Re: [hybi] Extensibility mechanisms?

[Willy Tarreau <[e-mail]>]

Hi Adam,

On Wed, Jul 21, 2010 at 09:40:00PM -0700, Adam Barth wrote:
> The more I read on this list, the more I think that folks here don't
> understand the requirements on the protocol, especially the security
> requirements.  That's understandable if you haven't worked extensively
> with the browser security model.  Fortunately, Ian is an expert on
> these topics and has more time to reply to this list than I do.

Unfortunately, if neither of you two can take some time to give concrete
examples of what you're trying to protect against, you will constantly
see proposals that don't fit your requirements.

My understanding of cross-protocol attacks (please correct me if I'm
wrong) is the fact that a browser can be tricked into sending specially
crafted data to an IP:port which it believes is one protocol while it's
another one, the typical example being a form designed to send a POST
to an SMTP server, which will ignore all the HTTP part it does not
understand and will happily apply the body's data as SMTP commands. It's
easy to put web sites on the net that build such forms so that browsers
which get there are accidentely used to perform that attack.

If this is indeed the issue you're talking about, then I don't see why
the HTTP-based handshake could be a problem there. It's not more than
any other common HTTP request, it's even better in that no data should
flow until the server has correctly replied indicating proper support
for the protocol.

Basically we should get this :

  - the client sends an HTTP handshake (headers only)
  - the server responds with its HTTP handshake
  - the client checks the response and only then forwards
    data.

This standard scheme protects against cross-protocol attacks (as I
understand them) as the client does not send anything unless the
server proves its ability to understand the client protocol. Also,
the request and response are different HTTP messages, so a simple
echo server can't return the valid handshake by accident.

So with this, I'm sorry I don't see what class of cross-protocol
attacks remain and which ones we should actively protect against,
so if you have good examples, it would be nice if you could take
some time to share them.

Best regards,
Willy