Re: [hybi] I-D Action:draft-ietf-hybi-thewebsocketprotocol-01.txt

[Willy Tarreau <[e-mail]>]

On Thu, Sep 02, 2010 at 02:07:29AM -0400, Hector Santos wrote:
> Willy Tarreau wrote:
> 
> >I would add that protocol naming and versioning is also an efficient
> >way to protect against cross-protocol attacks, which is regularly
> >brought to the table here... If SMTP required a version on its first
> >line instead of ignoring all unparsable lines, we would not be looking
> >for ways to prevent a web client from sending emails over SMTP through
> >POST requests.
> 
> Speaking with my SMTP developer hat on, I don't follow Willy how this 
> is a problem.
> 
> Many MTA already trap and count unknown commands. If the first command 
> is POST, you can reject the client immediately or prevent it from 
> going into the next state until it issues QUIT or drop the line for 
> excessive out of state commands.

Well, this is precisely a consequence of the problem I talked about. POST
has never been part of the SMTP protocol, and it's because the SMTP
protocol is prone to such attacks that these checks have been added in
implementations. Maybe some updates to the protocol have since been emitted
to suggest this, but I always had the feeling that these protections were
just good implementers' choices in face of a real threat.

Regards,
Willy