Subject: [hybi] Client firewall blocks server to client messages with HTTP content

From: Greg Wilkins <[email-masked]>
Date: Thu, 27 Sep 2012 17:13:33 -0700

FYI

http://stackoverflow.com/questions/12545524/message-in-jettys-websocket-connection-cannot-contain-any-http-method-keyword

Perhaps we should have masked server to client traffic -  I would not
have thought this would occur and hence argued against it -  mia
culpa!
So some intermediaries do need to be updated.

-- 
Greg Wilkins <[email-masked]>
http://www.webtide.com
Developer advice and support from the Jetty & CometD experts.

---

From: "John A. Tamplin" <[email-masked]>
Date: Thu, 27 Sep 2012 21:03:57 -0400

> So some intermediaries do need to be updated.

I would still argue against it -- we shouldn't try and accommodate software
that broken where it isn't a security issue involved.

-- 
John A. Tamplin

---

From: Jamie Lokier <[email-masked]>
Date: Fri, 28 Sep 2012 22:45:58 +0100

> So some intermediaries do need to be updated.

Masking wouldn't fix this case anyway.

According to the stackoverflow page, any occurrence of "get" with any
capitalisation, even as part of a longer word, trips the anti-virus.
As well as other words.

Being a 1:2^21 chance of that occurring in any sequence of 3 random
bytes, it would occur every megabyte or so, i.e. quite often.

Masking server to client traffic would just make the anti-virus block
the connection seemingly at random, which is arguably worse in this
instance, because it would be much more difficult to debug, and
impossible to workaround by encoding the messages in the application.

I wonder if the anti-virus blocks WSS (WS over TLS) when the trapped
messages occur in the encrypted form?

-- Jamie

---

From: Greg Wilkins <[email-masked]>
Date: Sat, 29 Sep 2012 00:23:39 -0700

> messages occur in the encrypted form?

Or how it copes with XMPP chat messages like : "Don't forget to get the milk!"

I guess as John says, there is no accounting for broken software -
this is not a security issue just a false positive of an over zealous
security check.

cheers