Re: [hybi] Handshake was: The WebSocket protocol issues.

[Willy Tarreau <[e-mail]>]

Greg,

I agree with all your points about your proposal, except the one
below :

On Thu, Sep 23, 2010 at 12:06:14PM -0700, Greg Wilkins wrote:
> Thus I think the ping/pong proposal is as least as good as the current
> handshake in this regards.

Since the client does not expect a response, it can't know whether
the intermediaries are blocking or not, which means it might be trying
to send large amounts of data before detecting that they're blocked.
And some intermediaries will definitely block. But I think that with
adding a few headers in the response (CL:0 + Conn: close), we should
be able prevent such intermediaries from sending the server's ping to
the client and trick them into closing first, which might do the trick.

However, I find the principle of not sending anything until the server
speaks WS a good idea because it protects against cross-proto attacks
after the handshake. The inital part being HTTP, it performs no better
and no worse than HTTP.

So if we're going to make the handshake look like this, then our efforts
must go towards ensuring that intermediaries that are not able to forward
the client's poing won't forward the server's ping first.

Last point, if we do that, we must keep in mind that it should not be
directly reused for non-HTTP handshake openings. It's important for
firewalls, IDS, proxies, etc... to see what protocol the client speaks
before forwarding to the server, so it will have to be advertised first.

Regards,
Willy