Subject: [hybi] symmetric masking

From: Toni Ruottu <[email-masked]>
Date: Tue, 8 Mar 2011 15:34:26 +0200

hello

In the BrowserSocket project we have been looking at defining a web
API for running untrusted WebSocket servers in the browser. I am a bit
worried about the one sided masking that has been suggested as a
solution for attacks on some web proxies. While the focus of WebSocket
discussions so far has not been on running untrusted servers, nothing
has prevented adding APIs for it as an afterthought without changing
the protocol. If the masking is implemented one way only however, an
untrusted server could probably do the same attacks against proxies
that clients can currently do. Thus it might make sense to implement
the masking in a symmetric manner even if it is not a strict
requirement at the moment.

  --Toni

---

From: John Tamplin <[email-masked]>
Date: Tue, 8 Mar 2011 09:28:27 -0500

> requirement at the moment.

If someone has complete control over the server, obviously they can open raw
sockets and send what they like on them, so masking has no impact as they
can choose the plaintext to produce whatever stream of bytes they want on
the wire.

Also, the primary attack masking is directed at, corrupting transparent
proxies, requires the request to come from the client side of the proxy.

-- 
John A. Tamplin
Software Engineer (GWT), Google

---

From: Andy Green <[email-masked]>
Date: Tue, 08 Mar 2011 14:32:37 +0000

On 03/08/2011 02:28 PM, Somebody in the thread at some point said:

Hi -

> If someone has complete control over the server, obviously they can open
> raw sockets and send what they like on them, so masking has no impact as
> they can choose the plaintext to produce whatever stream of bytes they
> want on the wire.
>

John this guy's project is to add Websocket serving into browsers.  So 
then, his server traffic is coming from his browser and so on the client 
side of the proxy.

I guess he would like all the browsers to integrate his project, then 
browsers would be able to issue unmasked packets, if they could get a 
client to touch their listening socket which seems a whole other 
problem, but that's his point anyway.

-Andy

---

From: John Tamplin <[email-masked]>
Date: Tue, 8 Mar 2011 09:50:00 -0500

On Tue, Mar 8, 2011 at 9:32 AM, Andy Green <[email-masked]> wrote:

> browsers would be able to issue unmasked packets, if they could get a client
> to touch their listening socket which seems a whole other problem, but
> that's his point anyway.
>

Sorry, I missed that the server was running in the browser.  In that case, I
agree there might be attacks that could be prevented with masking.

However, I am not sure the vulnerable transparent intermediary is one of
them.  Presumably the extension isn't going to allow JS to make arbitrary
connections, only respond to inbound WebSocket client connections.  It is
hard to imagine a configuration of a transparent proxy that would get
confused about the side of the conversation it is listening to and start
handling client requests from the server side, though I suppose it is
possible.