From aeeb84da107d25a32d3a207a685c1dc81632370a Mon Sep 17 00:00:00 2001 From: nightwatchcyber Date: Mon, 27 May 2019 14:28:59 -0400 Subject: [PATCH 1/4] Changes for #152 and #143 --- draft-foudil-securitytxt.html | 179 +++++++++++++++++----------------- draft-foudil-securitytxt.md | 13 ++- draft-foudil-securitytxt.txt | 152 ++++++++++++++--------------- 3 files changed, 176 insertions(+), 168 deletions(-) diff --git a/draft-foudil-securitytxt.html b/draft-foudil-securitytxt.html index 54c6057..d3bf52f 100644 --- a/draft-foudil-securitytxt.html +++ b/draft-foudil-securitytxt.html @@ -9,32 +9,82 @@ - +/*]]>*/ @@ -333,12 +334,12 @@ - + - + @@ -362,12 +363,12 @@ Y. Shafranovich -Expires: October 21, 2019 +Expires: November 28, 2019 Nightwatch Cybersecurity -April 19, 2019 +May 27, 2019 @@ -383,7 +384,7 @@

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

-

This Internet-Draft will expire on October 21, 2019.

+

This Internet-Draft will expire on November 28, 2019.

Copyright Notice

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

@@ -698,7 +699,7 @@

4.1. Web-based services

Web-based services SHOULD place the security.txt file under the /.well-known/ path; e.g. https://example.com/.well-known/security.txt as per [RFC5785]. A security.txt file located under the top-level path SHOULD either redirect (as per section 6.4 of [RFC7231]) to the security.txt file under the /.well-known/ path or be used as a fallback if the “.well-known” path cannot be used.

-

If retrieval of a “security.txt” file results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow redirects that lead to another domain or subdomain but SHOULD follow redirects within the same domain name (but not different subdomain on the same domain).

+

If retrieval of a “security.txt” file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow redirects that lead to another domain or subdomain but SHOULD follow redirects within the same domain name (but not different subdomain on the same domain).

The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file.

4.2. Filesystems @@ -735,8 +736,8 @@

sign-footer = <OpenPGP signature from section 7 of [RFC4880]> -unsigned = *line [canonical-field eol *line] [lang-field eol] *line -unsigned =/ *line [lang-field eol *line] [canonical-field eol] *line +unsigned = *line (can-field eol) *line contact-field *line (lang-field eol) *line + ;the order of elements is not important line = (field / comment) eol @@ -755,7 +756,7 @@

ack-field = "Acknowledgments" fs SP uri -canonical-field = "Canonical" fs SP uri +can-field = "Canonical" fs SP uri contact-field = "Contact" fs SP uri @@ -789,7 +790,7 @@

An attacker that has compromised a website is able to compromise the “security.txt” file as well or setup a redirect to their own site. This can result in security reports not being received by the organization or sent to the attacker.

To protect against this, organizations SHOULD digitally sign their “security.txt” files (as per Section 3.4), use the canonical directive to sign the location of the file (as per Section 3.5.2), and regularly monitor the file and the referenced resources to detect tampering.

Security researchers SHOULD check the “security.txt” file including verifying the digital signature and checking any available historical records before using the information contained in the file. If “security.txt” file looks suspicious or compromised, it SHOULD NOT be used.

-

To avoid redirect attacks, redirects for these files MUST NOT be followed if they lead to a different domain (as per Section 4.1).

+

To avoid redirect attacks, redirects for these files MUST NOT be followed when the file is placed in the top level path if they lead to a different domain (as per Section 4.1).

6.2. Incorrect or Stale Information

@@ -1150,7 +1151,11 @@

- +

Full list of changes can be viewed via the IETF document tracker: https://tools.ietf.org/html/draft-foudil-securitytxt

