Re: [hybi] workability (or otherwise) of HTTP upgrade

[Willy Tarreau <[e-mail]>]

On Wed, Dec 01, 2010 at 11:46:07AM -0800, Eric Rescorla wrote:
> > The fact that .invalid is reserved for invalid domains does not technically
> > imply that it will never resolve. Either the handshake does not care
> > whether
> > the host resolves or not, then we can safely put the correct one, or it
> > relies
> > on the fact that it must never ever resolve and we must use something that
> > cannot be resolved.
> >
> 
> This is incorrect. The threat is that the attacker can *control* the target.

I don't see how you can ensure that an attacker cannot control a target which
is not supposed to exist in the first place. Randomly pointing to anything
that should not exist or that is not even considered to be used means that
no care will be taken about the location it's pointing to.

Some will use "127.0.0.1" which may be enough for an attacker running the
service on a shared server to collect some traffic, some may put "10.10.10.10"
which unfortunately will be routed to the default gateway, etc... Puting a
false information somewhere is just a way to confuse the persons responsible
for ensuring everything is under control.

This security model does not rely on a safe design but on the fact that
components will be deployed in optimal conditions. This approach could as
well lead us to decide that every admin will take care of upgrading all
their proxies to support Upgrade as soon as Websocket is released, just
in case it causes an issue. But in my opinion, both asumptions are wrong.

Regards,
Willy