Jamie Lokier wrote: > Result: Because of assumptions, 0xff bytes will be sent occasionally > in the middle of a frame. Everything afterwards will break, but it'll > be rare enough that the author doesn't notice. For the same reason > you've explained authors get lengths wrong. > > The sentinel approach does not solve this fragility problem, it merely > shifts it around to a different place. The sentinel approach also opens an easy attack vector. If user data is sent, then tricking a poor implementation into sending an OxFF will allow packet insertion. This is similar to CRLFCRLF insertion attacks that can happen if user data is set unfiltered into a HTTP header and/or cookie. length framing avoids this vulnerability. Note also that my proposal for a meta-data bit would allow headers to be sent in one length frame and data in another, so the CRLFCRLF sentinel would not be needed and that vulnerability would also be avoided. regards
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.