Authors' Addresses

diff --git a/draft-foudil-securitytxt.md b/draft-foudil-securitytxt.md index 2b3223d..811f875 100644 --- a/draft-foudil-securitytxt.md +++ b/draft-foudil-securitytxt.md @@ -366,7 +366,7 @@ Web-based services SHOULD place the security.txt file under the /.well-known/ pa as per {{!RFC5785}}. A security.txt file located under the top-level path SHOULD either redirect (as per section 6.4 of {{!RFC7231}}) to the security.txt file under the /.well-known/ path or be used as a fallback if the ".well-known" path cannot be used. -If retrieval of a "security.txt" file results in a redirect (as per +If retrieval of a "security.txt" file from the top-level path results in a redirect (as per section 6.4 of {{!RFC7231}}), the implementors MUST NOT follow redirects that lead to another domain or subdomain but SHOULD follow redirects within the same domain name @@ -421,8 +421,8 @@ sign-header = sign-footer = -unsigned = *line [canonical-field eol *line] [lang-field eol] *line -unsigned =/ *line [lang-field eol *line] [canonical-field eol] *line +unsigned = *line (can-field eol) *line contact-field *line (lang-field eol) *line + ;the order of elements is not important line = (field / comment) eol @@ -441,7 +441,7 @@ comment = "#" *(WSP / VCHAR / %x80-FFFFF) ack-field = "Acknowledgments" fs SP uri -canonical-field = "Canonical" fs SP uri +can-field = "Canonical" fs SP uri contact-field = "Contact" fs SP uri @@ -488,7 +488,8 @@ contained in the file. If "security.txt" file looks suspicious or compromised, it SHOULD NOT be used. To avoid redirect attacks, redirects for these files MUST NOT be followed -if they lead to a different domain (as per {{weblocation}}). +when the file is placed in the top level path if they lead to a different +domain (as per {{weblocation}}). ## Incorrect or Stale Information @@ -743,6 +744,8 @@ of DNS-stored encryption keys (#28 and #94) ## Since draft-foudil-securitytxt-06 - Fixed ABNF grammar for non-chainable directives (#150) +- Clarified ABNF grammar (#152) +- Clarified redirect logic (#143) Full list of changes can be viewed via the IETF document tracker: https://tools.ietf.org/html/draft-foudil-securitytxt diff --git a/draft-foudil-securitytxt.txt b/draft-foudil-securitytxt.txt index 65c43ed..b765c40 100644 --- a/draft-foudil-securitytxt.txt +++ b/draft-foudil-securitytxt.txt @@ -5,8 +5,8 @@ Network Working Group E. Foudil Internet-Draft Intended status: Informational Y. Shafranovich -Expires: October 21, 2019 Nightwatch Cybersecurity - April 19, 2019 +Expires: November 28, 2019 Nightwatch Cybersecurity + May 27, 2019 A Method for Web Security Policies @@ -36,7 +36,7 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on October 21, 2019. + This Internet-Draft will expire on November 28, 2019. Copyright Notice @@ -53,9 +53,9 @@ Copyright Notice -Foudil & Shafranovich Expires October 21, 2019 [Page 1] +Foudil & Shafranovich Expires November 28, 2019 [Page 1] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 the Trust Legal Provisions and are provided without warranty as @@ -90,14 +90,14 @@ Table of Contents 5. File Format Description and ABNF Grammar . . . . . . . . . . 11 6. Security Considerations . . . . . . . . . . . . . . . . . . . 12 6.1. Compromised Files and Redirects . . . . . . . . . . . . . 12 - 6.2. Incorrect or Stale Information . . . . . . . . . . . . . 12 + 6.2. Incorrect or Stale Information . . . . . . . . . . . . . 13 6.3. Intentionally Malformed Files, Resources and Reports . . 13 6.4. No Implied Permission for Testing . . . . . . . . . . . . 13 6.5. Multi-user Environments . . . . . . . . . . . . . . . . . 13 6.6. Protecting Data in Transit . . . . . . . . . . . . . . . 14 6.7. Spam and Spurious Reports . . . . . . . . . . . . . . . . 14 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14 - 7.1. Well-Known URIs registry . . . . . . . . . . . . . . . . 14 + 7.1. Well-Known URIs registry . . . . . . . . . . . . . . . . 15 7.2. Registry for security.txt Header Fields . . . . . . . . . 15 8. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 16 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 @@ -109,9 +109,9 @@ Table of Contents -Foudil & Shafranovich Expires October 21, 2019 [Page 2] +Foudil & Shafranovich Expires November 28, 2019 [Page 2] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 B.2. Since draft-foudil-securitytxt-01 . . . . . . . . . . . . 