Fwd: New Version Notification for draft-ietf-xmpp-websocket-01.txt

This XMPP over WebSocket draft update warrants some discussion, and will need a good dose of feedback.


1) Using new open/close elements.

At the last IETF meeting we outlined how new open/close elements would work, but we didn't quite reach consensus on if that approach should used (discussions both on and off list resulted in people swapping sides repeatedly). However, after informal discussions at the XSF Summit in Brussels between those of us who expressed preference on list for the existing <stream /> method, I believe we have now reached consensus to use the new open/close elements.


The summary of the new open/close approach is:

-- Starting a stream (success)
=== Establish WebSocket === 
C: <open xmlns="urn:ietf:params:xml:ns:xmpp-framing"
         version="1.0"
         id="..."
         to="example.com"
         from="[email protected]" />

S: <open xmlns="urn:ietf:params:xml:ns:xmpp-framing"
         version="1.0"
         id="..."
         to="[email protected]"
         from="example.com" />


--- Starting a stream (error)
C: <open xmlns="urn:ietf:params:xml:ns:xmpp-framing"
         version="1.0"
         id="..."
         to="example.com"
         from="[email protected]" />
S: <open xmlns="urn:ietf:params:xml:ns:xmpp-framing"
         version="1.0"
         id="..."
         to="[email protected]"
         from="example.com" />
S: <error xmlns="http://etherx.jabber.org/streams">
     ... 
   </error>
S: <close xmlns="urn:ietf:params:xml:ns:xmpp-framing" />
C: <close xmlns="urn:ietf:params:xml:ns:xmpp-framing" />
=== Close WebSocket === 


-- Closing a stream
S: <close xmlns="urn:ietf:params:xml:ns:xmpp-framing" />
C: <close xmlns="urn:ietf:params:xml:ns:xmpp-framing" />
=== Close WebSocket ===


In addition, every WebSocket message MUST be a full, well-formed XML fragment with all relevant namespace and xml:lang declarations. There was concern before about the bandwidth increase this would cause, but it should be noted that WebSocket compression is well underway and has implementations in browsers now (with sliding zlib window between message frames).



As should be obvious, but I will state it to be clear: this is a BREAKING change. Given the relatively small number of existing implementations and production deployments, I hope we can get everything switched over fairly quickly. 



2) The see-other-uri issue

With the new <close /> element, we now have a way to express see-other-uri behaviour:

<close xmlns="urn:ietf:params:xml:ns:xmpp-framing"
       see-other-uri="wss://example.com/xmpp-binding" />


3) Security Considerations

Most of the security considerations we've discussed are due to the browser not exposing the information we traditionally need to perform peer verification. We have concluded before that in most cases, a browser-based client will be served from the same domain as the XMPP server and WebSocket endpoint, and be hardcoded to use the correct endpoint; however, there still are some gaps in multi-tenant situations and for browser-based clients intended to be used with any domain.

At the XSF, we have updated XEP-0156 (Discovering Alternative XMPP Connection Methods) to include an HTTPS lookup method. A neat side effect of that approach is that it lets us have 'POSH-lite', allowing a client to establish a trust relationship between the targeted XMPP domain and its WebSocket endpoint (with caveats of not allowing downgrades from wss to ws, etc). As far as I'm aware, that seems to be the most we can do in this area.




— Lance


Begin forwarded message:

> From: [email protected]
> Subject: New Version Notification for draft-ietf-xmpp-websocket-01.txt
> Date: February 14, 2014 at 9:28:39 AM PST
> To: Eric Cestari <[email protected]>, "Lance Stout" <[email protected]>, "Jack Moffitt" <[email protected]>, Lance Stout <[email protected]>, "Eric Cestari" <[email protected]>, Jack Moffitt <[email protected]>
> 
> 
> A new version of I-D, draft-ietf-xmpp-websocket-01.txt
> has been successfully submitted by Lance Stout and posted to the
> IETF repository.
> 
> Name:		draft-ietf-xmpp-websocket
> Revision:	01
> Title:		An XMPP Sub-protocol for WebSocket
> Document date:	2014-02-14
> Group:		xmpp
> Pages:		13
> URL:            http://www.ietf.org/internet-drafts/draft-ietf-xmpp-websocket-01.txt
> Status:         https://datatracker.ietf.org/doc/draft-ietf-xmpp-websocket/
> Htmlized:       http://tools.ietf.org/html/draft-ietf-xmpp-websocket-01
> Diff:           http://www.ietf.org/rfcdiff?url2=draft-ietf-xmpp-websocket-01
> 
> Abstract:
>   This document defines a binding for the XMPP protocol over a
>   WebSocket transport layer.  A WebSocket binding for XMPP provides
>   higher performance than the current HTTP binding for XMPP.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
>

_______________________________________________
xmpp mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/xmpp