Re: SECDIR review of draft-ietf-httpbis-alt-svc-12

[Mark Nottingham <[e-mail]>]

> On 25 Feb 2016, at 11:44 PM, Julian Reschke <[e-mail]> wrote:
> 
> On 2016-02-22 18:45, Julian Reschke wrote:
>> On 2016-02-22 00:43, Mark Nottingham wrote:
>>> FYI; we got a secdir review of alt-svc, with some editorial issues.
>>> 
>>> 
>>>> Begin forwarded message:
>>>> 
>>>> From: Mark Nottingham <[e-mail]>
>>>> Subject: Re: SECDIR review of draft-ietf-httpbis-alt-svc-12
>>>> Date: 22 February 2016 at 10:42:02 AM AEDT
>>>> To: Chris Lonvick <[e-mail]>
>>>> Cc: "[e-mail]" <[e-mail]>, "[e-mail]"
>>>> <[e-mail]>, [e-mail]
>>>> 
>>>> Hi Chris,
>>>> 
>>>> Thanks for the review. See:
>>>>  https://github.com/httpwg/http-extensions/commit/23d3b09374c077
>>>> ...
>> 
>> 
>> I'm not totally OK with all the edits, for instance we now have
>> normative language in notes, and a lowercase "required" has sneaked in.
>> 
>> Will review tomorrow.
> 
> OK, here we go. Below are the changes that IMHO need to be reviewed as they affect normative language:
> 
> 
>> Section 2., paragraph 11:
>> OLD:
>> 
>>    Alt-Svc MAY occur in any HTTP response message, regardless of the
>>    status code.  Note that recipients of Alt-Svc are free to ignore the
>>    header field (and indeed need to in some situations; see Sections 2.1
>>    and 6).
>> 
>> NEW:
>> 
>>    Alt-Svc MAY occur in any HTTP response message, regardless of the
>>    status code.  Note that recipients of Alt-Svc MAY ignore the header
>>    field (and are required to in some situations; see Sections 2.1 and
>>    6).
> 
> This should be reverted; the actual requirements are in Sections 2.1 and 6, and we should not have them in multiple places.

Agreed.

> 
>> Section 4., paragraph 2:
>> OLD:
>> 
>>    The ALTSVC frame is a non-critical extension to HTTP/2.  Endpoints
>>    that do not support this frame can safely ignore it.
>> 
>> NEW:
>> 
>>    The ALTSVC frame is a non-critical extension to HTTP/2.  Endpoints
>>    that do not support this frame MAY ignore it.
> 
> This is IMHO misleading as it is true for any unknown frame. It just follows from <http://greenbytes.de/tech/webdav/rfc7540.html#rfc.section.4.1>:
> 
> "Implementations MUST ignore and discard any frame that has a type that is unknown."

Would adding "as per [RFC7540], Section 4.1" help?


> 
>> Section 4., paragraph 13:
>> OLD:
>> 
>>    The ALTSVC frame is intended for receipt by clients; a server that
>>    receives an ALTSVC frame can safely ignore it.
>> 
>> NEW:
>> 
>>    The ALTSVC frame is intended for receipt by clients.  A device acting
>>    as a server MUST ignore it.
> 
> I'm ok with this one (but wanted to highlight the new normative requirement).
> 
> Best regards, Julian
> 
> 

--
Mark Nottingham   https://www.mnot.net/