20 @@ -165,9 +165,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 3] +Foudil & Shafranovich Expires November 28, 2019 [Page 3] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 1.2. Terminology @@ -221,9 +221,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 4] +Foudil & Shafranovich Expires November 28, 2019 [Page 4] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 unlimited number of fields. It is important to note that you MUST @@ -277,9 +277,9 @@ https://[2001:db8:8:4::2]/.well-known/security.txt -Foudil & Shafranovich Expires October 21, 2019 [Page 5] +Foudil & Shafranovich Expires November 28, 2019 [Page 5] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 3.3. Separate Fields @@ -333,9 +333,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 6] +Foudil & Shafranovich Expires November 28, 2019 [Page 6] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 3.5.2. Canonical @@ -389,9 +389,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 7] +Foudil & Shafranovich Expires November 28, 2019 [Page 7] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 When it comes to verifying the authenticity of the key, it is always @@ -445,9 +445,9 @@ Encryption: dns:5d2d37ab76d47d36._openpgpkey.example.com?type=OPENPGPKEY -Foudil & Shafranovich Expires October 21, 2019 [Page 8] +Foudil & Shafranovich Expires November 28, 2019 [Page 8] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 The order in which they appear MUST NOT be interpreted as an @@ -501,9 +501,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 9] +Foudil & Shafranovich Expires November 28, 2019 [Page 9] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 4. Location of the security.txt file @@ -517,11 +517,11 @@ Internet-Draft A Method for Web Security Policies April 2019 security.txt file under the /.well-known/ path or be used as a fallback if the ".well-known" path cannot be used. - If retrieval of a "security.txt" file results in a redirect (as per - section 6.4 of [RFC7231]), the implementors MUST NOT follow redirects - that lead to another domain or subdomain but SHOULD follow redirects - within the same domain name (but not different subdomain on the same - domain). + If retrieval of a "security.txt" file from the top-level path results + in a redirect (as per section 6.4 of [RFC7231]), the implementors + MUST NOT follow redirects that lead to another domain or subdomain + but SHOULD follow redirects within the same domain name (but not + different subdomain on the same domain). The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file. @@ -557,9 +557,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 10] +Foudil & Shafranovich Expires November 28, 2019 [Page 10] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 In general, implementors SHOULD "be conservative in what you do, be @@ -582,8 +582,8 @@ sign-header = sign-footer = -unsigned = *line [canonical-field eol *line] [lang-field eol] *line -unsigned =/ *line [lang-field eol *line] [canonical-field eol] *line +unsigned = *line (can-field eol) *line contact-field *line (lang-field eol) *line + ;the order of elements is not important line = (field / comment) eol @@ -602,7 +602,7 @@ comment = "#" *(WSP / VCHAR / %x80-FFFFF) ack-field = "Acknowledgments" fs SP uri -canonical-field = "Canonical" fs SP uri +can-field = "Canonical" fs SP uri contact-field = "Contact" fs SP uri @@ -613,9 +613,9 @@ uri = -Foudil & Shafranovich Expires October 21, 2019 [Page 11] +Foudil & Shafranovich Expires November 28, 2019 [Page 11] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 encryption-field = "Encryption" fs SP uri @@ -659,21 +659,25 @@ unstructured = used. To avoid redirect attacks, redirects for these files MUST NOT be - followed if they lead to a different domain (as per Section 4.1). + followed when the file is placed in the top level path if they lead + to a different domain (as per Section 4.1). + + -6.2. Incorrect or Stale Information - If information and resources referenced in a "security.txt" file are - incorrect or not kept up to date, this can result in security reports -Foudil & Shafranovich Expires October 21, 2019 [Page 12] +Foudil & Shafranovich Expires November 28, 2019 [Page 12] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 +6.2. Incorrect or Stale Information + + If information and resources referenced in a "security.txt" file are + incorrect or not kept up to date, this can result in security reports not being received by the organization or sent to incorrect contacts, thus exposing possible security issues to third parties. @@ -718,18 +722,17 @@ Internet-Draft A Method for Web