W3C home > Mailing lists > Public > ietf-http-wg@w3.org > April to June 2013

Re: Design Issue: Overlong Frames

From: Martin Thomson <martin.thomson@gmail.com>
Date: Fri, 10 May 2013 15:21:15 -0700
Message-ID: <CABkgnnUa1q=YCmvQV0yOUDPh-MEY=XQ-+wVTJW8mSS0zUe-i6A@mail.gmail.com>
To: James M Snell <jasnell@gmail.com>
Cc: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
On 10 May 2013 14:36, James M Snell <jasnell@gmail.com> wrote:
> FWIW, one possible attack vector this would help mitigate is "frame smuggling"..
>
> For example, suppose an attacker is sending a request through a proxy
> that is designed to filter out certain kinds of bad requests. The
> attacker determines that while the proxy properly examines both the
> size and type of a frame, it ignores extraneous bytes in known frame
> types and simply passes those thru.

There is your problem right there.  A proxy that wants to prevent this
sort of covert activity needs to look for unknown frame types, unknown
headers, unknown message bodies AND unknown frame parameters.

It should also look for all of the other covert channels in HTTP, of
which there are a wondrously large number available.  It would be a
sorry smuggler who had to resort to message timing for their covert
channel in this protocol.
Received on Friday, 10 May 2013 22:21:42 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 1 March 2016 11:11:13 UTC