (PST)
In-Reply-To: <20110226005407.GB28054@1wt.eu>
References: <AANLkTi=UenyXvGt4awT6_xGuK9jA_kSfcVR6p07yqY5h@mail.gmail.com> <20110225170214.GE23570@1wt.eu> <AANLkTikRWsxmuJ9TgCStGruY=qn=Xeu29mpEqvkvQonV@mail.gmail.com> <20110225172958.GI23570@1wt.eu> <AANLkTi=VkR2z7QYDBT2GaYWWt625H+zamS=zeRN22jtv@mail.gmail.com> <2745.1298670625.366666@puncture> <AANLkTinPETPxwEbnbk9H8fhejUcfnd_OUPwSEHJy+WHu@mail.gmail.com> <AANLkTi=fWWd8XV15kpe0=e-9NL06jEZLkASSvF4xnZ4J@mail.gmail.com> <AANLkTik8LGU+LHOjf11ofXLnUvM=A6KHAd4wvhWqrUB8@mail.gmail.com> <AANLkTinACJMJWAHOhc_uBY9e9tfwUNUdPiZUcx3feA6r@mail.gmail.com> <20110226005407.GB28054@1wt.eu>
Date: Sat, 26 Feb 2011 20:56:37 +0200
Message-ID: <AANLkTiniE54QHrEVtjnYa+jxSsif2cbHjOMb0rWKeWkb@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: "Salvatore.Loreto@ericsson.com" <Salvatore.Loreto@ericsson.com>, Server-Initiated HTTP <hybi@ietf.org>, "jhildebr@cisco.com" <jhildebr@cisco.com>
Subject: Re: [hybi] Computation part of handshake
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 18:55:43 -0000

>> Why would you want to burden both the client and a server with
>> computations that have no practical benefit?
>
> Why don't you propose an alternative that looks like something everybody
> can understand and discuss, with a minimum analysis of benefits vs risks
> compared to what it's supposed to replace ? I mean, something concrete,
> not just random ideas with and sentences all beginning with "Why".

Well, here's a proposition:
A static 32-bit number is added to the client's challenge (whether
called Sec-Websocket-Key or
Sec-Websocket-Challenge) and returned in the server response.
That is a much simpler operation than SHA-1, and provides exactly THE SAME
guarantees regarding unique mapping to a specific server challenge.

Hash randomizes the output, but it's not needed here.
Whether challenges (x) and (x+1) produce completely different
and unrelated outputs (y) and (z) or outputs or easily-related
(y) and (y+1) makes no difference from the protocol perspective.
The fact that the outputs are different and verifiable is all that matters.

If the output has same amount of bits as input, for each unique
challenge, the server will always provide a different response.

SHA-1 is an overkill. It slows down connection handshake and provides
not benefit as compared to a simple addition, or any other simple function.


--
 silvio

From silvio.ventres@gmail.com  Sat Feb 26 11:07:06 2011
Return-Path: <silvio.ventres@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCCEE3A67D9 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 11:07:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.843
X-Spam-Level: 
X-Spam-Status: No, score=-2.843 tagged_above=-999 required=5 tests=[AWL=-0.244, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wp9pzEfLD+Cp for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 11:07:06 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 7CB293A67B0 for <hybi@ietf.org>; Sat, 26 Feb 2011 11:07:05 -0800 (PST)
Received: by vxg33 with SMTP id 33so2408331vxg.31 for <hybi@ietf.org>; Sat, 26 Feb 2011 11:08:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=cTSqb89En+r9HV5JTLErgJ33Q1MpSRirGo2jyVK8I8k=; b=pkvIVhFiiJdVCbXsih7oUfUmocUWAEWc86YWwrvpn8joUvIO3hi2FttmZBCsRH1lzT QFGfCkijLkO4jQaslPf2VOW9JqcWWqdN+o0ERzbu9YZJnXJ2OEiIbjLJioj/Y/frLg75 O1WAFxK98erYyMkHu28b+KqpDU7EYeedF3bMU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=WNEQgd1qmtrwnCT5kLeZFxjeRSJkDKu+4igiFPddr/HBl2axYNAlPH+23fXL9L+WdO L+fX5gkjrF7P9mBEjjQtaflaBDOJxumn4/0JO8RxJbBx4QRqvDzjQpofPAdlxDjmgifB 06HE2xTlkYTgv6lfat1TVnwQ/XIIWsj2gJhKo=
MIME-Version: 1.0
Received: by 10.52.174.38 with SMTP id bp6mr2855796vdc.270.1298747280984; Sat, 26 Feb 2011 11:08:00 -0800 (PST)
Received: by 10.52.157.74 with HTTP; Sat, 26 Feb 2011 11:08:00 -0800 (PST)
Date: Sat, 26 Feb 2011 21:08:00 +0200
Message-ID: <AANLkTikzTJnHm_qTeqEtNkk+K=nDgfg3FWErnZ=gn-UD@mail.gmail.com>
From: Silvio Ventres <silvio.ventres@gmail.com>
To: =?ISO-2022-JP?B?SWFuIEZldHRlICgbJEIlJCUiJXMlVSUnJUMlRiUjGyhCKQ==?= <ifette@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org, Bjoern Hoehrmann <derhoermi@gmx.net>
Subject: [hybi] Masking debug capability proposition (WAS: Masking for WS data content)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 19:07:07 -0000

After doing a small benchmark done in C on a 1GHz Athlon X2,
it seems that if most of the WS-using packets will include less than 20 bytes
of content, the additional overhead of processing "fake-POST" header has
approximately the same impact on packet processing performance as the
XOR masking.
Given that fake-POST headers also add considerable bandwidth overhead,
approximately doubling the bandwidth requirements at sub-20byte data
content length,
it's not a viable solution.

Still, XOR masking prevents developers to easily debug their applications.

PROPOSITION:

Is it possible to include a section specifically allowing WS applications to set
some kind of "debug" flag to set XOR mask to 0?

Maybe the flag should automatically add some kind of user-visible
warning, so developers
don't leave it in production code.

--
 silvio

From ietf@adambarth.com  Sat Feb 26 12:35:08 2011
Return-Path: <ietf@adambarth.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 31ECE3A6847 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 12:35:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.844
X-Spam-Level: 
X-Spam-Status: No, score=-2.844 tagged_above=-999 required=5 tests=[AWL=0.133,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w1Y0We28N+xL for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 12:35:06 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id D80EB3A683B for <hybi@ietf.org>; Sat, 26 Feb 2011 12:35:05 -0800 (PST)
Received: by iwl42 with SMTP id 42so2276833iwl.31 for <hybi@ietf.org>; Sat, 26 Feb 2011 12:36:01 -0800 (PST)
Received: by 10.231.39.199 with SMTP id h7mr3969538ibe.157.1298752561521; Sat, 26 Feb 2011 12:36:01 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by mx.google.com with ESMTPS id d10sm2379416ibb.12.2011.02.26.12.35.59 (version=SSLv3 cipher=OTHER); Sat, 26 Feb 2011 12:35:59 -0800 (PST)
Received: by iyj8 with SMTP id 8so2060259iyj.31 for <hybi@ietf.org>; Sat, 26 Feb 2011 12:35:59 -0800 (PST)
Received: by 10.231.10.141 with SMTP id p13mr3996493ibp.131.1298752559100; Sat, 26 Feb 2011 12:35:59 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.40.7 with HTTP; Sat, 26 Feb 2011 12:35:29 -0800 (PST)
In-Reply-To: <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>
From: Adam Barth <ietf@adambarth.com>
Date: Sat, 26 Feb 2011 12:35:29 -0800
Message-ID: <AANLkTi=40ybHM6WENfQTf9g-QhK2i6g8cwp8ohNirN4Q@mail.gmail.com>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 20:35:08 -0000

I don't believe that is a wise course of action, for the reasons we've
discussed ad nauseum.

Adam


On Fri, Feb 25, 2011 at 3:02 AM, Greg Wilkins <gregw@intalio.com> wrote:
> So is there any support for changing away from masked framed to masked pa=
yloads?
> or should I just accept that we will be building masking into framing
> for all time?
>
> cheers
>
>
> On 1 February 2011 08:47, Greg Wilkins <gregw@intalio.com> wrote:
>> I think we still have a fundamental divide in opinions between masked fr=
aming:
>>
>> =A0 [ key1][masked frame1] [key2][masked frame 2] ..... [keyN][masked fr=
ame N]
>>
>> vs mask in frame:
>>
>> =A0 [ key1, masked payload 1 ] =A0[ key2, masked payload 2] =A0... =A0[k=
eyN,
>> masked payload N]
>>
>>
>> I'd like to eventually call for a straw poll on this, but would first
>> like to have a thread dedicated to the pros and cons of each.
>>
>>
>>
>> IMNSHO:
>>
>>
>> Masked Frames PROS:
>> =A0+ all bytes other than the key are masked. =A0This prevents an attack=
er
>> from using frame fields like the length to send "clear text"
>>
>> Masked Frame CONS:
>> =A0- Masking is not independent of framing - poor layered protocol desig=
n.
>> =A0- all WS handling that needs to be aware of frame boundaries will
>> need to implement masking. =A0This will mean that more infrastructure
>> will have masking hard coded into it, thus it will soon become very
>> difficult, if not impossible to change framing as it will be baked
>> into WS aware intermediaries.
>> =A0- Intermediaries that do not care about content will still need to
>> unmask and remask the frames.
>> =A0- the parser/generator code for WS becomes more complex and
>> asymmetric because it must implement masking for some WS streams but
>> not for others.
>> =A0- unmasking cannot be done as single optimised pass over the data,
>> but must be done on-the-fly in the parsing code.
>> =A0- the options for masking algorithms is limited. =A0For example sessi=
on
>> based keys could not be used in a MUX environment as the session key
>> would need to be known to access the extension data to know the stream
>> ID, so the session ID could be known so you can't know the session
>> key. =A0 While session based masking may not be desirable for other
>> reasons, this limitation indicates a fundamental limitation of the
>> masked frame approach.
>>
>>
>>
>> Mask in Frame PROS:
>> =A0+ Masking is independent of framing. =A0 Good layered protocol design=
.
>> =A0+ Intermediaries that do not process the payload will not need to
>> implement masking. This saves CPU, memory and also will make it easier
>> to change and/or remove masking in future.
>> =A0+ WS parsing code is simple and symmetric.
>> =A0+ session based masking algorithms can be used if desired
>> =A0+ Can utilise the extension data space to carry the key - thus
>> testing the implementation of the parsing of extension data length and
>> preventing implementations assuming this will be zero.
>>
>> Mask in Frame CONS:
>> =A0- The frame op-code, flags and length are sent in the clear. =A0Of
>> these, an attacker has reasonable control over the length field, so
>> could conceivably send 8 characters including "GET\n" as the length
>> (although this would be very difficult to do via the current
>> javascript API. =A0There are also simple heuristic defences for this,
>> such as fragmenting any frame that has a length that is all ascii and
>> has a CR)
>>
>>
>>
>> In summary, =A0 mask in frame is far more flexible, low cost and
>> demonstrable better design, at cost of exposing a very very unlikely
>> subcase of an already very very unlikely vulnerability to an as of yet
>> undiscovered threat, of which an exploitable variation is already in
>> the wild using non ws clients.
>>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>

From bruce@callenish.com  Sat Feb 26 12:50:47 2011
Return-Path: <bruce@callenish.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 457653A6817 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 12:50:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qOZNZjG07jcf for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 12:50:45 -0800 (PST)
Received: from biz82.inmotionhosting.com (biz82.inmotionhosting.com [74.124.202.87]) by core3.amsl.com (Postfix) with ESMTP id C7A1D3A6816 for <hybi@ietf.org>; Sat, 26 Feb 2011 12:50:45 -0800 (PST)
Received: from [24.108.133.142] (helo=[192.168.145.101]) by biz82.inmotionhosting.com with esmtpa (Exim 4.69) (envelope-from <bruce@callenish.com>) id 1PtR6r-0007oe-D1 for hybi@ietf.org; Sat, 26 Feb 2011 12:51:25 -0800
Message-ID: <4D6967DA.8020000@callenish.com>
Date: Sat, 26 Feb 2011 12:51:38 -0800
From: Bruce Atherton <bruce@callenish.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: Hybi <hybi@ietf.org>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <4D68633A.1070902@callenish.com> <AANLkTikKZKhp2j7OPr4-V5MZ6QEvQyz2QSqjmmu_DHfW@mail.gmail.com>
In-Reply-To: <AANLkTikKZKhp2j7OPr4-V5MZ6QEvQyz2QSqjmmu_DHfW@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - biz82.inmotionhosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - callenish.com
Subject: Re: [hybi] Indicator in frame whether it is masked (was Masked framing VS mask in frame)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 20:50:47 -0000

On 25/02/2011 7:22 PM, John Tamplin wrote:
>
> I agree it is unfortunate that the framing is no longer symmetric

It isn't the asymmetry, it is the fact that there are multiple frame 
types and no way to tell how to parse some of them without additional 
contextual information. Assuming Greg's proposal is successful, a frame 
is one of the following:

[Frame Header][7-bit Length][Payload]
[Frame Header][126][16-bit Length][Payload]
[Frame Header][127][64 bit Length][Payload]
[Frame Header][7-bit Length][Frame Mask][Payload]
[Frame Header][126][16-bit Length][Frame Mask][Payload]
[Frame Header][127][64 bit Length][Frame Mask][Payload]

(or perhaps the frame mask goes before the length field(s))

Of these variations, the only portion of the frame that can't be 
determined for parsing from the bytes that go before is the presence or 
absence of the frame mask. This strikes me as an unnecessary restriction.

> now that we have added client->server masking, but I don't think there 
> is sufficient value to justify using one of a very few reserved bits 
> to distinguish them.  There are a number of cases which already 
> require a protocol decoder to maintain state about which side of the 
> communication is involved:
>  - the initial handshake is asymmetric, so you have to know when side 
> initiated the connection to interpret it

The issue isn't interpretation. When you are debugging, you supply the 
interpretation. The issue is parsing, and the HTTP portion of the 
handshake can be parsed easily even though the two ends are asymmetric 
in what they send.

>  - if compression is being used, there are separate compression states 
> for each direction

True, which is why people will often turn off compression when 
debugging. Turning off the masking is not an option by design, though. 
The browser vendors would never allow it.

>  - fragmentation requires maintaining state about each side of the 
> connection separately

Not in terms of parsing, it doesn't. It might for parsing the payload, 
of course. Or it might not. People designing the subprotocols will have 
to decide for themselves how debuggable they want their streams to be. 
But Websockets design itself shouldn't rule it out from the start.

>
> There are also other protocols which have asymmetric framing, 
> including HTTP (though you can get at least the basic structure of the 
> message), and it doesn't seem to have imposed much burden in that case.

Again, this is missing the point. Imagine if an HTTP request was ASCII, 
and the response was EBCDIC and there was no way to tell the difference. 
Interpreting the ASCII as EBCDIC or vice versa appeared to be correct 
HTTP but with vastly different interpretations. Then you would have an 
analogous situation.

>
> I wouldn't object to a final protocol including it if many others 
> wanted it, but personally I feel it would be a horrible waste.

And that's the question, isn't it?  I think it only makes sense to have 
information in the frame that allows someone to parse the frame 
correctly given a variety of formats. If you are going to use one of the 
reserved bits for anything, it should be for that. I'm not sure there is 
any other use I can think of that would be more important. But if I'm 
the only one who thinks so, the idea dies here. So what do others think 
about this?


From jat@google.com  Sat Feb 26 13:09:49 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD1E53A6840 for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 13:09:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.902
X-Spam-Level: 
X-Spam-Status: No, score=-105.902 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QTRvVoa0y9Yj for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 13:09:48 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 9C25B3A683B for <hybi@ietf.org>; Sat, 26 Feb 2011 13:09:48 -0800 (PST)
Received: from wpaz24.hot.corp.google.com (wpaz24.hot.corp.google.com [172.24.198.88]) by smtp-out.google.com with ESMTP id p1QLAhai018586 for <hybi@ietf.org>; Sat, 26 Feb 2011 13:10:43 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298754643; bh=tul4rNZbiKfdm8VsXihPjdg3Vqw=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=TC622mH761FPgutqi9DWkqJPoSi0rJ/5MBOfJk+HR/pN+Sliu1hxJ+2LpfbMaDepZ UsSwNDL1M62OvzFRnfEQA==
Received: from gyd5 (gyd5.prod.google.com [10.243.49.197]) by wpaz24.hot.corp.google.com with ESMTP id p1QLAgIk028717 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for <hybi@ietf.org>; Sat, 26 Feb 2011 13:10:42 -0800
Received: by gyd5 with SMTP id 5so1407258gyd.11 for <hybi@ietf.org>; Sat, 26 Feb 2011 13:10:42 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=LBLU/pxricStVViEg8mPJaMTt5WyflM/mV8IYuDnREE=; b=W1ffqRVkUHJyiF2SgdoPl9hxNTRO2R2JaulGxoaW7/KhDRJXLRw4ke+ZkaRYak4Shi 0tPb3b+i/2A8+/CP1cqQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=b/Nr0sBndC4Ta0TN/ogUB6ZOAXGOsdz2NcEAyUrQSqz+a6K/+Kb3agoAbSfDkZzSBS Zx4zEZN2Jgp/mY0yPr+A==
Received: by 10.151.14.8 with SMTP id r8mr5301458ybi.331.1298754642102; Sat, 26 Feb 2011 13:10:42 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Sat, 26 Feb 2011 13:10:22 -0800 (PST)
In-Reply-To: <4D6967DA.8020000@callenish.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <4D68633A.1070902@callenish.com> <AANLkTikKZKhp2j7OPr4-V5MZ6QEvQyz2QSqjmmu_DHfW@mail.gmail.com> <4D6967DA.8020000@callenish.com>
From: John Tamplin <jat@google.com>
Date: Sat, 26 Feb 2011 16:10:22 -0500
Message-ID: <AANLkTimL0EvHdm_XQ7CFyohJ+RrM9OtOCH1cALbmst4V@mail.gmail.com>
To: Bruce Atherton <bruce@callenish.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Indicator in frame whether it is masked (was Masked framing VS mask in frame)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Feb 2011 21:09:49 -0000

On Sat, Feb 26, 2011 at 3:51 PM, Bruce Atherton <bruce@callenish.com> wrote=
:
> It isn't the asymmetry, it is the fact that there are multiple frame type=
s
> and no way to tell how to parse some of them without additional contextua=
l
> information. Assuming Greg's proposal is successful, a frame is one of th=
e
> following:
>
> [Frame Header][7-bit Length][Payload]
> [Frame Header][126][16-bit Length][Payload]
> [Frame Header][127][64 bit Length][Payload]
> [Frame Header][7-bit Length][Frame Mask][Payload]
> [Frame Header][126][16-bit Length][Frame Mask][Payload]
> [Frame Header][127][64 bit Length][Frame Mask][Payload]
>
> (or perhaps the frame mask goes before the length field(s))
>
> Of these variations, the only portion of the frame that can't be determin=
ed
> for parsing from the bytes that go before is the presence or absence of t=
he
> frame mask. This strikes me as an unnecessary restriction.

The fact that you know you are at the start of a frame header implies
you know about the "bytes that go before" all the way back to the
start of the connection, which will include the state about which side
of the connection you are processing.

>> =C2=A0- the initial handshake is asymmetric, so you have to know when si=
de
>> initiated the connection to interpret it
>
> The issue isn't interpretation. When you are debugging, you supply the
> interpretation. The issue is parsing, and the HTTP portion of the handsha=
ke
> can be parsed easily even though the two ends are asymmetric in what they
> send.

If we aren't talking about debugging where you might conceivable start
observing the communication after it starts, then I really don't see
the issue. =C2=A0To interpret the stream properly, you are already going to
have to know whether you are processing the client or server side, and
then it is easy enough to only look for the mask (and apply it) if you
are processing the client side.

>> There are also other protocols which have asymmetric framing, including
>> HTTP (though you can get at least the basic structure of the message), a=
nd
>> it doesn't seem to have imposed much burden in that case.
>
> Again, this is missing the point. Imagine if an HTTP request was ASCII, a=
nd
> the response was EBCDIC and there was no way to tell the difference.
> Interpreting the ASCII as EBCDIC or vice versa appeared to be correct HTT=
P
> but with vastly different interpretations. Then you would have an analogo=
us
> situation.

It seems similar to me -- is the first line of an HTTP message a
method/URI or not? =C2=A0It happens in this case you can guess because you
can't have spaces in headers before the colon, but I don't think
anybody writes parsers that way -- instead, they will either read the
request line outside of the code that parses the rest of the header,
or they will pass in a flag saying whether this is the client or
server side.

This seems very analogous to masking -- if the mask is before the
frame, external code will read it and pass in the mask (and for the
server case just pass in 0 unless they are trying to avoid unnecessary
XORs), or will pass in a flag into the frame parsing routine that says
it is client or server. =C2=A0Even with the mask inside the frame, I would
expect it to be written the same way -- pass in a flag that says
whether the mask is expected or not.

I guess to summarize what I am saying, the client->server and
server->client are two different framings, and you already have to
know which one you are dealing with.  Sure, they are mostly the same,
which means that with a little bit of effort you can use the same code
to process them, but fundamentally there is no requirement that they
be related at all.

--=20
John A. Tamplin
Software Engineer (GWT), Google

From bruce@callenish.com  Sat Feb 26 16:57:59 2011
Return-Path: <bruce@callenish.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 62B1F3A695E for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 16:57:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level: 
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t9xNdTT-U8OZ for <hybi@core3.amsl.com>; Sat, 26 Feb 2011 16:57:58 -0800 (PST)
Received: from biz82.inmotionhosting.com (biz82.inmotionhosting.com [74.124.202.87]) by core3.amsl.com (Postfix) with ESMTP id 481713A68BC for <hybi@ietf.org>; Sat, 26 Feb 2011 16:57:58 -0800 (PST)
Received: from [24.108.133.142] (helo=[192.168.145.101]) by biz82.inmotionhosting.com with esmtpa (Exim 4.69) (envelope-from <bruce@callenish.com>) id 1PtUy5-0000K2-Aw; Sat, 26 Feb 2011 16:58:37 -0800
Message-ID: <4D69A1CB.4020909@callenish.com>
Date: Sat, 26 Feb 2011 16:58:51 -0800
From: Bruce Atherton <bruce@callenish.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <4D68633A.1070902@callenish.com> <AANLkTikKZKhp2j7OPr4-V5MZ6QEvQyz2QSqjmmu_DHfW@mail.gmail.com> <4D6967DA.8020000@callenish.com> <AANLkTimL0EvHdm_XQ7CFyohJ+RrM9OtOCH1cALbmst4V@mail.gmail.com>
In-Reply-To: <AANLkTimL0EvHdm_XQ7CFyohJ+RrM9OtOCH1cALbmst4V@mail.gmail.com>
Content-Type: multipart/alternative; boundary="------------010808020208090002030809"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - biz82.inmotionhosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - callenish.com
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Indicator in frame whether it is masked (was Masked framing VS mask in frame)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Feb 2011 00:57:59 -0000

This is a multi-part message in MIME format.
--------------010808020208090002030809
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 26/02/2011 1:10 PM, John Tamplin wrote:
> On Sat, Feb 26, 2011 at 3:51 PM, Bruce Atherton<bruce@callenish.com>  wrote:
>> It isn't the asymmetry, it is the fact that there are multiple frame types
>> and no way to tell how to parse some of them without additional contextual
>> information. Assuming Greg's proposal is successful, a frame is one of the
>> following:
>>
>> [Frame Header][7-bit Length][Payload]
>> [Frame Header][126][16-bit Length][Payload]
>> [Frame Header][127][64 bit Length][Payload]
>> [Frame Header][7-bit Length][Frame Mask][Payload]
>> [Frame Header][126][16-bit Length][Frame Mask][Payload]
>> [Frame Header][127][64 bit Length][Frame Mask][Payload]
>>
>> (or perhaps the frame mask goes before the length field(s))
>>
>> Of these variations, the only portion of the frame that can't be determined
>> for parsing from the bytes that go before is the presence or absence of the
>> frame mask. This strikes me as an unnecessary restriction.
> The fact that you know you are at the start of a frame header implies
> you know about the "bytes that go before" all the way back to the
> start of the connection, which will include the state about which side
> of the connection you are processing.

Oh, it isn't that bad. Frame headers always start at packet boundaries, 
after all. You may have to test a few packets before finding a frame 
header, and it becomes problematic to find one with big frames, but 
generally I would expect you could try decoding just a few packets and 
see which ones came out with data that looked sensible. The trouble is 
that the number of manual tests is doubled per packet when you have to 
test both for mask keys and without.

>
> If we aren't talking about debugging where you might conceivable start
> observing the communication after it starts, then I really don't see
> the issue.

Since I *am* talking about that, perhaps the issue is clearer.

>
> It seems similar to me -- is the first line of an HTTP message a
> method/URI or not?  It happens in this case you can guess because you
> can't have spaces in headers before the colon, but I don't think
> anybody writes parsers that way -- instead, they will either read the
> request line outside of the code that parses the rest of the header,
> or they will pass in a flag saying whether this is the client or
> server side.