Security Policies April 2019 In multi-user / multi-tenant environments, it may possible for a user to take over the location of the "security.txt" file. Organizations SHOULD reserve the "security.txt" namespace to ensure no third-party - can create a page with the "security.txt" AND "/.well-known/ - security.txt" names. - - -Foudil & Shafranovich Expires October 21, 2019 [Page 13] +Foudil & Shafranovich Expires November 28, 2019 [Page 13] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 + can create a page with the "security.txt" AND "/.well-known/ + security.txt" names. + 6.6. Protecting Data in Transit To protect a "security.txt" file from being tampered in transit, @@ -773,18 +776,20 @@ Internet-Draft A Method for Web Security Policies April 2019 192.0.2.0 and 2001:db8:8:4::2 are used in this document following the uses indicated in [RFC6890]. -7.1. Well-Known URIs registry - The "Well-Known URIs" registry should be updated with the following - additional values (using the template from [RFC5785]): -Foudil & Shafranovich Expires October 21, 2019 [Page 14] +Foudil & Shafranovich Expires November 28, 2019 [Page 14] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 + +7.1. Well-Known URIs registry + + The "Well-Known URIs" registry should be updated with the following + additional values (using the template from [RFC5785]): URI suffix: security.txt @@ -832,14 +837,9 @@ Internet-Draft A Method for Web Security Policies April 2019 - - - - - -Foudil & Shafranovich Expires October 21, 2019 [Page 15] +Foudil & Shafranovich Expires November 28, 2019 [Page 15] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 Field Name: Acknowledgments @@ -893,9 +893,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 16] +Foudil & Shafranovich Expires November 28, 2019 [Page 16] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 The authors would also like to acknowledge the feedback provided by @@ -949,9 +949,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 17] +Foudil & Shafranovich Expires November 28, 2019 [Page 17] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 [RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network @@ -1005,9 +1005,9 @@ Internet-Draft A Method for Web Security Policies April 2019 -Foudil & Shafranovich Expires October 21, 2019 [Page 18] +Foudil & Shafranovich Expires November 28, 2019 [Page 18] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 9.2. Informative References @@ -1061,9 +1061,9 @@ Appendix A. Note to Readers -Foudil & Shafranovich Expires October 21, 2019 [Page 19] +Foudil & Shafranovich Expires November 28, 2019 [Page 19] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 Appendix B. Document History @@ -1117,9 +1117,9 @@ B.2. Since draft-foudil-securitytxt-01 -Foudil & Shafranovich Expires October 21, 2019 [Page 20] +Foudil & Shafranovich Expires November 28, 2019 [Page 20] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 B.3. Since draft-foudil-securitytxt-02 @@ -1173,9 +1173,9 @@ B.5. Since draft-foudil-securitytxt-04 -Foudil & Shafranovich Expires October 21, 2019 [Page 21] +Foudil & Shafranovich Expires November 28, 2019 [Page 21] -Internet-Draft A Method for Web Security Policies April 2019 +Internet-Draft A Method for Web Security Policies May 2019 o Removed permission directive (#30) @@ -1205,6 +1205,10 @@ B.7. Since draft-foudil-securitytxt-06 o Fixed ABNF grammar for non-chainable directives (#150) + o Clarified ABNF grammar (#152) + + o Clarified redirect logic (#143) + Full list of changes can be viewed via the IETF document tracker: https://tools.ietf.org/html/draft-foudil-securitytxt @@ -1225,8 +1229,4 @@ Authors' Addresses - - - - -Foudil & Shafranovich Expires October 21, 2019 [Page 22] +Foudil & Shafranovich Expires November 28, 2019 [Page 22] From a15035b6edf2639cb80262dc3992e6bed3fbace0 Mon Sep 17 00:00:00 2001 From: nightwatchcyber Date: Wed, 29 May 2019 21:08:15 -0400 Subject: [PATCH 2/4] fixes --- draft-foudil-securitytxt.html | 12 ++++---- draft-foudil-securitytxt.md | 4 +-- draft-foudil-securitytxt.txt | 54 +++++++++++++++++------------------ 3 files changed, 35 insertions(+), 35 deletions(-) diff --git a/draft-foudil-securitytxt.html b/draft-foudil-securitytxt.html index d3bf52f..cc78f75 100644 --- a/draft-foudil-securitytxt.html +++ b/draft-foudil-securitytxt.html @@ -339,7 +339,7 @@ - + @@ -363,12 +363,12 @@ Y. Shafranovich -Expires: November 28, 2019 +Expires: November 30, 2019 Nightwatch Cybersecurity -May 27, 2019 +May 29, 2019 @@ -384,7 +384,7 @@

