Re: [Technical Errata Reported] RFC7230 (4667)

Alex Rousskov <> Fri, 15 April 2016 23:55 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1AEFD12D983 for <>; Fri, 15 Apr 2016 16:55:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -7.917
X-Spam-Status: No, score=-7.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.996, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id hsfIeJLxx_CF for <>; Fri, 15 Apr 2016 16:55:55 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 8965212D913 for <>; Fri, 15 Apr 2016 16:55:55 -0700 (PDT)
Received: from lists by with local (Exim 4.80) (envelope-from <>) id 1arDW5-0002gC-Dh for; Fri, 15 Apr 2016 23:51:13 +0000
Resent-Date: Fri, 15 Apr 2016 23:51:13 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <>) id 1arDVz-0002ep-Tt for; Fri, 15 Apr 2016 23:51:07 +0000
Received: from ([]) by with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from <>) id 1arDVy-0007iv-CT for; Fri, 15 Apr 2016 23:51:07 +0000
Received: from [] (unknown []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id BB9B0E076; Fri, 15 Apr 2016 23:50:42 +0000 (UTC)
To: Willy Tarreau <>
References: <> <> <> <> <> <> <> <> <> <>
Cc: "Roy T. Fielding" <>, RFC Errata System <>, HTTP Working Group <>
From: Alex Rousskov <>
Message-ID: <>
Date: Fri, 15 Apr 2016 17:50:06 -0600
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Received-SPF: pass client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-5.7
X-W3C-Hub-Spam-Report: AWL=-0.835, BAYES_00=-1.9, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1arDVy-0007iv-CT fe4e4530fae0ab534e14617e0f59381b
Subject: Re: [Technical Errata Reported] RFC7230 (4667)
Archived-At: <>
X-Mailing-List: <> archive/latest/31490
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

On 04/15/2016 01:53 PM, Willy Tarreau wrote:
> On Fri, Apr 15, 2016 at 10:19:40AM -0600, Alex Rousskov wrote:
>> On 04/14/2016 10:49 PM, Willy Tarreau wrote:
>>> On Thu, Apr 14, 2016 at 06:50:43PM -0600, Alex Rousskov wrote:
>>>> On 04/14/2016 04:39 PM, Roy T. Fielding wrote:
>>>>> Don't confuse the various lenient ways in which implementations parse
>>>>> HTTP with the requirements on generating HTTP messages that are
>>>>> defined by the ABNF. The ABNF is intended to be more restrictive.

>>>> I fully agree, but we are not discussing ABNF creation IMO. We are
>>>> discussing a syntax change by an HTTPbis RFC. To change HTTP/1 syntax
>>>> that has been in use for many years, the "Founders Intent" alone is not
>>>> enough IMHO. There must be other compelling reasons. The only other
>>>> reason given so far was "lack of known examples", followed by your
>>>> discussion of "space padding" as a known usage example. I expect the bar
>>>> for HTTP/1 syntax change to be significantly higher.

> The way I read your comment makes me think you believe that there was
> an intent to purposely break existing implementations,

Just to avoid misunderstanding: I may be wrong, but I am not that dumb.
The "Founders Intent" phrase refers to Question #1 in Roy's history: Did
the authors intend to apply the "implied *LWS" rule to chunking? The
answer was "No, there was no such intent". AFAICT, that lack of intent
was used as the first reason to remove LWS, and I acknowledged that in
the above paragraph while claiming that reason #1 alone is not enough to
justify keeping the syntax as it is now.

I am now deleting most of my long response because I eventually realized
that you were just defending the way HTTPbis decisions were made. I was
_not_ attacking that (and understand the complexities of that process).

> Absolutely. It's too bad it was not identified by then, but we can circle
> in loops forever asking why is was not identified instead of proposing a
> solution. 

We might, but I am not asking that question and am proposing a solution.

> Your proposal might be fine, and maybe in 2 years we'll get
> another report for it not being enough and another errata will simply be
> emitted. That's the purpose of erratas.