Subject: [xmpp] #41: prohibition on sending XML data during TLS negotiation

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 00:22:30 -0000

#41: prohibition on sending XML data during TLS negotiation
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  trivial             |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 5.3.3.1 (which covers rules for TLS negotiation) states:

 > 1.  The entities MUST NOT send any further XML data until the TLS
 > negotiation has either failed or succeeded.

 Dave Cridland commented: "(1) is quite amusing, given that it's impossible
 to contravene."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/41>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 14:43:41 -0600

> #41: prohibition on sending XML data during TLS negotiation

The document editor is happy that you are amused, but does not see that
the text needs to change given that either party to the stream *could*
attempt to send more XMPP-related data over the underlying TCP
connection before TLS negotiation completes. If you wish to propose new
or modified text (or propose the deletion of the current text), feel
free to do so.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 15:15:09 -0600

On 6/23/10 2:47 PM, Dave Cridland wrote:
> On Wed Jun 23 21:43:41 2010, Peter Saint-Andre wrote:
> The proposer is amused that the document editor is happy, and
> furthermore suggests:
> 
> 1. No further XML is transmitted by either entity until the TLS

Do you disagree that an entity could *try* to send XMPP-related data
over the TCP connection? If so, your non-MUST-y wording fine, but I'd
prefer to bang implementers over the head with a nice big MUST NOT. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 16:38:51 -0600

On 6/23/10 3:19 PM, Dave Cridland wrote:
> On Wed Jun 23 22:15:09 2010, Peter Saint-Andre wrote:
> Oh...
> Well, once TLS negotiation has started, then nobody should be touching
> the TCP layer directly. 

Right -- and that's what the existing text was intended to capture.

> I'm kind of averse to going down that route,
> because then it might imply that after the TLS negotiation is done, you
> can start sending XML on the TCP connection itself, which is weird.

IMHO that doesn't follow.

> I mean, if you're trying to tune the specification to people who think
> like that, I think it's a giant black hole not worth trying to fill.

For sure.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Matthew Wild <[email-masked]>
Date: Wed, 23 Jun 2010 23:56:16 +0100

On 23 June 2010 23:38, Peter Saint-Andre <[email-masked]> wrote:
>>> >> >  > 1.  The entities MUST NOT send any further XML data until the TLS
>>> >> >  > negotiation has either failed or succeeded.
>>> >> >

I propose:

1. The entities MUST NOT send any further XML data until the TLS
negotiation is complete, and following successful negotiation all
further data transmitted by either party MUST be encrypted.

I know at least one case (Paul Aurich referred to it) of a developer
who sent unencrypted whitespace pings over a TLS secured connection.
That person is reading this and probably agrees :)

I'm not sure I'd agree with the amused that this text is of no value,
as you can see I think it should be further specified. In particular
I've also seen a couple of cases where people have trouble because
they send whitespace after <starttls/> or <proceed/> - I believe this
is covered elsewhere in the document already though.

Matthew

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 18:53:25 -0600

> further data transmitted by either party MUST be encrypted.

+1, except I would split it up into two bullets:

   negotiation is complete.

   ...

   [last bullet] Following successful TLS negotiation, all further
   data transmitted by either party MUST be encrypted.

Thanks for the text. :)

/psa

---

From: Matthew Wild <[email-masked]>
Date: Thu, 24 Jun 2010 01:56:47 +0100

>   data transmitted by either party MUST be encrypted.

Yes, I considered that - but when I looked at the other bullets they
weren't so closely related to the actual data sending so I wasn't
sure. You're the editor, go for it :)

Matthew

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 23 Jun 2010 19:00:45 -0600

> sure. You're the editor, go for it :)

My rationale is that we would test for these behaviors separately, so it
makes sense for them to be separate rules (one applies during TLS
negotiation, the other applies after success).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "xmpp issue tracker" <[email-masked]>
Date: Thu, 24 Jun 2010 01:03:31 -0000

#41: prohibition on sending XML data during TLS negotiation
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  trivial             |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  wontfix           
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => wontfix

-- 
Ticket URL: <http://svn.tools.ietf.org/wg/xmpp/trac/ticket/41#comment:1>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Dave Cridland <[email-masked]>
Date: Wed, 23 Jun 2010 21:47:46 +0100

---

From: Dave Cridland <[email-masked]>
Date: Wed, 23 Jun 2010 22:19:41 +0100

On Wed Jun 23 22:15:09 2010, Peter Saint-Andre wrote:
> >> >  Dave Cridland commented: "(1) is quite amusing, given that  
> it's
> >> impossible
> >> >  to contravene."
> >>

Oh...

Well, once TLS negotiation has started, then nobody should be  
touching the TCP layer directly. I'm kind of averse to going down  
that route, because then it might imply that after the TLS  
negotiation is done, you can start sending XML on the TCP connection  
itself, which is weird.

I mean, if you're trying to tune the specification to people who  
think like that, I think it's a giant black hole not worth trying to  
fill.

Dave.