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

-

This Internet-Draft will expire on November 28, 2019.

+

This Internet-Draft will expire on November 30, 2019.

Copyright Notice

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

@@ -736,8 +736,8 @@

sign-footer = <OpenPGP signature from section 7 of [RFC4880]> -unsigned = *line (can-field eol) *line contact-field *line (lang-field eol) *line - ;the order of elements is not important +unsigned = *line [can-field eol] *line contact-field eol *line [lang-field eol] *line + ; the order of elements is not important line = (field / comment) eol diff --git a/draft-foudil-securitytxt.md b/draft-foudil-securitytxt.md index 811f875..a932f1e 100644 --- a/draft-foudil-securitytxt.md +++ b/draft-foudil-securitytxt.md @@ -421,8 +421,8 @@ sign-header = sign-footer = -unsigned = *line (can-field eol) *line contact-field *line (lang-field eol) *line - ;the order of elements is not important +unsigned = *line [can-field eol] *line contact-field eol *line [lang-field eol] *line + ; the order of elements is not important line = (field / comment) eol diff --git a/draft-foudil-securitytxt.txt b/draft-foudil-securitytxt.txt index b765c40..1d211d3 100644 --- a/draft-foudil-securitytxt.txt +++ b/draft-foudil-securitytxt.txt @@ -5,8 +5,8 @@ Network Working Group E. Foudil Internet-Draft Intended status: Informational Y. Shafranovich -Expires: November 28, 2019 Nightwatch Cybersecurity - May 27, 2019 +Expires: November 30, 2019 Nightwatch Cybersecurity + May 29, 2019 A Method for Web Security Policies @@ -36,7 +36,7 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on November 28, 2019. + This Internet-Draft will expire on November 30, 2019. Copyright Notice @@ -53,7 +53,7 @@ Copyright Notice -Foudil & Shafranovich Expires November 28, 2019 [Page 1] +Foudil & Shafranovich Expires November 30, 2019 [Page 1] Internet-Draft A Method for Web Security Policies May 2019 @@ -109,7 +109,7 @@ Table of Contents -Foudil & Shafranovich Expires November 28, 2019 [Page 2] +Foudil & Shafranovich Expires November 30, 2019 [Page 2] Internet-Draft A Method for Web Security Policies May 2019 @@ -165,7 +165,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 3] +Foudil & Shafranovich Expires November 30, 2019 [Page 3] Internet-Draft A Method for Web Security Policies May 2019 @@ -221,7 +221,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 4] +Foudil & Shafranovich Expires November 30, 2019 [Page 4] Internet-Draft A Method for Web Security Policies May 2019 @@ -277,7 +277,7 @@ https://[2001:db8:8:4::2]/.well-known/security.txt -Foudil & Shafranovich Expires November 28, 2019 [Page 5] +Foudil & Shafranovich Expires November 30, 2019 [Page 5] Internet-Draft A Method for Web Security Policies May 2019 @@ -333,7 +333,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 6] +Foudil & Shafranovich Expires November 30, 2019 [Page 6] Internet-Draft A Method for Web Security Policies May 2019 @@ -389,7 +389,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 7] +Foudil & Shafranovich Expires November 30, 2019 [Page 7] Internet-Draft A Method for Web Security Policies May 2019 @@ -445,7 +445,7 @@ Encryption: dns:5d2d37ab76d47d36._openpgpkey.example.com?type=OPENPGPKEY -Foudil & Shafranovich Expires November 28, 2019 [Page 8] +Foudil & Shafranovich Expires November 30, 2019 [Page 8] Internet-Draft A Method for Web Security Policies May 2019 @@ -501,7 +501,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 9] +Foudil & Shafranovich Expires November 30, 2019 [Page 9] Internet-Draft A Method for Web Security Policies May 2019 @@ -557,7 +557,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 10] +Foudil & Shafranovich Expires November 30, 2019 [Page 10] Internet-Draft A Method for Web Security Policies May 2019 @@ -582,8 +582,8 @@ sign-header = sign-footer = -unsigned = *line (can-field eol) *line contact-field *line (lang-field eol) *line - ;the order of elements is not important +unsigned = *line [can-field eol] *line contact-field eol *line [lang-field eol] *line + ; the order of elements is not important line = (field / comment) eol @@ -613,7 +613,7 @@ uri = -Foudil & Shafranovich Expires November 28, 2019 [Page 11] +Foudil & Shafranovich Expires November 30, 2019 [Page 11] Internet-Draft A Method for Web Security Policies May 2019 @@ -669,7 +669,7 @@ unstructured = -Foudil & Shafranovich Expires November 28, 2019 [Page 12] +Foudil & Shafranovich Expires November 30, 2019 [Page 12] Internet-Draft A Method for Web Security Policies May 2019 @@ -725,7 +725,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 13] +Foudil & Shafranovich Expires November 30, 2019 [Page 13] Internet-Draft A Method for Web Security Policies May 2019 @@ -781,7 +781,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 14] +Foudil & Shafranovich Expires November 30, 2019 [Page 14] Internet-Draft A Method for Web Security Policies May 2019 @@ -837,7 +837,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 15] +Foudil & Shafranovich Expires November 30, 2019 [Page 15] Internet-Draft A Method for Web Security Policies May 2019 @@ -893,7 +893,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 16] +Foudil & Shafranovich Expires November 30, 2019 [Page 16] Internet-Draft A Method for Web Security Policies May 2019 @@ -949,7 +949,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 17] +Foudil & Shafranovich Expires November 30, 2019 [Page 17] Internet-Draft A Method for Web Security Policies May 2019 @@ -1005,7 +1005,7 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 28, 2019 [Page 18] +Foudil & Shafranovich Expires November 30, 2019 [Page 18] Internet-Draft A Method for Web Security Policies May 2019 @@ -1061,7 +1061,7 @@ Appendix A. Note to Readers -Foudil & Shafranovich Expires November 28, 2019 [Page 19] +Foudil & Shafranovich Expires November 30, 2019 [Page 19] Internet-Draft A Method for Web Security Policies May 2019 @@ -1117,7 +1117,7 @@ B.2. Since draft-foudil-securitytxt-01 -Foudil & Shafranovich Expires November 28, 2019 [Page 20] +Foudil & Shafranovich Expires November 30, 2019 [Page 20] Internet-Draft A Method for Web Security Policies May 2019 @@ -1173,7 +1173,7 @@ B.5. Since draft-foudil-securitytxt-04 -Foudil & Shafranovich Expires November 28, 2019 [Page 21] +Foudil & Shafranovich Expires November 30, 2019 [Page 21] Internet-Draft A Method for Web Security Policies May 2019 @@ -1229,4 +1229,4 @@ Authors' Addresses -Foudil & Shafranovich Expires November 28, 2019 [Page 22] +Foudil & Shafranovich Expires November 30, 2019 [Page 22] From c64c135d108a472139b64f5b2f1ec0e2fca8ae0f Mon Sep 17 00:00:00 2001 From: nightwatchcyber Date: Wed, 29 May 2019 21:19:25 -0400 Subject: [PATCH 3/4] updated redirect language --- draft-foudil-securitytxt.html | 2 +- draft-foudil-securitytxt.md | 6 +++--- draft-foudil-securitytxt.txt | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/draft-foudil-securitytxt.html b/draft-foudil-securitytxt.html index cc78f75..e7c7d8c 100644 --- a/draft-foudil-securitytxt.html +++ b/draft-foudil-securitytxt.html @@ -699,7 +699,7 @@

