From 3a0d87fe28718da1ae2a522653b9841990d62ea9 Mon Sep 17 00:00:00 2001 From: Ben Schwartz Date: Mon, 21 Oct 2024 10:43:19 -0400 Subject: [PATCH 1/2] [connect-tcp] Move capsule negotiation into the Upgrade Token Closes #2922 --- draft-ietf-httpbis-connect-tcp.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/draft-ietf-httpbis-connect-tcp.md b/draft-ietf-httpbis-connect-tcp.md index 59929d0d5..9e8207364 100644 --- a/draft-ietf-httpbis-connect-tcp.md +++ b/draft-ietf-httpbis-connect-tcp.md @@ -145,13 +145,13 @@ Authentication to a templated TCP proxy normally uses ordinary HTTP authenticati Clients SHOULD assume that all proxy resources generated by a single template share a protection space (i.e., a realm) ({{?RFC9110, Section 11.5}}). For many authentication schemes, this will allow the client to avoid waiting for a "401 (Unauthorized)" response before each new connection through the proxy. -### Use of the Capsule Protocol {#capsule-protocol} +## Use of the Capsule Protocol {#capsule-protocol} -In this specification, support for the Capsule Protocol {{?RFC9297}} is OPTIONAL for clients. Clients MAY request use of the Capsule Protocol by including a "Capsule-Protocol: ?1" header field in the request. +When using the "connect-tcp" Upgrade Token, templated TCP proxies do not use the Capsule Protocol {{!RFC9297}}. Clients MAY request use of the Capsule Protocol by offering the Upgrade Token "connect-tcp-capsule" instead. When offering or accepting the "connect-tcp-capsule" Upgrade Token, clients and servers SHOULD including a "Capsule-Protocol: ?1" header to facilitate processing by intermediaries. -Server support for the Capsule Protocol is REQUIRED. Servers MUST confirm use of the Capsule Protocol by echoing the "Capsule-Protocol: ?1" header in their response. +Clients of this specification MAY implement "connect-tcp", "connect-tcp-capsule", or both. Accordingly, templated TCP proxy servers for arbitrary clients MUST implement both Upgrade Tokens. -When using the Capsule Protocol, TCP payload data is sent in the payload of a new Capsule Type named DATA ({{data-capsule}}). The ordered concatenation of DATA capsule payloads has the same semantics as what would have been sent on the data stream if the Capsule Protocol were not in use. It is applicable whenever use of the Capsule Protocol is optional. +When using "connect-tcp-capsule", TCP payload data is sent in the payload of a new Capsule Type named DATA ({{data-capsule}}). The ordered concatenation of DATA capsule payloads represents the main payload data stream in any protocol where this is well-defined. Intermediaries MAY split or merge DATA capsules. Endpoints MAY indicate a TCP connection error by sending an incomplete DATA capsule, as an alternative to using TCP, TLS, or HTTP stream errors. # Additional Connection Setup Behaviors From d30593c9d71240e2b122dc6a028ef67e7e3187ba Mon Sep 17 00:00:00 2001 From: Ben Schwartz Date: Mon, 21 Oct 2024 15:49:40 -0400 Subject: [PATCH 2/2] Reverse condition around MUST --- draft-ietf-httpbis-connect-tcp.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/draft-ietf-httpbis-connect-tcp.md b/draft-ietf-httpbis-connect-tcp.md index 9e8207364..5dd023efa 100644 --- a/draft-ietf-httpbis-connect-tcp.md +++ b/draft-ietf-httpbis-connect-tcp.md @@ -149,7 +149,7 @@ Clients SHOULD assume that all proxy resources generated by a single template sh When using the "connect-tcp" Upgrade Token, templated TCP proxies do not use the Capsule Protocol {{!RFC9297}}. Clients MAY request use of the Capsule Protocol by offering the Upgrade Token "connect-tcp-capsule" instead. When offering or accepting the "connect-tcp-capsule" Upgrade Token, clients and servers SHOULD including a "Capsule-Protocol: ?1" header to facilitate processing by intermediaries. -Clients of this specification MAY implement "connect-tcp", "connect-tcp-capsule", or both. Accordingly, templated TCP proxy servers for arbitrary clients MUST implement both Upgrade Tokens. +Clients of this specification MAY implement "connect-tcp", "connect-tcp-capsule", or both. Accordingly, a templated TCP proxy server MUST implement both Upgrade Tokens unless its use is restricted to a subset of compatible clients. When using "connect-tcp-capsule", TCP payload data is sent in the payload of a new Capsule Type named DATA ({{data-capsule}}). The ordered concatenation of DATA capsule payloads represents the main payload data stream in any protocol where this is well-defined. Intermediaries MAY split or merge DATA capsules. Endpoints MAY indicate a TCP connection error by sending an incomplete DATA capsule, as an alternative to using TCP, TLS, or HTTP stream errors. @@ -216,15 +216,16 @@ Templated TCP proxies can make use of standard HTTP gateways and path-routing to # IANA Considerations -## New Upgrade Token +## New Upgrade Tokens -IF APPROVED, IANA is requested to add the following entry to the HTTP Upgrade Token Registry: +IF APPROVED, IANA is requested to add the following entries to the HTTP Upgrade Token Registry: -* Value: "connect-tcp" -* Description: Proxying of TCP payloads -* Reference: (This document) +| Value | Description | Reference | +| ----- | ----------- | --------- | +| "connect-tcp" | Proxying of TCP payloads | (This document) | +| "connect-tcp-capsule" | Proxying of TCP payloads in HTTP Capsules | (This document) | -For interoperability testing of this draft version, implementations SHALL use the value "connect-tcp-05". +For interoperability testing of this draft version, implementations SHALL use the values "connect-tcp-06" and "connect-tcp-capsule-06. ## New MASQUE Default Template {#iana-template}