Subject: Re: Structured data over TCP?

From: Bill Janssen <[email-masked]>
Date: Wed, 27 May 2009 09:27:25 PDT

I'd second Nicholas' suggestion of using XDR, or perhaps, MIME
"multipart/form-data" (RFC 2388), which turns out to be remarkably
flexible, and for which toolkits exist everywhere.

Bill

---

From: Joachim Strömbergson <[email-masked]>
Date: Thu, 28 May 2009 22:32:09 +0200

Aloha!

Tony Finch wrote:
> On Wed, 27 May 2009, Patrik Fältström wrote:
>> counting bytes is sometimes pretty simple...
> 
> Implementations of byte-count protocols have a history of security
> vulnerabilities associated with framing errors. It's evidently more
> difficult than it seems.

Interestingly though the motivation by Daniel J Bernstein for Netatrings
is to aid in reducing security problems:

<quote>
4. Security considerations

   The famous Finger security hole may be blamed on Finger's use of the
   CRLF encoding. In that encoding, each string is simply terminated by
   CRLF. This encoding has several problems. Most importantly, it does
   not declare the string size in advance. This means that a correct
   CRLF parser must be prepared to ask for more and more memory as it is
   reading the string. In the case of Finger, a lazy implementor found
   this to be too much trouble; instead he simply declared a fixed-size
   buffer and used C's gets() function. The rest is history.

   In contrast, as the above sample code shows, it is very easy to
   handle netstrings without risking buffer overflow. Thus widespread
   use of netstrings may improve network security.
</quote>

Netstrings is a design-by-contract thingy and if the string size differs
from the stated length the receiver can easily (easier - in some sense
of the word) detect such problem and discard excessive data.

- --
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
Kryptoblog - IT-säkerhet på svenska
http://www.strombergson.com/kryptoblog
========================================================================