IETF Logo Mail Archive

Re: Invalid HTTP2 preface handling?

Greg Wilkins <gregw@intalio.com> Wed, 11 February 2015 04:19 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ietf.org@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACD261A1B53 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 10 Feb 2015 20:19:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.289
X-Spam-Level:
X-Spam-Status: No, score=-6.289 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jw9DHB3QBXew for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 10 Feb 2015 20:19:46 -0800 (PST)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAD3F1A1B3C for <httpbisa-archive-bis2Juki@lists.ietf.org>; Tue, 10 Feb 2015 20:19:46 -0800 (PST)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1YLOil-0004CZ-FR for ietf-http-wg-dist@listhub.w3.org; Wed, 11 Feb 2015 04:16:15 +0000
Resent-Date: Wed, 11 Feb 2015 04:16:15 +0000
Resent-Message-Id: <E1YLOil-0004CZ-FR@frink.w3.org>
Received: from lisa.w3.org ([128.30.52.41]) by frink.w3.org with esmtp (Exim 4.80) (envelope-from <gregw@intalio.com>) id 1YLOid-0004Bo-4G for ietf-http-wg@listhub.w3.org; Wed, 11 Feb 2015 04:16:07 +0000
Received: from mail-lb0-f180.google.com ([209.85.217.180]) by lisa.w3.org with esmtps (TLS1.0:RSA_ARCFOUR_SHA1:16) (Exim 4.72) (envelope-from <gregw@intalio.com>) id 1YLOib-0001XG-Iy for ietf-http-wg@w3.org; Wed, 11 Feb 2015 04:16:07 +0000
Received: by mail-lb0-f180.google.com with SMTP id z12so937134lbi.11 for <ietf-http-wg@w3.org>; Tue, 10 Feb 2015 20:15:38 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=B2Gs3ysISkN0CEWlkON+qSSlbicK+2ufbN1LArOG1FU=; b=UZ4w0z3PwAKzqiKq59abTDGclFwxzG11rkuZsKid0AWz3P3b2kJm1i130ceSEzLDyN 0TF9tywA9tiBxNHgStcPvsvdJgOY8VXNkpNXKsfaRTyZzgPFoCQ4s43H7RjcUhKCdmUm tn7fT/5VKV3hCVFtPZjlFaAQ5foPGrpkSq343w2ZiTnE/KmsrW2hGlfY/FHRkJI11Yu+ wxLFVYORWcy6Vgl2Eh0kw4Le4gddLVJnNSEJaynLpmM0OmxuIBzyk5Llc40Lzzk1hTNH 9nYhxxSfsV8uPfkVlQD1IsNY/88avvXzwq12XEk4+xnEVSd5OIJ1ZT35vpp514fgZl7d js7A==
X-Gm-Message-State: ALoCoQnALQ30Yl+P/mxsEG/99/369sNdGOrpOrCl9lyPYLqK3IHkyPpfwXY+loEt2iZcaBS12cFD
MIME-Version: 1.0
X-Received: by 10.152.9.170 with SMTP id a10mr26204582lab.1.1423628138267; Tue, 10 Feb 2015 20:15:38 -0800 (PST)
Received: by 10.114.57.7 with HTTP; Tue, 10 Feb 2015 20:15:38 -0800 (PST)
In-Reply-To: <54DABF12.70609@treenet.co.nz>
References: <CAH_y2NE5Sa625XEec5WXJ7LdjK+h1b4M=Fc-_iGj2ZQKa1q_jg@mail.gmail.com> <5C91DE2C-BC82-4142-B292-815EED3627EC@mnot.net> <54DAA3A4.8060608@treenet.co.nz> <CAH_y2NG0_Y9nnDjLd2Fc_5wBessfy0DOfKBfkH8NiKjyzAiRVg@mail.gmail.com> <54DABF12.70609@treenet.co.nz>
Date: Wed, 11 Feb 2015 15:15:38 +1100
Message-ID: <CAH_y2NG5DtZ3zBP7FsUy392i8pcaHvTWvOdHODSi2gZ9vEZ_7g@mail.gmail.com>
From: Greg Wilkins <gregw@intalio.com>
To: Amos Jeffries <squid3@treenet.co.nz>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary="001a1132f49a795b74050ec841c6"
Received-SPF: permerror client-ip=209.85.217.180; envelope-from=gregw@intalio.com; helo=mail-lb0-f180.google.com
X-W3C-Hub-Spam-Status: No, score=-3.6
X-W3C-Hub-Spam-Report: AWL=-2.923, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001
X-W3C-Scan-Sig: lisa.w3.org 1YLOib-0001XG-Iy 4db41634bef2ee0fb803e4050ca9eda5
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Invalid HTTP2 preface handling?
Archived-At: <http://www.w3.org/mid/CAH_y2NG5DtZ3zBP7FsUy392i8pcaHvTWvOdHODSi2gZ9vEZ_7g@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/28811
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

On 11 February 2015 at 13:31, Amos Jeffries <squid3@treenet.co.nz> wrote:

>
> I agree with Mark completely about the 2.0 -> 1.1 transition being
> dangerous. 1.1 has a scary amount of legacy tolerances and gaps where
> nastiness can squeeze through.
>

I'm not really sure I see the difference between a 1.1 port being able to
opportunistically upgrade to 2.0 if it see a preface vs a 2.0 port doing a
downgrade if it sees as non-preface.    Both look the same to clients
regardless if they speak HTTP/1 or HTTP/2

Anyway, I've got my answer.  There is no specific threat, just a preference
to not allow such a simple upgrade/downgrade for the sake of prudence.    I
can accept that and while I'm still considering supporting a preface based
version switch, it will be a use-at-own-risk private feature.

cheers


-- 
Greg Wilkins <gregw@intalio.com>  @  Webtide - *an Intalio subsidiary*
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.

v2.46.0 | Report a Bug | By Email | System Status