4.1. Web-based services

Web-based services SHOULD place the security.txt file under the /.well-known/ path; e.g. https://example.com/.well-known/security.txt as per [RFC5785]. A security.txt file located under the top-level path SHOULD either redirect (as per section 6.4 of [RFC7231]) to the security.txt file under the /.well-known/ path or be used as a fallback if the “.well-known” path cannot be used.

-

If retrieval of a “security.txt” file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow redirects that lead to another domain or subdomain but SHOULD follow redirects within the same domain name (but not different subdomain on the same domain).

+

If retrieval of a “security.txt” file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow that redirect if it leads to another domain or subdomain but SHOULD follow such redirect within the same domain name (but not different subdomain on the same domain).

The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file.

4.2. Filesystems diff --git a/draft-foudil-securitytxt.md b/draft-foudil-securitytxt.md index a932f1e..bf36fbb 100644 --- a/draft-foudil-securitytxt.md +++ b/draft-foudil-securitytxt.md @@ -367,9 +367,9 @@ as per {{!RFC5785}}. A security.txt file located under the top-level path SHOULD to the security.txt file under the /.well-known/ path or be used as a fallback if the ".well-known" path cannot be used. If retrieval of a "security.txt" file from the top-level path results in a redirect (as per -section 6.4 of {{!RFC7231}}), the implementors MUST NOT follow -redirects that lead to another domain or subdomain -but SHOULD follow redirects within the same domain name +section 6.4 of {{!RFC7231}}), the implementors MUST NOT follow that +redirect if it leads to another domain or subdomain +but SHOULD follow such redirect within the same domain name (but not different subdomain on the same domain). The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file. diff --git a/draft-foudil-securitytxt.txt b/draft-foudil-securitytxt.txt index 1d211d3..f3c49de 100644 --- a/draft-foudil-securitytxt.txt +++ b/draft-foudil-securitytxt.txt @@ -519,9 +519,9 @@ Internet-Draft A Method for Web Security Policies May 2019 If retrieval of a "security.txt" file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors - MUST NOT follow redirects that lead to another domain or subdomain - but SHOULD follow redirects within the same domain name (but not - different subdomain on the same domain). + MUST NOT follow that redirect if it leads to another domain or + subdomain but SHOULD follow such redirect within the same domain name + (but not different subdomain on the same domain). The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file. From d30839da5ba86bfe257fc6899e3ace5b9923f548 Mon Sep 17 00:00:00 2001 From: nightwatchcyber Date: Tue, 4 Jun 2019 07:23:45 -0400 Subject: [PATCH 4/4] fixes --- draft-foudil-securitytxt.html | 12 ++--- draft-foudil-securitytxt.md | 4 +- draft-foudil-securitytxt.txt | 96 +++++++++++++++++------------------ 3 files changed, 56 insertions(+), 56 deletions(-) diff --git a/draft-foudil-securitytxt.html b/draft-foudil-securitytxt.html index e7c7d8c..5792539 100644 --- a/draft-foudil-securitytxt.html +++ b/draft-foudil-securitytxt.html @@ -339,7 +339,7 @@ - + @@ -363,12 +363,12 @@ Y. Shafranovich -Expires: November 30, 2019 +Expires: December 6, 2019 Nightwatch Cybersecurity -May 29, 2019 +June 04, 2019 @@ -384,7 +384,7 @@

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

-

This Internet-Draft will expire on November 30, 2019.

