HTTPbis M. Bishop Internet-Draft Akamai Intended status: Standards Track May 24, 2018 Expires: November 25, 2018 GREASE for HTTP/2 draft-bishop-httpbis-grease-00 Abstract Reserves several values in the HTTP/2 registries to exercise the requirement that clients and servers ignore unknown values. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on November 25, 2018. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Bishop Expires November 25, 2018 [Page 1] Internet-Draft GREASE for HTTP/2 May 2018 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Using GREASE in HTTP/2 . . . . . . . . . . . . . . . . . . . 2 2.1. GREASE for Frame Types . . . . . . . . . . . . . . . . . 2 2.2. GREASE for SETTINGS . . . . . . . . . . . . . . . . . . . 3 3. Security Considerations . . . . . . . . . . . . . . . . . . . 3 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 4.1. Frame Types . . . . . . . . . . . . . . . . . . . . . . . 3 4.2. Settings . . . . . . . . . . . . . . . . . . . . . . . . 3 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 4 5.1. Normative References . . . . . . . . . . . . . . . . . . 4 5.2. Informative References . . . . . . . . . . . . . . . . . 4 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 4 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 4 1. Introduction [UseIt] observes that extension and negotiation mechanisms which aren't exercised regularly can be found not to work when they are later employed by an extension to the protocol. [GREASE] is one mitigation which originated in TLS, registering multiple values in various TLS registries which can be sent prospectively by clients. The common requirement of the different spaces described by these documents is the requirement that recipients ignore unrecognized values. By reserving a scattered set of codepoints to have no defined meaning, clients and servers can inject values from these ranges into connections on a regular basis and exercise this requirement. HTTP/2 [HTTP2] frame types and settings employ a similar mechanism of ignoring unknown values. This makes HTTP/2 a good candidate to employ grease on connections. The need for such a technique was demonstrated recently by an HTTP/2 implementation which closed the connection upon receipt of an unknown setting. 2. Using GREASE in HTTP/2 2.1. GREASE for Frame Types Frame types of the format "0xb + (0x1f * N)" are reserved for use as grease. These frames have no semantic meaning, and SHOULD be send instead of using padding on DATA or HEADERS frames where possible. They MAY also be sent on connections where there is no application data currently being transferred. Endpoints MUST NOT consider these frames to have any meaning upon receipt. Bishop Expires November 25, 2018 [Page 2] Internet-Draft GREASE for HTTP/2 May 2018 Both the payload and length of the frames SHOULD be selected randomly, subject to implementation-defined limits on the length. 2.2. GREASE for SETTINGS Settings values of the format "0x?a?a" are reserved for use as grease. Such settings have no defined meaning. Endpoints SHOULD include at least one such setting in their initial SETTINGS frame, and MAY send new SETTINGS frames during the connection containing additional grease values. Endpoints MUST NOT consider such settings to have any meaning upon receipt. Because the setting has no defined meaning, the value of the setting SHOULD be selected randomly. 3. Security Considerations The ability to design, implement, and deploy new protocol mechanisms can be critical to security. 4. IANA Considerations 4.1. Frame Types This document registers a range of entries in the "HTTP/2 Frame Type" registry defined in [HTTP2]. For each code of the format "0xb + (0x1f * N)" for values of N in the range (0..7) (that is, "0xb", "0x2a", etc., through "0xe4"), the following values should be registered: Frame Type: Reserved - GREASE Specification: This document 4.2. Settings This document registers a range of entries in the "HTTP/2 Settings" registry defined in [HTTP2]. For each code of the format "0x?a?a" where each "?" is any octet (that is, "0x0a0a", "0x0a1a", etc. through "0xfafa"), the following values should be registered: Name: Reserved - GREASE Initial Value: (undefined) Specification: This document Bishop Expires November 25, 2018 [Page 3] Internet-Draft GREASE for HTTP/2 May 2018 5. References 5.1. Normative References [HTTP2] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext Transfer Protocol Version 2 (HTTP/2)", RFC 7540, DOI 10.17487/RFC7540, May 2015, . 5.2. Informative References [GREASE] Benjamin, D., "Applying GREASE to TLS Extensibility", draft-ietf-tls-grease-00 (work in progress), January 2017. [UseIt] Thomson, M., "Long-term Viability of Protocol Extension Mechanisms", draft-thomson-use-it-or-lose-it-01 (work in progress), March 2018. Appendix A. Acknowledgements This draft arose from a discussion in the QUIC WG with Lucas Pardue, Ryan Hamilton, and Martin Thomson. Author's Address Mike Bishop Akamai Email: mbishop@evequefou.be Bishop Expires November 25, 2018 [Page 4]