Re: [hybi] [Editorial Errata Reported] RFC6455 (3473)

[Martin Thomson <[e-mail]>]

Is this "host and port" or "IP and port" ?  That too is unclear.  If
I'm sharding a.example.com and b.example.com and they are served on
the same VIP, is the expectation that wss://a.example.com/ and
wss://b.example.com/ can't have concurrent connection attempts?

On 1 February 2013 16:38, RFC Errata System <[e-mail]> wrote:
>
> The following errata report has been submitted for RFC6455,
> "The WebSocket Protocol".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=3473
>
> --------------------------------------
> Type: Editorial
> Reported by: Adam Rice <[e-mail]>
>
> Section: 4.1
>
> Original Text
> -------------
>    2.  If the client already has a WebSocket connection to the remote
>        host (IP address) identified by /host/ and port /port/ pair, even
>        if the remote host is known by another name, the client MUST wait
>        until that connection has been established or for that connection
>        to have failed.  There MUST be no more than one connection in a
>        CONNECTING state.  If multiple connections to the same IP address
>        are attempted simultaneously, the client MUST serialize them so
>        that there is no more than one connection at a time running
>        through the following steps.
>
> Corrected Text
> --------------
>    2.  If the client already has a WebSocket connection to the remote
>        host (IP address) identified by /host/ and port /port/ pair, even
>        if the remote host is known by another name, the client MUST wait
>        until that connection has been established or for that connection
>        to have failed.  There MUST be no more than one connection in a
>        CONNECTING state.  If multiple connections to the same /host/ and
>        /port/ pair are attempted simultaneously, the client MUST serialize
>        them so that there is no more than one connection at a time running
>        through the following steps.
>
> Notes
> -----
> The original wording makes it ambiguous whether distinct ports on the same host are considered distinct for throttling purposes. The first sentence implies that the throttling should be applied per (host,port) pair, whereas the final sentence implies it is only based on IP address.
>
> Implementations of both interpretations appear to exist in the wild.
>
> I propose disambiguating in favour of the (host,port) interpretation, because the host-only interpretation allows for a potential denial-of-service attack targeted against hosts which drop packets to unused ports.
>
> For example, an attacker from a different origin can create several hundred WebSockets to "wss://google.com:81/". Each one will attempt to connect in serial, and take tens of seconds to time out.
>
> If the user then attempts to use an application which legitimately uses a WebSocket to "wss://google.com:443/", then due to the throttling to google.com it will not be able to connect until all of the attacker's connections have timed out.
>
> The user will perceive that the legitimate application is malfunctioning, since there is no visible sign that they are being attacked. From the server end, the attack is only apparent in the firewall logs. The actual rate of SYN packets dropped will be small and unlikely to trigger an alert.
>
> On the other hand, with the (host,port) interpretation, connections to google.com:81 do not block connections to google.com:443, and this attack is completely ineffective.
>
> Instructions:
> -------------
> This errata is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party (IESG)
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
> --------------------------------------
> Title               : The WebSocket Protocol
> Publication Date    : December 2011
> Author(s)           : I. Fette, A. Melnikov
> Category            : PROPOSED STANDARD
> Source              : BiDirectional or Server-Initiated HTTP
> Area                : Applications
> Stream              : IETF
> Verifying Party     : IESG
> _______________________________________________
> hybi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hybi