Subject: Re: [websec] STS ABNF, was: new rev: draft-ietf-websec-strict-transport-sec-04

From: =JeffH <[email-masked]>
Date: Mon, 26 Mar 2012 01:29:54 -0700

>> I'm not sure how to cleanly and unambiguously define them in terms of
 >> both token and quoted-string (and retain max-age's basis on
 >> delta-seconds). Perhaps you could propose how to do this?
 >
 > Just define the base grammar for the overall parsing; such as

I would appreciate it if you would just plain propose the grammar you believe 
we should have.

thanks,

=JeffH

---

From: Julian Reschke <[email-masked]>
Date: Mon, 26 Mar 2012 10:41:34 +0200

On 2012-03-26 10:29, =JeffH wrote:
> I would appreciate it if you would just plain propose the grammar you
> believe we should have.

The base grammar in Section 6 is fine (except for the nit about the 
leading ";" we were already discussing).

For the predefined directives, for example, change:

6.1.1. The max-age Directive

    The REQUIRED max-age directive specifies the number of seconds, after
    the reception of the STS header field, during which the UA regards
    the host, from whom the message was received, as a Known HSTS Host
    (see also Section 8.1.1 "Noting a HSTS Host", below).  The delta-
    seconds production is specified in [RFC2616].

    The syntax of the max-age directive is defined as:

     max-age       = "max-age" "=" delta-seconds

     delta-seconds = <1*DIGIT, defined in [RFC2616], Section 3.3.2>

    Note:  A max-age value of zero signals the UA to cease regarding the
           host as a Known HSTS Host.

to

6.1.1. The max-age Directive

    The REQUIRED max-age directive specifies the number of seconds, after
    the reception of the STS header field, during which the UA regards
    the host, from whom the message was received, as a Known HSTS Host
    (see also Section 8.1.1 "Noting a HSTS Host", below).

    The syntax of the max-age directive's value (after potential
    applying quoted-string unescaping) is:

     max-age-v     = delta-seconds
     delta-seconds = <1*DIGIT, defined in [RFC2616], Section 3.3.2>

    Note:  A max-age value of zero signals the UA to cease regarding the
           host as a Known HSTS Host.

So this

- states that the given ABNF applies to the value after q-s processing 
(when needed)
- changes the ABNF to specify only the *value*
- also we can remove the prose statement about delta-seconds; having it 
in the ABNF is sufficient

Finally, examples should show both variants of the syntax.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 28 Mar 2012 15:36:06 +0200

Here's the promised concrete change proposal:

Section 6.1., paragraph 3:
OLD:

      Strict-Transport-Security = "Strict-Transport-Security" ":"
                                  *( ";" [ directive ] )

NEW:

      Strict-Transport-Security = "Strict-Transport-Security" ":"
                                  [ directive ] *( ";" [ directive ] )

(fixes the leading ";" problem)

Section 6.1., paragraph 12:
OLD:

    Additional directives extending the semantic functionality of the STS
    header field may be defined in other specifications (which "update"
    this specification), using the STS directive extension point.

NEW:

    Additional directives extending the semantic functionality of the STS
    header field can be defined in other specifications (which "update"
    this specification).

(the extension directive extension point was removed earlier on when the 
ABNF was simplified)

Section 6.1.1., paragraph 2:
OLD:

NEW:

    The syntax of the max-age directive's value (after potential quoted-
    string when applicable) is defined as:

Section 6.1.1., paragraph 3:
OLD:

NEW:

     max-age-value = delta-seconds

(We just define the parameter value ABNF)

Section 6.2., paragraph 0:
OLD:

    The syntax of the includeSubDomains directive is defined as:

      includeSubDomains = "includeSubDomains"

  6.2.  Examples

NEW:

(text removed, as the directive is value-less)

  6.2.  Examples

Section 6.2., paragraph 2:
OLD:

       Strict-Transport-Security: max-age=31536000

NEW:

       Strict-Transport-Security: max-age="31536000"

(changed one example to use q-s)

Best regards, Julian