Re: [hybi] Frame size

["Thomson, Martin" <[e-mail]>]

> > You could complicate this if you like.  Perhaps each "fixed" sequence
> is
> > based on the output of a pseudorandom sequence, the seed to which is
> > assigned in the handshake.
> 
> Do you have any concrete suggestions for how we could do this? I'm not
> sure I follow.

Handshake contains: WebSocket-FrameSeed: <seed>

The peer that sends this header uses the number as follows:

  var PRNG prng = new PRNG(seed);
  WS.prototype.sendFrame = function (data) {
    this.buffer.send(prng.getNextBits(WS.FRAME_MARKER_LEN), WS.FRAME_MARKER_LEN);
 
    this.buffer.send(WS.BINARY_FRAME, WS.FRAME_TYPE_LEN);

    var binary = UTF8.encode(data);
    this.buffer.send(binary.length, WS.FRAME_LENGTH_LEN);
    this.buffer.send(binary, binary.length);
 }

A receiver does the same, but uses the PRNG.getNextBits() to check that the frame was correctly terminated:

  if (this.buffer.read(WS.FRAME_MARKER_LEN) != prng.getNextBits(WS.FRAME_MARKER_LEN)) {
    // ERROR: drop connection, throw exception, etc...
  }  

> Assuming you are asking for a longer rationale for the current
> handshake,
> please search for "the rationale" in this message for an explanation:
> 
>    http://www.ietf.org/mail-archive/web/hybi/current/msg01607.html

You have an HTTP client that is being duped into contacting a WebSockets server.  I can understand that far, but I don't see what the attacker gains.  The scenario needs more details.

Invent a scenario for me.  How does this allow the attacker to gain the nuclear launch codes?

If this is as simple as a programmer forgetting the distinction between /Upgrade: foo/ and /^Upgrade: foo/, then we're back to disagreeing on the same old and tired topic.

--Martin