IETF Logo Mail Archive

Re: [hybi] Review of draft-ietf-hybi-thewebsocketprotocol-13

Tobias Oberstein <tobias.oberstein@tavendo.de> Tue, 06 September 2011 16:21 UTC

Return-Path: <tobias.oberstein@tavendo.de>
X-Original-To: hybi@ietfa.amsl.com
Delivered-To: hybi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D553921F8B87; Tue, 6 Sep 2011 09:21:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.499
X-Spam-Level:
X-Spam-Status: No, score=-2.499 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P5tIdPGdLfge; Tue, 6 Sep 2011 09:21:58 -0700 (PDT)
Received: from EXHUB020-2.exch020.serverdata.net (exhub020-2.exch020.serverdata.net [206.225.164.29]) by ietfa.amsl.com (Postfix) with ESMTP id 4F27621F8B7F; Tue, 6 Sep 2011 09:21:58 -0700 (PDT)
Received: from EXVMBX020-12.exch020.serverdata.net ([169.254.3.209]) by EXHUB020-2.exch020.serverdata.net ([206.225.164.29]) with mapi; Tue, 6 Sep 2011 09:23:45 -0700
From: Tobias Oberstein <tobias.oberstein@tavendo.de>
To: "Richard L. Barnes" <rbarnes@bbn.com>, Alexey Melnikov <alexey.melnikov@isode.com>
Date: Tue, 06 Sep 2011 09:22:40 -0700
Thread-Topic: [hybi] Review of draft-ietf-hybi-thewebsocketprotocol-13
Thread-Index: AcxsqFSabZdu1Vg1Qsi1Xeefpxyj2wAB12hw
Message-ID: <634914A010D0B943A035D226786325D422C0EB8DED@EXVMBX020-12.exch020.serverdata.net>
References: <942CCA6B-B784-441B-96CA-3506FFC439E1@bbn.com> <4E620046.2000400@isode.com> <E566DD99-64E5-47DF-A24C-3AA4E2EA20CA@bbn.com>
In-Reply-To: <E566DD99-64E5-47DF-A24C-3AA4E2EA20CA@bbn.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: de-DE, en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: General Area Review Team <gen-art@ietf.org>, "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Review of draft-ietf-hybi-thewebsocketprotocol-13
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Sep 2011 16:21:59 -0000

> >> While the "MAY" doesn't specify a requirement, it seems like it would be
> helpful to implementers in light of the exhaustion/DoS possibilities
> presented by huge frames and fragmentation.  I would even argue that it

Why should that impose exhaustion/DoS possibilities?

A WS impl. offering a streaming API has no problem.
A WS impl. offering a frame-based API can fail as soon as the buffered amount for a frame exceeds some limit.
A WS impl. offering a message-based API can fail as soon as the total buffered amount for the message exceeds some limit.

All of these seem pretty straight forward. Where is the attack surface?

> should be a "SHOULD".
> >>
> > I am Ok with changing MAY to SHOULD.
> 
> I'm assuming from your response below that you're OK with going to MUST
> as well?

I'm not sure: does this refer to 10.4.  Implementation-Specific Limits?

So you suggest an implementation MUST impose limits on frame size AND
message size?

If that is your suggestion (which I hope not, since it's .. breathtaking), I really would
welcome a broad discussion within the WG ..

There was a long and heated debate about announcing frame-size limits and related error codes.
Never (as far as I know) was there discussion about limiting message size.

v2.23.0 | Report a Bug | By Email