Subject: [hybi] WebSocket connection throttling clarification requested

From: Adam Rice <[email-masked]>
Date: Wed, 23 Jan 2013 18:30:56 +0900

Hi,

I would like to ask for clarification on section 4.1 item 2 of WebSocket
RFC 6455. It reads (emphasis mine):

2. If the client already has a WebSocket connection to the remote host (IP
address) *identified by /host/ and port /port/ pair,* even if the remote
host is known by another name, the client MUST wait until that connection
has been established or for that connection to have failed. There MUST be
no more than one connection in a CONNECTING state. If multiple connections *to
the same IP address* are attempted simultaneously, the client MUST
serialize them so that there is no more than one connection at a time
running through the following steps.

The first sentence seems to imply that connections should be throttled on
the basis of (host, port) pairs, ie. that ws://192.0.2.1:80/ and ws://
192.0.2.1:81/ should be considered independent for the purposes of
connection throttling. The last sentence seems to imply that connections
should be throttled on the basis of IP address only, so connections ws://
192.0.2.1:80/ and ws://192.0.2.1:81/ should be placed in the same bucket
for throttling purposes.

Which interpretation is correct?

Thank you,
Adam Rice

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 23 Jan 2013 22:02:11 +0100

>192.0.2.1:80/ and ws://192.0.2.1:81/ should be placed in the same bucket

It seems pretty clear to me that the more conservative interpretation is
the intended one. One reason is that there would otherwise be no limit
on the simultaneous attempts to connect with a single IP address using
different port numbers. It seems "identified by /host/ and port /port/
pair" can safely be removed without replacement through errata.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Simone Bordet <[email-masked]>
Date: Thu, 24 Jan 2013 10:48:32 +0100

Hi,

On Wed, Jan 23, 2013 at 10:30 AM, Adam Rice <[email-masked]> wrote:
> Hi,
>
> I would like to ask for clarification on section 4.1 item 2 of WebSocket RFC
> 6455. It reads (emphasis mine):
>
> address) identified by /host/ and port /port/ pair, even if the remote host
> is known by another name, the client MUST wait until that connection has
> been established or for that connection to have failed. There MUST be no
> more than one connection in a CONNECTING state. If multiple connections to
> the same IP address are attempted simultaneously, the client MUST serialize
> them so that there is no more than one connection at a time running through
> the following steps.

May I ask the reason for this requirement ?

It seems to me that a protocol should not limit in this way concurrent
connects to a host.
This look more like a recommendation for implementers, but not
something that should be mandated in a protocol.

For example, this would be sub-optimal for client WebSocket libraries
that can be used to perform load testing, or server-to-server
communication, etc.
Not all clients or use cases are browsers.

I'd like to propose to remove this requirement and changing it a
non-normative section as a suggestion for browser implementations.

Thanks !

--
Simone Bordet
http://bordet.blogspot.com
---
Finally, no matter how good the architecture and design are,
to deliver bug-free software with optimal performance and reliability,
the implementation technique must be flawless.   Victoria Livschitz

---

From: Adam Rice <[email-masked]>
Date: Mon, 28 Jan 2013 14:23:33 +0900

I am concerned that the "throttling is per IP address (regardless of port)"
interpretation allows for a denial of service against any host which uses
web sockets and also has a firewall policy to drop SYN packets to unused
ports.

Example:

1. attacker opens a socket to ws://google.com:81/
2. since there is no response to the TCP/IP SYN packet, the connection
hangs until it times out on the client-side.
3. The user attempts navigates to google.com in another tab, which attempts
to open a connection to ws://google.com:80/
4. If we consider port 81 and port 80 to be in the same bucket for
connection throttling, the user's legitimate connection will hang waiting
for the attacker's connection to finish.

Obviously a single connection will not hang for more than a few minutes at
most, but the attacker can open hundreds of connections, essentially
completely blocking google.com from using WebSockets for as long as the
user doesn't close the attacker's page.

Since the browser is not doing a lot of work (only sending a SYN packet
every few seconds), it remains completely responsive and from the user's
point of view it appears that google.com is simply not working.

SYN-dropping firewalls are ubiquitous among major commercial websites, and
it seems unlikely that this policy will change. I think there is a risk
that this will hurt WebSocket adoption.

I would therefore like to propose that the wording of the third paragraph
is changed from "to the same IP address" to "to the same /host/ and /port/
pair", so that this interpretation will be unambiguously endorsed.