Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: "Roy T. Fielding" <fielding@gbiv.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Subject: blocking Upgrade
Date: Tue, 29 Mar 2011 23:04:48 +0200
Message-Id: <697525EE-57D4-475D-802A-E47752833665@gbiv.com>
To: dev <dev@httpd.apache.org>
Mime-Version: 1.0 (Apple Message framework v1084)

Does anyone with a working install want a quick project?

We need to block the Upgrade header field by default.  What this
will require is a new configuration command, like

   AllowUpgrade None | word ...

where word is any protocol name, like HTTP/2.0, waka, websocket, etc.
The config command must only be allowed in rsrc_conf.

We then need a check somewhere in the http filter for an incoming
request header field called "Upgrade".  If present and the config option
is set to None (or default), then remove the Upgrade field before it
is seen by the request handler (i.e., before it might be used by some
module or CGI script to send the server down a rat hole).
If the config option is set and not None, then set the Upgrade
header field-value to be the intersection of what was sent by the
client and what is allowed by the config.

Likewise, perform the same filtering on outbound responses.

In other words, only allow a handler to upgrade the connection
if it has been explicitly configured by the main server config
to be an okay thing to do.

Any takers?  If not, I'll give it a try next week when I am back
from the IETF.

....Roy