I'm not talking about a parser inside a client or server. Sure, they 
know what role they are going to play. I'm talking about one inside a 
tool like Wireshark that deciphers the state of all the fields in a 
Websocket packet. Perhaps tokenizer is a closer approximation to what 
I'm describing. Something that takes a bit stream and describes clusters 
of bits as fields in a Websocket frame or as ASCII/UTF-8 characters, 
possibly after applying a demasking if a frame mask is present.


--------------010808020208090002030809
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    On 26/02/2011 1:10 PM, John Tamplin wrote:
    <blockquote
      cite="mid:AANLkTimL0EvHdm_XQ7CFyohJ+RrM9OtOCH1cALbmst4V@mail.gmail.com"
      type="cite">
      <pre wrap="">On Sat, Feb 26, 2011 at 3:51 PM, Bruce Atherton <a class="moz-txt-link-rfc2396E" href="mailto:bruce@callenish.com">&lt;bruce@callenish.com&gt;</a> wrote:
</pre>
      <blockquote type="cite">
        <pre wrap="">It isn't the asymmetry, it is the fact that there are multiple frame types
and no way to tell how to parse some of them without additional contextual
information. Assuming Greg's proposal is successful, a frame is one of the
following:

[Frame Header][7-bit Length][Payload]
[Frame Header][126][16-bit Length][Payload]
[Frame Header][127][64 bit Length][Payload]
[Frame Header][7-bit Length][Frame Mask][Payload]
[Frame Header][126][16-bit Length][Frame Mask][Payload]
[Frame Header][127][64 bit Length][Frame Mask][Payload]

(or perhaps the frame mask goes before the length field(s))

Of these variations, the only portion of the frame that can't be determined
for parsing from the bytes that go before is the presence or absence of the
frame mask. This strikes me as an unnecessary restriction.
</pre>
      </blockquote>
      <pre wrap="">
The fact that you know you are at the start of a frame header implies
you know about the "bytes that go before" all the way back to the
start of the connection, which will include the state about which side
of the connection you are processing.
</pre>
    </blockquote>
    <br>
    Oh, it isn't that bad. Frame headers always start at packet
    boundaries, after all. You may have to test a few packets before
    finding a frame header, and it becomes problematic to find one with
    big frames, but generally I would expect you could try decoding just
    a few packets and see which ones came out with data that looked
    sensible. The trouble is that the number of manual tests is doubled
    per packet when you have to test both for mask keys and without.<br>
    <br>
    <blockquote
      cite="mid:AANLkTimL0EvHdm_XQ7CFyohJ+RrM9OtOCH1cALbmst4V@mail.gmail.com"
      type="cite"><br>
      <pre wrap="">If we aren't talking about debugging where you might conceivable start
observing the communication after it starts, then I really don't see
the issue.</pre>
    </blockquote>
    <br>
    Since I <b>am</b> talking about that, perhaps the issue is clearer.<br>
    <br>
    <blockquote
      cite="mid:AANLkTimL0EvHdm_XQ7CFyohJ+RrM9OtOCH1cALbmst4V@mail.gmail.com"
      type="cite"><br>
      <pre wrap="">It seems similar to me -- is the first line of an HTTP message a
method/URI or not? Â It happens in this case you can guess because you
can't have spaces in headers before the colon, but I don't think
anybody writes parsers that way -- instead, they will either read the
request line outside of the code that parses the rest of the header,
or they will pass in a flag saying whether this is the client or
server side.
</pre>
    </blockquote>
    <br>
    I'm not talking about a parser inside a client or server. Sure, they
    know what role they are going to play. I'm talking about one inside
    a tool like Wireshark that deciphers the state of all the fields in
    a Websocket packet. Perhaps tokenizer is a closer approximation to
    what I'm describing. Something that takes a bit stream and describes
    clusters of bits as fields in a Websocket frame or as ASCII/UTF-8
    characters, possibly after applying a demasking if a frame mask is
    present.<br>
    <br>
  </body>
</html>

--------------010808020208090002030809--

From gregw@intalio.com  Sun Feb 27 14:28:45 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6C3EA3A6835 for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 14:28:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.477
X-Spam-Level: 
X-Spam-Status: No, score=-2.477 tagged_above=-999 required=5 tests=[AWL=-0.500, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JiTX1xcu7g5d for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 14:28:44 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id A0DAC3A6832 for <hybi@ietf.org>; Sun, 27 Feb 2011 14:28:44 -0800 (PST)
Received: by vxg33 with SMTP id 33so2944986vxg.31 for <hybi@ietf.org>; Sun, 27 Feb 2011 14:29:42 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.91.230 with SMTP id ch6mr1044477vdb.270.1298845782496; Sun, 27 Feb 2011 14:29:42 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Sun, 27 Feb 2011 14:29:42 -0800 (PST)
In-Reply-To: <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>
Date: Mon, 28 Feb 2011 09:29:42 +1100
Message-ID: <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Feb 2011 22:28:45 -0000

On 26 February 2011 01:41, John Tamplin <jat@google.com> wrote:
> On Fri, Feb 25, 2011 at 6:02 AM, Greg Wilkins <gregw@intalio.com> wrote:
>>
>> So is there any support for changing away from masked framed to masked p=
ayloads?
>> or should I just accept that we will be building masking into framing
>> for all time?
>
> I am willing to support it, but I think there are a few complications
> that need to be addressed:
> =A0- you point out attacker control over the length - we would need to
> codify exactly what would
> =A0 be done about it

My thoughts regarding the length field issue is that we have to decide
simply between  the risk of some kind of cross protocol attack being
carried out in the 4 bytes of the length field vs the CONs listed
about masked frames.

If we seriously think that there is any kind of conceivable  attack
that can be carried out in 4 bytes (and that browsers are able to
generate frames of the required size), then we should stick with
masked frames and accept the cons.



> =A0- I would not support use of any reserved bits to indicate the mask
> is in the extension data
> =A0 portion of the frame - instead, it should simply be defined to be
> the first 4 bytes if masking is
> =A0 present (ie, client->server frames)

See a separate thread I'm about to start about extension data.


> =A0- it will complicate how mux and other extensions are defined, but I
> think we can deal with that
> =A0 when we define those extensions

I actually think it simplifies them... but mileage may vary.

cheers

From gregw@intalio.com  Sun Feb 27 14:38:30 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 189B33A6958 for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 14:38:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.227
X-Spam-Level: 
X-Spam-Status: No, score=-2.227 tagged_above=-999 required=5 tests=[AWL=-0.250, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 56pNOIKumK9f for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 14:38:29 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 3B72C3A6835 for <hybi@ietf.org>; Sun, 27 Feb 2011 14:38:29 -0800 (PST)
Received: by vxg33 with SMTP id 33so2948712vxg.31 for <hybi@ietf.org>; Sun, 27 Feb 2011 14:39:27 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr7913978vdb.150.1298846367774; Sun, 27 Feb 2011 14:39:27 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Sun, 27 Feb 2011 14:39:27 -0800 (PST)
In-Reply-To: <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>
Date: Mon, 28 Feb 2011 09:39:27 +1100
Message-ID: <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Feb 2011 22:38:30 -0000

On 28 February 2011 09:29, Greg Wilkins <gregw@intalio.com> wrote:
>> =A0- I would not support use of any reserved bits to indicate the mask
>> is in the extension data
>> =A0 portion of the frame - instead, it should simply be defined to be
>> the first 4 bytes if masking is
>> =A0 present (ie, client->server frames)
>
> See a separate thread I'm about to start about extension data.

Cancel that - I don't think I will open another thread about extension data=
.

I remain concerned that the framing does not have a way to indicate
the length of the extension data, nor to partition it between
extension.
Essentially this means that there is really no extension data in the
framing and that the only way to extend a frame is to prepend the
extended data to the payload itself - so tools and intermediaries will
not be able to distinguish between extended data and real payload.   I
fear there will be issues because of this, but I don't think I can
provide the clear examples needed to win a debate on this.

Thus keeping the current "extension" data will have to do and Johns
example of how masking could be done is an exemplar of how it would
have to be used.   Both endpoints would need to negotiate the
activation of an extension (or in the case of masking, the lack of
negotiation can be seen to turn on the default masking extension).
The endpoints would then just know that the first 4 bytes of the
payload are the mask to be applied to the remaining payload.


regards

From jat@google.com  Sun Feb 27 15:06:15 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D12B83A695C for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 15:06:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.905
X-Spam-Level: 
X-Spam-Status: No, score=-105.905 tagged_above=-999 required=5 tests=[AWL=0.071, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S8M2hxDSpKzZ for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 15:06:14 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id BD04B3A6958 for <hybi@ietf.org>; Sun, 27 Feb 2011 15:06:13 -0800 (PST)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p1RN7BJ0007221 for <hybi@ietf.org>; Sun, 27 Feb 2011 15:07:11 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298848031; bh=C24chf4XjOl5w2PQDAWlN0go59I=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Eu8bZf6tj9MQG0A/QX2bETHSnrZ7dnpefGwSibU7IQ4to+OJ3kQSiX1h+m5N7/UK8 9dWkqm5/IlRmuGTOabtGw==
Received: from yie12 (yie12.prod.google.com [10.243.66.12]) by wpaz37.hot.corp.google.com with ESMTP id p1RN7Asq032675 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Sun, 27 Feb 2011 15:07:10 -0800
Received: by yie12 with SMTP id 12so530146yie.13 for <hybi@ietf.org>; Sun, 27 Feb 2011 15:07:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=CYzXIrVmMaD+8iRgPVDXerT9u5t9+Lpm06LotNw3I/8=; b=kXPKOKUrHP1zf92gY/DdTHGnuVU0Sm/x69wHikMNq7xjdYivuiqDvg6s2HF0sm2Z5e 2PSX7Bf4TaPuGYSg9+xw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=vBZesK8d4Z4j3PInGw2mzRspMnYc+xkp+hLlW7jLnc1MGwBi91gDA6rzlzdVQgzKrZ f/R54+B7zQCsaROKsnDg==
Received: by 10.150.195.3 with SMTP id s3mr6386827ybf.274.1298848030240; Sun, 27 Feb 2011 15:07:10 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Sun, 27 Feb 2011 15:06:49 -0800 (PST)
In-Reply-To: <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Sun, 27 Feb 2011 18:06:49 -0500
Message-ID: <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: multipart/alternative; boundary=000e0cd4847075b119049d4b9f8e
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Feb 2011 23:06:16 -0000

--000e0cd4847075b119049d4b9f8e
Content-Type: text/plain; charset=UTF-8

On Sun, Feb 27, 2011 at 5:39 PM, Greg Wilkins <gregw@intalio.com> wrote:

> I remain concerned that the framing does not have a way to indicate
> the length of the extension data, nor to partition it between
> extension.
> Essentially this means that there is really no extension data in the
> framing and that the only way to extend a frame is to prepend the
> extended data to the payload itself - so tools and intermediaries will
> not be able to distinguish between extended data and real payload.   I
> fear there will be issues because of this, but I don't think I can
> provide the clear examples needed to win a debate on this.
>

The point is if an extension is negotiated, that extension determines how to
know which, if any, bytes at the beginning of the payload are extension data
vs application data.  Some extensions might include length information,
while others might have fixed fields that don't need anything.

Yes, that means that intermediaries that don't understand the negotiated
extensions cannot do anything with the payload of the frame, and that is
documented in the current spec.

This was the compromise that got us agreement on the framing, since
otherwise there seemed to be divergent opinions on how the extension data
should be used.  Basically, we just postponed it until each extension, or we
may come along later and define a standard way for groups of extensions to
identify their data -- ie, "the Foo extension uses the standard tag/value
encoding of extension data, with tags 14-18 as defined below" etc.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd4847075b119049d4b9f8e
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Sun, Feb 27, 2011 at 5:39 PM, Greg Wilkins <s=
pan dir=3D"ltr">&lt;<a href=3D"mailto:gregw@intalio.com">gregw@intalio.com<=
/a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:=
0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">I remain concerned that the framing does not have a way t=
o indicate</div>
the length of the extension data, nor to partition it between<br>
extension.<br>
Essentially this means that there is really no extension data in the<br>
framing and that the only way to extend a frame is to prepend the<br>
extended data to the payload itself - so tools and intermediaries will<br>
not be able to distinguish between extended data and real payload. =C2=A0 I=
<br>
fear there will be issues because of this, but I don&#39;t think I can<br>
provide the clear examples needed to win a debate on this.<br></blockquote>=
<div><br></div><div>The point is if an extension is negotiated, that extens=
ion determines how to know which, if any, bytes at the beginning of the pay=
load are extension data vs application data. =C2=A0Some extensions might in=
clude length information, while others might have fixed fields that don&#39=
;t need anything.</div>

<div><br></div><div>Yes, that means that intermediaries that don&#39;t unde=
rstand the negotiated extensions cannot do anything with the payload of the=
 frame, and that is documented in the current spec.</div><div>=C2=A0</div><=
div>

This was the compromise that got us agreement on the framing, since otherwi=
se there seemed to be divergent opinions on how the extension data should b=
e used. =C2=A0Basically, we just postponed it until each extension, or we m=
ay come along later and define a standard way for groups of extensions to i=
dentify their data -- ie, &quot;the Foo extension uses the standard tag/val=
ue encoding of extension data, with tags 14-18 as defined below&quot; etc.<=
/div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd4847075b119049d4b9f8e--

From andy.warmcat.com@googlemail.com  Sun Feb 27 23:19:58 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 351FE3A68F2 for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 23:19:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.587
X-Spam-Level: 
X-Spam-Status: No, score=-3.587 tagged_above=-999 required=5 tests=[AWL=0.012,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vrcswKrNver6 for <hybi@core3.amsl.com>; Sun, 27 Feb 2011 23:19:57 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id B9F263A6ABC for <hybi@ietf.org>; Sun, 27 Feb 2011 23:19:56 -0800 (PST)
Received: by wyb42 with SMTP id 42so3654689wyb.31 for <hybi@ietf.org>; Sun, 27 Feb 2011 23:20:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=fgu7N2VfbqMnIwUbFTtRKMzwOMc+IB4R3rUDImwhERA=; b=wLNpX9tJVFBPf9F6TfRzQD3P0SzNyh2WHMZKa7eBpEmyANRufDAjnKLkBaLRnOIti7 A84gpMZWB7/66ryRws95hhHbe2incP6MdVU9/QTCW6x7rA8fEe+Se97+Yo760vLj8TLY H5g8pSdgFAI3Yp442Nfg09QVMc1LIHOvVTpCY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=AZhhbxtAY76FXE+ZhzKbqLQQf2IQrjreJ9S0U9koabhHiGLkMEz5WfFTTtz++2rPmY 3o5iqHfpWUgivTt7XdFhcJZ0KspvAdfG2mUNeJwdrBvATgp5VYIcNPSoDjXycnuXLH37 KX3ayeDltEq1s76kM6SXeRdMOaePgk6c+y+BM=
Received: by 10.227.54.4 with SMTP id o4mr4584823wbg.210.1298877655609; Sun, 27 Feb 2011 23:20:55 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id y29sm3064779wbd.4.2011.02.27.23.20.53 (version=SSLv3 cipher=OTHER); Sun, 27 Feb 2011 23:20:53 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6B4CD2.2020808@warmcat.com>
Date: Mon, 28 Feb 2011 07:20:50 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Greg Wilkins <gregw@intalio.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>	<AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>	<AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>
In-Reply-To: <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 07:19:58 -0000

On 02/27/2011 10:29 PM, Somebody in the thread at some point said:

>>   - you point out attacker control over the length - we would need to
>> codify exactly what would
>>    be done about it
>
> My thoughts regarding the length field issue is that we have to decide
> simply between  the risk of some kind of cross protocol attack being
> carried out in the 4 bytes of the length field vs the CONs listed
> about masked frames.
>
> If we seriously think that there is any kind of conceivable  attack
> that can be carried out in 4 bytes (and that browsers are able to
> generate frames of the required size), then we should stick with
> masked frames and accept the cons.

Actually those are good points, although there would be 8 length bytes 
in clear in the protocol, in order to issue a frame with the length you 
chose from Javascript, since you can only send existing Javascript 
objects you're going to actually have to allocate a Javascript object of 
the size you wanted.

If you wanted even a four byte length sequence on the wire, with the 
first byte as 'G', it means you had to allocate over a Javascript object 
over 1GBytes.  Setting the byte before that with b6 set for uppercase 
alphabet is > 256GByte allocation which is unreasonable for a few years.

Whatever else you did like navigate away from the script to abort the 
payload send, it would be prepended by header and unused length bytes like

  04 7F 00 00 00 00 XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP...

Where XX is the length, MM is the frame mask, EE is the extension data, 
PP is payload.

Personally I think an HTTP parser surviving the preamble is too broken 
to care about, but I see other people don't agree.

To think about controllability of extension data, which would allow 
carrying on the data in the length bytes, leads to your other point 
about if structure of extension data is really OK as it stands, when it 
is implicit from the connection handshake, so if you missed the 
handshake you can't understand where the payload starts and for example, 
all muxed channels on the connection must carry all negotiated 
extensions like compression.

-Andy

From gregw@intalio.com  Mon Feb 28 00:19:55 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 675DF3A69AD for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 00:19:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.644
X-Spam-Level: 
X-Spam-Status: No, score=-2.644 tagged_above=-999 required=5 tests=[AWL=0.333,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tMW8havLf-jZ for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 00:19:54 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 76EDC3A695F for <hybi@ietf.org>; Mon, 28 Feb 2011 00:19:54 -0800 (PST)
Received: by vws6 with SMTP id 6so3289546vws.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 00:20:53 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr8514350vdb.150.1298881253600; Mon, 28 Feb 2011 00:20:53 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 00:20:53 -0800 (PST)
In-Reply-To: <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com>
Date: Mon, 28 Feb 2011 19:20:53 +1100
Message-ID: <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 08:19:55 -0000

On 28 February 2011 10:06, John Tamplin <jat@google.com> wrote:
> This was the compromise that got us agreement on the framing, since
> otherwise there seemed to be divergent opinions on how the extension data
> should be used.

Well yes that true and why I don't really want to open the discussion
on this point again.

In fact, if I was to argue anything... I'd argue the other way and say
that we should remove extension data from the framing as it is not
really a part of  the framing in any meaningful way that would allow
any code to do anything with.  Nor is there any way we could actually
police that it is used in the way we intend.  If nobody but the
extension knows the boundary between the real payload and the
extension payload, then the extension can put the data anywhere it
likes and nobody would be the wiser.

Instead of extension data, we could instead talk about how extensions
may mutate and/or extend the payload of a frame.   For example may
even be more efficient for an extension in an intermediary to append
rather than prepend data.

regards

From gregw@intalio.com  Mon Feb 28 01:51:28 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F3D663A6B0F for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 01:51:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.566
X-Spam-Level: 
X-Spam-Status: No, score=-2.566 tagged_above=-999 required=5 tests=[AWL=0.411,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPlTVL7yoZ2b for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 01:51:27 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id D237D3A6B0E for <hybi@ietf.org>; Mon, 28 Feb 2011 01:51:26 -0800 (PST)
Received: by vws6 with SMTP id 6so3343838vws.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 01:52:26 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.91.230 with SMTP id ch6mr1787003vdb.270.1298886745612; Mon, 28 Feb 2011 01:52:25 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 01:52:25 -0800 (PST)
In-Reply-To: <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com>
References: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com> <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com>
Date: Mon, 28 Feb 2011 20:52:25 +1100
X-Google-Sender-Auth: R19sv1lo88dmaYMHJwME7MhZ5Z4
Message-ID: <AANLkTik5i3Nh6OfyU=uso8tb2LzqKiJFRd_k+hpCyyWt@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Yutaka_Takeda@playstation.sony.com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 09:51:28 -0000

I'm +1 for compression within the frame.

If we compress the framing, then intermediaries will have to
decompress in order to see framing and to know when to forward etc.
It also has significant debug issues as it makes it much harder to
decode a partial frame capture.

I understand the argument that compression will not be as good, but I
think some compromise is necessary.

To look at the analogy of HTTP, compression does not change HTTP
framing and intermediaries do not need to be updated to deal with any
new compression algorithms that may be deployed.

regards



On 25 February 2011 16:19,  <Yutaka_Takeda@playstation.sony.com> wrote:
>
> Hi,
>
> If we could apply deflate-stream only to payload, that would solve
> the problem. I was looking for reasons why entire stream has to be
> compressed, and found only one here:
>
> http://www.ietf.org/mail-archive/web/hybi/current/msg04117.html
>
> From layering aspects, I would prefer any compression taking place
> on top of framing layer from the other way around:
>
> =A0 =A0+-------------+
> =A0 =A0| compression |
> =A0 =A0+-------------+
> =A0 =A0+-------------+
> =A0 =A0| WS framing =A0|
> =A0 =A0+-------------+
> =A0 =A0+-------------+
> =A0 =A0| =A0 =A0 TCP =A0 =A0 |
> =A0 =A0+-------------+
>
> where, current draft -05 sugggests:
>
> =A0 =A0+-------------+
> =A0 =A0| WS framing =A0|
> =A0 =A0+-------------+
> =A0 =A0+-------------+
> =A0 =A0| compression |
> =A0 =A0+-------------+
> =A0 =A0+-------------+
> =A0 =A0| =A0 =A0 TCP =A0 =A0 |
> =A0 =A0+-------------+
>
> Justifications for the former layering would be:
>
> o =A0Framing is necessary because of the underlying transport
> =A0 =A0layer is in fact 'streaming', or TCP. (TCP and WS-framing
> =A0 =A0are more tightly coupled)
> o =A0WS-layer needs to buffer entire message (passed by app/JS)
> =A0 =A0anyway.
> o =A0Text and binary do not interleave fragments, hence there
> =A0 =A0needs only one context for compression / decompression in
> =A0 =A0memory.
> o =A0Overhead (frame headers and control frames) are much smaller
> =A0 =A0than payload of text/binary frames and negligible as to
> =A0 =A0compression ratio.
> o =A0Close frame appears at the end of stream with no traling
> =A0 =A0bytes. (Can remove requirement for TCP graceful shutdown).
>
> Please let me know if I am missing something...
>
> Best.
> - Yutaka
>
>
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>
>

From jat@google.com  Mon Feb 28 06:31:26 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 62C153A69CC for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 06:31:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.909
X-Spam-Level: 
X-Spam-Status: No, score=-105.909 tagged_above=-999 required=5 tests=[AWL=0.068, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IssA8QGT+9Jz for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 06:31:25 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 4CB543A6940 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:31:25 -0800 (PST)
Received: from kpbe15.cbf.corp.google.com (kpbe15.cbf.corp.google.com [172.25.105.79]) by smtp-out.google.com with ESMTP id p1SEWPJE010795 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:32:25 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298903545; bh=Jr8MqP14z38S/SzmeJQH9Ed0suY=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=NdYFAfZ+bPpojuKN4SjrXjLTTcc9Cu1UgO9sTGdfWpudrVdN7dx5YfNvkh8YXEC6L 3M+woXlVOkS9DrhSdBBpQ==
Received: from gxk3 (gxk3.prod.google.com [10.202.11.3]) by kpbe15.cbf.corp.google.com with ESMTP id p1SEWN1e004880 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 06:32:24 -0800
Received: by gxk3 with SMTP id 3so1527225gxk.26 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:32:23 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=/BLawHMjWnJvOo3vuaQl6PSMLTbdW6Y1QPVlPixTkXA=; b=SKT8vdvDZNyjXHgTW7WHVh9daqUP6xLHjKfAsdTrAXSnAVLRmHOjzs622qtSc4afUu nio7lZFjxne9kejLamfw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=DXeSt9K3925F2qQDkU99n/NBSfVtPHEk0cGqEAyYX5yZ4koxB3BJeK2Ry8alKHSrk9 NEQCiM4tD2X7kdwnDDjg==
Received: by 10.150.198.11 with SMTP id v11mr7214573ybf.388.1298903543417; Mon, 28 Feb 2011 06:32:23 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 06:32:03 -0800 (PST)
In-Reply-To: <AANLkTik5i3Nh6OfyU=uso8tb2LzqKiJFRd_k+hpCyyWt@mail.gmail.com>
References: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com> <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com> <AANLkTik5i3Nh6OfyU=uso8tb2LzqKiJFRd_k+hpCyyWt@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 09:32:03 -0500
Message-ID: <AANLkTinTqHtG+HmjBm4n2yS3Ouz+Fw3i_R_Gf7qx0vn1@mail.gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: hybi@ietf.org, Yutaka_Takeda@playstation.sony.com
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 14:31:26 -0000

[BTW - here is the thread where I first posted results of an
experiment -=C2=A0http://www.ietf.org/mail-archive/web/hybi/current/msg0181=
0.html
]

On Mon, Feb 28, 2011 at 4:52 AM, Greg Wilkins <gregw@webtide.com> wrote:
> I'm +1 for compression within the frame.
>
> If we compress the framing, then intermediaries will have to
> decompress in order to see framing and to know when to forward etc.
> It also has significant debug issues as it makes it much harder to
> decode a partial frame capture.
>
> I understand the argument that compression will not be as good, but I
> think some compromise is necessary.

