IETF Logo Mail Archive

Re: Fwd: New Version Notification for draft-nottingham-http2-encryption-03.txt

Martin Thomson <martin.thomson@gmail.com> Tue, 27 May 2014 17:24 UTC

Return-Path: <ietf-http-wg-request@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48AEE1A0546 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 27 May 2014 10:24:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.653
X-Spam-Level:
X-Spam-Status: No, score=-7.653 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.651, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ImZozV1_-7jh for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 27 May 2014 10:24:39 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC0A11A0535 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Tue, 27 May 2014 10:24:37 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.72) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1WpL3f-0005gc-JO for ietf-http-wg-dist@listhub.w3.org; Tue, 27 May 2014 17:21:03 +0000
Resent-Date: Tue, 27 May 2014 17:21:03 +0000
Resent-Message-Id: <E1WpL3f-0005gc-JO@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.72) (envelope-from <martin.thomson@gmail.com>) id 1WpL3X-0005fx-Pj for ietf-http-wg@listhub.w3.org; Tue, 27 May 2014 17:20:55 +0000
Received: from mail-wg0-f52.google.com ([74.125.82.52]) by maggie.w3.org with esmtps (TLS1.0:RSA_ARCFOUR_SHA1:16) (Exim 4.72) (envelope-from <martin.thomson@gmail.com>) id 1WpL3W-0004qI-Sv for ietf-http-wg@w3.org; Tue, 27 May 2014 17:20:55 +0000
Received: by mail-wg0-f52.google.com with SMTP id l18so9752089wgh.11 for <ietf-http-wg@w3.org>; Tue, 27 May 2014 10:20:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=vkV03veugZAgpcgdMl35ILdN3ouAZYPHkvHaV+lqPxI=; b=ZvwyJgrLPXsJh1wePVbKaKA5ePSZuRTQUNZIdPmPNNwmh4aJ6nlispj5n8f5qTxs9U BJDxTnoYS35SlQdQoJmPJ5l7sTotnTLSjCmUnJM3d6He8TTm1Qwy8k2uWCPzbWt/y6cD rRkDX+c7nqgnZvc1YVMvmUeiYYX8D0o4xqDbEK4SBe5IszNSRiSdY+pBla7De7HNoh8R q7M1up9ibvtmzfm73+fJo3b7gYxvGL0CVt7vq4/JSH3i+qQYIli/FbMBtxGIZIocn8Wr qcXPs2Mx1gtMcLGyZ1rfZQmYQ6DGE0qAhU5m6cN43YSLpjbY2L+qWF+cHRDEoe0YYEe5 84sg==
MIME-Version: 1.0
X-Received: by 10.195.18.8 with SMTP id gi8mr41500244wjd.75.1401211228395; Tue, 27 May 2014 10:20:28 -0700 (PDT)
Received: by 10.194.235.163 with HTTP; Tue, 27 May 2014 10:20:28 -0700 (PDT)
In-Reply-To: <op.xghr0msriw9drz@uranium.bredbandsbolaget.se>
References: <20140520034054.10225.92036.idtracker@ietfa.amsl.com> <5905C797-A8E2-417B-94AB-589C174382BA@mnot.net> <op.xghr0msriw9drz@uranium.bredbandsbolaget.se>
Date: Tue, 27 May 2014 10:20:28 -0700
Message-ID: <CABkgnnWMWsVSD6sZiZn=hJe8OpBKw1hycQe6jUd9Q2tW3Mitaw@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: Martin Nilsson <nilsson@opera.com>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: text/plain; charset="UTF-8"
Received-SPF: pass client-ip=74.125.82.52; envelope-from=martin.thomson@gmail.com; helo=mail-wg0-f52.google.com
X-W3C-Hub-Spam-Status: No, score=-3.5
X-W3C-Hub-Spam-Report: AWL=-2.739, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001
X-W3C-Scan-Sig: maggie.w3.org 1WpL3W-0004qI-Sv ff98d59b2846b7a91de9025d633fe286
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Fwd: New Version Notification for draft-nottingham-http2-encryption-03.txt
Archived-At: <http://www.w3.org/mid/CABkgnnWMWsVSD6sZiZn=hJe8OpBKw1hycQe6jUd9Q2tW3Mitaw@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/23866
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

On 26 May 2014 17:08, Martin Nilsson <nilsson@opera.com> wrote:
> #2 As a transparent proxy you could observe a client make a request, get an
> response lacking alt-svc, and inject one to get the client to connect
> through TLS to the proxy (given client support). The proxy needs a way to
> distinguish between these TLS connections and "real" (opportunistic or
> https-initiated) TLS connections from the client, which currently can only
> be done by picking a differnt port that is unlikely (or probed not) to be in
> use. It would mess with alt-svc caching however.

I think that the decision so far has been to keep proxy use orthogonal
to its operation.

Yes, as defined, a transparent proxy could opportunistically upgrade
either (or both) links that it maintains.  It won't be able to make
this situation more permanent though, that would enable a DoS attack.

v2.23.0 | Report a Bug | By Email