[secdir] secdir review of draft-ietf-httpbis-h2-websockets

[Carl Wallace <[e-mail]>]

I have reviewed this document as part of the security directorate’s
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments
just like any other last call comments.

This document defines a mechanism for running the WebSocket Protocol (RFC
6455 ) over a single stream of an HTTP/2 connection. The mechanism takes
the form of a new SETTINGS parameter and a new pseudo-header. The document
is well-written and I see no issues with it other than some friction with
this statement in section 8.1.2.1 of RFC7540:

	"Endpoints MUST NOT generate pseudo-header fields other than those
defined in this document."

The draft-ietf-httpbis-h2-websockets defines a new pseudo-header field in
section 4. Section 3 addresses extending HTTP/2 via a reference to section
5.5 of RFC7540, but there was nothing in that section to relax the
prohibition on using pseudo-header fields not defined by 7540. Is a mod to
7540 necessary to enable support for the mechanism in
draft-ietf-httpbis-h2-websockets?


One minor nit, section 3 states "a sender MUST NOT send a
SETTINGS_ENABLE_CONNECT_PROTOCOL parameter with the value of 0 after
previously sending a value of 1". This reads as though one could never
turn off web socket support once enabled.