The framing is pretty small and it is hard to imagine much redundancy
from the header (the opcode and reserved bits will be constant, but
then you will interfere with the compression by all the constantly
changing lengths), so I think little is lost by compressing only the
payload.

However, it does mean the implementation is more complicated, and I
don't believe this would be feasible using the stock inflate/deflate
in Java for example. =C2=A0I would not agree to just compressing each
frame's payload independently -- my earlier experiments show this will
frequently increase the size of the data and result in only modest
savings compared to maintaining compression state over the life of the
connection (while we are discussing it, we should talk about the
parameters to use for deflate to minimize memory requirements on the
server -- experiments done for compression in SPDY [mentioned in the
linked thread] show you can get most of the benefit with more modest
memory requirements using lower parameters).

It also means we have to agree on the details of how it should be
specified, which is why the super-simple deflate-stream was added to
the standard instead of trying to get agreement on something better.

--
John A. Tamplin
Software Engineer (GWT), Google

From jat@google.com  Mon Feb 28 06:42:21 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 490CF3A69F8 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 06:42:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.663
X-Spam-Level: 
X-Spam-Status: No, score=-105.663 tagged_above=-999 required=5 tests=[AWL=0.314, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9REyLZSROZcq for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 06:42:20 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 390B73A6940 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:42:19 -0800 (PST)
Received: from hpaq12.eem.corp.google.com (hpaq12.eem.corp.google.com [172.25.149.12]) by smtp-out.google.com with ESMTP id p1SEhJW5004692 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:43:19 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298904199; bh=fZgZxfl8xUi3mbDOWw0nO2o48/c=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=ZD2h66t6VuCTzDkNi5T9o7LmeKycunpRqLgREPyiWNKKi9SFmeSFpqx6x8rsCYygh LIxarYN7wstzw7FvzNZCQ==
Received: from gxk21 (gxk21.prod.google.com [10.202.11.21]) by hpaq12.eem.corp.google.com with ESMTP id p1SEhHf1019518 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 06:43:18 -0800
Received: by gxk21 with SMTP id 21so2714892gxk.22 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:43:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=qune/bHh3BvII8KT2Bwqs0PYKh8a2TKZsNXwwOe/dv4=; b=yMx7f0s8oKEwd9L+SSm2BMCL+ftDKgy6cMSuaaVq3/u8noQtzWHwOYq2QC2lU5GgGi ng0Wt/O0nKWUNxiPsAkA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=rrDViBJsez2Fk+0OLOItZdNQcuyGF83HIhPA9+bJlaN7H8wlq9nIxoEFh0Z184P1Kw OvUSM8GAUTe6cu5Nh8Bw==
Received: by 10.150.140.6 with SMTP id n6mr7219717ybd.160.1298904197106; Mon, 28 Feb 2011 06:43:17 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 06:42:56 -0800 (PST)
In-Reply-To: <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 09:42:56 -0500
Message-ID: <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 14:42:21 -0000

On Mon, Feb 28, 2011 at 3:20 AM, Greg Wilkins <gregw@intalio.com> wrote:
> In fact, if I was to argue anything... I'd argue the other way and say
> that we should remove extension data from the framing as it is not
> really a part of =C2=A0the framing in any meaningful way that would allow
> any code to do anything with. =C2=A0Nor is there any way we could actuall=
y
> police that it is used in the way we intend. =C2=A0If nobody but the
> extension knows the boundary between the real payload and the
> extension payload, then the extension can put the data anywhere it
> likes and nobody would be the wiser.
>
> Instead of extension data, we could instead talk about how extensions
> may mutate and/or extend the payload of a frame. =C2=A0 For example may
> even be more efficient for an extension in an intermediary to append
> rather than prepend data.

I think that makes it harder to reason about exactly what happens when
there are multiple extensions - about the only way I could think of is
that each extension is modeled as a function taking the current
payload and mutating it arbitrarily, with the extensions applied in
the order they are listed in the handshake.  However, even that
complicates things -- what about an extension that combines multiple
frames, such as an aggregating MUX?  Trying to define a regular way to
apply arbitrary extensions that may cross message boundaries seems
hard without it excessively hard to describe simpler extensions.

--=20
John A. Tamplin
Software Engineer (GWT), Google

From tyoshino@google.com  Mon Feb 28 06:50:42 2011
Return-Path: <tyoshino@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5307B3A6C21 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 06:50:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.704
X-Spam-Level: 
X-Spam-Status: No, score=-105.704 tagged_above=-999 required=5 tests=[AWL=0.272, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cTr5siFAUhh3 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 06:50:40 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id BC0813A6C1F for <hybi@ietf.org>; Mon, 28 Feb 2011 06:50:39 -0800 (PST)
Received: from wpaz13.hot.corp.google.com (wpaz13.hot.corp.google.com [172.24.198.77]) by smtp-out.google.com with ESMTP id p1SEpeWx018891 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:51:40 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298904700; bh=N0LUNzkWEzNvKuQeerWWPajJKCc=; h=MIME-Version:From:Date:Message-ID:Subject:To:Content-Type; b=yGHD63c2/+n03seDLY/KaYaDfRdic0vBBE3wLNHs9Az45ntxCCcLqQWXCmJhtqocu agmwhqfsqInTzJF7kAnXQ==
Received: from iyb26 (iyb26.prod.google.com [10.241.49.90]) by wpaz13.hot.corp.google.com with ESMTP id p1SEpcgM003664 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 06:51:39 -0800
Received: by iyb26 with SMTP id 26so3489873iyb.34 for <hybi@ietf.org>; Mon, 28 Feb 2011 06:51:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:from:date:message-id:subject:to :content-type; bh=VUcgCC8jG3rpN6KeXfimR3Aw+2HCXfqQCByDAzkMsHM=; b=eQkHP608Bmojk4Dh7vh/oe8HxfcM6+RJErRA1b2ebrA4MGuPuhHWIst78ZEDakc7Jd tnbYsgGTPIOdRL/nwvag==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:from:date:message-id:subject:to:content-type; b=JNEXzOlf+zJIBlGoth3I9Z4187r0dOPBbF4WSWd9ghOhrl7onWpoL8xXd52jZg0o/Z Leqvbaft9KJ2hH80ftGw==
Received: by 10.231.185.30 with SMTP id cm30mr2217360ibb.59.1298904698233; Mon, 28 Feb 2011 06:51:38 -0800 (PST)
MIME-Version: 1.0
Received: by 10.231.17.201 with HTTP; Mon, 28 Feb 2011 06:51:18 -0800 (PST)
From: Takeshi Yoshino <tyoshino@google.com>
Date: Mon, 28 Feb 2011 23:51:18 +0900
Message-ID: <AANLkTik2LqCC2-ZLLdWNNaQ18ypcQU_5djJobkYtYk6T@mail.gmail.com>
To: hybi@ietf.org
Content-Type: multipart/alternative; boundary=00504501740022a474049d58d125
X-System-Of-Record: true
Subject: [hybi] Payload only compression extension, again
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 14:50:42 -0000

--00504501740022a474049d58d125
Content-Type: text/plain; charset=ISO-8859-1

Hi,

Seeing several people preferring payload only compression, I'd like to
resume discussion on it.

Here's requirements and my strawman proposal based on Patrick's proposals
and recent discussion.

I've removed compression indication that might be implemented by some
reserved bits or opcode for now. Please use this as starting point and
propose any extension to add necessary features. Different from the time
deflate-stream was defined, now extension negotiation is well defined in the
spec.

----

Requirements
- Each message must be able to be uncompressed immediately
-- Use Z_SYNC_FLUSH or Z_FINISH at the end of application data
- Want to maintain the compression state (LZ77 sliding window) between
frames
-- Use Z_SYNC_FLUSH
- 4 octet overhead of Z_SYNC_FLUSH is too big
-- Use the same scheme as RFC 1979 PPP Deflate to eliminate it
- Want not to mess up dictionary by compressing incompressible messages
-- Use BTYPE=0b00 block for such messages

Requests I gave up to address in the strawman below for simplicity
- Want to maintain the compression state (LZ77 sliding window and Huffman
table)
- Want to keep separate dictionaries for messages with different
characteristics
-- Case 1: Binary and text mixed
-- Case 2: Short and long mixed
-- Case 3: Application data in data frame and control frame may have
different characteristics
--- Apply DEFLATE only to data frame (Is it worth including control frame?)
- Want to turn off compression for messages that becomes bigger when
compressed e.g. 1-octet message

----

Proposal

Compression

The registered extension token for this compression extension
is "deflate-application-data".

The extension does not have any per message extension data and it does not
define the use of any WebSocket reserved bits or opcodes.

Senders using this extension MUST apply RFC 1951 DEFLATE to all the bytes of
the application data portion of data frames. Senders MAY include multiple
blocks in a frame. Senders MAY use blocks of any type as defined in RFC
1951. Senders MUST use the algorithm described in Section 2.1 of RFC1979 to
align compressed data to byte boundary. Senders MAY keep using the same LZ77
sliding window for multiple frames.

Receivers MUST append 0x00 0x00 0xff 0xff to the application data portion
and decompress it using DEFLATE to decode the original application data.
Receivers MUST keep using the same LZ77 sliding window for all the frames of
the same WebSocket connection. Receivers MUST assume the senders use 32768
byte LZ77 sliding window.

--00504501740022a474049d58d125
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Hi,</div><div><br></div><div>Seeing several people preferring payload =
only compression, I&#39;d like to resume discussion on it.</div><div><br></=
div><div>Here&#39;s requirements and my strawman proposal based on Patrick&=
#39;s proposals and recent discussion.</div>

<div><br></div><div>I&#39;ve removed compression indication that might be i=
mplemented by some reserved bits or opcode for now. Please use this as star=
ting point and propose any extension to add necessary features. Different f=
rom the time deflate-stream was defined, now extension negotiation is well =
defined in the spec.</div>

<div><br></div><div>----</div><div><br></div><div>Requirements</div><div>- =
Each message must be able to be uncompressed=A0immediately</div><div>-- Use=
 Z_SYNC_FLUSH or Z_FINISH at the end of application data</div><div>- Want t=
o maintain the compression state (LZ77 sliding window) between frames</div>

<div>-- Use Z_SYNC_FLUSH</div><div>- 4 octet overhead of Z_SYNC_FLUSH is to=
o big</div><div><div>-- Use the same scheme as RFC 1979 PPP Deflate to elim=
inate it</div></div><div>- Want not to mess up dictionary by compressing in=
compressible messages</div>

<div>-- Use BTYPE=3D0b00 block for such messages</div><div><br></div><div><=
div>Requests I gave up to address in the strawman below for simplicity</div=
><div>- Want to maintain the compression state (LZ77 sliding window and Huf=
fman table)</div>

<div><div>- Want to keep separate dictionaries for messages with different =
characteristics</div></div><div><div><div><div><div><div><div><div><div>-- =
Case 1: Binary and text mixed</div><div>-- Case 2: Short and long mixed</di=
v>

<div><div><div><div><div></div></div></div></div></div><div>-- Case 3: Appl=
ication data in data frame and control frame may have different characteris=
tics</div></div><div>--- Apply DEFLATE only to data frame (Is it worth incl=
uding control frame?)</div>

</div></div></div></div></div></div></div></div><div><div>- Want to turn of=
f compression for messages that becomes bigger when compressed e.g. 1-octet=
 message</div></div><div><br></div><div><div>----</div><div><br></div>
<div>
Proposal</div><div><br></div><div>Compression</div><div><br></div><div>The =
registered extension token for this compression extension is=A0&quot;deflat=
e-application-data&quot;.</div><div><br></div><div>The extension does not h=
ave any per message extension data and it=A0does not define the use of any =
WebSocket reserved bits or opcodes.</div>

<div><br></div><div>Senders using this extension MUST apply RFC 1951 DEFLAT=
E to all=A0the bytes of the application data portion of data frames.=A0Send=
ers MAY include multiple blocks in a frame. Senders MAY use blocks of any t=
ype as defined in RFC 1951.=A0Senders MUST use the algorithm described in=
=A0Section 2.1 of=A0RFC1979 to align compressed data to byte boundary. Send=
ers MAY keep using the same LZ77 sliding window for multiple frames.</div>

<div><br></div><div>Receivers MUST append 0x00 0x00 0xff 0xff to the applic=
ation data portion and decompress it using DEFLATE to=A0decode the original=
 application data. Receivers MUST keep using the same LZ77 sliding window f=
or all the frames of the same WebSocket connection.=A0Receivers MUST assume=
 the senders use 32768 byte LZ77 sliding window.</div>

</div><div><br></div>

--00504501740022a474049d58d125--

From gregw@intalio.com  Mon Feb 28 12:19:23 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E2FE53A6C76 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 12:19:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.227
X-Spam-Level: 
X-Spam-Status: No, score=-2.227 tagged_above=-999 required=5 tests=[AWL=-0.250, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Id61OrLIwEsG for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 12:19:23 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 05A9C3A6C6C for <hybi@ietf.org>; Mon, 28 Feb 2011 12:19:22 -0800 (PST)
Received: by vxg33 with SMTP id 33so3891106vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 12:20:24 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.97.130 with SMTP id ea2mr2912570vdb.230.1298924392559; Mon, 28 Feb 2011 12:19:52 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 12:19:52 -0800 (PST)
In-Reply-To: <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com>
Date: Tue, 1 Mar 2011 07:19:52 +1100
Message-ID: <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 20:19:24 -0000

On 1 March 2011 01:42, John Tamplin <jat@google.com> wrote:
> On Mon, Feb 28, 2011 at 3:20 AM, Greg Wilkins <gregw@intalio.com> wrote:
>> In fact, if I was to argue anything... I'd argue the other way and say
>> that we should remove extension data from the framing as it is not
>> really a part of =A0the framing in any meaningful way that would allow
>> any code to do anything with. =A0Nor is there any way we could actually
>> police that it is used in the way we intend. =A0If nobody but the
>> extension knows the boundary between the real payload and the
>> extension payload, then the extension can put the data anywhere it
>> likes and nobody would be the wiser.
>>
>> Instead of extension data, we could instead talk about how extensions
>> may mutate and/or extend the payload of a frame. =A0 For example may
>> even be more efficient for an extension in an intermediary to append
>> rather than prepend data.
>
> I think that makes it harder to reason about exactly what happens when
> there are multiple extensions - about the only way I could think of is
> that each extension is modeled as a function taking the current
> payload and mutating it arbitrarily, with the extensions applied in
> the order they are listed in the handshake.

I think we are in agreement here?   I don't think there is an extension dat=
a
field, but an extension is a function of payload producing payload.

> However, even that
> complicates things -- what about an extension that combines multiple
> frames, such as an aggregating MUX?

That's not that complex:

    extFn(payload0) produced no payload
    extFn(payload1) produced the aggregate payload


> Trying to define a regular way to
> apply arbitrary extensions that may cross message boundaries seems
> hard without it excessively hard to describe simpler extensions.

I actually don't think the protocol document needs to describe this
extension mechanism.
It only needs to describe a way that the extensions are negotiated and
ordered and then
say that extensions are allowed to mutate and extend payload.

cheers

From gregw@intalio.com  Mon Feb 28 12:26:23 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B68593A6C6C for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 12:26:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level: 
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[AWL=-0.123,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g6m37w-HTSxa for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 12:26:22 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 774063A67D9 for <hybi@ietf.org>; Mon, 28 Feb 2011 12:26:22 -0800 (PST)
Received: by vxg33 with SMTP id 33so3898389vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 12:27:23 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.173.78 with SMTP id bi14mr4343231vdc.30.1298924842645; Mon, 28 Feb 2011 12:27:22 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 12:27:22 -0800 (PST)
In-Reply-To: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com>
References: <AANLkTinesK0k7H2kiGKA9wrTkNb03ns4SV=ihQXY3nhK@mail.gmail.com>
Date: Tue, 1 Mar 2011 07:27:22 +1100
X-Google-Sender-Auth: mnnrhUM1TInSSq80jWMXT0D1Q14
Message-ID: <AANLkTi=qYuOMBOQCNrKPqTdhu4X5ymF-GptTFGifUz4U@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: hybi@ietf.org
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit
Subject: Re: [hybi] -06 posted
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 20:26:23 -0000

2011/2/26 Ian Fette ($B%$%"%s%U%'%C%F%#(B) <ifette@google.com>:
> As an FYI, -06 was just posted.

I've updated the jetty implementation to support -76,-00,-01  and -06

It is in svn trunk r2831
http://dev.eclipse.org/svnroot/rt/org.eclipse.jetty/jetty/trunk


cheers

From gregw@intalio.com  Mon Feb 28 12:41:31 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2FDFB3A67D6 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 12:41:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.591
X-Spam-Level: 
X-Spam-Status: No, score=-2.591 tagged_above=-999 required=5 tests=[AWL=0.386,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CR2lh+c4abhK for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 12:41:30 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 525BE3A67C1 for <hybi@ietf.org>; Mon, 28 Feb 2011 12:41:30 -0800 (PST)
Received: by vws6 with SMTP id 6so3976485vws.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 12:42:31 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.160.8 with SMTP id xg8mr9354642vdb.310.1298925640101; Mon, 28 Feb 2011 12:40:40 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 12:40:40 -0800 (PST)
In-Reply-To: <AANLkTinTqHtG+HmjBm4n2yS3Ouz+Fw3i_R_Gf7qx0vn1@mail.gmail.com>
References: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com> <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com> <AANLkTik5i3Nh6OfyU=uso8tb2LzqKiJFRd_k+hpCyyWt@mail.gmail.com> <AANLkTinTqHtG+HmjBm4n2yS3Ouz+Fw3i_R_Gf7qx0vn1@mail.gmail.com>
Date: Tue, 1 Mar 2011 07:40:40 +1100
X-Google-Sender-Auth: 6uhYdlxSzEq4mCNABO9_X7wAU3s
Message-ID: <AANLkTinjMJamX4wGFqcN8yPq+NeXOvnzL+gO3DATF_rr@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: hybi@ietf.org, Yutaka_Takeda@playstation.sony.com
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 20:41:31 -0000

On 1 March 2011 01:32, John Tamplin <jat@google.com> wrote:
> It also means we have to agree on the details of how it should be
> specified, which is why the super-simple deflate-stream was added to
> the standard instead of trying to get agreement on something better.

Well I remember the proposal for deflate stream being made, but I
certainly don't recall any consensus that it should be put into the
draft.  There have been consistent voices against compressing the
framing.

I really think this is an important point of principal, if any
arbitrary extension is free to entirely change what is sent on the
wire, then we are going to have a very difficult environment in which
to develop any kind of meaningful intermediaries.    I keep coming
back to the analogy of HTTP, where it is not legal to just add a
header to define an extension and then change HTTP framing entirely.
The only way to break out of HTTP framing is with something like
Upgrade or CONNECT.

If the first exemplar of an extension we have is something that
completely changes what is sent over the wire, then I think we have
totally devalued WS framing as a standard.

regards

From gregw@intalio.com  Mon Feb 28 13:24:38 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A99963A6C32 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 13:24:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.677
X-Spam-Level: 
X-Spam-Status: No, score=-2.677 tagged_above=-999 required=5 tests=[AWL=0.300,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KFV6iFUlBtEG for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 13:24:37 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id BCC3D3A6A25 for <hybi@ietf.org>; Mon, 28 Feb 2011 13:24:37 -0800 (PST)
Received: by vws6 with SMTP id 6so4022688vws.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 13:25:38 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.97.130 with SMTP id ea2mr3042733vdb.230.1298928328501; Mon, 28 Feb 2011 13:25:28 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 13:25:28 -0800 (PST)
Date: Tue, 1 Mar 2011 08:25:28 +1100
Message-ID: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Hybi <hybi@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 21:24:38 -0000

Now the handshake is mostly settled, can we put Hello frames back on
the agenda to discuss. As has been discussed before, Hello frames can
be motivated for reasons other than the handshake or protecting from
attacks.

Specifically hello frames (or even just a mandatory ping/pong) can act
as a rapid test of the established WS channel, so we'd have a
conversation that looks like:

  --- client HTTP handshake -->
  <--- server HTTP handshake ---
  <--- server Hello (or ping) ---
  --- client Hello (or pong) -->

I'm happy with ping/pong if we are not going to have any meaningful
content to the packets.   However, if we want some meaningful content
that is different for client and server then either we need Hello
frames or we need to allow pongs to have different content to pings.

The content I would like to see in a hello is a description of the
timeouts and buffer sizes supported by the client/server.  One of the
big problems with Comet over HTTP is that we don't know what the
network times are, so we don't know what frequency we need to send
long polls.  The equivalent of this in websockets is how frequently
does a ping/pong need to be sent to avoid an idle close.   I
understand that a fair bit of work is needed to know who will send the
ping/pongs etc, but I think the first step in any plan will be
disclosure of timeouts.   Hello frames would look to be a good way
disclose this information.

cheers

From theturtle32@gmail.com  Mon Feb 28 13:35:17 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0BD333A6CAF for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 13:35:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kSr+4fGiqd0V for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 13:35:16 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id 0B7CA3A67D9 for <hybi@ietf.org>; Mon, 28 Feb 2011 13:35:15 -0800 (PST)
Received: by iwl42 with SMTP id 42so3935993iwl.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 13:36:17 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=/cfPc+lU7CN2dVeaS3LipKCMjcERU7bny2apjNsxe1Y=; b=enTjMZ/oqW9DYBkY9Mq4CSrWlPW+WcEEsERG4p2vNHRv9ychr7/sRm9amShsAp6XJ7 eAxDRYBoIHiuuGa2PAbWiHG8gp4bdw3czSYbMEusNx8OqX5JbOvJ7MjbdBW/eIFwhalk QmU4YkP72OwsmIlLSW4rKpty6bv3VV8noJJUM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=okJMuPQqx57+u5RPDosL0irXy69ZSVQsJASGRf0Kels2LbzmXlkIDsDLWH2A1yQ2Du VZIAfeh2s5uZD9U7GoRrxxIwZEPqns+n0955pk9faGIGOi1yXX6OaQIs0fIO8ZEdBrr5 SwxHsHFZk1C2eMT47pr7Cw75eNvu3op+ubaJg=
Received: by 10.231.200.134 with SMTP id ew6mr5677357ibb.164.1298928976940; Mon, 28 Feb 2011 13:36:16 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id 8sm4967356iba.4.2011.02.28.13.36.15 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 13:36:15 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com>
In-Reply-To: <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Message-Id: <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 13:36:07 -0800
To: Greg Wilkins <gregw@intalio.com>
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 21:35:17 -0000

I agree with this.  At the very least it's nothing short of ridiculous to ha=
ve an amorphous extensions field without a length indicator sitting before t=
he payload.  At the least we should add a variable length "extension data si=
ze" field.

Having the extensions basically work like middleware (similar to the way rub=
y/rack middleware transforms incoming/outgoing http requests before handing t=
he request to the next middleware function in the stack) I think makes the m=
ost sense, and indeed would require very limited explanation in the protocol=
 draft.

How each extension works is up to the extension and it can have free reign t=
o transform the payload however it wants, including splicing out it's extens=
ion specific metadata so that the next extension in the stack never even see=
s it.

All the spec needs to say on the matter is roughly that extensions are appli=
ed in the order in which they're negotiated and can transform the message in=
 whatever way they like.

