Re: AD review of draft-ietf-httpbis-alt-svc-10

Stephen Farrell <stephen.farrell@cs.tcd.ie> Wed, 13 January 2016 19:22 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86A341B310C for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 13 Jan 2016 11:22:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.003
X-Spam-Level:
X-Spam-Status: No, score=-7.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Q08dLW2xRej for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 13 Jan 2016 11:22:29 -0800 (PST)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03D281A21BF for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 13 Jan 2016 11:22:25 -0800 (PST)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1aJQx4-0007io-5a for ietf-http-wg-dist@listhub.w3.org; Wed, 13 Jan 2016 19:19:26 +0000
Resent-Date: Wed, 13 Jan 2016 19:19:26 +0000
Resent-Message-Id: <E1aJQx4-0007io-5a@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <stephen.farrell@cs.tcd.ie>) id 1aJQwx-0007i7-UY for ietf-http-wg@listhub.w3.org; Wed, 13 Jan 2016 19:19:19 +0000
Received: from mercury.scss.tcd.ie ([134.226.56.6]) by maggie.w3.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from <stephen.farrell@cs.tcd.ie>) id 1aJQwu-0005Se-Ol for ietf-http-wg@w3.org; Wed, 13 Jan 2016 19:19:19 +0000
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id DD52FBE80; Wed, 13 Jan 2016 19:18:52 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VbLRkVHAHWbj; Wed, 13 Jan 2016 19:18:50 +0000 (GMT)
Received: from [10.87.48.91] (unknown [86.41.53.98]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id EAF98BE8A; Wed, 13 Jan 2016 19:18:49 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1452712730; bh=q6WLoOZRkXytMF5WLoTXRCW2eHd7f1NBGt53/svIL3c=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=EmYmQ1qs9Xlafx3HSnsgmgs0z0L6qCWAoE/VrofpBUp8fMYB99Ns+GLfD8+Su/BjW wv4MuDw5MJT5KNV0kg3D5NhM7YH1rQ4y8Ei65ag7o/+IwfKHrE1aFv8hnNdvVBtK8P dEVIVbgoSjrhgjNlnnR6TtykvaBss2ZK7OrFUPig=
To: Mike Bishop <Michael.Bishop@microsoft.com>, Barry Leiba <barryleiba@computer.org>
References: <CALaySJK5fYy_JCv0Y7Fs3QpPk95fUxyt272JMc-QUpVKO7_gJA@mail.gmail.com> <56853BCC.7030005@gmx.de> <56927D52.2000106@gmx.de> <CALaySJ+mVOHinmehK2jm3jQaEkXJZ2BRbaY4a5wuw=eOOO-A9Q@mail.gmail.com> <BN3PR03MB13675838E560ED08916D245187C90@BN3PR03MB1367.namprd03.prod.outlook.com> <5693DC2E.7010001@cs.tcd.ie> <569562B6.904@cs.tcd.ie> <BN3PR03MB13677294EE2ABFE14D0A56D087CA0@BN3PR03MB1367.namprd03.prod.outlook.com> <CALaySJ+918e-VO2V6HTK6OnQc0kQrY-YYj=ZToxs3wXxZqjvCg@mail.gmail.com> <56962487.6030709@cs.tcd.ie> <BN3PR03MB1367417E3088E4AD82F9B53887CB0@BN3PR03MB1367.namprd03.prod.outlook.com>
Cc: Julian Reschke <julian.reschke@gmx.de>, "draft-ietf-httpbis-alt-svc@ietf.org" <draft-ietf-httpbis-alt-svc@ietf.org>, HTTP Working Group <ietf-http-wg@w3.org>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url=
Message-ID: <5696A318.4010808@cs.tcd.ie>
Date: Wed, 13 Jan 2016 19:18:48 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <BN3PR03MB1367417E3088E4AD82F9B53887CB0@BN3PR03MB1367.namprd03.prod.outlook.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Received-SPF: pass client-ip=134.226.56.6; envelope-from=stephen.farrell@cs.tcd.ie; helo=mercury.scss.tcd.ie
X-W3C-Hub-Spam-Status: No, score=-8.6
X-W3C-Hub-Spam-Report: AWL=1.701, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_IRA=-1, W3C_IRR=-3, W3C_WL=-1
X-W3C-Scan-Sig: maggie.w3.org 1aJQwu-0005Se-Ol 9963a32d78a31c522ae53db02179957f
X-Original-To: ietf-http-wg@w3.org
Subject: Re: AD review of draft-ietf-httpbis-alt-svc-10
Archived-At: <http://www.w3.org/mid/5696A318.4010808@cs.tcd.ie>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/30920
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>


