1145844 - Fallback whitelist update: mid-May 2015

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Masatoshi Kimura [:emk]]

+++ This bug was initially created as a clone of Bug #1142769 +++

I would like to land this before the next merge.

Comment 1

[nick.smith]

Please add: jst.doded.mil

Comment 2

[Masatoshi Kimura [:emk]]

Attachment: Update fallback whitelist

* Added sites from bug 1126620 blockers and bug 1138101 blockers.
* Removed fixed sites.
* Removed following sites due to consistent connection errors or unknown host errors (please double check):
  https://click2gov.alpharetta.ga.us
  https://developer.palm.com
  https://hypotheek.bankofscotland.nl
  https://startrekonline.com
  https://www.marenostrumresort.com
  https://www.partnerandaffinitycards.co.uk
  https://www.startrekonline.com
  https://www.torrecatalunya.com

Comment 3

[:Cykesiopka]

Some entries from Bug 1144058 it would be nice to get in as well:
  https://compteasso.service-public.fr
  https://comptepro.service-public.fr
  https://connexion.mon.service-public.fr
  https://mon.service-public.fr

(In reply to Masatoshi Kimura [:emk] from comment #2)
> * Removed following sites due to consistent connection errors or unknown
> host errors (please double check):
>   https://click2gov.alpharetta.ga.us
>   https://developer.palm.com
>   https://hypotheek.bankofscotland.nl
>   https://startrekonline.com
>   https://www.marenostrumresort.com
>   https://www.partnerandaffinitycards.co.uk
>   https://www.startrekonline.com
>   https://www.torrecatalunya.com

Same results here.

Comment 4

[Masatoshi Kimura [:emk]]

Attachment: Update fallback whitelist

* Added a site from bug 1159224.
* Added servers from comment #3.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8598625 [details] [diff] [review]
Update fallback whitelist

Review of attachment 8598625 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM, but see the comment on annotating ports (and, indeed, should we refine this mechanism to use {host,port} instead of all ports on a given host?)

::: security/manager/ssl/src/IntolerantFallbackList.inc
@@ +248,2 @@
>    "partnerweb.vmware.com", // bug 1142187
> +  "paslists.com", // :9211 bug 1155712

We should maybe be a bit more verbose in these cases: "for port 9211" or something

Comment 6

[Masatoshi Kimura [:emk]]

Attachment: patch for checkin

Updated comments for non-default ports.

Comment 7

[Masatoshi Kimura [:emk]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3e18d65b28c3

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3e18d65b28c3

Comment 9

[Masatoshi Kimura [:emk]]

Comment on attachment 8599042 [details] [diff] [review]
patch for checkin

Approval Request Comment
[Feature/regressing bug #]: N/A
[User impact if declined]: Users can not connect some sites.
[Describe test coverage new/current, TreeHerder]: tested locally
[Risks and why]: Very low. Only trivial changes to static data.
[String/UUID change made/needed]: none

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8599042 [details] [diff] [review]
patch for checkin

[Triage Comment]
Should be in 38 RC1

Comment 11

[Ryan VanderMeulen [:RyanVM]]

checkin-needed isn't necessary for uplifts (and adds noise to bug queries)

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2674e227b5ee

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/a61af55e410d

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr38/rev/a61af55e410d

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a61af55e410d