From: Carl Kugler <[email-masked]>
Date: Thu, 6 Nov 1997 11:15:44 -0500

I still wish we had some kind of magic number or string to identify valid IPP
messages with high confidence.  Talking IPP through off-the-shelf Web servers
we sometimes see this kind of thing:

HTTP/1.1 200 Document follows. \r\n
Server: XXXXXXXXXXXXX\r\n
Date: Wed, 05 Nov 1997 16:30:37 GMT\r\n
Accept-Ranges: bytes\r\n
Content-Type: text/html\r\n
Content-Length: 190\r\n
Last-Modified: Wed, 05 Nov 1997 16:30:37 GMT\r\n
\r\n
<HTML>\n
<HEAD>\n
<TITLE>Error</TITLE>\n
</HEAD>\n
<BODY>\n
<H1>Error 500</H1>\n
\n
Internal error\n
\n
<P><HR><ADDRESS><A HREF="/">XXXXXXXXXXX  Server X.X.X.X </A></ADDRESS>\n
</BODY>\n
</HTML>\n
<HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY><H1>Error 501</H1>The request is
not valid or not recognized "INVALID-METHOD"<P><HR><ADDRESS><A HREF="
http://karlk.penn.boulder.ibm.com:8080/">XXXXXXXXXXXXXXXX Server
XXXXX</A></ADDRESS></BODY></HTML>

Even though there was an Error 500 in the server, the response has been wrapped
in a document and sent with return code 200.  So the IPP client has apply
various heuristics to see if it has got a good IPP response.

And even when there isn't an internal error in the server we often see this:

HTTP/1.1 200 OK\r\n
Server: XXXXXXXXXXXXXXXXXXXX\r\n
Date: Wed, 5 Nov 1997 16:40:10 GMT\r\n
Content-Type: application/ipp\r\n
Last-Modified: Wed, 5 Nov 1997 16:40:10 GMT\r\n
Content-Length: 126\r\n
\r\n
\r\n
\r\n
\x01\x00\x00\x00\x02*\x00\bjob-name\x00\x04
Job1*\x00\tjob-state\x00\x04Job1*\x00\x00\x00\x04Job2*\x00\x11job-state-reasons\x00\x04Job1*\x00\x11job-state-message\x00\x02YO\x05)\x00\x05sides\x00\x0bunsupported\x03

Notice all the CRLF pairs following the HTTP header.  So the client again is
forced to use heuristics, and I hope we never get to version 13.10, because the
start of the IPP message will look just like another CRLF!

Does anyone have a good algorithm worked out for determining the validity of an
IPP response and finding the true start of the message?

Will this problem go away with mandatory SSL V3 "framing"?

  -Carl Kugler