On 13/01/16 19:16, Mike Bishop wrote:
> Yes, that's obviously a mitigation servers can set up, but that means
> we're telling existing servers they need to disallow something that's

Well s/need/can/ I think, but sure.

> newly defined in order to prevent their users from hijacking them.
> And I don't believe retroactive guidance like that is reasonable --
> that will lag actual deployment of the protocol, and will never be
> 100%.
> 
> My proposal was that ~eve remains able to advertise an Alt-Svc, but
> that alternative must then authenticate itself as users.example.com
> (which Eve's proxy cannot do) before clients will use it.
> 
> I remain a little unhappy with this as it stands, but if no one else
> thinks it's a problem, I'll stop now.

Yeah, ditto:-)

Cheers
S

> 
> -----Original Message----- From: Stephen Farrell
> [mailto:stephen.farrell@cs.tcd.ie] Sent: Wednesday, January 13, 2016
> 2:19 AM To: Barry Leiba <barryleiba@computer.org>; Mike Bishop
> <Michael.Bishop@microsoft.com> Cc: Julian Reschke
> <julian.reschke@gmx.de>; draft-ietf-httpbis-alt-svc@ietf.org; HTTP
> Working Group <ietf-http-wg@w3.org> Subject: Re: AD review of
> draft-ietf-httpbis-alt-svc-10
> 
> 
> Hiya,
> 
> Yes, I'm fine that ~eve in Mike's scenario can muck with ~alice as
> specified. (And such servers still do exist, we have one still.)
> 
> I'd say best would be to call that attack out in the draft, but I
> don't think the mitigation for the misbehaviour is to authenticate
> ~eve, which is what the text below seems to be saying. Authenticating
> the web server for the name will help of course, but surely the real
> mitigation for that attack is for the server to scrub the alt-svc
> headers? (And to be clear, yes the port number thing is fine, I don't
> think system ports is a deal these days.)
> 
> All of the above of course also assumes that the "changing host"
> stuff is worked out well, which I'm sure it is or will be, but
> haven't checked.
> 
> S
> 
> On 13/01/16 00:34, Barry Leiba wrote:
>> The point with all this, in my mind and with respect to the text we
>>  have, is whether it makes any practical difference any more
>> whether Eve sets this up on port 23412 or on port 1000.  My
>> contention is that it doesn't, these days (while it might have in
>> the past), and that implying that it's safe if the alt-svc is on a
>> low-numbered port, but not safe (or less safe) if it's on a
>> high-numbered port isn't doing any service to anyone.
>> 
>> I think we should alert people to the possible
>> attack/issues/whatever, but that we should not imply that any set
>> of ports enjoy any sort of immunity against or resistance to those
>> attacks.
>> 
>> b
>> 
>> 
>> On Tue, Jan 12, 2016 at 5:09 PM, Mike Bishop 
>> <Michael.Bishop@microsoft.com> wrote:
>>> More whether you're okay with that text as mitigation to this
>>> hypothetical attack:
>>> 
>>> http://users.example.com is a shared server which hosts user home
>>> pages.  Eve places a config file in her wwwpages directory to add
>>> an Alt-Svc header to pages served out of
>>> http://users.example.com/~eve announcing an alternative service
>>> for http://users.example.com on port 23412.  Bob is using an
>>> Alt-Svc-capable browser.  After Bob has visited
>>> http://users.example.com/~eve, he visits
>>> http://users.example.com/~alice.  His browser, obeying Eve's
>>> Alt-Svc header, accesses the alternative service on port 23412,
>>> where Eve is running a forward proxy that replaces all pages
>>> except her own with dancing hamsters.
