Via header specification bug

Daurnimator <quae@daurnimator.com> Tue, 22 November 2016 12:23 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9446F1294C1 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 22 Nov 2016 04:23:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.788
X-Spam-Level:
X-Spam-Status: No, score=-7.788 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=daurnimator.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xH4emuf9hPd1 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Tue, 22 Nov 2016 04:23:38 -0800 (PST)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E56D01295D1 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Tue, 22 Nov 2016 04:23:37 -0800 (PST)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1c9A2n-0006QC-Qv for ietf-http-wg-dist@listhub.w3.org; Tue, 22 Nov 2016 12:19:25 +0000
Resent-Date: Tue, 22 Nov 2016 12:19:25 +0000
Resent-Message-Id: <E1c9A2n-0006QC-Qv@frink.w3.org>
Received: from titan.w3.org ([128.30.52.76]) by frink.w3.org with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <quae@daurnimator.com>) id 1c9A2d-0006Ow-KH for ietf-http-wg@listhub.w3.org; Tue, 22 Nov 2016 12:19:15 +0000
Received: from mail-wj0-f180.google.com ([209.85.210.180]) by titan.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <quae@daurnimator.com>) id 1c9A2X-0002SY-Sp for ietf-http-wg@w3.org; Tue, 22 Nov 2016 12:19:10 +0000
Received: by mail-wj0-f180.google.com with SMTP id qp4so41525906wjc.3 for <ietf-http-wg@w3.org>; Tue, 22 Nov 2016 04:18:49 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=daurnimator.com; s=daurnimator; h=mime-version:from:date:message-id:subject:to; bh=RBWYxeK+cMQOTuWOzHnj2hdXSFnEzKX2FehZO7ELbYk=; b=Zi8tGqsEiL04lo5vMOHe9djt8eQPBcEPznavJm7EdsFCD39cfAh0IW91GyoEJxGErn HgMRSvewyBFmPd7XQuEdq8D4LS6ujTVXT1+Mjlcd0/lrmDF8rOx9bcQfBSuPP2lP8BVY L5+1TYDp/gLo/FV6w165tSTKYQYnAv9WcMSmw=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=RBWYxeK+cMQOTuWOzHnj2hdXSFnEzKX2FehZO7ELbYk=; b=Nf+Ft2zQhpy1sayzTFSNxQF43UZoDbuAkPyKZUp4BBB/csJI3JANQB3BFtzfuEEQCT Zoe/4QUKT/PyubfxsnlcUMiSbp2URcJoPrLjngQ7Ky6HBLxo7kvmJiS4fOicmFgdSdZm E56MnpvhZfkvv3q5GizYxXMUgJUvhlOIdOplKbG7B+DGAVMOBeBk9AxHMEJOK6ywWyd3 IhSYb3OAp1jyKp05eOjBn8LX9ZaRnDtVJIfkHsXcRAX+gNp32vCG4hL5JeOUSQqMTjbh 2geHMRSS/sVfUe7WHmSaWa8KTJ+V9BDE6vhbsw6fFsJwW/1Pc9C8qq5v+4oU/4COMHdk zIZg==
X-Gm-Message-State: AKaTC01iKEX7VNRBvJVs0m5lXS3j3JlpHTzJCTf1Ydl18zQ+rQSjTyhICbt6+72u7iqZTg==
X-Received: by 10.194.235.198 with SMTP id uo6mr16851687wjc.40.1479817122870; Tue, 22 Nov 2016 04:18:42 -0800 (PST)
Received: from mail-wm0-f42.google.com (mail-wm0-f42.google.com. [74.125.82.42]) by smtp.gmail.com with ESMTPSA id f67sm2671183wmd.13.2016.11.22.04.18.42 for <ietf-http-wg@w3.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 22 Nov 2016 04:18:42 -0800 (PST)
Received: by mail-wm0-f42.google.com with SMTP id t79so22054520wmt.0 for <ietf-http-wg@w3.org>; Tue, 22 Nov 2016 04:18:42 -0800 (PST)
X-Received: by 10.25.104.20 with SMTP id d20mr4429003lfc.59.1479817121899; Tue, 22 Nov 2016 04:18:41 -0800 (PST)
MIME-Version: 1.0
Received: by 10.25.21.102 with HTTP; Tue, 22 Nov 2016 04:18:41 -0800 (PST)
From: Daurnimator <quae@daurnimator.com>
Date: Tue, 22 Nov 2016 23:18:41 +1100
X-Gmail-Original-Message-ID: <CAEnbY+fOsgT7+o3bpP9KYur=YBH_QQ8-fQcBS6GisNDX64QGiw@mail.gmail.com>
Message-ID: <CAEnbY+fOsgT7+o3bpP9KYur=YBH_QQ8-fQcBS6GisNDX64QGiw@mail.gmail.com>
To: HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: text/plain; charset="UTF-8"
Received-SPF: none client-ip=209.85.210.180; envelope-from=quae@daurnimator.com; helo=mail-wj0-f180.google.com
X-W3C-Hub-Spam-Status: No, score=-3.5
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: titan.w3.org 1c9A2X-0002SY-Sp 6bfe5977500bb9bc026b78ce6adc3316
X-Original-To: ietf-http-wg@w3.org
Subject: Via header specification bug
Archived-At: <http://www.w3.org/mid/CAEnbY+fOsgT7+o3bpP9KYur=YBH_QQ8-fQcBS6GisNDX64QGiw@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32958
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

I think I found a bug in the specification of the Via header as given
in RFC 7230

>From RFC 7230: Via = 1#( received-protocol RWS received-by [ RWS comment ] )
where 1# is a special syntax that means "comma seperated list, at
least one element"

>From RFC 7230: received-by = ( uri-host [ ":" port ] ) / pseudonym
>From RFC 7230: uri-host = <host, see [RFC3986], Section 3.2.2>
>From RFC 3986: host = IP-literal / IPv4address / reg-name
>From RFC 3986: reg-name = *( unreserved / pct-encoded / sub-delims )
>From RFC 3986: sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" /
"+" / "," / ";" / "="

notice "," there in sub-delims; this means that comma is a valid
character in a host.
and hence, that using a comma to terminate a host makes no sense

e.g.
Via: 1.0 fred, 1.1 p.example.net
'fred,' is a valid uri-host
In this case, I think we might be saved by the fact that the rest of
the line doesn't match, so 'fred' ends up being a pseudonym rather
than a uri-host.

However, I believe that there might be corner cases not backed up by
this fallback.