Subject: [websec] new rev: draft-ietf-websec-strict-transport-sec-07

From: =JeffH <[email-masked]>
Date: Wed, 02 May 2012 13:38:39 -0700

New rev:
https://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-07

full issue ticket list for strict-transport-sec:
<http://trac.tools.ietf.org/wg/websec/trac/query?status=assigned&status=closed&status=new&status=reopened&component=strict-transport-sec&order=id>

Redline spec diff from previous rev:
https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-websec-strict-transport-sec-07.txt

side-by-side diff from previous rev:
https://tools.ietf.org/rfcdiff?url2=draft-ietf-websec-strict-transport-sec-07.txt

Change Log is below.

=JeffH

==============================================================

Appendix D. Change Log

    [RFCEditor: please remove this section upon publication as an RFC.]

    Changes are grouped by spec revision listed in reverse issuance
    order.

D.1. For draft-ietf-websec-strict-transport-sec

       Changes from -06 to -07:

       1.  Various minor/modest editorial tweaks throughout as I went
           through it pursuing the below issue tickets.  Viewing a visual
           diff against -06 revision recommended.

       2.  fixed some minor editorial issues noted in review by Alexey,
           fixes noted in here: <https://www.ietf.org/mail-archive/web/
           websec/current/msg01163.html>

       3.  Addressed ABNF exposition issues, specifically inclusion of
           quoted-string syntax for directive values.  Fix STS header
           ABNF such that a leading ";" isn't required.  Add example of
           quoted-string-encoded max-age-value.  This addresses (re-
           opened) issue ticket #33.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/33>

       4.  Reworked sections 8.1 through 8.3 to ensure matching algorithm
           and resultant HSTS Policy application is more clear, and that
           it is explicitly stipulated to not muck with attributes of
           superdomain matching Known HSTS Hosts.  This addresses issue
           ticket #37.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/37>

       5.  Added reference to [I-D.ietf-dane-protocol], pared back
           extraneous discussion in section 2.2, and updated discussion
           in 10.2 to accomodate TLSA (nee DANE).  This addresses issue
           ticket #39.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/39>

       6.  Addressed various editorial items from issue ticket #40.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/40>

       7.  Loosened up the language regarding redirecting "http" requests
           to "https" in section 7.2 such that future flavors of
           permanent redirects are accommodated.  This addresses issue
           ticket #43.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/43>

       8.  Reworked the terminology and language in Section 9, in
           particular defining the term "putative domain name string" to
           replace "valid Unicode-encoded string-serialized domain name".
           This addresses issue ticket #44.
           <http://trac.tools.ietf.org/wg/websec/trac/ticket/44>

       Changes from -05 to -06:
                 .
                 .
                 .
                 .
---
end

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 4 May 2012 04:12:38 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of =JeffH
> Sent: Wednesday, May 02, 2012 1:39 PM
> To: IETF WebSec WG
> Subject: [websec] new rev: draft-ietf-websec-strict-transport-sec-07
> 
> New rev:

The ABNF is better but still doesn't allow for whitespace.  In particular, your example:

	Strict-Transport-Security: max-age=15768000 ; includeSubDomains

...does not match the current ABNF:

	Strict-Transport-Security = "Strict-Transport-Security" ":"
	                            [ directive ] *( ";" [ directive ] )

	directive = token [ "=" ( token | quoted-string ) ]	

	where:

	token = <token, defined in [RFC2616], Section 2.2>
	quoted-string = <quoted-string, defined in [RFC2616], Section 2.2>

In RFC2616, "token" is defined as:

       token          = 1*<any CHAR except CTLs or separators>
       separators     = "(" | ")" | "<" | ">" | "@"
                      | "," | ";" | ":" | "\" | <">
                      | "/" | "[" | "]" | "?" | "="
                      | "{" | "}" | SP | HT

So all the spaces after the colon are not currently valid.  I didn't know if you wanted to take the spaces out or allow them (probably the latter), so perhaps this is what you're after:

	directive = *( SP | HT ) token *( SP | HT ) [ "=" ( token | *( SP | HT ) quoted-string ) ]	

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 4 May 2012 05:16:29 +0000

Nevermind all of that.  It looks like that's covered in RFC2616 Section 4.2.

-MSK