+

This Internet-Draft will expire on December 6, 2019.

Copyright Notice

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

@@ -699,7 +699,7 @@

4.1. Web-based services

Web-based services SHOULD place the security.txt file under the /.well-known/ path; e.g. https://example.com/.well-known/security.txt as per [RFC5785]. A security.txt file located under the top-level path SHOULD either redirect (as per section 6.4 of [RFC7231]) to the security.txt file under the /.well-known/ path or be used as a fallback if the “.well-known” path cannot be used.

-

If retrieval of a “security.txt” file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow that redirect if it leads to another domain or subdomain but SHOULD follow such redirect within the same domain name (but not different subdomain on the same domain).

+

If retrieval of a “security.txt” file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow that redirect if it leads to another domain or subdomain but SHOULD follow that redirect within the same domain name (but not different subdomain on the same domain).

The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file.

4.2. Filesystems @@ -736,7 +736,7 @@

sign-footer = <OpenPGP signature from section 7 of [RFC4880]> -unsigned = *line [can-field eol] *line contact-field eol *line [lang-field eol] *line +unsigned = *line [can-field eol] *line (contact-field eol) *line [lang-field eol] *line ; the order of elements is not important line = (field / comment) eol diff --git a/draft-foudil-securitytxt.md b/draft-foudil-securitytxt.md index bf36fbb..881de9d 100644 --- a/draft-foudil-securitytxt.md +++ b/draft-foudil-securitytxt.md @@ -369,7 +369,7 @@ to the security.txt file under the /.well-known/ path or be used as a fallback i If retrieval of a "security.txt" file from the top-level path results in a redirect (as per section 6.4 of {{!RFC7231}}), the implementors MUST NOT follow that redirect if it leads to another domain or subdomain -but SHOULD follow such redirect within the same domain name +but SHOULD follow that redirect within the same domain name (but not different subdomain on the same domain). The guidance regarding redirects SHOULD NOT apply to the resource locations that appear within the file. @@ -421,7 +421,7 @@ sign-header = sign-footer = -unsigned = *line [can-field eol] *line contact-field eol *line [lang-field eol] *line +unsigned = *line [can-field eol] *line (contact-field eol) *line [lang-field eol] *line ; the order of elements is not important line = (field / comment) eol diff --git a/draft-foudil-securitytxt.txt b/draft-foudil-securitytxt.txt index f3c49de..3b3ae4c 100644 --- a/draft-foudil-securitytxt.txt +++ b/draft-foudil-securitytxt.txt @@ -5,8 +5,8 @@ Network Working Group E. Foudil Internet-Draft Intended status: Informational Y. Shafranovich -Expires: November 30, 2019 Nightwatch Cybersecurity - May 29, 2019 +Expires: December 6, 2019 Nightwatch Cybersecurity + June 04, 2019 A Method for Web Security Policies @@ -36,7 +36,7 @@ Status of This Memo time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on November 30, 2019. + This Internet-Draft will expire on December 6, 2019. Copyright Notice @@ -53,9 +53,9 @@ Copyright Notice -Foudil & Shafranovich Expires November 30, 2019 [Page 1] +Foudil & Shafranovich Expires December 6, 2019 [Page 1] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 the Trust Legal Provisions and are provided without warranty as @@ -109,9 +109,9 @@ Table of Contents -Foudil & Shafranovich Expires November 30, 2019 [Page 2] +Foudil & Shafranovich Expires December 6, 2019 [Page 2] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 B.2. Since draft-foudil-securitytxt-01 . . . . . . . . . . . . 20 @@ -165,9 +165,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 3] +Foudil & Shafranovich Expires December 6, 2019 [Page 3] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 1.2. Terminology @@ -221,9 +221,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 4] +Foudil & Shafranovich Expires December 6, 2019 [Page 4] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 unlimited number of fields. It is important to note that you MUST @@ -277,9 +277,9 @@ https://[2001:db8:8:4::2]/.well-known/security.txt -Foudil & Shafranovich Expires November 30, 2019 [Page 5] +Foudil & Shafranovich Expires December 6, 2019 [Page 5] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 3.3. Separate Fields @@ -333,9 +333,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 6] +Foudil & Shafranovich Expires December 6, 2019 [Page 6] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 3.5.2. Canonical @@ -389,9 +389,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 7] +Foudil & Shafranovich