Subject: Re: [hybi] #4: handshake does not work properly with HTTP reverse proxy.

From: "hybi issue tracker" <[email-masked]>
Date: Tue, 17 Aug 2010 15:51:49 -0000

#4: handshake does not work properly with HTTP reverse proxy.
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@…             |       Owner:     
     Type:  defect                         |      Status:  new
 Priority:  critical                       |   Milestone:     
Component:  thewebsocketprotocol           |     Version:     
 Severity:  Active WG Document             |    Keywords:     
-------------------------------------------+--------------------------------
Changes (by sm+ietf@…):

 * cc: ian@… (removed)
 * cc: ifette@… (added)

Comment:

 Comment posted by Salvatore Loreto on 17 Aug, 2010:
 there has been a lot of mails and good technical discussion about
 - the need of "8 random bytes" for security reasons
 - the fact that as the "8 random bytes" are used  in the 00 wg version
 they do not work for reverse proxies and are non-HTTP-compliance,
 - the possibility to use the "8 random bytes" in a way that both work with
 reverse proxies and are HTTP-compliance among the others:
 inserting the 8 random bytes in an header
 using the Willy Tarreau analysis/proposal explained

 http://www.ietf.org/mail-archive/web/hybi/current/msg03315.html

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/4#comment:3>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

---

From: "hybi issue tracker" <[email-masked]>
Date: Mon, 30 Aug 2010 22:24:09 -0000

Comment(by ifette@…):

 I definitely want to figure out how to fix this issue. That said, even
 reading the linked messages, I don't see any solutions readily available.
 Putting the 8 bytes in a header seems to imply that we're not actually
 certain that the proxy is capable of forwarding the data correctly (the
 data that would be sent on the first message). This seems undesirable.
 Adding a 2nd RTT is also desirable.

 From the referenced message http://www.ietf.org/mail-
 archive/web/hybi/current/msg03238.html

 "Note that this data is used for three things :
   - detection of cross-protocol communication
   - ensure that no cache will return a cached content
   - ensure that intermediaries correctly forward data after the 101

 "The first point and second points are not changed with a header. The
 third point changes slightly. With the key in the data, it was able
 to detect some of the proxies which would reset the connection during
 the handshake. With the key3 in a header, it will only detect the
 connection reset when trying to send data for the first time. However,
 neither method detects intermediaries which don't forward request body
 and remain stuck on it, so on this point there is no change."

 The status quo is also undesirable as we may hang on some proxies, which
 also is a bad state to be in.

 My understanding of this issue is that we are still looking for a
 solution. As such, I am not planning to address this in -01, but will make
 a note of the issue and that it is still open.

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/4#comment:4>