Subject: [websec] HSTS ABNF still broken: requires leading semi-colon

From: =JeffH <[email-masked]>
Date: Fri, 23 Mar 2012 16:01:22 -0700

[email-masked] wrote:
 >
 > The ABNF for the Strict-Transport-Security header looks wrong. It now
 > *requires* a leading ";" before the first directive.

yes, it's broken as you indicate, and you aren't the only person to have 
noticed it.

I apologize (to all), I didn't thoroughly vet the suggested change to the ABNF 
before incorporating it. doh.

I suspect Julian just didn't look closely at his suggestion before posting it..

   https://www.ietf.org/mail-archive/web/websec/current/msg01020.html

 > I suggest the following ABNF.
 >
 >   Strict-Transport-Security = "Strict-Transport-Security" ":"
 >                                  directive *( ";" directive )
 >
 >   directive                 = [ token [ "=" ( token | quoted-string ) ] ]

Well, I've been counseled in the past (and agree with it) that having an ABNF 
production that is potentially totally null is not such a good idea.

Perhaps this approach addresses this problem and is closer to what Julian 
intended..

      Strict-Transport-Security = "Strict-Transport-Security" ":"
                                  [ directive ]  *( ";" [ directive ] )

      directive                 = token [ "=" ( token | quoted-string ) ]

?

thanks,

=JeffH

---

From: Martin Thomson <[email-masked]>
Date: Fri, 23 Mar 2012 16:16:33 -0700

On 23 March 2012 16:01, =JeffH <[email-masked]> wrote:
> Well, I've been counseled in the past (and agree with it) that having an
> ABNF production that is potentially totally null is not such a good idea.
>

That's exactly the same as what I see above, and both have two obvious
problems, one of which I think you all missed.

You want zero or more directives ?  or one or more?

for one or more:
STS = "STS" ":" directive *(";" directive)
for zero or more:
STS = "STS" ":" [ directive *(";" directive) ]
and:
directive = token ["="(token / quoted-string)]

Note the second problem: a slash should be used instead of vertical bar.

--Martin

---

From: Julian Reschke <[email-masked]>
Date: Sat, 24 Mar 2012 09:37:37 +0100

On 2012-03-24 00:01, =JeffH wrote:
> I apologize (to all), I didn't thoroughly vet the suggested change to
> the ABNF before incorporating it. doh.
>

Why? (want to know :-)

> Perhaps this approach addresses this problem and is closer to what
> Julian intended..
>
> ...

Works for me.

Reminder: if the separator character would have been "," in the first 
place, you wouldn't need to think about this (-> 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-19.html#rfc.section.3.2.5>)

Best regards, Julian

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 24 Mar 2012 11:02:20 +0100

On 24/03/2012 00:16, Martin Thomson wrote:
> On 23 March 2012 16:01, =JeffH<[email-masked]>  wrote:
  [...]
> Note the second problem: a slash should be used instead of vertical bar.
This is RFC 2616 syntax, not RFC 5234. So no changes needed.

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 24 Mar 2012 11:18:43 +0100

On 24/03/2012 00:01, =JeffH wrote:
> yes, it's broken as you indicate, and you aren't the only person to 
> have noticed it.
>
> Well, I've been counseled in the past (and agree with it) that having 
> an ABNF production that is potentially totally null is not such a good 
> idea.
>
I think this is fine. And you can enforce "can't be totally null" in 
prose, if you don't want to fix this in ABNF.

---

From: Julian Reschke <[email-masked]>
Date: Sat, 24 Mar 2012 11:28:12 +0100

> prose, if you don't want to fix this in ABNF.

There will always be constraints not checkable in the ABNF.

I recommend to keep the ABNF simple (in particular not to include 
syntactical constructs that vary by parameter name :-), and put all 
other constraints either into prose, or into separate ABNF rules for 
specific parameter values.

Best regards, Julian

---

From: Tobias Gondrom <[email-masked]>
Date: Sat, 24 Mar 2012 10:32:05 +0000

On 24/03/12 10:28, Julian Reschke wrote:
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

<hat="individual">
Fully agree with that recommendation.
+1

Tobias