Subject: Via header specification bug

From: Daurnimator <[email-masked]>
Date: Tue, 22 Nov 2016 23:18:41 +1100

I think I found a bug in the specification of the Via header as given
in RFC 7230

>From RFC 7230: Via = 1#( received-protocol RWS received-by [ RWS comment ] )
where 1# is a special syntax that means "comma seperated list, at
least one element"

>From RFC 7230: received-by = ( uri-host [ ":" port ] ) / pseudonym
>From RFC 7230: uri-host = <host, see [RFC3986], Section 3.2.2>
>From RFC 3986: host = IP-literal / IPv4address / reg-name
>From RFC 3986: reg-name = *( unreserved / pct-encoded / sub-delims )
>From RFC 3986: sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" /
"+" / "," / ";" / "="

notice "," there in sub-delims; this means that comma is a valid
character in a host.
and hence, that using a comma to terminate a host makes no sense

e.g.
Via: 1.0 fred, 1.1 p.example.net
'fred,' is a valid uri-host
In this case, I think we might be saved by the fact that the rest of
the line doesn't match, so 'fred' ends up being a pseudonym rather
than a uri-host.

However, I believe that there might be corner cases not backed up by
this fallback.

---

From: Julian Reschke <[email-masked]>
Date: Tue, 22 Nov 2016 13:58:36 +0100

On 2016-11-22 13:18, Daurnimator wrote:
> ...

Oops.

It seems this bug was introduced because RFC 3986 relaxed the syntax for 
"host" (as opposed to RFC 2396).

I think this requires an erratum; but let's discuss the fix first.

We could:

1) replace "host" by something more restrictive. Drawback: can't express 
all host names legal in RFC 3986.

2) require some or all sub-delims to be percent-escaped when they occur 
here.

 > ...

Best regards, Julian