Brian


Sent from my iPhone

On Feb 28, 2011, at 12:19 PM, Greg Wilkins <gregw@intalio.com> wrote:

> On 1 March 2011 01:42, John Tamplin <jat@google.com> wrote:
>> On Mon, Feb 28, 2011 at 3:20 AM, Greg Wilkins <gregw@intalio.com> wrote:
>>> In fact, if I was to argue anything... I'd argue the other way and say
>>> that we should remove extension data from the framing as it is not
>>> really a part of  the framing in any meaningful way that would allow
>>> any code to do anything with.  Nor is there any way we could actually
>>> police that it is used in the way we intend.  If nobody but the
>>> extension knows the boundary between the real payload and the
>>> extension payload, then the extension can put the data anywhere it
>>> likes and nobody would be the wiser.
>>>=20
>>> Instead of extension data, we could instead talk about how extensions
>>> may mutate and/or extend the payload of a frame.   For example may
>>> even be more efficient for an extension in an intermediary to append
>>> rather than prepend data.
>>=20
>> I think that makes it harder to reason about exactly what happens when
>> there are multiple extensions - about the only way I could think of is
>> that each extension is modeled as a function taking the current
>> payload and mutating it arbitrarily, with the extensions applied in
>> the order they are listed in the handshake.
>=20
> I think we are in agreement here?   I don't think there is an extension da=
ta
> field, but an extension is a function of payload producing payload.
>=20
>> However, even that
>> complicates things -- what about an extension that combines multiple
>> frames, such as an aggregating MUX?
>=20
> That's not that complex:
>=20
>    extFn(payload0) produced no payload
>    extFn(payload1) produced the aggregate payload
>=20
>=20
>> Trying to define a regular way to
>> apply arbitrary extensions that may cross message boundaries seems
>> hard without it excessively hard to describe simpler extensions.
>=20
> I actually don't think the protocol document needs to describe this
> extension mechanism.
> It only needs to describe a way that the extensions are negotiated and
> ordered and then
> say that extensions are allowed to mutate and extend payload.
>=20
> cheers
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

From theturtle32@gmail.com  Mon Feb 28 13:47:57 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2252C3A6C9C for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 13:47:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nq+JF3+rkDm9 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 13:47:56 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id CC5503A68B1 for <hybi@ietf.org>; Mon, 28 Feb 2011 13:47:53 -0800 (PST)
Received: by iyj8 with SMTP id 8so3722664iyj.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 13:48:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=66plTua0xgfOLkkTeQenn2QBtUg/iWA52ZsAhl59ZKM=; b=C6P7tDJ7x3hna9U25HVgCt8IU0eWCb2ewBZA645EVmsBVfMCY9ttibbA6Q6eXehV7s EmBxYPCXJA+PBXQU94EuBEqK5LeTHOgnzq0AcZyB38Z2+4lLxjE5UA6raIAohSs6ncTp pmpi5nZAk5grUGYN80Olpx/XG/7AbUKB2kOBY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=JimeXIPOxIuZ4X++CFtkPE+CR+RL1+dqLlhzmGjUvz7DSgSX5fPCVInFHztxriZ9ln gh8yQeKiQMY6hFTzYsDHom65r4R/d6VG5GHGVTzfku0Pn5Njaujv4otqebm4XHyXJ3Zt KTBIePYnBBSJdNLR3gmXjWSdi88ccHApLFbI4=
Received: by 10.231.174.71 with SMTP id s7mr5902653ibz.56.1298929735077; Mon, 28 Feb 2011 13:48:55 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id u9sm4976992ibe.8.2011.02.28.13.48.53 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 13:48:53 -0800 (PST)
References: <AANLkTinVwPRpo7NgJjf3+6gcrBHaJugT9OugKKAsMU9X@mail.gmail.com> <OFED4F78E9.C77C54B8-ON88257842.001A696A-88257842.001D41FB@playstation.sony.com> <AANLkTik5i3Nh6OfyU=uso8tb2LzqKiJFRd_k+hpCyyWt@mail.gmail.com> <AANLkTinTqHtG+HmjBm4n2yS3Ouz+Fw3i_R_Gf7qx0vn1@mail.gmail.com> <AANLkTinjMJamX4wGFqcN8yPq+NeXOvnzL+gO3DATF_rr@mail.gmail.com>
In-Reply-To: <AANLkTinjMJamX4wGFqcN8yPq+NeXOvnzL+gO3DATF_rr@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Message-Id: <E5307837-2B8D-4B86-9B0F-8305D27707E6@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 13:48:45 -0800
To: Greg Wilkins <gregw@webtide.com>
Cc: "hybi@ietf.org" <hybi@ietf.org>, "Yutaka_Takeda@playstation.sony.com" <Yutaka_Takeda@playstation.sony.com>
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 21:47:57 -0000

I completely agree.  Extensions should have free reign over the payload, but=
 not be allowed to change the framing at all.  In fact the framing layer its=
elf could be imagined as the first and last stage in the middleware stack, f=
or the receiver and sender, respectively. =20

Once all the extensions have executed their transformations on the sending n=
ode, then and only then is the framing generated from the state of the inter=
nal data structures that describe the current frame.

And since we're already not supporting things like "sendfile" and arbitraril=
y long messages of unknown length can be fragmented, this works quite cleanl=
y and simply.

Brian

Sent from my iPhone

On Feb 28 2011, at 12:40 PM, Greg Wilkins <gregw@webtide.com> wrote:

> On 1 March 2011 01:32, John Tamplin <jat@google.com> wrote:
>> It also means we have to agree on the details of how it should be
>> specified, which is why the super-simple deflate-stream was added to
>> the standard instead of trying to get agreement on something better.
>=20
> Well I remember the proposal for deflate stream being made, but I
> certainly don't recall any consensus that it should be put into the
> draft.  There have been consistent voices against compressing the
> framing.
>=20
> I really think this is an important point of principal, if any
> arbitrary extension is free to entirely change what is sent on the
> wire, then we are going to have a very difficult environment in which
> to develop any kind of meaningful intermediaries.    I keep coming
> back to the analogy of HTTP, where it is not legal to just add a
> header to define an extension and then change HTTP framing entirely.
> The only way to break out of HTTP framing is with something like
> Upgrade or CONNECT.
>=20
> If the first exemplar of an extension we have is something that
> completely changes what is sent over the wire, then I think we have
> totally devalued WS framing as a standard.
>=20
> regards
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

From jat@google.com  Mon Feb 28 14:03:24 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DEC013A6C40 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 14:03:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.681
X-Spam-Level: 
X-Spam-Status: No, score=-105.681 tagged_above=-999 required=5 tests=[AWL=0.296, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vdCgrpXgtqh2 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 14:03:24 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id ADD013A6BEC for <hybi@ietf.org>; Mon, 28 Feb 2011 14:03:21 -0800 (PST)
Received: from wpaz33.hot.corp.google.com (wpaz33.hot.corp.google.com [172.24.198.97]) by smtp-out.google.com with ESMTP id p1SM4LWR008719 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:04:22 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298930662; bh=h93FLzHANADGbrcAKBbMinOegPM=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=isC0iVxj/pH955t450nhnsX1CU5RXWiyg4VEnRHmdUYn55D+luq9GdGYqt/WYkVEm l7qaziGajrK5FdyDY7l0Q==
Received: from gyd10 (gyd10.prod.google.com [10.243.49.202]) by wpaz33.hot.corp.google.com with ESMTP id p1SM36WT019131 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 14:04:20 -0800
Received: by gyd10 with SMTP id 10so2060869gyd.26 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:04:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=ipekbvQAs2OgHJ3hNMxKARbPr2+bVdZ+JEdG5UpNHeU=; b=N1sooefFTKr08Sksdl9+TwcR1Zy+EAk4ZuHKYHr3YORVh8+7BcAxs/zIt0bcsLtN1N 81VfE4lAHbaYBE8j1+sg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=nM4nGpwf+DoB8h7jH33MuTVubTEZ+0Boz/QgKZ+SfeXbTYW/EA/dcPrjUpzeHinajp /Cqb2yADlqIcAgfyHvWA==
Received: by 10.150.198.11 with SMTP id v11mr7819904ybf.388.1298930660242; Mon, 28 Feb 2011 14:04:20 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 14:04:00 -0800 (PST)
In-Reply-To: <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 17:04:00 -0500
Message-ID: <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com>
To: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 22:03:25 -0000

On Mon, Feb 28, 2011 at 4:36 PM, Brian McKelvey <theturtle32@gmail.com> wro=
te:
> I agree with this. =C2=A0At the very least it's nothing short of ridiculo=
us to
> have an amorphous extensions field without a length indicator sitting
> before the payload. =C2=A0At the least we should add a variable length
> "extension data size" field.

If an extension has a fixed-length data field, requiring a length indicator
is wasteful.  For example, would you want to include a length byte for
the fixed-length masking key?

I think it is better to leave it up to the extension in the base spec, and
then we can argue about a particular extension when we get to it.

--=20
John A. Tamplin
Software Engineer (GWT), Google

From theturtle32@gmail.com  Mon Feb 28 14:12:47 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A990D3A694E for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 14:12:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5N0rFRwDUNTB for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 14:12:47 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id EADEC3A68B1 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:12:46 -0800 (PST)
Received: by iwl42 with SMTP id 42so3967552iwl.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:13:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=341W1OtIidh8sovzfsRwb4MWdvD+QauakMNWj2ERGBw=; b=KuTmioZNdxs1OGN8a7/xe86xfPVVrWO6lgecC25bBiprtLhFo+0aNoYvb9pkufngtT ATHpOMlfJabzXnF9UcxZuMzePgZ94X0JsGxar/sh+rvYVExRQLK7GeJ9j4FwoNlvPXd5 BHX7w1O0X5XXjmSO2m1ulfY5MJwjZrgo7KdoI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=S7APi7tp1mpHHkoWMn5VfirSKk4rNi9gIMFc08j/DYHLP6mUHrtQdJpzek4W0yvi83 xPE+RR+wYz+wt0pQ7GHZ+LQ257AMovRcaHBq77TOdWnatcacEM+M++1g0JLm1zijaa/z piLGCUodfqIVVaXBk6OytD9ZCp1yQZk1MKjhE=
Received: by 10.42.229.130 with SMTP id ji2mr5720896icb.204.1298931228269; Mon, 28 Feb 2011 14:13:48 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id z4sm4994694ibg.1.2011.02.28.14.13.47 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 14:13:47 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com>
In-Reply-To: <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Message-Id: <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 14:13:40 -0800
To: John Tamplin <jat@google.com>
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 22:12:47 -0000

But thats the point.  The field itself is specifically *not* fixed length.  A=
n extension may define some fixed length data to add to it, but that's not t=
he same thing.

An intermediary or debugging system should be able to at least find all of t=
he fields defined by the framing without knowing anything about the extensio=
ns.

An alternative might be to move it after the mask key and include it in the b=
ody size.  The extensions can then transparently splice it into and out of t=
he body before handing it off to the next layer of middleware.  Or for that m=
atter just eliminate the extension data field altogether since it's effectiv=
ely part of the body at that point.

Brian

Sent from my iPhone

On Feb 28, 2011, at 2:04 PM, John Tamplin <jat@google.com> wrote:

> On Mon, Feb 28, 2011 at 4:36 PM, Brian McKelvey <theturtle32@gmail.com> wr=
ote:
>> I agree with this.  At the very least it's nothing short of ridiculous to=

>> have an amorphous extensions field without a length indicator sitting
>> before the payload.  At the least we should add a variable length
>> "extension data size" field.
>=20
> If an extension has a fixed-length data field, requiring a length indicato=
r
> is wasteful.  For example, would you want to include a length byte for
> the fixed-length masking key?
>=20
> I think it is better to leave it up to the extension in the base spec, and=

> then we can argue about a particular extension when we get to it.
>=20
> --=20
> John A. Tamplin
> Software Engineer (GWT), Google

From jat@google.com  Mon Feb 28 14:17:26 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 32EF03A6C9C for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 14:17:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.696
X-Spam-Level: 
X-Spam-Status: No, score=-105.696 tagged_above=-999 required=5 tests=[AWL=0.281, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Msn5G7dRfuea for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 14:17:25 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 3A6DC3A6A30 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:17:25 -0800 (PST)
Received: from kpbe15.cbf.corp.google.com (kpbe15.cbf.corp.google.com [172.25.105.79]) by smtp-out.google.com with ESMTP id p1SMIMNM023713 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:18:24 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298931504; bh=Cty3VQnGWG/N3t0SYJK7ZxeSvtY=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=tQ2xkYWoCHLKzR/Vg2sx1oik3hvlluaO1r0YP1qwxg7YVlpwBStG87YqNR7C8mYe9 h4T44AShuITH9KKDiEpVQ==
Received: from gxk3 (gxk3.prod.google.com [10.202.11.3]) by kpbe15.cbf.corp.google.com with ESMTP id p1SMIJOs023652 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 14:18:21 -0800
Received: by gxk3 with SMTP id 3so15687gxk.26 for <hybi@ietf.org>; Mon, 28 Feb 2011 14:18:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=xss0elJldqK+vxZoKTR0pbcqyNM+h7pIfutXdG1t4xw=; b=Ey5xg+On2zmLAgCdbufA0oFfeJb0TYllE0e8LMVF62X3ssV15/e90gg2YcgHu9gJJJ JCbnjUGvARUakNjbaXIA==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=HJ6IiEf2featqJ3JQ4z81wSiNb0d1o/snwcz6cd+zy6xqHXXzNTuubxltHhy0C078k pgUxfIx8zE5wLqEqYs1w==
Received: by 10.150.43.37 with SMTP id q37mr7928744ybq.103.1298931501113; Mon, 28 Feb 2011 14:18:21 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 14:18:01 -0800 (PST)
In-Reply-To: <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 17:18:01 -0500
Message-ID: <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>
To: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 22:17:26 -0000

On Mon, Feb 28, 2011 at 5:13 PM, Brian McKelvey <theturtle32@gmail.com> wro=
te:
> An alternative might be to move it after the mask key and include it in t=
he body
> size. =C2=A0The extensions can then transparently splice it into and out =
of the body
> before handing it off to the next layer of middleware. =C2=A0Or for that =
matter just
> eliminate the extension data field altogether since it's effectively part=
 of the
> body at that point.

So how is that different than what is currently in the spec?

--=20
John A. Tamplin
Software Engineer (GWT), Google

From Gabriel.Montenegro@microsoft.com  Mon Feb 28 15:17:30 2011
Return-Path: <Gabriel.Montenegro@microsoft.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D81193A6CC7 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 15:17:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.465
X-Spam-Level: 
X-Spam-Status: No, score=-10.465 tagged_above=-999 required=5 tests=[AWL=0.134, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7jmr95oPWKMh for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 15:17:30 -0800 (PST)
Received: from smtp.microsoft.com (smtp.microsoft.com [131.107.115.214]) by core3.amsl.com (Postfix) with ESMTP id E88953A6CBE for <hybi@ietf.org>; Mon, 28 Feb 2011 15:17:25 -0800 (PST)
Received: from TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Mon, 28 Feb 2011 15:18:27 -0800
Received: from TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com (157.54.71.68) by TK5EX14HUBC102.redmond.corp.microsoft.com (157.54.7.154) with Microsoft SMTP Server (TLS) id 14.1.270.2; Mon, 28 Feb 2011 15:18:27 -0800
Received: from TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com ([169.254.2.139]) by TK5EX14MLTW652.wingroup.windeploy.ntdev.microsoft.com ([157.54.71.68]) with mapi id 14.01.0270.002; Mon, 28 Feb 2011 15:18:28 -0800
From: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
To: Greg Wilkins <gregw@intalio.com>, Hybi <hybi@ietf.org>
Thread-Topic: [hybi] Hello frames?
Thread-Index: AQHL14412iWCpzy4ZUaGhFQV7JGbhJQXiymQ
Date: Mon, 28 Feb 2011 23:18:27 +0000
Message-ID: <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com>
In-Reply-To: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [157.54.51.90]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Feb 2011 23:17:30 -0000

> The content I would like to see in a hello is a description of the timeou=
ts and
> buffer sizes supported by the client/server.  One of the big problems wit=
h Comet
> over HTTP is that we don't know what the network times are, so we don't k=
now
> what frequency we need to send long polls.  The equivalent of this in
> websockets is how frequently
> does a ping/pong need to be sent to avoid an idle close.   I
> understand that a fair bit of work is needed to know who will send the
> ping/pongs etc, but I think the first step in any plan will be
> disclosure of timeouts.   Hello frames would look to be a good way
> disclose this information.

[gab] Why would one side need to disclose timeouts to the other? Would a si=
mpler approach work whereby either side would act on the timeouts by issuin=
g a Ping at the appropriate time instead of disclosing the timeout. The oth=
er side's issuing a Pong would reset its timer (if it has not been sending =
anything else) and serves to suppress any Ping it would have otherwise sent=
.

From theturtle32@gmail.com  Mon Feb 28 16:05:49 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 242CF3A6CF0 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 16:05:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KuIJ8IW0dtIp for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 16:05:48 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id 30ADF3A6CB1 for <hybi@ietf.org>; Mon, 28 Feb 2011 16:05:48 -0800 (PST)
Received: by iyj8 with SMTP id 8so3829206iyj.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 16:06:49 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-type:content-transfer-encoding:message-id:cc:x-mailer:from :subject:date:to; bh=58WEeMuVbJhpPAA8T+y+kwpXMM9vCsVghfW1oW1yWUs=; b=FxPm793PdAbTgfBVjo9leU0HgYru3SOBZdpaAJpezDz8isMA7c/g5KopEL2gJIUVDC nRr6CcRwCbNb44w6WpHHqIEOXOigDKBvGFwk8UcCTQe7a0hyU7lfLyQy36xIUM/CNC/g U6jd/rbz5J1zVyM77Hxgryyg4+DRP0vJzIcek=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-type :content-transfer-encoding:message-id:cc:x-mailer:from:subject:date :to; b=jOw63Y5geM9RXLEOy9zqRHzpMvRIeaHbF3k7NyGTemCcMDjDmHKuAU7dowdpjckf28 NqYp33++2FsSXYeCKIi8QCEE55FPQiecmHrDfDJk8CCSItsz39p6LcvZ9slcl2K+7aLP h/L6zFd6+w2LQ5PkPfSqDkRfJzQ5pg6IMyn7s=
Received: by 10.231.17.203 with SMTP id t11mr5854093iba.141.1298938009346; Mon, 28 Feb 2011 16:06:49 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id d21sm5080313ibg.21.2011.02.28.16.06.47 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 16:06:48 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>
In-Reply-To: <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Type: multipart/alternative; boundary=Apple-Mail-9-655742450
Content-Transfer-Encoding: 7bit
Message-Id: <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 16:06:37 -0800
To: John Tamplin <jat@google.com>
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 00:05:49 -0000

--Apple-Mail-9-655742450
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

It's exactly what is in the spec now.  In the 06 draft, the mask applies als=
o to the framing so it's not an issue.  Andy Green's previous message in thi=
s thread referenced the potential of placing the masking key between the ext=
ension data and payload fields:

04 7F 00 00 00 00 XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP...

Where XX is the length, MM is the frame mask, EE is the extension data, PP i=
s payload.

If that were to be the case there wouldn't be a reliable way to find the pay=
load without knowing how all the extensions manipulated the extension data f=
ield.

Brian

Sent from my iPhone

On Feb 28, 2011, at 2:18 PM, John Tamplin <jat@google.com> wrote:

> On Mon, Feb 28, 2011 at 5:13 PM, Brian McKelvey <theturtle32@gmail.com> wr=
ote:
>> An alternative might be to move it after the mask key and include it in t=
he body
>> size.  The extensions can then transparently splice it into and out of th=
e body
>> before handing it off to the next layer of middleware.  Or for that matte=
r just
>> eliminate the extension data field altogether since it's effectively part=
 of the
>> body at that point.
>=20
> So how is that different than what is currently in the spec?
>=20
> --=20
> John A. Tamplin
> Software Engineer (GWT), Google


--Apple-Mail-9-655742450
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><body bgcolor=3D"#FFFFFF"><div><span>It's exactly what is in the spec n=
ow. &nbsp;In the 06 draft, the mask applies also to the framing so it's not a=
n issue. &nbsp;Andy Green's previous message in this thread referenced the p=
otential of placing the masking key between the extension data and payload f=
ields:</span><br><span></span><br><span></span><span class=3D"Apple-style-sp=
an" style=3D"-webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webki=
t-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition=
-frame-color: rgba(77, 128, 180, 0.230469); font-size: medium; "><span>04 7F&=
nbsp;<a href=3D"tel:00%2000%2000%2000" x-apple-data-detectors=3D"true">00 00=
 00 00</a>&nbsp;XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP...</span></spa=
n><span class=3D"Apple-style-span" style=3D"-webkit-tap-highlight-color: rgb=
a(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227,=
 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); f=
ont-size: medium; "><br></span><span class=3D"Apple-style-span" style=3D"-we=
bkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fi=
ll-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rg=
ba(77, 128, 180, 0.230469); font-size: medium; "><span></span></span><span c=
lass=3D"Apple-style-span" style=3D"-webkit-tap-highlight-color: rgba(26, 26,=
 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469=
); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); font-size:=
 medium; "><br></span><span class=3D"Apple-style-span" style=3D"-webkit-tap-=
highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color:=
 rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 12=
8, 180, 0.230469); font-size: medium; "><span>Where XX is the length, MM is t=
he frame mask, EE is the extension data, PP is payload.</span></span></div><=
div><span class=3D"Apple-style-span" style=3D"-webkit-tap-highlight-color: r=
gba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 22=
7, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);=
 font-size: medium;"><br></span></div><div><span></span><span class=3D"Apple=
-style-span" style=3D"-webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969=
); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-co=
mposition-frame-color: rgba(77, 128, 180, 0.230469); font-size: medium;">If t=
hat were to be the case there wouldn't be a reliable way to find the payload=
 without knowing how all the extensions manipulated the extension data field=
.<br></span><span></span><br><span>Brian</span><br><span></span><br><span>Se=
nt from my iPhone</span><br><span></span><br><span>On Feb 28, 2011, at 2:18 P=
M, John Tamplin &lt;<a href=3D"mailto:jat@google.com">jat@google.com</a>&gt;=
 wrote:</span><br><span></span><br><blockquote type=3D"cite"><span>On Mon, Fe=
b 28, 2011 at 5:13 PM, Brian McKelvey &lt;<a href=3D"mailto:theturtle32@gmai=
l.com">theturtle32@gmail.com</a>&gt; wrote:</span><br></blockquote><blockquo=
te type=3D"cite"><blockquote type=3D"cite"><span>An alternative might be to m=
ove it after the mask key and include it in the body</span><br></blockquote>=
</blockquote><blockquote type=3D"cite"><blockquote type=3D"cite"><span>size.=
 &nbsp;The extensions can then transparently splice it into and out of the b=
ody</span><br></blockquote></blockquote><blockquote type=3D"cite"><blockquot=
e type=3D"cite"><span>before handing it off to the next layer of middleware.=
 &nbsp;Or for that matter just</span><br></blockquote></blockquote><blockquo=
te type=3D"cite"><blockquote type=3D"cite"><span>eliminate the extension dat=
a field altogether since it's effectively part of the</span><br></blockquote=
></blockquote><blockquote type=3D"cite"><blockquote type=3D"cite"><span>body=
 at that point.</span><br></blockquote></blockquote><blockquote type=3D"cite=
"><span></span><br></blockquote><blockquote type=3D"cite"><span>So how is th=
at different than what is currently in the spec?</span><br></blockquote><blo=
ckquote type=3D"cite"><span></span><br></blockquote><blockquote type=3D"cite=
"><span>-- </span><br></blockquote><blockquote type=3D"cite"><span>John A. T=
amplin</span><br></blockquote><blockquote type=3D"cite"><span>Software Engin=
eer (GWT), Google</span><br></blockquote></div><div><span></span></div></bod=
y></html>=

--Apple-Mail-9-655742450--

From theturtle32@gmail.com  Mon Feb 28 16:09:58 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 489AF3A6CFD for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 16:09:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wHY+nAbgnwTA for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 16:09:57 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id 805583A6CFC for <hybi@ietf.org>; Mon, 28 Feb 2011 16:09:57 -0800 (PST)
Received: by iwl42 with SMTP id 42so4054354iwl.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 16:10:59 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=RszWP8ampjAjk/IkTWqXARUimve/ipirpjsX79NAs8g=; b=U9xnFH024x5AZtemia9MJNtfxHPqJjdxLJz53htsKNpWHLs4CZVfxFa9YTGKgXUkcu VdoZUy31seH8T7WMaKe3C3805lSxxR/yGG6bgmaHwMTOY5XMcY87GXNrcCtsFkEBMEZ/ 5TxBgnloyY/AsU0Qog8d+e8Vhc754A4Nq+BKE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=hKd1Vx7DUaIMu4Q0Afl/Qp4ngOrNwt8MqkCT+NzX1nfssIl/+GhzpSjxY9c68+jBj3 0FIKdiXWEZPZfZMvPyO24Oj1GyF8uXpB9vwGmrHosZiNBjADpx8JctnCtN3aH1Eaz/uh bFregH6t3rXNdem15t0ko3jMucxhmi4rCema8=
Received: by 10.42.241.68 with SMTP id ld4mr5720360icb.447.1298938259052; Mon, 28 Feb 2011 16:10:59 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id xi12sm2077177icb.18.2011.02.28.16.10.57 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 16:10:58 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>
In-Reply-To: <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Message-Id: <07FEA89B-2B02-48D1-88EC-957FE7B44B3B@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 16:10:51 -0800
To: John Tamplin <jat@google.com>
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 00:09:58 -0000

I admit I got a little confused about the state of things.. Thanks for the r=
eminder to check on the spec for frame of reference.  :)

Brian

Sent from my iPhone

On Feb 28, 2011, at 2:18 PM, John Tamplin <jat@google.com> wrote:

> On Mon, Feb 28, 2011 at 5:13 PM, Brian McKelvey <theturtle32@gmail.com> wr=
ote:
>> An alternative might be to move it after the mask key and include it in t=
he body
>> size.  The extensions can then transparently splice it into and out of th=
e body
>> before handing it off to the next layer of middleware.  Or for that matte=
r just
>> eliminate the extension data field altogether since it's effectively part=
 of the
>> body at that point.
>=20
> So how is that different than what is currently in the spec?
>=20
> --=20
> John A. Tamplin
> Software Engineer (GWT), Google

From jat@google.com  Mon Feb 28 16:25:19 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 757733A6CBA for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 16:25:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.913
X-Spam-Level: 
X-Spam-Status: No, score=-105.913 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ngOoC5AK72Z9 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 16:25:18 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 83B6C3A6CB3 for <hybi@ietf.org>; Mon, 28 Feb 2011 16:25:18 -0800 (PST)
Received: from hpaq13.eem.corp.google.com (hpaq13.eem.corp.google.com [172.25.149.13]) by smtp-out.google.com with ESMTP id p210QJBs028952 for <hybi@ietf.org>; Mon, 28 Feb 2011 16:26:19 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298939179; bh=sKQgKYhxgNMNa7rhyVAE9ZKOTws=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=ZYW41e18npWkupXvrCbbfIl34yn1k6ED/X6Nml8lfXPqPaMySlHC3LCd0ySZ5yuN9 G1bgKbHpceCWKkkOD3J0g==
Received: from yih10 (yih10.prod.google.com [10.243.66.202]) by hpaq13.eem.corp.google.com with ESMTP id p210QGGu029764 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 16:26:17 -0800
Received: by yih10 with SMTP id 10so2220940yih.11 for <hybi@ietf.org>; Mon, 28 Feb 2011 16:26:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=2R9zdvnVhnsYsNyFpcW4Ll+EnRzJRnbvwt9vg2OE/cg=; b=upGcgDTxFXeCqjpXk4dj437xbv8RQZpoAYlCrKPfHGEk/eMbEoST9SCOQAYXk1ICa1 t3w3n5q2C7Qu78/IWF+g==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=bA6CKzdTHfJsobY/IE6NqgFPk2tGIaatZ+wI8X808D21PhSLrnMfWXRpTa9AmJATqn 39iMynJagfff8M74Qb+w==
Received: by 10.150.149.16 with SMTP id w16mr3611444ybd.217.1298939176366; Mon, 28 Feb 2011 16:26:16 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 16:25:56 -0800 (PST)
In-Reply-To: <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 19:25:56 -0500
Message-ID: <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
To: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 00:25:19 -0000

On Mon, Feb 28, 2011 at 7:06 PM, Brian McKelvey <theturtle32@gmail.com> wro=
te:
>
> It's exactly what is in the spec now. =C2=A0In the 06 draft, the mask app=
lies also to the framing so it's not an issue. =C2=A0Andy Green's previous =
message in this thread referenced the potential of placing the masking key =
between the extension data and payload fields:
>
> 04 7F=C2=A000 00 00 00=C2=A0XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP=
...
>
> Where XX is the length, MM is the frame mask, EE is the extension data, P=
P is payload.
> If that were to be the case there wouldn't be a reliable way to find the =
payload without knowing how all the extensions manipulated the extension da=
ta field.

