Re: [hybi] Call for interest: multiplexing dedicated for WebSocket

Tobias Oberstein <> Thu, 30 May 2013 08:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A6ACC21F96B5 for <>; Thu, 30 May 2013 01:30:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.598
X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id OCl4zMapJNWE for <>; Thu, 30 May 2013 01:30:32 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id E91A121F8A03 for <>; Thu, 30 May 2013 01:30:31 -0700 (PDT)
Received: from [] ( by ( with Microsoft SMTP Server (TLS) id; Thu, 30 May 2013 01:30:30 -0700
Message-ID: <>
Date: Thu, 30 May 2013 10:29:45 +0200
From: Tobias Oberstein <>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130509 Thunderbird/17.0.6
MIME-Version: 1.0
To: Takeshi Yoshino <>
References: <> <> <> <> <> <>
In-Reply-To: <>
Content-Type: multipart/alternative; boundary="------------080708080102070705040802"
Cc: "" <>
Subject: Re: [hybi] Call for interest: multiplexing dedicated for WebSocket
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 30 May 2013 08:30:37 -0000

Am 30.05.2013 09:28, schrieb Takeshi Yoshino:
> On Thu, May 30, 2013 at 1:12 PM, Adam Rice < 
> <>> wrote:
>         So d) - f) cannot be multiplexed over the same physical WS as
>         a) - c)?
>         Or can an implementation just "silently" transport a)-c) also
>         over wss, and hence multiplex all of a) - f) over 1 physical WS?
>     The handshake does not currently include the schema, so there
>     would be no way to communicate to the server that a)-c) were
>     supposed to be ws:, not wss:.
> Right. I missed that point.
>     Even if this was amended, both client and server would have to be
>     careful that no ambient authority leaked from the wss: channels to
>     the ws: channels. For example: the client would have to be careful
>     not to send "secure" cookies with the ws: handshakes, and the
>     server would have to be careful not to apply any authority
>     contained in a client TLS certificate to the ws: logical channels.
>     For this reason, I think it would be easiest not to attempt to
>     multiplex ws: and wss: onto a single TCP/IP connection.
> Compression contexts, etc. also need to be isolated carefully to 
> protect it from attack like CRIME.

I also agree with Adam. To summarize, given the possible "issues" of

- client cert based auth
- "secure" cookies / ambient authority
- compression contexts / CRIME

(plus complexities like: what if an app opens ws://, and then 
_later_ opens wss:// Upgrade to TLS not possible anymore .. 
cannot TLS handshake in the middle of an already established non-TLS TCP 
where some traffic already traveled .. the WS handshake at least.)

I think it would be good to include explicit text into the MUX draft, e.g.

An implementation MUST NOT multiplex multiple logical channels to 
WebSocket addresses with different schemes (ws: versus wss:) on a single 
physical WebSocket connection.

For example, two WebSocket connections to ws:// and 
wss:// must not be shared on a single physical WebSocket 
connection to

I also think it would be helpful to include explicit text describing 
what WebSocket addresses are eligible for sharing, e.g.

An implementation MAY multiplex multiple logical channels to different 
WebSocket addresses if and only if the WebSocket addresses share the 
same WebSocket scheme, the hostname resolves to the same IP address and 
the same port.

For example, connections to all of the following WebSocket addresses may 
be multiplexed over a single physical WebSocket connection (assum, and all resolve to the same IP 


Note: When a WS address does not specify an explicit port, the port is 
the default port for the given WS scheme (ws: = 80 and wss: = 443).