Subject: [hybi] Masking of Control Frames that have a zero length payload.

From: "Len Holgate" <[email-masked]>
Date: Wed, 22 Jun 2011 09:19:24 +0100

Hi,

I haven't been able to find a previous discussion on this list about this
point, forgive me if it's already been covered.

4.3 Client-to-Server Masking 

States that "The client MUST mask all frames sent to the server."

4.5 Control Frames 

States that "All control frames MUST have a payload length of 125 bytes or
less..."

4.5.1 Close

States that "The Close frame MAY contain a body (the "application data"
portion of the frame)

Which implies to me that control frames with a zero length payload may exist
but if these are sent from client to server then these MUST still be masked,
which results in the inclusion of a masking key which is not used for
anything and simply increases the length of the frame for no reason.

Perhaps the inclusion of the rationale behind client to server masking would
clear this up - including the masking key when no data needs to be masked
makes the control frame unique and unpredictable and perhaps this is the
reason, but at present it's unclear as to why the above is desirable.

Len

---

From: John Tamplin <[email-masked]>
Date: Wed, 22 Jun 2011 04:27:05 -0400

> reason, but at present it's unclear as to why the above is desirable.

IMHO, the utility of a zero-length frame seems low enough that it doesn't
warrant adding a special case to leave off the mask if the payload length is
zero.

-- 
John A. Tamplin
Software Engineer (GWT), Google

---

From: "Arman Djusupov" <[email-masked]>
Date: Wed, 22 Jun 2011 12:19:58 +0300

> IMHO, the utility of a zero-length frame seems low enough that it doesn't warrant adding a special case to leave off the mask if the payload length is zero.

In practice 0 length frames do appear quite often as terminal frames of messages when data is streamed from a source of unknown length. I see this happening when my implementation sends the output of an object serializer that flushes the stream and then suddenly closes it. If the message stream is closed when it doesn’t have any data buffered, there is no other option but to send the 0 length terminal frame for this message. Control frames are of course another case when the frame might contain no data.

However, I think that adding the mask to ALL frames uniformly is not a bad idea. It’s not a huge waste of bandwidth and does not cause any significant overhead, at the same time the random mask attached to the frame header increases the unpredictability of the payload which eliminates the remote chance that an attacker could produce some attack sequence by playing with opcodes and reserved flags when the API would permit using them (highly unlikely though). In any case, I do like the simplicity – “ALL frames are masked and end of story”, the fewer IF ELSE in the spec the better.

With best regards,
Arman