Whether it is before or after the mask it doesn't change that
intermediaries must understand any negotiated extensions to interpret
the payload further.

Personally, it seems dangerous to not mask the extension data, since
you don't know what extensions might carry data controllable by an
attacker.  If we don't mask extension data now, then it seems like
such extensions will reinvent their own masking mechanism, probably
including another key, or just ignore the problem and then we haven't
actually avoided the problem we are trying to avoid.

Regarding whether to specify how an intermediary can parse the payload
without understanding all the extensions, that requires including some
mechanism before we ship the base spec.  The compromise that led to
the current framing was precisely because we couldn't all agree on how
that should be done.  Maybe we can get agreement now, but it seems
better to get the base spec out, and then when we define the first
extension that uses extension data we can argue about it then.

Even if we come up with something like a tag/value approach, I think
we can't ever have intermediaries that understand the payload without
understanding extensions -- for example, what do they do when they see
a reserved opcode after an extension they didn't recognize was
negotiated?

--
John A. Tamplin
Software Engineer (GWT), Google

From gregw@intalio.com  Mon Feb 28 17:26:34 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E1073A6D5B for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 17:26:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.227
X-Spam-Level: 
X-Spam-Status: No, score=-2.227 tagged_above=-999 required=5 tests=[AWL=-0.250, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QYBbCC+KXJ0n for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 17:26:33 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 305903A6D59 for <hybi@ietf.org>; Mon, 28 Feb 2011 17:26:32 -0800 (PST)
Received: by vxg33 with SMTP id 33so4153754vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 17:27:34 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr10344614vdc.110.1298942854503; Mon, 28 Feb 2011 17:27:34 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 17:27:34 -0800 (PST)
In-Reply-To: <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com>
Date: Tue, 1 Mar 2011 12:27:34 +1100
Message-ID: <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 01:26:34 -0000

On 1 March 2011 10:18, Gabriel Montenegro
<Gabriel.Montenegro@microsoft.com> wrote:
> [gab] Why would one side need to disclose timeouts to the other? Would a =
simpler approach work whereby either side would act on the timeouts by issu=
ing a Ping at the appropriate time instead of disclosing the timeout. The o=
ther side's issuing a Pong would reset its timer (if it has not been sendin=
g anything else) and serves to suppress any Ping it would have otherwise se=
nt.
>

How does one side know what the appropriate time is?

If the server is configured with a  30s idle timeout, then the client
needs to know to send a ping every < 30s if it wants to keep the
connection alive.
Thus the server needs to disclose that timeout so the client can act on it.

Ideally, any intermediary would also append any timeouts it has to the
hello contents, so that timeouts can be known for the full path.   Of
course there is nothing to prevent a transparent proxy of NAT gateway
applying it's own timeout,   but I see that as no reason to give up
and not start declaring our timeouts and using those as the basis of
where to start our timeout at.

If we just give up and conceal our timeouts,  then I can see
ping/pongs being sent every 30s, which means that we will basically be
the same as long polling.


cheers

From gregw@intalio.com  Mon Feb 28 17:37:56 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1EF683A6D6A for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 17:37:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.191
X-Spam-Level: 
X-Spam-Status: No, score=-2.191 tagged_above=-999 required=5 tests=[AWL=-0.214, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rAJWbUkWq6FK for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 17:37:55 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 1BD343A6D71 for <hybi@ietf.org>; Mon, 28 Feb 2011 17:37:55 -0800 (PST)
Received: by vxg33 with SMTP id 33so4161583vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 17:38:55 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr10358019vdc.110.1298943535338; Mon, 28 Feb 2011 17:38:55 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 17:38:55 -0800 (PST)
In-Reply-To: <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
Date: Tue, 1 Mar 2011 12:38:55 +1100
Message-ID: <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 01:37:56 -0000

I think that the mask should apply to all data (extension and normal
payload) after the mask itself.

So by default, masking should be the only extension and we will have
frames like:

   084 LL MM MM MM MM MX MX MX .........

LL =3D length
MM =3D mask
MX =3D masked payload


If we negotiate an extension E1, that prepends some data to the
payload, then by default it should apply after the default masking
extension, so the extension order would be mask,E1 and we should get:

   084 LL MM MM MM MM M1 M1 MX MX MX .........

M1 =3D masked extension 1 data


If we then gave masking an actual extension name, it should be
possible to negotiate extensions with masking order E1,mask and we
would get:

   084 LL E1 E1 MM MM MM MM MX MX MX .........

E1 =3D extension 1 data


If we added another extension E2 we could have an extension order like
E1,mask,E2 and get:


   084 LL E1 E1 MM MM MM MM M2 M2 MX MX MX .........


M2 =3D masked extension 2 data


This interpretation would allow John's idea of extensions being
mutation functions on the payload, so this last example the payload
would be:

  frame_payload =3D extension1( mask ( extension2 ( application_payload )))=
;


Note that there is no real requirement that extension data be
prepended, just that each extension knows how to find it's own data.

cheers




On 1 March 2011 11:25, John Tamplin <jat@google.com> wrote:
> On Mon, Feb 28, 2011 at 7:06 PM, Brian McKelvey <theturtle32@gmail.com> w=
rote:
>>
>> It's exactly what is in the spec now. =A0In the 06 draft, the mask appli=
es also to the framing so it's not an issue. =A0Andy Green's previous messa=
ge in this thread referenced the potential of placing the masking key betwe=
en the extension data and payload fields:
>>
>> 04 7F=A000 00 00 00=A0XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP...
>>
>> Where XX is the length, MM is the frame mask, EE is the extension data, =
PP is payload.
>> If that were to be the case there wouldn't be a reliable way to find the=
 payload without knowing how all the extensions manipulated the extension d=
ata field.
>
> Whether it is before or after the mask it doesn't change that
> intermediaries must understand any negotiated extensions to interpret
> the payload further.
>
> Personally, it seems dangerous to not mask the extension data, since
> you don't know what extensions might carry data controllable by an
> attacker. =A0If we don't mask extension data now, then it seems like
> such extensions will reinvent their own masking mechanism, probably
> including another key, or just ignore the problem and then we haven't
> actually avoided the problem we are trying to avoid.
>
> Regarding whether to specify how an intermediary can parse the payload
> without understanding all the extensions, that requires including some
> mechanism before we ship the base spec. =A0The compromise that led to
> the current framing was precisely because we couldn't all agree on how
> that should be done. =A0Maybe we can get agreement now, but it seems
> better to get the base spec out, and then when we define the first
> extension that uses extension data we can argue about it then.
>
> Even if we come up with something like a tag/value approach, I think
> we can't ever have intermediaries that understand the payload without
> understanding extensions -- for example, what do they do when they see
> a reserved opcode after an extension they didn't recognize was
> negotiated?
>
> --
> John A. Tamplin
> Software Engineer (GWT), Google
>

From jlee@antwerkz.com  Mon Feb 28 17:50:07 2011
Return-Path: <jlee@antwerkz.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A288E3A6D6C for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 17:50:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.836
X-Spam-Level: 
X-Spam-Status: No, score=-2.836 tagged_above=-999 required=5 tests=[AWL=0.140,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M52KPRHCLktM for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 17:49:56 -0800 (PST)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 2EC3D3A6C4C for <hybi@ietf.org>; Mon, 28 Feb 2011 17:49:56 -0800 (PST)
Received: by fxm15 with SMTP id 15so4446660fxm.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 17:50:57 -0800 (PST)
MIME-Version: 1.0
Received: by 10.223.72.10 with SMTP id k10mr3553731faj.31.1298944256419; Mon, 28 Feb 2011 17:50:56 -0800 (PST)
Received: by 10.223.10.144 with HTTP; Mon, 28 Feb 2011 17:50:56 -0800 (PST)
In-Reply-To: <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>
Date: Mon, 28 Feb 2011 20:50:56 -0500
Message-ID: <AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com>
From: Justin Lee <jlee@antwerkz.com>
To: Hybi <hybi@ietf.org>
Content-Type: multipart/alternative; boundary=20cf3054a285fcab9a049d6206b7
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 01:50:08 -0000

--20cf3054a285fcab9a049d6206b7
Content-Type: text/plain; charset=ISO-8859-1

Why can't the *server* send those pings?  I had actually considered making
grizzly do just that in the absence of any clear direction one way or the
other in the spec.

On Mon, Feb 28, 2011 at 8:27 PM, Greg Wilkins <gregw@intalio.com> wrote:

> On 1 March 2011 10:18, Gabriel Montenegro
> <Gabriel.Montenegro@microsoft.com> wrote:
> > [gab] Why would one side need to disclose timeouts to the other? Would a
> simpler approach work whereby either side would act on the timeouts by
> issuing a Ping at the appropriate time instead of disclosing the timeout.
> The other side's issuing a Pong would reset its timer (if it has not been
> sending anything else) and serves to suppress any Ping it would have
> otherwise sent.
> >
>
> How does one side know what the appropriate time is?
>
> If the server is configured with a  30s idle timeout, then the client
> needs to know to send a ping every < 30s if it wants to keep the
> connection alive.
> Thus the server needs to disclose that timeout so the client can act on it.
>
> Ideally, any intermediary would also append any timeouts it has to the
> hello contents, so that timeouts can be known for the full path.   Of
> course there is nothing to prevent a transparent proxy of NAT gateway
> applying it's own timeout,   but I see that as no reason to give up
> and not start declaring our timeouts and using those as the basis of
> where to start our timeout at.
>
> If we just give up and conceal our timeouts,  then I can see
> ping/pongs being sent every 30s, which means that we will basically be
> the same as long polling.
>
>
> cheers
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi
>



-- 
You can find me on the net at:
http://antwerkz.com
http://www.linkedin.com/in/justinlee
http://www.twitter.com/evanchooly

--20cf3054a285fcab9a049d6206b7
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Why can&#39;t the *server* send those pings? =A0I had actually considered m=
aking grizzly do just that in the absence of any clear direction one way or=
 the other in the spec.<br><br><div class=3D"gmail_quote">On Mon, Feb 28, 2=
011 at 8:27 PM, Greg Wilkins <span dir=3D"ltr">&lt;<a href=3D"mailto:gregw@=
intalio.com">gregw@intalio.com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex;">On 1 March 2011 10:18, Gabriel Montenegro<b=
r>
<div class=3D"im">&lt;<a href=3D"mailto:Gabriel.Montenegro@microsoft.com">G=
abriel.Montenegro@microsoft.com</a>&gt; wrote:<br>
&gt; [gab] Why would one side need to disclose timeouts to the other? Would=
 a simpler approach work whereby either side would act on the timeouts by i=
ssuing a Ping at the appropriate time instead of disclosing the timeout. Th=
e other side&#39;s issuing a Pong would reset its timer (if it has not been=
 sending anything else) and serves to suppress any Ping it would have other=
wise sent.<br>

&gt;<br>
<br>
</div>How does one side know what the appropriate time is?<br>
<br>
If the server is configured with a =A030s idle timeout, then the client<br>
needs to know to send a ping every &lt; 30s if it wants to keep the<br>
connection alive.<br>
Thus the server needs to disclose that timeout so the client can act on it.=
<br>
<br>
Ideally, any intermediary would also append any timeouts it has to the<br>
hello contents, so that timeouts can be known for the full path. =A0 Of<br>
course there is nothing to prevent a transparent proxy of NAT gateway<br>
applying it&#39;s own timeout, =A0 but I see that as no reason to give up<b=
r>
and not start declaring our timeouts and using those as the basis of<br>
where to start our timeout at.<br>
<br>
If we just give up and conceal our timeouts, =A0then I can see<br>
ping/pongs being sent every 30s, which means that we will basically be<br>
the same as long polling.<br>
<br>
<br>
cheers<br>
<div><div></div><div class=3D"h5">_________________________________________=
______<br>
hybi mailing list<br>
<a href=3D"mailto:hybi@ietf.org">hybi@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/hybi" target=3D"_blank">ht=
tps://www.ietf.org/mailman/listinfo/hybi</a><br>
</div></div></blockquote></div><br><br clear=3D"all"><br>-- <br>You can fin=
d me on the net at:<div><a href=3D"http://antwerkz.com" target=3D"_blank">h=
ttp://antwerkz.com</a><br><a href=3D"http://www.linkedin.com/in/justinlee" =
target=3D"_blank">http://www.linkedin.com/in/justinlee</a><br>
<a href=3D"http://www.twitter.com/evanchooly" target=3D"_blank">http://www.=
twitter.com/evanchooly</a></div><br>

--20cf3054a285fcab9a049d6206b7--

From theturtle32@gmail.com  Mon Feb 28 19:02:14 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C4B793A6D01 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:02:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GG4mIBgQhKP3 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:02:14 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id EBC2C3A6CB0 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:02:13 -0800 (PST)
Received: by iwl42 with SMTP id 42so4168666iwl.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:03:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=QqdK1wZh7cgPPDEPsWhMYInKNISkD8hduDt8ck7GCL4=; b=DxJOYFmDdz28fwukuh7NIG4WDNMWTwCsb1v8OBhCo2vnQSiBTfFEmJ+2lYLJ4lO45I Za3YvAExdT3gFwebBRsnuNfvvgo8BCHFrTMvdSZNogtPHvOSr+rksiNDVre4FfNtgbFx gtI0Go44oh7yPYegSaVpWbKUvhPOcCEwrOq4Q=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=jchmsFrr3GyUNBBxxEePmV9FpgL06dIl/8+I5+QiqZo6xcEvjAlC+G5zRf0pNoEXfj aRqdU4xcEKyN+9Ebin/qofJF+9hlQbRKFTzVzSAhrZwuh1mFYG/Hs8myX52LoEkBQohA RfqBqr+XGIS9KcyUB4KWzLFCUioRvfCMc7WCI=
Received: by 10.42.180.194 with SMTP id bv2mr6024688icb.122.1298948595867; Mon, 28 Feb 2011 19:03:15 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id uf10sm1929040icb.5.2011.02.28.19.03.14 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 19:03:15 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
In-Reply-To: <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Message-Id: <33B46028-223B-48C6-AA17-88FBE046E064@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 19:03:07 -0800
To: John Tamplin <jat@google.com>
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:02:14 -0000

That seems fine to me.  My main concern was to make sure something like a wi=
reshark packet interpreter can find the extension/payload data field, whethe=
r or not it can interpret the contents due to unsupported extensions.

Brian

Sent from my iPhone

On Feb 28, 2011, at 4:25 PM, John Tamplin <jat@google.com> wrote:

> On Mon, Feb 28, 2011 at 7:06 PM, Brian McKelvey <theturtle32@gmail.com> wr=
ote:
>>=20
>> It's exactly what is in the spec now.  In the 06 draft, the mask applies a=
lso to the framing so it's not an issue.  Andy Green's previous message in t=
his thread referenced the potential of placing the masking key between the e=
xtension data and payload fields:
>>=20
>> 04 7F 00 00 00 00 XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP...
>>=20
>> Where XX is the length, MM is the frame mask, EE is the extension data, P=
P is payload.
>> If that were to be the case there wouldn't be a reliable way to find the p=
ayload without knowing how all the extensions manipulated the extension data=
 field.
>=20
> Whether it is before or after the mask it doesn't change that
> intermediaries must understand any negotiated extensions to interpret
> the payload further.
>=20
> Personally, it seems dangerous to not mask the extension data, since
> you don't know what extensions might carry data controllable by an
> attacker.  If we don't mask extension data now, then it seems like
> such extensions will reinvent their own masking mechanism, probably
> including another key, or just ignore the problem and then we haven't
> actually avoided the problem we are trying to avoid.
>=20
> Regarding whether to specify how an intermediary can parse the payload
> without understanding all the extensions, that requires including some
> mechanism before we ship the base spec.  The compromise that led to
> the current framing was precisely because we couldn't all agree on how
> that should be done.  Maybe we can get agreement now, but it seems
> better to get the base spec out, and then when we define the first
> extension that uses extension data we can argue about it then.
>=20
> Even if we come up with something like a tag/value approach, I think
> we can't ever have intermediaries that understand the payload without
> understanding extensions -- for example, what do they do when they see
> a reserved opcode after an extension they didn't recognize was
> negotiated?
>=20
> --
> John A. Tamplin
> Software Engineer (GWT), Google

From theturtle32@gmail.com  Mon Feb 28 19:04:31 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 42F653A6D84 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:04:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[AWL=0.000,  BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bBjf7TbTNLNr for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:04:30 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id 4757E3A6CB0 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:04:30 -0800 (PST)
Received: by iyj8 with SMTP id 8so3947665iyj.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:05:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=fMfw8CQyOtYuPQUxrc5rpoP4gMNfsEsZ3S3Ix9zEjjk=; b=jewuVyg7uzMiocbSMUhGWqAvYtDdFoXFoIS/qE4BXGmz2+kfV8JDFnsVn5c2o1ZFAN S9nlAKz5LI0dgoqyTFpCp7AX1LZLv6TasaK5nT64Y/mMdJDyFs6XOtJjGl9RbhWcpnqF bjD3u6RyrfIv0DCMMTW8hDXCdyVIbQfTlNN2s=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=HLBeZSkbNDlTJZk3oYpbHzh/Ac90K0AZciNFA04fBT24wKt4fA9OLvYR+8ldH3YdKH BXkerfWnvRnZQixaS0MvPUV1Usjbbt+dBVfKAaN/P/jWFCl959qYJpGUpiZulRiFFY7j 1m/HiROhIM5PcADz+XZzzm8u7z3XEm1H0XosI=
Received: by 10.42.146.10 with SMTP id h10mr6049350icv.33.1298948732142; Mon, 28 Feb 2011 19:05:32 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id yf11sm3578633icb.20.2011.02.28.19.05.31 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 19:05:31 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com>
In-Reply-To: <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Message-Id: <569915DD-DE46-4B3D-85FE-B14D18639936@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 19:05:23 -0800
To: Greg Wilkins <gregw@intalio.com>
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:04:31 -0000

I like this approach, though john's point about all extension data needing t=
o be masked seems a valid one to me.  So as long as the masking "extension" i=
s non-negotiable and always the end of the extension chain, that's fine.  An=
d at that point, the methodology for applying masking in the same way as ext=
ensions are applied becomes an implementation detail.

Brian

Sent from my iPhone

On Feb 28, 2011, at 5:38 PM, Greg Wilkins <gregw@intalio.com> wrote:

> I think that the mask should apply to all data (extension and normal
> payload) after the mask itself.
>=20
> So by default, masking should be the only extension and we will have
> frames like:
>=20
>   084 LL MM MM MM MM MX MX MX .........
>=20
> LL =3D length
> MM =3D mask
> MX =3D masked payload
>=20
>=20
> If we negotiate an extension E1, that prepends some data to the
> payload, then by default it should apply after the default masking
> extension, so the extension order would be mask,E1 and we should get:
>=20
>   084 LL MM MM MM MM M1 M1 MX MX MX .........
>=20
> M1 =3D masked extension 1 data
>=20
>=20
> If we then gave masking an actual extension name, it should be
> possible to negotiate extensions with masking order E1,mask and we
> would get:
>=20
>   084 LL E1 E1 MM MM MM MM MX MX MX .........
>=20
> E1 =3D extension 1 data
>=20
>=20
> If we added another extension E2 we could have an extension order like
> E1,mask,E2 and get:
>=20
>=20
>   084 LL E1 E1 MM MM MM MM M2 M2 MX MX MX .........
>=20
>=20
> M2 =3D masked extension 2 data
>=20
>=20
> This interpretation would allow John's idea of extensions being
> mutation functions on the payload, so this last example the payload
> would be:
>=20
>  frame_payload =3D extension1( mask ( extension2 ( application_payload )))=
;
>=20
>=20
> Note that there is no real requirement that extension data be
> prepended, just that each extension knows how to find it's own data.
>=20
> cheers
>=20
>=20
>=20
>=20
> On 1 March 2011 11:25, John Tamplin <jat@google.com> wrote:
>> On Mon, Feb 28, 2011 at 7:06 PM, Brian McKelvey <theturtle32@gmail.com> w=
rote:
>>>=20
>>> It's exactly what is in the spec now.  In the 06 draft, the mask applies=
 also to the framing so it's not an issue.  Andy Green's previous message in=
 this thread referenced the potential of placing the masking key between the=
 extension data and payload fields:
>>>=20
>>> 04 7F 00 00 00 00 XX XX XX XX [ EE EE... ] MM MM MM MM PP PP PP...
>>>=20
>>> Where XX is the length, MM is the frame mask, EE is the extension data, P=
P is payload.
>>> If that were to be the case there wouldn't be a reliable way to find the=
 payload without knowing how all the extensions manipulated the extension da=
ta field.
>>=20
>> Whether it is before or after the mask it doesn't change that
>> intermediaries must understand any negotiated extensions to interpret
>> the payload further.
>>=20
>> Personally, it seems dangerous to not mask the extension data, since
>> you don't know what extensions might carry data controllable by an
>> attacker.  If we don't mask extension data now, then it seems like
>> such extensions will reinvent their own masking mechanism, probably
>> including another key, or just ignore the problem and then we haven't
>> actually avoided the problem we are trying to avoid.
>>=20
>> Regarding whether to specify how an intermediary can parse the payload
>> without understanding all the extensions, that requires including some
>> mechanism before we ship the base spec.  The compromise that led to
>> the current framing was precisely because we couldn't all agree on how
>> that should be done.  Maybe we can get agreement now, but it seems
>> better to get the base spec out, and then when we define the first
>> extension that uses extension data we can argue about it then.
>>=20
>> Even if we come up with something like a tag/value approach, I think
>> we can't ever have intermediaries that understand the payload without
>> understanding extensions -- for example, what do they do when they see
>> a reserved opcode after an extension they didn't recognize was
>> negotiated?
>>=20
>> --
>> John A. Tamplin
>> Software Engineer (GWT), Google
>>=20

From jat@google.com  Mon Feb 28 19:06:12 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2C6F23A6D80 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:06:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.915
X-Spam-Level: 
X-Spam-Status: No, score=-105.915 tagged_above=-999 required=5 tests=[AWL=0.061, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17ciMQXGGShS for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:06:11 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 3CC763A6CB0 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:06:11 -0800 (PST)
Received: from wpaz13.hot.corp.google.com (wpaz13.hot.corp.google.com [172.24.198.77]) by smtp-out.google.com with ESMTP id p2137CrO023066 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:07:12 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298948832; bh=q0irckUrsIfiXTa3iboCZPe70BM=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=LoA7Ajzf+2BL5AHj2DDT+tPnI7ZcbbDgsmlxf7BctuPR4N7x5J6KqMklOF+uXVeQA B0j0tNZwZaKhV+wbEKwmg==
Received: from yia25 (yia25.prod.google.com [10.243.65.25]) by wpaz13.hot.corp.google.com with ESMTP id p2136ZVu003229 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 19:07:11 -0800
Received: by yia25 with SMTP id 25so2498667yia.7 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:07:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=ndCTg99UIdk48ErQe1Mnwc5SuFnfwIzqQ7G5US9LX4Y=; b=cIVcUK7OnKazO62pYg+NQJ/I3Qz+virLgD2SEvYd1RV7+Y9Y6vpFifBYqv1bmcgd2i 06fwoZxLbv1W3jD+nIOg==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=VACcmDzfLOf6LqZwBkzjbrDW/7SNa8MXQLxLSvpIczzei7BquLIH9WgP0hJkE3p/Rp bBB1hV2GrjXCOc5AE3Ow==
Received: by 10.150.198.11 with SMTP id v11mr8118115ybf.388.1298948831562; Mon, 28 Feb 2011 19:07:11 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 19:06:48 -0800 (PST)
In-Reply-To: <33B46028-223B-48C6-AA17-88FBE046E064@gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <33B46028-223B-48C6-AA17-88FBE046E064@gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 22:06:48 -0500
Message-ID: <AANLkTimEe-2t1K=EHjh1iitzz3fBF2U8fvfxV92o6994@mail.gmail.com>
To: Brian McKelvey <theturtle32@gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd34888afce38049d631759
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:06:12 -0000

--000e0cd34888afce38049d631759
Content-Type: text/plain; charset=UTF-8

On Mon, Feb 28, 2011 at 10:03 PM, Brian McKelvey <theturtle32@gmail.com>wrote:

> That seems fine to me.  My main concern was to make sure something like a
> wireshark packet interpreter can find the extension/payload data field,
> whether or not it can interpret the contents due to unsupported extensions.


