Re: WebSocket2

Kari Hurtta <hurtta-ietf@elmme-mailer.org> Tue, 04 October 2016 15:25 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C8741298B2 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 4 Oct 2016 08:25:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.917
X-Spam-Level:
X-Spam-Status: No, score=-9.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.996, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cw4xQeElFHWQ for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 4 Oct 2016 08:25:01 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C250812955A for <httpbisa-archive-bis2Juki@lists.ietf.org>; Tue, 4 Oct 2016 08:25:01 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1brRWV-0005bu-GO for ietf-http-wg-dist@listhub.w3.org; Tue, 04 Oct 2016 15:20:51 +0000
Resent-Date: Tue, 04 Oct 2016 15:20:51 +0000
Resent-Message-Id: <E1brRWV-0005bu-GO@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <hurtta@siilo.fmi.fi>) id 1brRWT-0005bA-OX for ietf-http-wg@listhub.w3.org; Tue, 04 Oct 2016 15:20:49 +0000
Received: from smtpvgate.fmi.fi ([193.166.223.36]) by maggie.w3.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from <hurtta@siilo.fmi.fi>) id 1brRWJ-0002Ld-Gf for ietf-http-wg@w3.org; Tue, 04 Oct 2016 15:20:47 +0000
Received: from virkku.fmi.fi (virkku.fmi.fi [193.166.211.54]) (envelope-from hurtta@siilo.fmi.fi) by smtpVgate.fmi.fi (8.13.8/8.13.8/smtpgate-20160114/smtpVgate) with ESMTP id u94FK7eL019773 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 4 Oct 2016 18:20:07 +0300
Received: from shell.siilo.fmi.fi by virkku.fmi.fi with ESMTP id u94FK7lf026654 ; Tue, 4 Oct 2016 18:20:07 +0300
Received: from shell.siilo.fmi.fi ([127.0.0.1]) by shell.siilo.fmi.fi with ESMTP id u94FK7Vm008977 ; Tue, 4 Oct 2016 18:20:07 +0300
Received: by shell.siilo.fmi.fi id u94FK6vV008976; Tue, 4 Oct 2016 18:20:06 +0300
Message-Id: <201610041520.u94FK6vV008976@shell.siilo.fmi.fi>
In-Reply-To: <CAH9hSJaMsKaoTK+kr2X_GP_T7=jcDQtFLSusYrV+nDWCadcyxg@mail.gmail.com>
References: <CAG-EYChPJpAzoEuNwY3cNz503d0FRbNnDx_9AsNsZyfb5nmN0g@mail.gmail.com> <20161002080030.5F328160CC@welho-filter4.welho.com> <20161002101548.GA9450@LK-Perkele-V2.elisa-laajakaista.fi> <201610021110.u92BAWpi019029@shell.siilo.fmi.fi> <20161002124346.GB9450@LK-Perkele-V2.elisa-laajakaista.fi> <201610021340.u92DeBBL029907@shell.siilo.fmi.fi> <20161002171905.GA10108@LK-Perkele-V2.elisa-laajakaista.fi> <201610030440.u934e3kL031002@shell.siilo.fmi.fi> <CAG-EYCgEs1oSdLeLVwd12ECaL=+3pzytuy89xFWvvKCEY8fi4g@mail.gmail.com> <CAH9hSJaMsKaoTK+kr2X_GP_T7=jcDQtFLSusYrV+nDWCadcyxg@mail.gmail.com>
To: Takeshi Yoshino <tyoshino@google.com>
Date: Tue, 4 Oct 2016 18:20:06 +0300 (EEST)
Sender: hurtta@siilo.fmi.fi
From: Kari Hurtta <hurtta-ietf@elmme-mailer.org>
CC: Van Catha <vans554@gmail.com>, Kari Hurtta <hurtta-ietf@elmme-mailer.org>, Ilari Liusvaara <ilariliusvaara@welho.com>, HTTP working group mailing list <ietf-http-wg@w3.org>
X-Mailer: ELM [version ME+ 2.5 PLalpha41]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"
X-Filter: smtpVgate.fmi.fi: 3 received headers rewritten with id 20161004/20602/01
X-Filter: smtpVgate.fmi.fi: ID 20602/01, 1 parts scanned for known viruses
X-Filter: virkku.fmi.fi: ID 11119/01, 1 parts scanned for known viruses
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-3.0 (smtpVgate.fmi.fi [193.166.223.36]); Tue, 04 Oct 2016 18:20:07 +0300 (EEST)
Received-SPF: none client-ip=193.166.223.36; envelope-from=hurtta@siilo.fmi.fi; helo=smtpVgate.fmi.fi
X-W3C-Hub-Spam-Status: No, score=-6.7
X-W3C-Hub-Spam-Report: AWL=-0.181, BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-2.64, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: maggie.w3.org 1brRWJ-0002Ld-Gf 9f5e8d63487c64fc1ea5e56ba579ff96
X-Original-To: ietf-http-wg@w3.org
Subject: Re: WebSocket2
Archived-At: <http://www.w3.org/mid/201610041520.u94FK6vV008976@shell.siilo.fmi.fi>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32464
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

