1283109 - Create a services client for augmenting the STS preload list between releases

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Mark Goodwin [:mgoodwin]]

The services blocklist client provides a mechanism we can use to get Strict Transport Security preloads to the browser between releases.

Let's build a client to do this.

Comment 1

[Daniel Veditz [:dveditz]]

Does this include HPKP preloads as well, or is there a separate bug for that?

Comment 2

[Mark Goodwin [:mgoodwin]]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> Does this include HPKP preloads as well, or is there a separate bug for that?

The work I've done so far only relates to STS - We should file a separate bug.

Comment 3

[Mark Goodwin [:mgoodwin]]

(In reply to Mark Goodwin [:mgoodwin] from comment #2)
> (In reply to Daniel Veditz [:dveditz] from comment #1)
> > Does this include HPKP preloads as well, or is there a separate bug for that?
> 
> The work I've done so far only relates to STS - We should file a separate
> bug.

Bug 1306470

Comment 4

[Mark Goodwin [:mgoodwin]]

Attachment: Bug 1283109 - Create a services client for augmenting the STS preload list between releases.

Review commit: https://reviewboard.mozilla.org/r/100164/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/100164/

Comment 5

[Mathieu Leplatre [:leplatrem]]

Comment on attachment 8820702 [details]
Bug 1283109 - Create a services client for augmenting the STS preload list between releases.

https://reviewboard.mozilla.org/r/100162/#review100656

::: services/common/tests/unit/test_blocklist_pinning.js:161
(Diff revision 1)
>    Services.prefs.setCharPref("services.settings.server",
>                               `http://localhost:${server.identity.primaryPort}/v1`);
>    yield PinningPreloadClient.maybeSync(5000, Date.now());
> +
> +  // Check that five.example.com is now has includeSubdomains set
> +  ok(sss.isSecureHost(sss.HEADER_HSTS, "subdomain.five.example.com", 0));

When looking at the diff it is rather obvious, but I think we could make it even more explicit with a comment that an update to this same STS entry with `last_modified=5000` now has `includeSubdomains=true`.

Comment 6

[Mathieu Leplatre [:leplatrem]]

Comment on attachment 8820702 [details]
Bug 1283109 - Create a services client for augmenting the STS preload list between releases.

https://reviewboard.mozilla.org/r/100162/#review100658

Comment 7

[Mathieu Leplatre [:leplatrem]]

Comment on attachment 8820702 [details]
Bug 1283109 - Create a services client for augmenting the STS preload list between releases.

https://reviewboard.mozilla.org/r/100164/#review100662

Comment 8

[Mathieu Leplatre [:leplatrem]]

Comment on attachment 8820702 [details]
Bug 1283109 - Create a services client for augmenting the STS preload list between releases.

https://reviewboard.mozilla.org/r/100164/#review100664

Comment 9

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8820702 [details]
Bug 1283109 - Create a services client for augmenting the STS preload list between releases.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/100164/diff/1-2/

Comment 10

[Mark Goodwin [:mgoodwin]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ae9f58eea512

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e7181e3b6f3e
Create a services client for augmenting the STS preload list between releases. r=leplatrem

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e7181e3b6f3e