The current spec handles that fine -- a Wireshark dissector that didn't
understand the negotiated extensions would know where the combined
extension/application data was, but couldn't interpret it further (not that
it can really do much with the payload anyway, other than UTF8->text).

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd34888afce38049d631759
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Mon, Feb 28, 2011 at 10:03 PM, Brian McKelvey=
 <span dir=3D"ltr">&lt;<a href=3D"mailto:theturtle32@gmail.com">theturtle32=
@gmail.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

That seems fine to me. =C2=A0My main concern was to make sure something lik=
e a wireshark packet interpreter can find the extension/payload data field,=
 whether or not it can interpret the contents due to unsupported extensions=
.</blockquote>

<div><br></div><div>The current spec handles that fine -- a Wireshark disse=
ctor that didn&#39;t understand the negotiated extensions would know where =
the combined extension/application data was, but couldn&#39;t interpret it =
further (not that it can really do much with the payload anyway, other than=
 UTF8-&gt;text).</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd34888afce38049d631759--

From theturtle32@gmail.com  Mon Feb 28 19:12:27 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BF6EE3A6D6D for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:12:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.202
X-Spam-Level: 
X-Spam-Status: No, score=-2.202 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K8hBt38tCbhM for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:12:27 -0800 (PST)
Received: from mail-iy0-f172.google.com (mail-iy0-f172.google.com [209.85.210.172]) by core3.amsl.com (Postfix) with ESMTP id E629B3A6A6B for <hybi@ietf.org>; Mon, 28 Feb 2011 19:12:26 -0800 (PST)
Received: by iyj8 with SMTP id 8so3952542iyj.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:13:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:references:in-reply-to:mime-version :content-transfer-encoding:content-type:message-id:cc:x-mailer:from :subject:date:to; bh=2Av3peSxRVMoEJ2fHpmVnoOZFMO3aUBdCudRVWh6wQ4=; b=KbdPxtO/IfYGFJ31XVnG5MVkFwWxilpvohFHF61i+7KJsXKOmWksTP6HBfmr3ejSEn y6hgygaE+wnt1nygYmy05+hR3vEYjofSsCuxUhaltyVIQZugEEcAMm1uttQin6USlFpC 0lF8ZEIobnIVFkpD7rJ8fjTGQMkpe8j3Y0Czg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to; b=eA+AeV3874gcXRzrEmS+yrFZJmUrWOJ/3vx2ygDa+1XyHps5xsqZZHGSyv3Y8U5n+U HzcNAVBMg4qd2Ik8GMJnchGdFJYz0L/kQxcAzY5s0C1qmq7wrsUfZlTlIijA6hXBXrku 3o5T34k62fANsV8aJB8GzmW9xSieKncnptzs4=
Received: by 10.231.145.68 with SMTP id c4mr6056580ibv.47.1298949208856; Mon, 28 Feb 2011 19:13:28 -0800 (PST)
Received: from [10.38.10.231] ([166.205.138.239]) by mx.google.com with ESMTPS id z4sm5208775ibg.13.2011.02.28.19.13.25 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Feb 2011 19:13:28 -0800 (PST)
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <33B46028-223B-48C6-AA17-88FBE046E064@gmail.com> <AANLkTimEe-2t1K=EHjh1iitz z3fBF2U8fvfxV92o6994@mail.gmail.com>
In-Reply-To: <AANLkTimEe-2t1K=EHjh1iitzz3fBF2U8fvfxV92o6994@mail.gmail.com>
Mime-Version: 1.0 (iPhone Mail 8C148)
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary=Apple-Mail-10-666940660
Message-Id: <AFF49524-BDB8-456F-9480-DAF9012E401F@gmail.com>
X-Mailer: iPhone Mail (8C148)
From: Brian McKelvey <theturtle32@gmail.com>
Date: Mon, 28 Feb 2011 19:13:15 -0800
To: John Tamplin <jat@google.com>
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:12:27 -0000

--Apple-Mail-10-666940660
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Yes it does.  I just got worried/confused when I saw andy's example where ex=
tension data came before the mask key and payload data, in which case it wou=
ldnt be able to find and apply the mask without knowing how to interpret the=
 extensions.

The current draft's handling is fine.

Brian

Sent from my iPhone

On Feb 28, 2011, at 7:06 PM, John Tamplin <jat@google.com> wrote:

> On Mon, Feb 28, 2011 at 10:03 PM, Brian McKelvey <theturtle32@gmail.com> w=
rote:
> That seems fine to me.  My main concern was to make sure something like a w=
ireshark packet interpreter can find the extension/payload data field, wheth=
er or not it can interpret the contents due to unsupported extensions.
>=20
> The current spec handles that fine -- a Wireshark dissector that didn't un=
derstand the negotiated extensions would know where the combined extension/a=
pplication data was, but couldn't interpret it further (not that it can real=
ly do much with the payload anyway, other than UTF8->text).
>=20
> --=20
> John A. Tamplin
> Software Engineer (GWT), Google

--Apple-Mail-10-666940660
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><body bgcolor=3D"#FFFFFF"><div><span class=3D"Apple-style-span" style=3D=
"-webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-compositio=
n-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color=
: rgba(77, 128, 180, 0.230469); "><div>Yes it does. &nbsp;I just got worried=
/confused when I saw andy's example where extension data came before the mas=
k key and payload data, in which case it wouldnt be able to find and apply t=
he mask without knowing how to interpret the extensions.</div><div><br></div=
><div>The current draft's handling is fine.</div><div><br></div><div>Brian</=
div></span><br>Sent from my iPhone</div><div><br>On Feb 28, 2011, at 7:06 PM=
, John Tamplin &lt;<a href=3D"mailto:jat@google.com">jat@google.com</a>&gt; w=
rote:<br><br></div><div></div><blockquote type=3D"cite"><div><div class=3D"g=
mail_quote">On Mon, Feb 28, 2011 at 10:03 PM, Brian McKelvey <span dir=3D"lt=
r">&lt;<a href=3D"mailto:theturtle32@gmail.com"><a href=3D"mailto:theturtle3=
2@gmail.com">theturtle32@gmail.com</a></a>&gt;</span> wrote:<br><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p=
adding-left:1ex;">

That seems fine to me. &nbsp;My main concern was to make sure something like=
 a wireshark packet interpreter can find the extension/payload data field, w=
hether or not it can interpret the contents due to unsupported extensions.</=
blockquote>

<div><br></div><div>The current spec handles that fine -- a Wireshark dissec=
tor that didn't understand the negotiated extensions would know where the co=
mbined extension/application data was, but couldn't interpret it further (no=
t that it can really do much with the payload anyway, other than UTF8-&gt;te=
xt).</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>
</div></blockquote></body></html>=

--Apple-Mail-10-666940660--

From gregw@intalio.com  Mon Feb 28 19:15:26 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6515A3A6D16 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:15:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.118
X-Spam-Level: 
X-Spam-Status: No, score=-2.118 tagged_above=-999 required=5 tests=[AWL=-0.141, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sOlA9oKk2ecp for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:15:25 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 943933A6A6B for <hybi@ietf.org>; Mon, 28 Feb 2011 19:15:25 -0800 (PST)
Received: by vxg33 with SMTP id 33so4228515vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:16:27 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr10466815vdc.110.1298949387088; Mon, 28 Feb 2011 19:16:27 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 19:16:27 -0800 (PST)
In-Reply-To: <AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com> <AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com>
Date: Tue, 1 Mar 2011 14:16:27 +1100
X-Google-Sender-Auth: GkXAhscTx3F-mdV0bdETyB3-a_g
Message-ID: <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Justin Lee <jlee@antwerkz.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:15:26 -0000

On 1 March 2011 12:50, Justin Lee <jlee@antwerkz.com> wrote:
> Why can't the *server* send those pings? =A0I had actually considered mak=
ing
> grizzly do just that in the absence of any clear direction one way or the
> other in the spec.

Because it all depends on which end wants to keep the connection open.

Typically it will be the client that knows the user has the "chat
dialog" still open, so they know that the user wants to receive chat
and thus still needs the websocket connection.

Of course the client could tell the server with an ajax call and the
server side application could configure the server side to send pings
at some rate, but then after all that complication, the server would
not know the browsers timeouts and would still end up sending pings
more frequently than necessary.

As I said, there is some thinking needed to work out exactly who sends
the pings (application or infrastructure) and how applications
communicate to the whoever sends the pings if they want the connection
kept open or not..... Some of that consideration may involve the in
browser API and would need to be discussed elsewhere.      So
disclosing timeouts is not the end of the story, it's just a good
first step that may enable some more intelligent behaviour other than
sending frequent pings.


cheers

From gregw@intalio.com  Mon Feb 28 19:17:40 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C011D3A6D16 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:17:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.165
X-Spam-Level: 
X-Spam-Status: No, score=-2.165 tagged_above=-999 required=5 tests=[AWL=-0.187, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P0yz51GxG8wE for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:17:40 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 055973A6A6B for <hybi@ietf.org>; Mon, 28 Feb 2011 19:17:39 -0800 (PST)
Received: by vxg33 with SMTP id 33so4229941vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:18:41 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.160.8 with SMTP id xg8mr9879400vdb.310.1298949521455; Mon, 28 Feb 2011 19:18:41 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 19:18:41 -0800 (PST)
In-Reply-To: <569915DD-DE46-4B3D-85FE-B14D18639936@gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com> <569915DD-DE46-4B3D-85FE-B14D18639936@gmail.com>
Date: Tue, 1 Mar 2011 14:18:41 +1100
Message-ID: <AANLkTim_cfDz8_S+eBXp6OPD85mt-4MRVv0CZuze+B0H@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Brian McKelvey <theturtle32@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:17:40 -0000

On 1 March 2011 14:05, Brian McKelvey <theturtle32@gmail.com> wrote:
> I like this approach, though john's point about all extension data needin=
g to be masked seems a valid one to me. =A0So as long as the masking "exten=
sion" is non-negotiable and always the end of the extension chain, that's f=
ine. =A0And at that point, the methodology for applying masking in the same=
 way as extensions are applied becomes an implementation detail.

I agree that masking is should be non-negotiable in the browsers, and
probably always the first extension as well.  But I think that for
flexibility, the protocol specification should allow non-browser
clients to negotiate otherwise.

cheers

From theturtle32@gmail.com  Mon Feb 28 19:31:59 2011
Return-Path: <theturtle32@gmail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 183CC3A6D83 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:31:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.599
X-Spam-Level: 
X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id srxDkjU1HtrV for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:31:55 -0800 (PST)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id 402DC3A6A6B for <hybi@ietf.org>; Mon, 28 Feb 2011 19:31:55 -0800 (PST)
Received: by iwl42 with SMTP id 42so4187522iwl.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:32:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=CmHQ/Nmb5WV4CPcr8Y6cAtGhD566ii9pFqWCoGPyI+I=; b=kKgmDWdCQGx9LJbw+d6f8IsQQIsvLggZbupwdQnGVTOU1YV3u4KfA1I3YotvyPKtqe Ry98yaU0hHZR+Kv/04cDUGa9NKXEGeDiM6Jl20y1RqGkMW/sm+3XSku4thRObpHahF1J 9BBDDmP95fk7WDg1TtxfvTtBvZTimWNB61kMk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=GxfzQBE8BBNaRMtzitkoSzs1cQObQsX+GwGIoS0KfVRepDaAn02Q86fBKTKMoZHd4N yURAjB3fk1l+7VSY/QKAPgJHXXlxrNd9DXecnk12etrGGBXXYA2A3HsUIqDzSEmwrv+o ZZppFkZW14pAJG28Oatb0u/zd3RVzfkwXH94U=
MIME-Version: 1.0
Received: by 10.231.199.10 with SMTP id eq10mr5970963ibb.112.1298950376938; Mon, 28 Feb 2011 19:32:56 -0800 (PST)
Received: by 10.231.155.5 with HTTP; Mon, 28 Feb 2011 19:32:56 -0800 (PST)
In-Reply-To: <AANLkTim_cfDz8_S+eBXp6OPD85mt-4MRVv0CZuze+B0H@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com> <569915DD-DE46-4B3D-85FE-B14D18639936@gmail.com> <AANLkTim_cfDz8_S+eBXp6OPD85mt-4MRVv0CZuze+B0H@mail.gmail.com>
Date: Mon, 28 Feb 2011 19:32:56 -0800
Message-ID: <AANLkTikYkaj6z9CtUeJ5YrBQWtVXWaObyUOdvQMzREFq@mail.gmail.com>
From: Brian <theturtle32@gmail.com>
To: Greg Wilkins <gregw@intalio.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:31:59 -0000

To clarify, are you suggesting that masking be allowed to be specified
as an extension during the handshake for the purposes of negotiating
the extension order, with the caveat that it be required?  What
happens if it's not specified by the client?  Where would it appear in
the order in that case?  Or would the connection be rejected?

I suspect you'll encounter the same resistance to that as we've seen
against having the masking be optional, since as John says, we don't
know what user-provided data might show up in the prepended metadata
for a yet-to-be-thought-of extension that could end up on the wire
unmasked.  :-/


Brian

On Mon, Feb 28, 2011 at 7:18 PM, Greg Wilkins <gregw@intalio.com> wrote:
> On 1 March 2011 14:05, Brian McKelvey <theturtle32@gmail.com> wrote:
>> I like this approach, though john's point about all extension data needi=
ng to be masked seems a valid one to me. =A0So as long as the masking "exte=
nsion" is non-negotiable and always the end of the extension chain, that's =
fine. =A0And at that point, the methodology for applying masking in the sam=
e way as extensions are applied becomes an implementation detail.
>
> I agree that masking is should be non-negotiable in the browsers, and
> probably always the first extension as well. =A0But I think that for
> flexibility, the protocol specification should allow non-browser
> clients to negotiate otherwise.
>
> cheers
>

From jat@google.com  Mon Feb 28 19:36:50 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2C1AF3A6D8E for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:36:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.71
X-Spam-Level: 
X-Spam-Status: No, score=-105.71 tagged_above=-999 required=5 tests=[AWL=0.266, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hKle7SARd+St for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:36:49 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id A15A93A6A6B for <hybi@ietf.org>; Mon, 28 Feb 2011 19:36:48 -0800 (PST)
Received: from hpaq14.eem.corp.google.com (hpaq14.eem.corp.google.com [172.25.149.14]) by smtp-out.google.com with ESMTP id p213bnlb029661 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:37:49 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298950669; bh=LmELfXzzgBCOnRoJD1ZWaegCRxA=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=Sxw62pwx1irIvEvGuFw1Kx1VPf5Ny1R1/C4KmRKUE7OtHANRiWJhreyweF7F9LJ0R qpiWkyf5zTI3fyIUtlBlg==
Received: from gxk21 (gxk21.prod.google.com [10.202.11.21]) by hpaq14.eem.corp.google.com with ESMTP id p213bleB017299 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 19:37:48 -0800
Received: by gxk21 with SMTP id 21so2251994gxk.24 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:37:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=MRCQUjqfNsu6rHfOuKA0ohWs0Vc+jODUQBjbgrGwYxo=; b=mTjDjsXMaTxKY/kbfdJIHdL3gZlenBUhOzdfqrcGSMxmAejCnPmIdBuksMy9pBUFhy Ri52NsREMGXbGyDhl8Zw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Xus+pfdHCQa4wCoauTvT3Ko8hVjlqwUQW6b49FDyn68LTjUfHy32yQrlEmfwuHVinu /8ewVu8Q5pQLfZoYzIfw==
Received: by 10.151.14.8 with SMTP id r8mr8181410ybi.331.1298950667091; Mon, 28 Feb 2011 19:37:47 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 19:37:26 -0800 (PST)
In-Reply-To: <AANLkTikYkaj6z9CtUeJ5YrBQWtVXWaObyUOdvQMzREFq@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com> <569915DD-DE46-4B3D-85FE-B14D18639936@gmail.com> <AANLkTim_cfDz8_S+eBXp6OPD85mt-4MRVv0CZuze+B0H@mail.gmail.com> <AANLkTikYkaj6z9CtUeJ5YrBQWtVXWaObyUOdvQMzREFq@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 22:37:26 -0500
Message-ID: <AANLkTi=N=sEbwU4OCav+0me0-6mMMs_o6Qs8swwO8pDw@mail.gmail.com>
To: Brian <theturtle32@gmail.com>
Content-Type: multipart/alternative; boundary=000e0cd6ea7217c2e4049d638576
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:36:50 -0000

--000e0cd6ea7217c2e4049d638576
Content-Type: text/plain; charset=UTF-8

On Mon, Feb 28, 2011 at 10:32 PM, Brian <theturtle32@gmail.com> wrote:

> To clarify, are you suggesting that masking be allowed to be specified
> as an extension during the handshake for the purposes of negotiating
> the extension order, with the caveat that it be required?  What
> happens if it's not specified by the client?  Where would it appear in
> the order in that case?  Or would the connection be rejected?
>

I presume any standards-compliant implementations would reject the
connection, including browsers.

I suspect you'll encounter the same resistance to that as we've seen
> against having the masking be optional, since as John says, we don't
> know what user-provided data might show up in the prepended metadata
> for a yet-to-be-thought-of extension that could end up on the wire
> unmasked.  :-/


There was significant objection from Maciej and others to even making
masking listed as a specific extension.  I also think that leaving the
possibility of any extension data unmasked would be frowned upon.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd6ea7217c2e4049d638576
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Mon, Feb 28, 2011 at 10:32 PM, Brian <span di=
r=3D"ltr">&lt;<a href=3D"mailto:theturtle32@gmail.com">theturtle32@gmail.co=
m</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margi=
n:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

To clarify, are you suggesting that masking be allowed to be specified<br>
as an extension during the handshake for the purposes of negotiating<br>
the extension order, with the caveat that it be required? =C2=A0What<br>
happens if it&#39;s not specified by the client? =C2=A0Where would it appea=
r in<br>
the order in that case? =C2=A0Or would the connection be rejected?<br></blo=
ckquote><div><br></div><div>I presume any standards-compliant implementatio=
ns would reject the connection, including browsers.=C2=A0</div><div><br></d=
iv><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex;">


I suspect you&#39;ll encounter the same resistance to that as we&#39;ve see=
n<br>
against having the masking be optional, since as John says, we don&#39;t<br=
>
know what user-provided data might show up in the prepended metadata<br>
for a yet-to-be-thought-of extension that could end up on the wire<br>
unmasked. =C2=A0:-/</blockquote><div><br></div><div>There was significant o=
bjection from Maciej and others to even making masking listed as a specific=
 extension. =C2=A0I also think that leaving the possibility of any extensio=
n data unmasked would be frowned upon.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd6ea7217c2e4049d638576--

From jat@google.com  Mon Feb 28 19:41:05 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 52AB13A6D92 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:41:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.918
X-Spam-Level: 
X-Spam-Status: No, score=-105.918 tagged_above=-999 required=5 tests=[AWL=0.058, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ewRS0lyhtZYK for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 19:41:04 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id CC8D43A6A6B for <hybi@ietf.org>; Mon, 28 Feb 2011 19:41:03 -0800 (PST)
Received: from kpbe19.cbf.corp.google.com (kpbe19.cbf.corp.google.com [172.25.105.83]) by smtp-out.google.com with ESMTP id p213g5oD012416 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:42:05 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298950925; bh=lg4tBwTh1/CRm9Qdaw3M5eFqR4g=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=cly0kk7pY/k65Hc1fJVaqMaSZkmoc+sYEz8AkiElxfpGr4hTr5sh/pL9YmB/0YyKF JqQgN4FfDbM6B/i6qim8g==
Received: from yxh35 (yxh35.prod.google.com [10.190.2.227]) by kpbe19.cbf.corp.google.com with ESMTP id p213g3Ue022890 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 19:42:04 -0800
Received: by yxh35 with SMTP id 35so3139058yxh.22 for <hybi@ietf.org>; Mon, 28 Feb 2011 19:42:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=Bp+J2AP+Wx63kEtAyF4TbPjqxJS4gF2iannXmzaY080=; b=tcWEihoGJeJwC7XKuMIYZHGwNZ2GfmxNgLfAkBAfpYJL+CuOn7JoUPaQkBXFsEEY3o XK9eA3gqo9MK5glJrONQ==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=njvPMvxm3NIJ+Dqviqn6hiEVMa6nF74Wq2aTHot6UISNbWQYc6b2CJO61KifGU1yR4 hkE/+FEqBXfrshE4Ljqg==
Received: by 10.150.140.6 with SMTP id n6mr8143585ybd.160.1298950923312; Mon, 28 Feb 2011 19:42:03 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 19:41:43 -0800 (PST)
In-Reply-To: <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com> <AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com> <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com>
From: John Tamplin <jat@google.com>
Date: Mon, 28 Feb 2011 22:41:43 -0500
Message-ID: <AANLkTinEYY-Z6ezFyz-Smqa4-5_Pxy-1CJNOpcxUzm22@mail.gmail.com>
To: Greg Wilkins <gregw@webtide.com>
Content-Type: multipart/alternative; boundary=000e0cd375925d6111049d63940c
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 03:41:05 -0000

--000e0cd375925d6111049d63940c
Content-Type: text/plain; charset=UTF-8

On Mon, Feb 28, 2011 at 10:16 PM, Greg Wilkins <gregw@webtide.com> wrote:

> On 1 March 2011 12:50, Justin Lee <jlee@antwerkz.com> wrote:
> > Why can't the *server* send those pings?  I had actually considered
> making
> > grizzly do just that in the absence of any clear direction one way or the
> > other in the spec.
>
> Because it all depends on which end wants to keep the connection open.
>
> Typically it will be the client that knows the user has the "chat
> dialog" still open, so they know that the user wants to receive chat
> and thus still needs the websocket connection.
>
> Of course the client could tell the server with an ajax call and the
> server side application could configure the server side to send pings
> at some rate, but then after all that complication, the server would
> not know the browsers timeouts and would still end up sending pings
> more frequently than necessary.
>
> As I said, there is some thinking needed to work out exactly who sends
> the pings (application or infrastructure) and how applications
> communicate to the whoever sends the pings if they want the connection
> kept open or not..... Some of that consideration may involve the in
> browser API and would need to be discussed elsewhere.      So
> disclosing timeouts is not the end of the story, it's just a good
> first step that may enable some more intelligent behaviour other than
> sending frequent pings.


I really think if we are talking about keepalives and timeouts, this will
require much more effort to come to consensus on.  As an example of the
issues that arise -- if you are aggregating connections, whether in a
standard MUX extension or perhaps a vendor-specific tunnel, you probably
don't want to transport all the separate keep-alives across the channel, and
things like mobile implementations will want to put limits on what can be
chosen for keepalives for bandwidth and battery reasons.

I think it would be better to get the spec done with as few bells and
whistles as possible, and only then start working on things like specifying
keepalives.  Doing it right will probably also involve the application,
which means changing the JS API and yet more delay to get consensus across
groups.  If the application isn't involved, you will wind up having an
application-level keepalive on top of the channel keepalive and the ensuing
inefficiency.