Takeshi Yoshino <tyoshino@google.com>om>: (Tue Oct  4 14:12:25 2016)
> Hi Van, Kari,
> 
> On Tue, Oct 4, 2016 at 1:39 AM, Van Catha <vans554@gmail.com> wrote:
> 
> <snip>
> 
> 
> > Kari Hurtta
> >
> > > Well, I think the following would work and avoid SETTINGS:
> > >
> >
> 
> Yutaka's proposal required the SETTINGS_WEBSOCKET_CAPABLE SETTINGS
> parameter because we planned to use special framing (use of HTTP2 framing
> level features not used for HTTP1.1/h2 layering). We wanted allow endpoints
> to make sure that the h2 intermediaries between them are able to forward
> WS/HTTP2's special framing correctly.
> 
> So, for the current proposal by Van where only the DATA frame is used as
> well as HTTP1.1/h2 layering, it's unnecessary.

I contemplated SETTINGS as:

∙ SETTINGS frame with SETTINGS_WEBSOCKET_CAPABLE = 1
  from HTTP/2 server ⇒  HTTP/1 client direction

  ∘ Promises that HTTP/2 server checks ":scheme"
    (and specially "wss" and "ws")

  ∘ Acknowledges that DATA frames for
    ":scheme" = "wss" and "ws" are handled
    as bidirectional traffic (similar than
    ":method" = "CONNECT").

    In other words these DATA drames do
    NOT form HTTP request body from client 
    and DATA drames do not form
    HTTP response body from server
    (on cases ":scheme" = "wss" and "ws").
   
  ∘ SETTINGS_WEBSOCKET_CAPABLE = 1 does
    not promise that HTTP/2 server
    accepts ":scheme" = "wss" or "ws".

  (※)

∙ Promise of HTTP/1 client (⇒ HTTP/2 server)
  is implied with ":scheme" = "wss" or "ws". 

> > > -> :method ws2
> > > -> :scheme wss
> > > -> :authority foo.example
> > > -> :path /bar
> > > -> <optional extra parameters, e.g. compression support>
> > > <- :status 200
> > > <- sec-ws2-ack 1
> > > <- <optional negotiated extras>
> >
> >
> :scheme is needed, yes.
> 
> Not sure about need for "sec-ws2-ack". For WebSocket/TCP, we employed the
> Sec-WebSocket-Key/Accept challenge/response in order to prevent the
> WebSocket protocol from being abused for cross protocol attacks e.g. SMTP.
> If all the intermediaries and servers correctly investigate the :scheme
> header and don't get confused, "sec-ws2-ack" is unnecessary. Regarding
> ws/h2-RFC6455 bridging, a correctly implemented intermediary facing ws/h2
> capable node and ws/h2 non-capable node would just perform RFC 6455
> handshake as Kari suggested. So, no problem.

Ilari Liusvaara suggested sec-ws2-ack for check that
":scheme" is not ignored (if I remember correctly).

/ Kari Hurtta



(※)  Yes, on my network picture there is 
     many HTTP/2 servers and clients:

    +---------------------------+
    | Web browser or other      |
    | WebSockect client         |
    +---------------------------+   [ HTTP/2 client ]
                 ⇓
                 ⇓
    +---------------------------+   [ HTTP/2 server ]
    | forward proxy configure   |     ( client uses CONNECT
    | on web blowser            |       tunnel if encypted scheme )
    +---------------------------+  [ HTTP/2 client ]
                 ⇓
                 ⇓
    +---------------------------+  [ HTTP/2 client ]
    | reverse proxy for         |   ( may include TLS offloading,
    | :authority                |     if encryption is used )
    +---------------------------+  [ HTTP/2 client ] 
                 ⇓
                 ⇓
    +---------------------------+  [ HTTP/2 server ]
    | origin server             |
    |                           |
    +---------------------------+


SETTINGS frame is for one hop between
HTTP/2 server and HTTP/2 client.