Subject: Re: [http-state] I-D Action:draft-ietf-httpstate-cookie-14.txt

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Thu, 07 Oct 2010 02:07:31 +0900

Hi,

I found that date parsing algorithm in draft-ietf-httpstate-cookie-14
can not parse ANSI C's asctime() format which is one of HTTP date in
RFC2616. Daniel's cookie.cgi script uses asctime() format too. I think
it should be supported.

- From RFC2616,
asctime format is: Sun Nov  6 08:49:37 1994

According to the algorithm in 5.1.1, it searches year before time(hms).
In the above test case, 08:49:37 is matched with year production because
":" is non-digit and "49:37" is *OCTET. This algorithm detects "08" as
year and failed to find time.

>    non-digit       = %x00-2F / %x3A-FF

>    day-of-month    = 1*2DIGIT ( non-digit *OCTET )
>    month           = ( "jan" / "feb" / "mar" / "apr" /
>                        "may" / "jun" / "jul" / "aug" /
>                        "sep" / "oct" / "nov" / "dec" ) *OCTET
>    year            = 1*4DIGIT ( non-digit *OCTET )
>    time            = hms-time ( non-digit *OCTET )
>    hms-time        = time-field ":" time-field ":" time-field
>    time-field      = 1*2DIGIT

Simple fix is that search time first because time production is more
restrictive than day-of-month, month and year production rule.
Another option is exclude ":" from non-digit, but this might cause
another problem.

Best regards,

Tatsuhiro Tsujikawa

---

From: Adam Barth <[email-masked]>
Date: Sun, 10 Oct 2010 10:02:29 -0700

Thanks.  That bug was an unintended consequence of a recent change.  Fixed.

Adam

On Wed, Oct 6, 2010 at 10:07 AM, Tatsuhiro Tsujikawa
<[email-masked]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkysrMMACgkQfoQD1dZzw2ZQFQCeLSZd8i4i9QhidXbo/hOBKQKr
> xDcAniFwx8YS3Jc1P534dG91CAY2EVbR
> =rKFZ
> -----END PGP SIGNATURE-----
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state
>

---

From: Daniel Stenberg <[email-masked]>
Date: Sun, 10 Oct 2010 19:23:11 +0200 (CEST)

>>    hms-time        = time-field ":" time-field ":" time-field

This reminds me: do we want the algorithm to handle RFC822 date strings?

RFC822 allows the time in a date string to be specified as HM:MM which implies 
zero seconds.

An example of such a date string would thus be:

  Thu Apr 18 22:50 2007 GMT

I'm not sure supporting the RFC822 format verbatim is a goal but I thought I 
should at least point this out so that we make an active decision either way.

-- 

  / daniel.haxx.se

---

From: Adam Barth <[email-masked]>
Date: Sun, 10 Oct 2010 10:27:52 -0700

On Sun, Oct 10, 2010 at 10:23 AM, Daniel Stenberg <[email-masked]> wrote:
> RFC822 allows the time in a date string to be specified as HM:MM which
> implies zero seconds.
>

Dates of this format didn't show up in the data we collected about the
date formats actually used in cookies on the Internet, so I think
we're safe not supporting it.

Adam