IETF Logo Mail Archive

Re: Framing and control-frame continuations

Amos Jeffries <squid3@treenet.co.nz> Thu, 07 February 2013 01:24 UTC

Return-Path: <ietf-http-wg-request@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40E8221F8514 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 6 Feb 2013 17:24:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.221
X-Spam-Level:
X-Spam-Status: No, score=-10.221 tagged_above=-999 required=5 tests=[AWL=0.378, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PXQKmAKWPGEo for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 6 Feb 2013 17:24:00 -0800 (PST)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) by ietfa.amsl.com (Postfix) with ESMTP id 6B12221F84FB for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 6 Feb 2013 17:23:58 -0800 (PST)
Received: from lists by frink.w3.org with local (Exim 4.72) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1U3GBk-00007j-PE for ietf-http-wg-dist@listhub.w3.org; Thu, 07 Feb 2013 01:22:08 +0000
Resent-Date: Thu, 07 Feb 2013 01:22:08 +0000
Resent-Message-Id: <E1U3GBk-00007j-PE@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.72) (envelope-from <squid3@treenet.co.nz>) id 1U3GBT-00006w-1q for ietf-http-wg@listhub.w3.org; Thu, 07 Feb 2013 01:21:51 +0000
Received: from ip-58-28-153-233.static-xdsl.xnet.co.nz ([58.28.153.233] helo=treenet.co.nz) by maggie.w3.org with esmtp (Exim 4.72) (envelope-from <squid3@treenet.co.nz>) id 1U3GBR-0002vS-TT for ietf-http-wg@w3.org; Thu, 07 Feb 2013 01:21:51 +0000
Received: from [192.168.1.103] (unknown [14.1.64.4]) by treenet.co.nz (Postfix) with ESMTP id 96EE0E72D0; Thu, 7 Feb 2013 14:21:25 +1300 (NZDT)
Message-ID: <51130191.9050601@treenet.co.nz>
Date: Thu, 07 Feb 2013 14:21:21 +1300
From: Amos Jeffries <squid3@treenet.co.nz>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130107 Thunderbird/17.0.2
MIME-Version: 1.0
To: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
CC: ietf-http-wg@w3.org
References: <CAP+FsNemzHOH1YrDXbEqy_dMB8h=e2pD0QrgLzkz+cUtdHMaRw@mail.gmail.com> <511242BC.4040207@treenet.co.nz> <20130206170624.GA17660@LK-Perkele-VII>
In-Reply-To: <20130206170624.GA17660@LK-Perkele-VII>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Received-SPF: pass client-ip=58.28.153.233; envelope-from=squid3@treenet.co.nz; helo=treenet.co.nz
X-W3C-Hub-Spam-Status: No, score=-3.3
X-W3C-Hub-Spam-Report: AWL=-3.321, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001
X-W3C-Scan-Sig: maggie.w3.org 1U3GBR-0002vS-TT 857da8bc8b66a2553b2efd531ec66fd7
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Framing and control-frame continuations
Archived-At: <http://www.w3.org/mid/51130191.9050601@treenet.co.nz>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/16433
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

On 7/02/2013 6:06 a.m., Ilari Liusvaara wrote:
> On Thu, Feb 07, 2013 at 12:47:08AM +1300, Amos Jeffries wrote:
>
>> Magic" below.  I've been holding this off while I try to figure out
>> what bit ranges the TLS handshakes are detectible with. It seems
>> 32-bits is required if we merge TLS port 443 traffic into this
>> magic, but I'm not yet completely certain of that.
> AFAIK, the first bytes from client in current TLS connections are:
>
> 0x16 (Handshake packet)
> 0x03 (SSLv3 or TLS v1.x)
> 0x00-0x03 (At least until TLSv1.3 appears, that would use 0x04).
>
> Then there's the SSLv2 compatiblity handshake. Hope nothing uses
> that anymore.
>
> -Ilari

Thank you. I was loosing hope of finding these in the TLS RFC's.

So the relevant magic for TLS is F=0,C=0, type=0x16, top byte of the 
length field being non-0x0. Meaning we can distinguish it easily from 
WebSockets and HTTP/2 client. Good news there.

Amos

v2.23.0 | Report a Bug | By Email