1365790 - Make sure HPKP preload expiration date is accurate for 54

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[J.C. Jones [:jcj] (he/him)]

Confirm and patch security/manager/ssl/StaticHPKPins.h and security/manager/ssl/nsSTSPreloadList.inc in 54 to have sufficient lifetime on the preloaded HPKP and STS pins.

Comment 1

[Liz Henry (:lizzard) (relman/hg->git project)]

Marking this as a blocker for 54 release to make sure we catch it.

Comment 2

[Gerry Chang [:gchang]]

Hi :jcj,
After checking the time, it seems HPKP is July 24. Is it correct? This might need your help to check? We need to extend the lifetime after August 8.

Comment 3

[J.C. Jones [:jcj] (he/him)]

Gerry,

Yes, we should update mozilla-beta's StaticHPKPins.h and nsSTSPreloadList.inc files to 1506384000000000, which is 2017-09-26, the start of the 56 cycle (giving 1 whole cycle of overlap).

Assigning :keeler - we should get this done in the next week.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: bug 1365790 - bump security preload information expiration dates to 2017-09-26 for Firefox 54 a?gchang

Review commit: https://reviewboard.mozilla.org/r/143450/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/143450/

Comment 5

[J.C. Jones [:jcj] (he/him)]

Comment on attachment 8871939 [details]
bug 1365790 - bump security preload information expiration dates to 2017-09-26 for Firefox 54  a?gchang

https://reviewboard.mozilla.org/r/143450/#review147218

Verified as 2017-09-26

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8871939 [details]
bug 1365790 - bump security preload information expiration dates to 2017-09-26 for Firefox 54  a?gchang

Approval Request Comment
[Feature/Bug causing the regression]: HSTS/HPKP preloading
[User impact if declined]: users may have out-of-date preloaded security information before they can update to the next version
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: n/a - doesn't need to land in Nightly
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: we've done this a few times before
[String changes made/needed]: none

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #6)
> [User impact if declined]: users may have out-of-date preloaded security
> information before they can update to the next version

Er, rather, the preloaded lists may turn themselves off before users update, leaving a window of vulnerability.

Comment 8

[Julien Cristau [:jcristau] (back April 22)]

Comment on attachment 8871939 [details]
bug 1365790 - bump security preload information expiration dates to 2017-09-26 for Firefox 54  a?gchang

bump hpkp/hsts preload expiration dates, beta54+

Should be in 54.0b13

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/10cfa295a989

Comment 10

[Andrei Vaida [:avaida]]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #6)
> [Is this code covered by automated tests?]: yes
> [Has the fix been verified in Nightly?]: n/a - doesn't need to land in
> Nightly
> [Needs manual test from QE? If yes, steps to reproduce]: no

Setting qe-verify- based on David's assessment on manual testing needs and the fact that this fix has automated coverage.