Re: [hybi] Handshake was: The WebSocket protocol issues.

[Simone Bordet <[e-mail]>]

Hi,

On Wed, Sep 29, 2010 at 19:15, Willy Tarreau <[e-mail]> wrote:
> On Wed, Sep 29, 2010 at 09:47:37AM -0700, Maciej Stachowiak wrote:
>> The idea is that you make an HTTP request with a header that looks close enough to the WS handshake to fool the server, followed by what appear to be WS messages in the body.
>
> Except that you have the Upgrade header which requires a 101 in
> response. A normal HTTP server will either :
>  - ignore the Upgarde and return a classical code (200, 404, 403, ...)
>  - consider the Upgrade header and either return 101 because it matches
>    the protocol it supports (WebSocket) or return an error code because
>    it does not support the WS protocol.

I think Maciej's point was that the server could interpret a ws
message before knowing that the client is a real (or good) ws client.
E.g.

GET / HTTP/1.1
...
Upgrade: WebSocket
Content-Length: 0
<bytes that look like a ws frame>

The server replies with a 101, then starts reading the bytes
interpreting them as websocket.

However, I don't see how this could be interpreted by a ws server in
the ping-pong handshake that Greg/Scott were proposing: there is no
way for the client to guess the exact content of the pong message
before receiving the ping.
And a HTTP server would just choke on those bytes, because I don't
think that a ws message (whatever framing we settle on) can possibly
generate a valid http request line.
The server would just read the bytes, understand the client is not a
ws compliant client, and close the connection.
And if it does not, then it's a buggy server and there is nothing we
can do about (both as a websocket and http server).

I am sure I miss something and that an attack is possible, but I cannot see it.
Would someone more expert on the area provide an example of how the
ping-pong handshake would offer an attack opening ?

Simon
-- 
http://bordet.blogspot.com
---
Finally, no matter how good the architecture and design are,
to deliver bug-free software with optimal performance and reliability,
the implementation technique must be flawless.   Victoria Livschitz