>>> 
>>> The original mitigations proposed in the text were "prohibit
>>> normal users from setting the Alt-Svc header" (which is
>>> retroactive on pre-Alt-Svc servers) or "prohibit normal users
>>> from listening for incoming requests" (which is contrary to the
>>> security model of any shared machine I've used).  This scenario
>>> originally made me want to require strong auth on any change of
>>> endpoint, but that breaks the opportunistic security draft.  The
>>> current text, which I agree does very little, was as strong as we
>>> could think of a way to make it without breaking the way Opp-Sec
>>> wanted to work.
>>> 
>>> I haven't seen such a server since I was in college, so I don't
>>> know whether they still actually exist and run that way.  I
>>> presume they do, even if rare, but I have no data.
>>> 
>>> -----Original Message----- From: Stephen Farrell
>>> [mailto:stephen.farrell@cs.tcd.ie] Sent: Tuesday, January 12,
>>> 2016 12:32 PM To: Mike Bishop <Michael.Bishop@microsoft.com>;
>>> Barry Leiba <barryleiba@computer.org>; Julian Reschke
>>> <julian.reschke@gmx.de> Cc: draft-ietf-httpbis-alt-svc@ietf.org;
>>> HTTP Working Group <ietf-http-wg@w3.org> Subject: Re: AD review
>>> of draft-ietf-httpbis-alt-svc-10
>>> 
>>> 
>>> 
>>> On 11/01/16 16:45, Stephen Farrell wrote:
>>>> 
>>>> 
>>>> On 11/01/16 16:34, Mike Bishop wrote:
>>>>> Haven't heard back from Stephen on the port-change issue we
>>>>> wanted him to weigh in on; I sent him a reminder.
>>>> 
>>>> 2nd one worked:-)
>>>> 
>>>> Lemme go back and read the mail. Please hassle me if I've not
>>>> gotten back by tomorrow sometime
>>> 
>>> So as I understand it (thanks Barry), the issue is whether or not
>>> this text is ok:
>>> 
>>> "Clients can reduce this risk by imposing stronger requirements
>>> (e.g. strong authentication) when moving from System Ports to
>>> User or Dynamic Ports, or from User Ports to Dynamic Ports, as
>>> defined in Section 6 of [RFC6335]."
>>> 
>>> FWIW, I have no problem with that. I'm not sure quite what it's 
>>> telling a client to do, but I don't think there's much difference
>>>  these days between lower numbered and higher numbered ports. (If
>>>  that's wrong, I'm sure someone will correct me:-)
>>> 
>>> Note that I've not read the rest of the document, just that bit.
>>> 
>>> Cheers, S.
>>> 
>>>> 
>>>> Cheers, S.
>>>> 
>>>>> 
>>>>> -----Original Message----- From: barryleiba@gmail.com 
>>>>> [mailto:barryleiba@gmail.com] On Behalf Of Barry Leiba Sent:
>>>>>  Sunday, January 10, 2016 9:20 AM To: Julian Reschke 
>>>>> <julian.reschke@gmx.de> Cc:
>>>>> draft-ietf-httpbis-alt-svc@ietf.org; HTTP Working Group 
>>>>> <ietf-http-wg@w3.org> Subject: Re: AD review of 
>>>>> draft-ietf-httpbis-alt-svc-10
>>>>> 
>>>>>>>> I don't think this is a 2119 "MAY": what *else* can it
>>>>>>>> do?  You have no other guidance about which alternative
>>>>>>>> alternative to pick, so....  I think this should just
>>>>>>>> say, "it chooses the most suitable...."
>>>>>>> 
>>>>>>> Agreed. I haven't changed that yet as it affects
>>>>>>> normative language but I will unless somebody wants to
>>>>>>> defend it soonish.
>>>>>> 
>>>>>> <https://github.com/httpwg/http-extensions/commit/a9df1e33703a2cb4
>>>>>>
>>>>>> 
6c
>>>>>> 9b
>>>>>> 
>>>>>> 
>>>> 441bfca5bbc04fff80d1>
>>>>> 
>>>>> Nice.  Is this the last of the updates, or are we still
>>>>> working on any?  Whenever you're ready to post a new I-D
>>>>> version, I'll give it a check and request last call.
>>>>> 
>>>>> Barry
>>>>> 
>>>> 
>>>> 
>>