Dear 6man, Kerry and I talked about this. It seems to me that, given we allow for IPv6 literals in URIs principally for diagnostic purposes, it is indeed unfortunate that http://[fe80::206:98ff:fe00:232%tap0] is not allowed by the formal syntax.
This would need to be fixed by a small RFC that updates 3986, just as 2732 updated 2396 in its day. Do people agree that this is a reasonable thing to do? If so, I'll follow it up appropriately (i.e. I will draft something when time permits). Regards Brian On 2011-11-14 22:40, Brian E Carpenter wrote: > Kerry, > > On 2011-11-14 18:41, Kerry Lynn wrote: >> Greetings, >> >> I've noticed that a "bug" has re-appeared in Firefox: >> https://bugzilla.mozilla.org/show_bug.cgi?id=700999 >> >> In older versions of Firefox (e.g. 3.6.23) it is possible to enter URIs of >> the form http://[fe80::206:98ff:fe00:232%tap0] in the >> location bar and get a positive result. This capability is quite handy in >> simple testing scenarios and obviously requires the client and server >> to be on a common link (so I don't necessarily see how it creates a >> security risk.) >> >> According to a note attached to the bug, the regression occurred as a >> result of fixing a security bug: >> https://bugzilla.mozilla.org/show_bug.cgi?id=<https://bugzilla.mozilla.org/show_bug.cgi?id=700999> >> 504014 <https://bugzilla.mozilla.org/show_bug.cgi?id=504014> >> I don't seem to have access to that bug, so I don't know the complete >> rationale. However, the note on 700999 says the title is "Enforce RFC >> 3986 syntax for IPv6 literals". It goes on to say that RFC 3986 >> "disallows" interface specifiers (a.k.a. zone indices: >> http://en.wikipedia.org/wiki/IPv6_address#Link-local_addresses_and_zone_indices >> ). >> >> I don't see how a link-local address can be used in this context w/o >> using a zone index. > > As soon as there's more than one interface, there is an issue. > >> Granted, RFC 3986 doesn't cover this case but >> it also doesn't prohibit it. > > Yes it does, because the ABNF for IPv6address is for an address, not > a scoped address. A scoped address would not conform to the ABNF, so > that amounts to a prohibition. > >> This leads me to suspect it was an oversight, > > This part of RFC 3986 derives from RFC 2732 (which had broken ABNF, > and didn't allow for a scoped address, because they didn't exist then). > >> so I'm wondering if RFC 3986 needs to be updated to cover it link- >> local IPv6 literals? If so, is there a reference that could be used to >> derive the necessary ABNF? > > I don't believe so. The ABNF has never been extended to cover RFC 4007 > as far as I know. > > Getting RFC 3986 updated would be reasonably complicated I suspect. > It involves a chat with the W3C people for a start. > > Brian > > -------------------------------------------------------------------- IETF IPv6 working group mailing list ipv6@ietf.org Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 --------------------------------------------------------------------