Expires December 6, 2019 [Page 7] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 When it comes to verifying the authenticity of the key, it is always @@ -445,9 +445,9 @@ Encryption: dns:5d2d37ab76d47d36._openpgpkey.example.com?type=OPENPGPKEY -Foudil & Shafranovich Expires November 30, 2019 [Page 8] +Foudil & Shafranovich Expires December 6, 2019 [Page 8] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 The order in which they appear MUST NOT be interpreted as an @@ -501,9 +501,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 9] +Foudil & Shafranovich Expires December 6, 2019 [Page 9] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 4. Location of the security.txt file @@ -520,7 +520,7 @@ Internet-Draft A Method for Web Security Policies May 2019 If retrieval of a "security.txt" file from the top-level path results in a redirect (as per section 6.4 of [RFC7231]), the implementors MUST NOT follow that redirect if it leads to another domain or - subdomain but SHOULD follow such redirect within the same domain name + subdomain but SHOULD follow that redirect within the same domain name (but not different subdomain on the same domain). The guidance regarding redirects SHOULD NOT apply to the resource @@ -557,9 +557,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 10] +Foudil & Shafranovich Expires December 6, 2019 [Page 10] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 In general, implementors SHOULD "be conservative in what you do, be @@ -582,7 +582,7 @@ sign-header = sign-footer = -unsigned = *line [can-field eol] *line contact-field eol *line [lang-field eol] *line +unsigned = *line [can-field eol] *line (contact-field eol) *line [lang-field eol] *line ; the order of elements is not important line = (field / comment) eol @@ -613,9 +613,9 @@ uri = -Foudil & Shafranovich Expires November 30, 2019 [Page 11] +Foudil & Shafranovich Expires December 6, 2019 [Page 11] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 encryption-field = "Encryption" fs SP uri @@ -669,9 +669,9 @@ unstructured = -Foudil & Shafranovich Expires November 30, 2019 [Page 12] +Foudil & Shafranovich Expires December 6, 2019 [Page 12] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 6.2. Incorrect or Stale Information @@ -725,9 +725,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 13] +Foudil & Shafranovich Expires December 6, 2019 [Page 13] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 can create a page with the "security.txt" AND "/.well-known/ @@ -781,9 +781,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 14] +Foudil & Shafranovich Expires December 6, 2019 [Page 14] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 7.1. Well-Known URIs registry @@ -837,9 +837,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 15] +Foudil & Shafranovich Expires December 6, 2019 [Page 15] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 Field Name: Acknowledgments @@ -893,9 +893,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 16] +Foudil & Shafranovich Expires December 6, 2019 [Page 16] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 The authors would also like to acknowledge the feedback provided by @@ -949,9 +949,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 17] +Foudil & Shafranovich Expires December 6, 2019 [Page 17] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 [RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network @@ -1005,9 +1005,9 @@ Internet-Draft A Method for Web Security Policies May 2019 -Foudil & Shafranovich Expires November 30, 2019 [Page 18] +Foudil & Shafranovich Expires December 6, 2019 [Page 18] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 9.2. Informative References @@ -1061,9 +1061,9 @@ Appendix A. Note to Readers -Foudil & Shafranovich Expires November 30, 2019 [Page 19] +Foudil & Shafranovich Expires December 6, 2019 [Page 19] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 Appendix B. Document History @@ -1117,9 +1117,9 @@ B.2. Since draft-foudil-securitytxt-01 -Foudil & Shafranovich Expires November 30, 2019 [Page 20] +Foudil & Shafranovich Expires December 6, 2019 [Page 20] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 B.3. Since draft-foudil-securitytxt-02 @@ -1173,9 +1173,9 @@ B.5. Since draft-foudil-securitytxt-04 -Foudil & Shafranovich Expires November 30, 2019 [Page 21] +Foudil & Shafranovich Expires December 6, 2019 [Page 21] -Internet-Draft A Method for Web Security Policies May 2019 +Internet-Draft A Method for Web Security Policies June 2019 o Removed permission directive (#30) @@ -1229,4 +1229,4 @@ Authors' Addresses -Foudil & Shafranovich Expires November 30, 2019 [Page 22] +Foudil & Shafranovich Expires December 6, 2019 [Page 22]