-- 
John A. Tamplin
Software Engineer (GWT), Google

--000e0cd375925d6111049d63940c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Mon, Feb 28, 2011 at 10:16 PM, Greg Wilkins <=
span dir=3D"ltr">&lt;<a href=3D"mailto:gregw@webtide.com">gregw@webtide.com=
</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin=
:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">On 1 March 2011 12:50, Justin Lee &lt;<a href=3D"mailto:j=
lee@antwerkz.com">jlee@antwerkz.com</a>&gt; wrote:<br>
&gt; Why can&#39;t the *server* send those pings? =C2=A0I had actually cons=
idered making<br>
&gt; grizzly do just that in the absence of any clear direction one way or =
the<br>
&gt; other in the spec.<br>
<br>
</div>Because it all depends on which end wants to keep the connection open=
.<br>
<br>
Typically it will be the client that knows the user has the &quot;chat<br>
dialog&quot; still open, so they know that the user wants to receive chat<b=
r>
and thus still needs the websocket connection.<br>
<br>
Of course the client could tell the server with an ajax call and the<br>
server side application could configure the server side to send pings<br>
at some rate, but then after all that complication, the server would<br>
not know the browsers timeouts and would still end up sending pings<br>
more frequently than necessary.<br>
<br>
As I said, there is some thinking needed to work out exactly who sends<br>
the pings (application or infrastructure) and how applications<br>
communicate to the whoever sends the pings if they want the connection<br>
kept open or not..... Some of that consideration may involve the in<br>
browser API and would need to be discussed elsewhere. =C2=A0 =C2=A0 =C2=A0S=
o<br>
disclosing timeouts is not the end of the story, it&#39;s just a good<br>
first step that may enable some more intelligent behaviour other than<br>
sending frequent pings.</blockquote><div><br></div><div>I really think if w=
e are talking about keepalives and timeouts, this will require much more ef=
fort to come to consensus on. =C2=A0As an example of the issues that arise =
-- if you are aggregating connections, whether in a standard MUX extension =
or perhaps a vendor-specific tunnel, you probably don&#39;t want to transpo=
rt all the separate keep-alives across the channel, and things like mobile =
implementations will want to put limits on what can be chosen for keepalive=
s for bandwidth and battery reasons.</div>

<div><br></div><div>I think it would be better to get the spec done with as=
 few bells and whistles as possible, and only then start working on things =
like specifying keepalives. =C2=A0Doing it right will probably also involve=
 the application, which means changing the JS API and yet more delay to get=
 consensus across groups. =C2=A0If the application isn&#39;t involved, you =
will wind up having an application-level keepalive on top of the channel ke=
epalive and the ensuing inefficiency.</div>

</div><br>-- <br>John A. Tamplin<br>Software Engineer (GWT), Google<br>

--000e0cd375925d6111049d63940c--

From duerst@it.aoyama.ac.jp  Mon Feb 28 20:09:42 2011
Return-Path: <duerst@it.aoyama.ac.jp>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BEF1A3A6D16 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:09:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -99.854
X-Spam-Level: 
X-Spam-Status: No, score=-99.854 tagged_above=-999 required=5 tests=[AWL=-0.064, BAYES_00=-2.599, HELO_EQ_JP=1.244, HOST_EQ_JP=1.265, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kI-KEgS7PYKH for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:09:38 -0800 (PST)
Received: from scintmta02.scbb.aoyama.ac.jp (scintmta02.scbb.aoyama.ac.jp [133.2.253.34]) by core3.amsl.com (Postfix) with ESMTP id 942313A6D9D for <hybi@ietf.org>; Mon, 28 Feb 2011 20:09:38 -0800 (PST)
Received: from scmse02.scbb.aoyama.ac.jp ([133.2.253.231]) by scintmta02.scbb.aoyama.ac.jp (secret/secret) with SMTP id p214AYeV021079 for <hybi@ietf.org>; Tue, 1 Mar 2011 13:10:34 +0900
Received: from (unknown [133.2.206.133]) by scmse02.scbb.aoyama.ac.jp with smtp id 416f_c202_db39be7a_43b9_11e0_a95a_001d096c5782; Tue, 01 Mar 2011 13:10:34 +0900
Received: from [IPv6:::1] ([133.2.210.1]:40792) by itmail.it.aoyama.ac.jp with [XMail 1.22 ESMTP Server] id <S14DBF47> for <hybi@ietf.org> from <duerst@it.aoyama.ac.jp>; Tue, 1 Mar 2011 13:10:32 +0900
Message-ID: <4D6C71B3.8050404@it.aoyama.ac.jp>
Date: Tue, 01 Mar 2011 13:10:27 +0900
From: =?ISO-8859-1?Q?=22Martin_J=2E_D=FCrst=22?= <duerst@it.aoyama.ac.jp>
Organization: Aoyama Gakuin University
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.9) Gecko/20100722 Eudora/3.0.4
MIME-Version: 1.0
To: Greg Wilkins <gregw@webtide.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com>	<AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>	<AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com> <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com>
In-Reply-To: <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 04:09:42 -0000

On 2011/03/01 12:16, Greg Wilkins wrote:
> On 1 March 2011 12:50, Justin Lee<jlee@antwerkz.com>  wrote:
>> Why can't the *server* send those pings?  I had actually considered making
>> grizzly do just that in the absence of any clear direction one way or the
>> other in the spec.
>
> Because it all depends on which end wants to keep the connection open.
>
> Typically it will be the client that knows the user has the "chat
> dialog" still open, so they know that the user wants to receive chat
> and thus still needs the websocket connection.

Yes, but if that "chat dialog" isn't open anymore, the ping from the 
server won't be returned, and the server will know that it can close the 
connection. Or not?

Regards,   Martin.

-- 
#-# Martin J. Dürst, Professor, Aoyama Gakuin University
#-# http://www.sw.it.aoyama.ac.jp   mailto:duerst@it.aoyama.ac.jp

From gregw@intalio.com  Mon Feb 28 20:20:13 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 184A93A6DA1 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:20:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.109
X-Spam-Level: 
X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[AWL=-0.132, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t-8SIsTN02cW for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:20:12 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 4FF993A6D16 for <hybi@ietf.org>; Mon, 28 Feb 2011 20:20:12 -0800 (PST)
Received: by vxg33 with SMTP id 33so4267080vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 20:21:14 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr10521610vdb.190.1298953274144; Mon, 28 Feb 2011 20:21:14 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 20:21:14 -0800 (PST)
In-Reply-To: <AANLkTinEYY-Z6ezFyz-Smqa4-5_Pxy-1CJNOpcxUzm22@mail.gmail.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com> <AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com> <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com> <AANLkTinEYY-Z6ezFyz-Smqa4-5_Pxy-1CJNOpcxUzm22@mail.gmail.com>
Date: Tue, 1 Mar 2011 15:21:14 +1100
X-Google-Sender-Auth: fi-VYoTHzoqFCZI7Zj-PifgG8qU
Message-ID: <AANLkTim+HNMJtpWS1CKYLoVbLAYJmv15SukoxBXOD_Of@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 04:20:13 -0000

On 1 March 2011 14:41, John Tamplin <jat@google.com> wrote:
> I really think if we are talking about keepalives and timeouts, this will
> require much more effort to come to consensus on.

True - which is why I'm not proposing any such thing at this time.

I'm simply saying that there is a case to have Hello frames, and that
it would be reasonable content for those frames to carry a declaration
of timeouts and buffer sizes.      This can form the basis of future
work on a standardized keep alive mechanism.


regards

From gregw@intalio.com  Mon Feb 28 20:24:32 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED5523A698D for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:24:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.951
X-Spam-Level: 
X-Spam-Status: No, score=-1.951 tagged_above=-999 required=5 tests=[AWL=-0.274, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gMfC6vS1DO0c for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:24:32 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 25D4D3A6DAA for <hybi@ietf.org>; Mon, 28 Feb 2011 20:24:32 -0800 (PST)
Received: by vxg33 with SMTP id 33so4269202vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 20:25:33 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.169.161 with SMTP id af1mr10542403vdc.110.1298953533881; Mon, 28 Feb 2011 20:25:33 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 20:25:33 -0800 (PST)
In-Reply-To: <4D6C71B3.8050404@it.aoyama.ac.jp>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com> <AANLkTi=+1AK8F2Onk5quNijyT7Y6PZdPmv-w6NyfUMFt@mail.gmail.com> <AANLkTi=hwTVj_cvV6gtVpW90Mzp7=001ynyzCKeUdVOH@mail.gmail.com> <4D6C71B3.8050404@it.aoyama.ac.jp>
Date: Tue, 1 Mar 2011 15:25:33 +1100
X-Google-Sender-Auth: cb8yPUa8PKkixGmuuwrXTFMIUeQ
Message-ID: <AANLkTinU518Ru9dZNGWww55fW_qNJJ6R8QPC95BtK=7c@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: =?ISO-8859-1?Q?Martin_J=2E_D=FCrst?= <duerst@it.aoyama.ac.jp>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 04:24:33 -0000

On 1 March 2011 15:10, "Martin J. D=FCrst" <duerst@it.aoyama.ac.jp> wrote:
> Yes, but if that "chat dialog" isn't open anymore, the ping from the serv=
er
> won't be returned, and the server will know that it can close the
> connection. Or not?

Sure, but having the server send the pings doesn't help.  It knows
it's own timeouts, but it does not know the browsers timeouts, so the
question remains - how frequently should the pings be sent.

Unless there is disclosure of timeouts, then any keep alive (at the
protocol or application level) will just have to guess a low value and
send frequent messages to keep the channel alive.

For example, the current implementation of cometd over websocket sends
exactly the same packet at the same frequency as the long polling
implementation (defaults to 30s).  Sure the ws data density is a bit
better, but the long poll is < MTU anyway, so their is not a lot of
difference between them for sporadic traffic profiles.


regards

From gregw@intalio.com  Mon Feb 28 20:41:21 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B5E33A6DAF for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:41:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.644
X-Spam-Level: 
X-Spam-Status: No, score=-2.644 tagged_above=-999 required=5 tests=[AWL=0.333,  BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3KujHkKmZiiN for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 20:41:20 -0800 (PST)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id C0FE03A6A94 for <hybi@ietf.org>; Mon, 28 Feb 2011 20:41:20 -0800 (PST)
Received: by vws6 with SMTP id 6so4353594vws.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 20:42:22 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.173.78 with SMTP id bi14mr5011228vdc.30.1298954542579; Mon, 28 Feb 2011 20:42:22 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 20:42:22 -0800 (PST)
In-Reply-To: <AANLkTi=N=sEbwU4OCav+0me0-6mMMs_o6Qs8swwO8pDw@mail.gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <AANLkTimeXJiQy9U7UQKMB-X_Tjys-sJHy+5N+eewaEWi@mail.gmail.com> <569915DD-DE46-4B3D-85FE-B14D18639936@gmail.com> <AANLkTim_cfDz8_S+eBXp6OPD85mt-4MRVv0CZuze+B0H@mail.gmail.com> <AANLkTikYkaj6z9CtUeJ5YrBQWtVXWaObyUOdvQMzREFq@mail.gmail.com> <AANLkTi=N=sEbwU4OCav+0me0-6mMMs_o6Qs8swwO8pDw@mail.gmail.com>
Date: Tue, 1 Mar 2011 15:42:22 +1100
Message-ID: <AANLkTikhwPbc=5wZMK3E-gREmOuDFhoyhGsEWOxh=VZz@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: John Tamplin <jat@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Hybi <hybi@ietf.org>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 04:41:21 -0000

On 1 March 2011 14:37, John Tamplin <jat@google.com> wrote:
> There was significant objection from Maciej and others to even making
> masking listed as a specific extension. =A0I also think that leaving the
> possibility of any extension data unmasked would be frowned upon.

Indeed there were a few vocal opponents.    However, I do not think
they have well communicated the technical case against it.   I think
there were two concerns they expressed:

 1) That it could be turned off to the browsers - which I think is
adequately addressed simply by allowing the browser to make it
mandatory.
 2) That a server could be contacted by a non-WS client that
negotiates a no masking WS connection and then uses that send bytes in
the clear that may poison a cache.    However, I would think that any
non-WS client that was able to negotiate a WS connection would
obviously have pretty good capabilities to send arbitrary data.

On the other hand, there  are some clearly defined benefits of masking
as an extension within the frame:
  + framing symmetry
  + no masking within data centre
  + future agility to change masking.
  + the ability to turn off masking if SSL or similar is used.

In the context of this thread,  the subject of masking and how it
should apply to extension data came up.  My response that if we treat
masking as an extension and if we consider extensions as a change of
functions on the payload - then it is the extension order that gives a
clear indication of what masking applies to and what it does not.

So I know this is an oft repeated topic of conversation, but I do feel
that there is more support for masking as an extension than there is
opposition. There are also clear benefits vs unsubstantiated security
concerns.    I really really really don't want to start the security
debate again, as I think almost all that has been said there has been
said.     But that does not mean we have consensus on this issue, nor
does it mean the status quo should hold.

cheers

From w@1wt.eu  Mon Feb 28 22:02:51 2011
Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB2483A6CB5 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 22:02:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.975
X-Spam-Level: 
X-Spam-Status: No, score=-1.975 tagged_above=-999 required=5 tests=[AWL=0.068,  BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AGamKIUMKTrI for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 22:02:51 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id BBEA83A6C68 for <hybi@ietf.org>; Mon, 28 Feb 2011 22:02:50 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p2163n96011138; Tue, 1 Mar 2011 07:03:49 +0100
Date: Tue, 1 Mar 2011 07:03:49 +0100
From: Willy Tarreau <w@1wt.eu>
To: Greg Wilkins <gregw@intalio.com>
Message-ID: <20110301060349.GC9463@1wt.eu>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>
User-Agent: Mutt/1.4.2.3i
Cc: Hybi <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 06:02:52 -0000

On Tue, Mar 01, 2011 at 12:27:34PM +1100, Greg Wilkins wrote:
> On 1 March 2011 10:18, Gabriel Montenegro
> <Gabriel.Montenegro@microsoft.com> wrote:
> > [gab] Why would one side need to disclose timeouts to the other? Would a simpler approach work whereby either side would act on the timeouts by issuing a Ping at the appropriate time instead of disclosing the timeout. The other side's issuing a Pong would reset its timer (if it has not been sending anything else) and serves to suppress any Ping it would have otherwise sent.
> >
> 
> How does one side know what the appropriate time is?
> 
> If the server is configured with a  30s idle timeout, then the client
> needs to know to send a ping every < 30s if it wants to keep the
> connection alive.
> Thus the server needs to disclose that timeout so the client can act on it.
> 
> Ideally, any intermediary would also append any timeouts it has to the
> hello contents, so that timeouts can be known for the full path.

It could equally adjust the announced timeout to its own value if it's
lower. BTW I'd prefer to see a suggested heartbeat interval than a
timeout, because I can already imagine the number of situations where
client developers and server developers will fight considering that
the wrong timeout was announced. A suggested interval should be lower
than the timeout (typically half of the smallest one) and does not
look mandatory.

I'm even thinking that if we want to announce that, we'd better do that
in the initial HTTP handshake as a header, because it will be easy to
make any HTTP only intermediary add it or change it in the response.

That also means that it'd leave the ping usable for any purpose we
want :-)

Regards,
Willy


From gregw@intalio.com  Mon Feb 28 22:14:53 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 860433A6C68 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 22:14:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.177
X-Spam-Level: 
X-Spam-Status: No, score=-2.177 tagged_above=-999 required=5 tests=[AWL=-0.200, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0BotuwOPwGAL for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 22:14:52 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 146803A68B3 for <hybi@ietf.org>; Mon, 28 Feb 2011 22:14:50 -0800 (PST)
Received: by vxg33 with SMTP id 33so4324249vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 22:15:52 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.157.100 with SMTP id wl4mr10649036vdb.190.1298960152871; Mon, 28 Feb 2011 22:15:52 -0800 (PST)
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 22:15:52 -0800 (PST)
In-Reply-To: <20110301060349.GC9463@1wt.eu>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com> <AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com> <20110301060349.GC9463@1wt.eu>
Date: Tue, 1 Mar 2011 17:15:52 +1100
Message-ID: <AANLkTinv03KbpLL1oFupQzXCySNM9SDrmD8atsJftgR1@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Hybi <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Hello frames?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 06:14:53 -0000

On 1 March 2011 17:03, Willy Tarreau <w@1wt.eu> wrote:
> BTW I'd prefer to see a suggested heartbeat interval than a
> timeout,

work for me.

> I'm even thinking that if we want to announce that, we'd better do that
> in the initial HTTP handshake as a header,

Also fine with that

> That also means that it'd leave the ping usable for any purpose we
> want :-)

for a hello frame for example.

cheers

From gregw@intalio.com  Mon Feb 28 23:00:56 2011
Return-Path: <gregw@intalio.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 636B03A6ABB for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:00:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.085
X-Spam-Level: 
X-Spam-Status: No, score=-2.085 tagged_above=-999 required=5 tests=[AWL=-0.108, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dpB0ZhlrVlNA for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:00:55 -0800 (PST)
Received: from mail-vx0-f172.google.com (mail-vx0-f172.google.com [209.85.220.172]) by core3.amsl.com (Postfix) with ESMTP id 484813A6AA1 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:00:55 -0800 (PST)
Received: by vxg33 with SMTP id 33so4346928vxg.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:01:57 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.167.166 with SMTP id zp6mr10659841vdb.150.1298962917158; Mon, 28 Feb 2011 23:01:57 -0800 (PST)
Sender: gregw@intalio.com
Received: by 10.52.165.129 with HTTP; Mon, 28 Feb 2011 23:01:57 -0800 (PST)
In-Reply-To: <AANLkTik2LqCC2-ZLLdWNNaQ18ypcQU_5djJobkYtYk6T@mail.gmail.com>
References: <AANLkTik2LqCC2-ZLLdWNNaQ18ypcQU_5djJobkYtYk6T@mail.gmail.com>
Date: Tue, 1 Mar 2011 18:01:57 +1100
X-Google-Sender-Auth: WUqyr7mVsxcm06GiGvFs4Z-Ns4w
Message-ID: <AANLkTik+uh98b0n7U=xrE0Aaa7MyBfZVXSwj+8wfVTKW@mail.gmail.com>
From: Greg Wilkins <gregw@webtide.com>
To: Takeshi Yoshino <tyoshino@google.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: hybi@ietf.org
Subject: Re: [hybi] Payload only compression extension, again
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:00:56 -0000

On 1 March 2011 01:51, Takeshi Yoshino <tyoshino@google.com> wrote:
> Hi,
> Seeing several people preferring payload only compression, I'd like to
> resume discussion on it.

+1

> Requirements
> - Each message must be able to be uncompressed=A0immediately

+1

> - Want not to mess up dictionary by compressing incompressible messages

Is that to say that you don't want to compress fragments?
I'm cautious about this as we don't want to have to buffer up all
fragments before we can decompress.

> - Want to maintain the compression state (LZ77 sliding window and Huffman
> table)

+1, although it might be good to have this as an extension option that
can be turned off.

> - Want to keep separate dictionaries for messages with different
> characteristics
> -- Case 1: Binary and text mixed
> -- Case 2: Short and long mixed
> -- Case 3: Application data in data frame and control frame may have
> different characteristics

-1 too complex.

I think that eventually MUX will be available that will keep different
types of messages in different channels.
Until that time, I expect to see very little mixed usage on WS
connections as each usage will just open up a fresh connection.



> --- Apply DEFLATE only to data frame (Is it worth including control frame=
?)

+1

control frames should be in the clear, so that they can be considered
and handled without the need to track extension or extension state.


cheers

From andy.warmcat.com@googlemail.com  Mon Feb 28 23:24:36 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E5E93A6842 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:24:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.588
X-Spam-Level: 
X-Spam-Status: No, score=-3.588 tagged_above=-999 required=5 tests=[AWL=0.011,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EzopbDmEdRiA for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:24:35 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id C9A943A6804 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:24:34 -0800 (PST)
Received: by wyb42 with SMTP id 42so4837895wyb.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:25:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=JL+CgM2FVXudC3kgwhE/PihJFj4y4/zvgdzNEq6/9Yc=; b=RhLJjXNrvIfisbDRx5g9JnM05E0Wmcf4hf8zwmZupw2Fgnnl5+EGNFN8KJhhycJFwl PWB0xAfsw34r4Mnselu/47geQ5oADYZy8wqgRg9jfTNJMoNhAuiJ77ni9yD++5BVLlkB Prl4RQVH5ghgBCqAyWymp9zeZey+K9RCUG2eU=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=Xte9KHp/F3uYoJvw9KVXIgh0DGoglK39SSRjxo720WnrBqsHjsuE/DrO47XYX3gHSH aLrQ3McDGe16h55lF2w78TcgKgMJZxgA/ZPjpXu5vk7ENA6PfuC5hPIqryyWvpAVlN7x Pmg34nXyhXeYycXeXjSeCOnaqd3DWU0LvN5p0=
Received: by 10.227.154.129 with SMTP id o1mr5862508wbw.109.1298964336180; Mon, 28 Feb 2011 23:25:36 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id y29sm4002753wbd.4.2011.02.28.23.25.34 (version=SSLv3 cipher=OTHER); Mon, 28 Feb 2011 23:25:35 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6C9F6D.1030306@warmcat.com>
Date: Tue, 01 Mar 2011 07:25:33 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>	<AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>	<AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>	<AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>	<AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com>	<AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com>	<AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com>	<AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com>	<AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com>	<A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com>	<AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com>	<23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com>	<AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>	<30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
In-Reply-To: <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:24:36 -0000

On 03/01/2011 12:25 AM, Somebody in the thread at some point said:

Hi -

> Personally, it seems dangerous to not mask the extension data, since
> you don't know what extensions might carry data controllable by an

Yeah that was the context of the example packet, showing that moving the 
mask to be extension data you could control at most four bytes but then...

''To think about controllability of extension data, which would allow 
carrying on the data in the length bytes, leads to your other point 
about if structure of extension data is really OK as it stands''

> Even if we come up with something like a tag/value approach, I think
> we can't ever have intermediaries that understand the payload without
> understanding extensions -- for example, what do they do when they see
> a reserved opcode after an extension they didn't recognize was
> negotiated?

What would typically go in this per-packet extension area?  Maybe it 
could be moved into being just normal payload in other packets with 
extended opcodes, eliminating the extension area concept.

-Andy

From andy.warmcat.com@googlemail.com  Mon Feb 28 23:29:49 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2128F3A6A2A for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:29:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.589
X-Spam-Level: 
X-Spam-Status: No, score=-3.589 tagged_above=-999 required=5 tests=[AWL=0.010,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zDVv7tC2nLcA for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:29:47 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 5E68A3A6A32 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:29:46 -0800 (PST)
Received: by wyb42 with SMTP id 42so4840943wyb.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:30:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=0sE10AncwxKVNu6wjghKjip6VxgCpwFNSExm9Ad9Ypg=; b=F420Qsf8qW1QMdd0kWxbqRsvo7YWo3g7MccVNlTF1zRzBcomdipHPmT0o6t+R8QxyP w/F6f7H/dYOgMOU5g9bU9VXEyQZwyHSrM/xU8myXuUiK8kuVR7KfAayN4+W/9tewZPdq HQ2+gSH9khOBs/XYTZc9aGpowGeP0ZWZ8FfvI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=OviqzSZH+/KWg4KrZa4J7SFs4vncsvu+kgJkpDVO6kEOdhAyqAuvP9SDiOxxDD0Im/ fLJoTDYSoOt56HvIDQ3tIRCzUf9LpFQsukLrj/xrb9TY717hs0UFXWQ5nG5PkVjoFWOi XMQtNxRxzzBdRFcGNXl0AOA+MCA92JOfL32DQ=
Received: by 10.227.59.17 with SMTP id j17mr5773522wbh.228.1298964648132; Mon, 28 Feb 2011 23:30:48 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id x1sm4007091wbh.2.2011.02.28.23.30.47 (version=SSLv3 cipher=OTHER); Mon, 28 Feb 2011 23:30:47 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6CA0A6.7000401@warmcat.com>
Date: Tue, 01 Mar 2011 07:30:46 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Greg Wilkins <gregw@intalio.com>
References: <AANLkTikb1eShW7yrLpAAv7YrmHon2ZY38fkFw-c8To-T@mail.gmail.com>	<CA566BAEAD6B3F4E8B5C5C4F61710C1126EB84A2@TK5EX14MBXW602.wingroup.windeploy.ntdev.microsoft.com>	<AANLkTikQsxynAaSN0V8aE_bc2=Ba3N4Luf0QU0R1Pux8@mail.gmail.com>	<20110301060349.GC9463@1wt.eu> <AANLkTinv03KbpLL1oFupQzXCySNM9SDrmD8atsJftgR1@mail.gmail.com>
In-Reply-To: <AANLkTinv03KbpLL1oFupQzXCySNM9SDrmD8atsJftgR1@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>, Gabriel Montenegro <Gabriel.Montenegro@microsoft.com>
Subject: Re: [hybi] Hello / idle timeout
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:29:49 -0000

On 03/01/2011 06:15 AM, Somebody in the thread at some point said:
> On 1 March 2011 17:03, Willy Tarreau<w@1wt.eu>  wrote:
>> BTW I'd prefer to see a suggested heartbeat interval than a
>> timeout,
>
> work for me.

Isn't it better to think of this as "idle timeout" for the channel?  If 
there's normal traffic coming from the other guy at any time, actually 
the receiver can take that as a PONG for a PING he didn't have to send 
and reset his idle timeout.  It's only after the channel is idle for the 
idle timeout he has to think about making synthetic traffic via PING to 
confirm all is still well.

>> I'm even thinking that if we want to announce that, we'd better do that
>> in the initial HTTP handshake as a header,
>
> Also fine with that

That sounds like a good way.

>> That also means that it'd leave the ping usable for any purpose we
>> want :-)
>
> for a hello frame for example.

If you accept the idle timeout concept, in fact any traffic -- and 
someone is probably planning to send something when they set up the 
connection -- will serve as resetting the channel and explicit hello 
probing at the start isn't needed.

-Andy

From jat@google.com  Mon Feb 28 23:35:33 2011
Return-Path: <jat@google.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 46CBB3A69FB for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:35:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.723
X-Spam-Level: 
X-Spam-Status: No, score=-105.723 tagged_above=-999 required=5 tests=[AWL=0.254, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nd4KApEayRg8 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:35:31 -0800 (PST)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by core3.amsl.com (Postfix) with ESMTP id 806583A69AB for <hybi@ietf.org>; Mon, 28 Feb 2011 23:35:31 -0800 (PST)
Received: from wpaz1.hot.corp.google.com (wpaz1.hot.corp.google.com [172.24.198.65]) by smtp-out.google.com with ESMTP id p217aWNg010504 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:36:33 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1298964993; bh=tTf8OLfaD7FtBPirJtY0z171Qrk=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type:Content-Transfer-Encoding; b=BhfmsjMWfQN9paxJhXeXzGajULgxHU09lUwCs2xWp+2FCj0QftrOEe6hhqAEvskHX f7gTQjExPoWASPd01k8Hg==
Received: from gyd8 (gyd8.prod.google.com [10.243.49.200]) by wpaz1.hot.corp.google.com with ESMTP id p217aVOK024559 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <hybi@ietf.org>; Mon, 28 Feb 2011 23:36:31 -0800
Received: by gyd8 with SMTP id 8so2210189gyd.32 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:36:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=XMNNiNOKG0w6zELJnALOmmSWYz9QVqI3jVx4rVIHZDE=; b=gQdHuyPnyHzpxGcOoSUJhR+GJYSdFLxHBFnQh2sM8sC7MmPsH7gerSD1BPSeJy/1tb OBzA07+p5vN9S/DD/jaw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=tuynH+H5yI9DUNrBdhnpDM/pv5frglI3Xcucc6CTgIXukUo2g46boByQ9qz36nWoZ7 0InhFGKFZoTVO8Kv0xXQ==
Received: by 10.150.149.16 with SMTP id w16mr4031171ybd.217.1298964991136; Mon, 28 Feb 2011 23:36:31 -0800 (PST)
MIME-Version: 1.0
Received: by 10.150.200.16 with HTTP; Mon, 28 Feb 2011 23:36:11 -0800 (PST)
In-Reply-To: <4D6C9F6D.1030306@warmcat.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <4D6C9F6D.1030306@warmcat.com>
From: John Tamplin <jat@google.com>
Date: Tue, 1 Mar 2011 02:36:11 -0500
Message-ID: <AANLkTin_3ctQg=JJ3RYh3DZc-zogW_f--rwyCcrbM2G3@mail.gmail.com>
To: Andy Green <andy@warmcat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:35:33 -0000

On Tue, Mar 1, 2011 at 2:25 AM, Andy Green <andy@warmcat.com> wrote:
> What would typically go in this per-packet extension area? =C2=A0Maybe it=
 could
> be moved into being just normal payload in other packets with extended
> opcodes, eliminating the extension area concept.

Again, the whole reason we have this framing was that we could get
consensus on it.  We went around and around for months on different
ideas of particular ways to represent extensions, some with tag/value
extension data, some with nested opcodes, etc.  We only made progress
when we defined a bare framing that could be extended later to
implement any of these choices.

Please, let's not revisit the basic framing discussion.

--=20
John A. Tamplin
Software Engineer (GWT), Google

From andy.warmcat.com@googlemail.com  Mon Feb 28 23:35:52 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 957E23A6A89 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:35:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.59
X-Spam-Level: 
X-Spam-Status: No, score=-3.59 tagged_above=-999 required=5 tests=[AWL=0.009,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZwVx50Fpl0Lg for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:35:51 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id B45963A69AB for <hybi@ietf.org>; Mon, 28 Feb 2011 23:35:50 -0800 (PST)
Received: by wyb42 with SMTP id 42so4844698wyb.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:36:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=AZKA62ro17V7BN+CrC4UGWdKjFWOYhhke6dTPYh9z9k=; b=TzjN2S/n/1VqAo7kb4r/5i4v5TH+LwbFo7PNI9M7ZP0DH0rti8XoJh2wiZA0AYq2a7 hviL/uSUY6+niAsVbQa//h/+h97Gwqw65Nf6qvvgkxLGrWhf6QnX/Pmuyh4FUlslGNyl FRx2aZuhGu2Vc5YIyx3k1PZZvAanhmFkMep+o=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=aXrGbTuJhdAfF4yZrEVUnzorA9UMm/P0zKuSDzyD07jojDtQtO75TEN1ha+tfiAl/4 M0crxXCJVD8+l53ztgT+x8005Ot7J627u38wkG8KMwRgFyoaIswEFsjaPvvslL0ZZaIu HyDtA8SEQrrxOciiMOjqlFnCQaj6mHx4kogyg=
Received: by 10.227.10.202 with SMTP id q10mr5737832wbq.202.1298965012587; Mon, 28 Feb 2011 23:36:52 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id bd8sm241190wbb.1.2011.02.28.23.36.50 (version=SSLv3 cipher=OTHER); Mon, 28 Feb 2011 23:36:51 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6CA212.40204@warmcat.com>
Date: Tue, 01 Mar 2011 07:36:50 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: Brian McKelvey <theturtle32@gmail.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com>	<AANLkTi=65LMo=kUv5uKNM5DeUNKFtnY6xks2UgsFEEWq@mail.gmail.com>	<AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com>	<AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com>	<AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com>	<AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com>	<AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com>	<AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com>	<AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com>	<A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com>	<AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com>	<23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com>	<AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com>	<30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com>	<AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <33B46028-223B-48C6-AA17-88FBE046E064@gmail.com>
In-Reply-To: <33B46028-223B-48C6-AA17-88FBE046E064@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:35:52 -0000

On 03/01/2011 03:03 AM, Somebody in the thread at some point said:

> That seems fine to me.  My main concern was to make sure something
> like a wireshark packet interpreter can find the extension/payload
> data field, whether or not it can interpret the contents due to
> unsupported extensions.

Don't forget a packet snooper is screwed by the mask already in current 
draft, it doesn't know if the packet is client -> server and has a 
4-byte mask prepended, or server -> client and lacks it.

It could be solved by moving the mask down the packet at least a byte or 
two and using a reserved bit in the first header byte to indicate if the 
mask is coming next or not.

-Andy

From Yutaka_Takeda@PlayStation.Sony.Com  Mon Feb 28 23:36:10 2011
Return-Path: <Yutaka_Takeda@PlayStation.Sony.Com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 237EA3A69AB for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:36:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.995
X-Spam-Level: 
X-Spam-Status: No, score=-5.995 tagged_above=-999 required=5 tests=[AWL=0.269,  BAYES_00=-2.599, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gzxji3k8bB7U for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:36:08 -0800 (PST)
Received: from paris.playstation.sony.com (nat.playstation.sony.com [69.36.131.254]) by core3.amsl.com (Postfix) with ESMTP id 58BC13A6AA4 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:36:08 -0800 (PST)
Received: from constantine.playstation.sony.com ([162.49.67.15]) by paris.playstation.sony.com (Lotus Domino Release 8.5.1FP5) with ESMTP id 2011022823370325-263566 ; Mon, 28 Feb 2011 23:37:03 -0800 
In-Reply-To: <AANLkTinTqHtG+HmjBm4n2yS3Ouz+Fw3i_R_Gf7qx0vn1@mail.gmail.com>
To: John Tamplin <jat@google.com>
MIME-Version: 1.0
X-KeepSent: D3C37398:B2A4BACA-88257846:002385CC; type=4; flags=0; name=$KeepSent
X-Mailer: Lotus Notes Release 7.0.2 September 26, 2006
Message-ID: <OFD3C37398.B2A4BACA-ON88257846.002385CC-88257846.0029DE5F@playstation.sony.com>
From: Yutaka_Takeda@PlayStation.Sony.Com
Date: Mon, 28 Feb 2011 23:37:17 -0800
X-MIMETrack: Serialize by Router on SCEA919ML04/SCEA(Release 8.5.1FP3|May 23, 2010) at 02/28/2011 11:37:02 PM, Serialize complete at 02/28/2011 11:37:02 PM, Itemize by SMTP Server on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/28/2011 11:37:03 PM, Serialize by Router on SCEA919ML02/SCEA(Release 8.5.1FP5|September 29, 2010) at 02/28/2011 11:37:11 PM, Serialize complete at 02/28/2011 11:37:11 PM
Content-Type: multipart/alternative; boundary="=_alternative 0029DE5C88257846_="
Cc: hybi@ietf.org
Subject: Re: [hybi] With deflate-stream, Close frame doesn't work as an end of data marker
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:36:10 -0000

This is a multipart message in MIME format.
--=_alternative 0029DE5C88257846_=
Content-Type: text/plain; charset="US-ASCII"

Hi John,

hybi-bounces@ietf.org wrote on 02/28/2011 06:32:03 AM:

> [BTW - here is the thread where I first posted results of an
> experiment 
- http://www.ietf.org/mail-archive/web/hybi/current/msg01810.html
> ]
> 
> On Mon, Feb 28, 2011 at 4:52 AM, Greg Wilkins <gregw@webtide.com> wrote:
> > I'm +1 for compression within the frame.
> >
> > If we compress the framing, then intermediaries will have to
> > decompress in order to see framing and to know when to forward etc.
> > It also has significant debug issues as it makes it much harder to
> > decode a partial frame capture.
> >
> > I understand the argument that compression will not be as good, but I
> > think some compromise is necessary.
> 
> The framing is pretty small and it is hard to imagine much redundancy
> from the header (the opcode and reserved bits will be constant, but
> then you will interfere with the compression by all the constantly
> changing lengths), so I think little is lost by compressing only the
> payload.

Just to be clear, the compression does not have to be per payload of
a data frame, but can be entire stream of messages application passes in.
At the end of the message, though, F_SYNC_FLUSH is necessary to prevent 
receiver from waiting for the last compressed data to arrive from sender, 
but we should be aware that the compressor still maintains 32kB(or 
whatever 
it is configured for) of reference range in its context.

> 
> However, it does mean the implementation is more complicated, and I

It is actually very simple, in python for example:


        zlibObj = zlib.compressobj()

        def send(in_data):
                buf = zlibObj.compress(in_data)
                buf += zlibObj.flush(zilib.Z_SYNC_FLUSH)
                        :
                (construct frames/fragments and put into a queue)

Note: the 'zlibObj' has the same lifetime as that of WebSocket.


> don't believe this would be feasible using the stock inflate/deflate
> in Java for example.  I would not agree to just compressing each
> frame's payload independently -- my earlier experiments show this will
> frequently increase the size of the data and result in only modest
> savings compared to maintaining compression state over the life of the
> connection (while we are discussing it, 

Again, lifetime of the compression state/context can be the same. It 
just needs, Z_SYNC_FLUSH operation at the end of the 'WS-frame' to avoid 
unnecessary delay. Even compression was done for whole stream, we still 
need Z_SYNC_FLUSH per frame basis with the exact same reason - we cannot
delay the frame! (Unless we introduce nagle's algorithm like protocol
just for slightly better compression ratio, which I think would not be
feasible.) This, at least to me, looks more complicated.

I am aware that, if application passes in is very small message 
frequently, (Z_SYNC_FLUSH has to be done frequently), resulting 
compression ratio would not be that great. However, since we can not 
delay each frame, we need the Z_SYNC_FLUSH anyways. Therefore, there's 
no benefit in having compression layer under the framing layer.

As I mentioned earlier, the compression state can be shared between 
text and binary messages since they are not interleaved (even fragmented),
though it may be better to have dedicated compression state if we can
afford memory. Either way, we need to define the spec in the document.


- Yutaka


> we should talk about the
> parameters to use for deflate to minimize memory requirements on the
> server -- experiments done for compression in SPDY [mentioned in the
> linked thread] show you can get most of the benefit with more modest
> memory requirements using lower parameters).
> 
> It also means we have to agree on the details of how it should be
> specified, which is why the super-simple deflate-stream was added to
> the standard instead of trying to get agreement on something better.
> 
> --
> John A. Tamplin
> Software Engineer (GWT), Google
> _______________________________________________
> hybi mailing list
> hybi@ietf.org
> https://www.ietf.org/mailman/listinfo/hybi

--=_alternative 0029DE5C88257846_=
Content-Type: text/html; charset="US-ASCII"


<br><tt><font size=2>Hi John,</font></tt>
<br>
<br><tt><font size=2>hybi-bounces@ietf.org wrote on 02/28/2011 06:32:03
AM:<br>
<br>
&gt; [BTW - here is the thread where I first posted results of an<br>
&gt; experiment -&nbsp;http://www.ietf.org/mail-archive/web/hybi/current/msg01810.html<br>
&gt; ]<br>
&gt; <br>
&gt; On Mon, Feb 28, 2011 at 4:52 AM, Greg Wilkins &lt;gregw@webtide.com&gt;
wrote:<br>
&gt; &gt; I'm +1 for compression within the frame.<br>
&gt; &gt;<br>
&gt; &gt; If we compress the framing, then intermediaries will have to<br>
&gt; &gt; decompress in order to see framing and to know when to forward
etc.<br>
&gt; &gt; It also has significant debug issues as it makes it much harder
to<br>
&gt; &gt; decode a partial frame capture.<br>
&gt; &gt;<br>
&gt; &gt; I understand the argument that compression will not be as good,
but I<br>
&gt; &gt; think some compromise is necessary.<br>
&gt; <br>
&gt; The framing is pretty small and it is hard to imagine much redundancy<br>
&gt; from the header (the opcode and reserved bits will be constant, but<br>
&gt; then you will interfere with the compression by all the constantly<br>
&gt; changing lengths), so I think little is lost by compressing only the<br>
&gt; payload.</font></tt>
<br>
<br><tt><font size=2>Just to be clear, the compression does not have to
be per payload of</font></tt>
<br><tt><font size=2>a data frame, but can be entire stream of messages
application passes in.</font></tt>
<br><tt><font size=2>At the end of the message, though, F_SYNC_FLUSH is
necessary to prevent </font></tt>
<br><tt><font size=2>receiver from waiting for the last compressed data
to arrive from sender, </font></tt>
<br><tt><font size=2>but we should be aware that the compressor still maintains
32kB(or whatever </font></tt>
<br><tt><font size=2>it is configured for) of reference range in its context.</font></tt>
<br><tt><font size=2><br>
&gt; <br>
&gt; However, it does mean the implementation is more complicated, and
I</font></tt>
<br>
<br><tt><font size=2>It is actually very simple, in python for example:</font></tt>
<br>
<br>
<br><tt><font size=2>&nbsp; &nbsp; &nbsp; &nbsp; zlibObj = zlib.compressobj()</font></tt>
<br>
<br><tt><font size=2>&nbsp; &nbsp; &nbsp; &nbsp; def send(in_data):</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp;buf = zlibObj.compress(in_data)</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp;buf += zlibObj.flush(zilib.Z_SYNC_FLUSH)</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; :</font></tt>
<br><tt><font size=2>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; (construct frames/fragments and put into a queue)</font></tt>
<br>
<br><tt><font size=2>Note: the 'zlibObj' has the same lifetime as that
of WebSocket.</font></tt>
<br>
<br><tt><font size=2><br>
&gt; don't believe this would be feasible using the stock inflate/deflate<br>
&gt; in Java for example. &nbsp;I would not agree to just compressing each<br>
&gt; frame's payload independently -- my earlier experiments show this
will<br>
&gt; frequently increase the size of the data and result in only modest<br>
&gt; savings compared to maintaining compression state over the life of
the<br>
&gt; connection (while we are discussing it, </font></tt>
<br>
<br><tt><font size=2>Again, lifetime of the compression state/context can
be the same. It </font></tt>
<br><tt><font size=2>just needs, Z_SYNC_FLUSH operation at the end of the
'WS-frame' to avoid </font></tt>
<br><tt><font size=2>unnecessary delay. Even compression was done for whole
stream, we still </font></tt>
<br><tt><font size=2>need Z_SYNC_FLUSH per frame basis with the exact same
reason - we cannot</font></tt>
<br><tt><font size=2>delay the frame! (Unless we introduce nagle's algorithm
like protocol</font></tt>
<br><tt><font size=2>just for slightly better compression ratio, which
I think would not be</font></tt>
<br><tt><font size=2>feasible.) This, at least to me, looks more complicated.</font></tt>
<br>
<br><tt><font size=2>I am aware that, if application passes in is very
small message </font></tt>
<br><tt><font size=2>frequently, (Z_SYNC_FLUSH has to be done frequently),
resulting </font></tt>
<br><tt><font size=2>compression ratio would not be that great. However,
since we can not </font></tt>
<br><tt><font size=2>delay each frame, we need the Z_SYNC_FLUSH anyways.
Therefore, there's </font></tt>
<br><tt><font size=2>no benefit in having compression layer under the framing
layer.</font></tt>
<br>
<br><tt><font size=2>As I mentioned earlier, the compression state can
be shared between </font></tt>
<br><tt><font size=2>text and binary messages since they are not interleaved
(even fragmented),</font></tt>
<br><tt><font size=2>though it may be better to have dedicated compression
state if we can</font></tt>
<br><tt><font size=2>afford memory. Either way, we need to define the spec
in the document.</font></tt>
<br>
<br>
<br><tt><font size=2>- Yutaka</font></tt>
<br>
<br><tt><font size=2><br>
&gt; we should talk about the<br>
&gt; parameters to use for deflate to minimize memory requirements on the<br>
&gt; server -- experiments done for compression in SPDY [mentioned in the<br>
&gt; linked thread] show you can get most of the benefit with more modest<br>
&gt; memory requirements using lower parameters).</font></tt>
<br><tt><font size=2>&gt; <br>
&gt; It also means we have to agree on the details of how it should be<br>
&gt; specified, which is why the super-simple deflate-stream was added
to<br>
&gt; the standard instead of trying to get agreement on something better.<br>
&gt; <br>
&gt; --<br>
&gt; John A. Tamplin<br>
&gt; Software Engineer (GWT), Google<br>
&gt; _______________________________________________<br>
&gt; hybi mailing list<br>
&gt; hybi@ietf.org<br>
&gt; https://www.ietf.org/mailman/listinfo/hybi<br>
</font></tt>
--=_alternative 0029DE5C88257846_=--

From andy.warmcat.com@googlemail.com  Mon Feb 28 23:41:04 2011
Return-Path: <andy.warmcat.com@googlemail.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6C6343A6AA1 for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:41:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.59
X-Spam-Level: 
X-Spam-Status: No, score=-3.59 tagged_above=-999 required=5 tests=[AWL=0.009,  BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ykRDnXHMlyzr for <hybi@core3.amsl.com>; Mon, 28 Feb 2011 23:41:02 -0800 (PST)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by core3.amsl.com (Postfix) with ESMTP id 8BF753A6A03 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:41:02 -0800 (PST)
Received: by wyb42 with SMTP id 42so4847552wyb.31 for <hybi@ietf.org>; Mon, 28 Feb 2011 23:42:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=O3OH+HOIqm11Ip/ueK1s44ticZwnX6Q0dUokQktRi7U=; b=WkHUQKJd32ssA8XHwnJ29M9hjrFj5zPfCd7qJa/ZMFi/gwJDIip9kmW4rYecb/q+2x R50gsZvMYea2W8oCw1/k5hC3JU4+NcvvEJ1xHoKVQTrbat2ciCO9AY0MEc0AGYW+1PwL AuIFlCdQJPHablIN76rYzrhk66pjJyQGYPQ/U=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=eGe+aj8GqLXo0uRwGm052sU1cYBTMrzfZIrkvYHvLKTIO7l9SDUnzzFcdotBJhxfXh JD1klVoo5Qo1EV4aeQFLViQ3HSZjYfUozphCexc72xmgXqFpCsx/GU7DFeugDYNpSgWY yUeBBq0eq4jmDC0KLQZOzhiOwkU1IGSAMNqNc=
Received: by 10.227.27.222 with SMTP id j30mr5909199wbc.129.1298965324330; Mon, 28 Feb 2011 23:42:04 -0800 (PST)
Received: from otae.warmcat.com (cpc1-nrte21-2-0-cust677.8-4.cable.virginmedia.com [81.111.78.166]) by mx.google.com with ESMTPS id o6sm4009120wbo.15.2011.02.28.23.42.03 (version=SSLv3 cipher=OTHER); Mon, 28 Feb 2011 23:42:03 -0800 (PST)
Sender: Andy Green <andy.warmcat.com@googlemail.com>
Message-ID: <4D6CA34A.3050301@warmcat.com>
Date: Tue, 01 Mar 2011 07:42:02 +0000
From: Andy Green <andy@warmcat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101217 Fedora/3.1.7-0.39.b3pre.fc15 Thunderbird/3.1.7
MIME-Version: 1.0
To: John Tamplin <jat@google.com>
References: <AANLkTindH-Eu8GvsdtG7dgr+8MpQaaeRA7KTEBGz0sh-@mail.gmail.com> <AANLkTi=2fUyryrRGDcS5Bqb-C2YPhRqJuKwUUkZnCBOu@mail.gmail.com> <AANLkTinjmXiYy3f_XFDAazwEYW1vw2gu92sWKJckm=s5@mail.gmail.com> <AANLkTikjM=O2QEBdu8DYeSQinN_i4HSozz5w9Hg1HBt5@mail.gmail.com> <AANLkTinrLf_7DUGE3ko4xBOd1L3NZBhqGK+OLn_DB51F@mail.gmail.com> <AANLkTim6wsce_eYvt2_N+43K1f=JtbfJQsyqb=s0JNhs@mail.gmail.com> <AANLkTikkSxF60H-pZgxcz0SXgozsG4gJ2xEgMweNRwJs@mail.gmail.com> <AANLkTi=7VMnwWSUxU7yTa49dShP0FVVzeSpX6gVNAGpM@mail.gmail.com> <A5CFA133-90EF-4AFD-BB50-41365DDDAB84@gmail.com> <AANLkTin9cUwb80grTPJCgTWoCjc31z3J8D5ekzeAanuU@mail.gmail.com> <23EC9206-34BB-454E-888F-4F41D4B24F9A@gmail.com> <AANLkTikvNHND6GKjyDwR85ts2+d66Amw0bA_XVL+FhQt@mail.gmail.com> <30DBC9B6-A495-4CD9-8CBF-E79FD713B1D2@gmail.com> <AANLkTi=UKMeROxs_sEvJG6w+PC+jfsboLRRGtU+OSj0W@mail.gmail.com> <4D6C9F6D.1030306@warmcat.com> <AANLkTin_3ctQg=JJ3RYh3DZc-zogW_f--rwyCcrbM2G3@mail.gmail.com>
In-Reply-To: <AANLkTin_3ctQg=JJ3RYh3DZc-zogW_f--rwyCcrbM2G3@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Hybi <hybi@ietf.org>, Greg Wilkins <gregw@intalio.com>
Subject: Re: [hybi] Masked framing VS mask in frame
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2011 07:41:04 -0000

On 03/01/2011 07:36 AM, Somebody in the thread at some point said:
> On Tue, Mar 1, 2011 at 2:25 AM, Andy Green<andy@warmcat.com>  wrote:
>> What would typically go in this per-packet extension area?  Maybe it could
>> be moved into being just normal payload in other packets with extended
>> opcodes, eliminating the extension area concept.
>
> Again, the whole reason we have this framing was that we could get
> consensus on it.  We went around and around for months on different
> ideas of particular ways to represent extensions, some with tag/value
> extension data, some with nested opcodes, etc.  We only made progress
> when we defined a bare framing that could be extended later to
> implement any of these choices.
>
> Please, let's not revisit the basic framing discussion.

Well, I feel your pain, but it's notable nothing has been suggested to 
need that extension area per-packet and it's legitimate to ask for an 
example of what would need it and if we can get rid of it.  I'm not 
asking out of the blue it is part of looking at moving masking down the 
packet and make sure it can't run on into the undefined extension area 
in a controllable way.

If there are reasonable examples I am happy to accept that and forget 
about it.

-Andy
