1309201 - automated hsts update infrastructure can't connect to ipv6-only hosts

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Darkspirit]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20161010030204

Steps to reproduce:

Found terrax.net on https://dxr.mozilla.org/comm-central/source/mozilla/security/manager/ssl/nsSTSPreloadList.errors

https://dev.ssllabs.com/ssltest/analyze.html?d=terrax.net&hideResults=on


Actual results:

It is not preloaded in Firefox, but in Chrome.


Expected results:

Domain should have been preloaded.
terrax.net is "IPv6 + Port 443 + ECDHE-RSA-AES256-GCM-SHA384 + secp521r1" only. (Yes, Port 80/HTTP is closed. That's what we all want with preloading.)

Comment 1

[Darkspirit]

ECDHE-RSA-AES256-GCM-SHA384 was added in Firefox 49.
Maybe the bot importing and checking chromiums HSTS preload list was/is still not capable of this cipher?

secp521r1 is not enabled by default in Windows: Maybe there was SChannel used?

DNSSEC signatures and TLSA/DANE records are correct. (There were no problems.)

It would be stupid if the importing script would check port 80 (I don't know).

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

From what I can tell, the infrastructure the update script runs on can't connect to ipv6-only hosts. I'll move this to a more appropriate component, but my understanding is we basically can't fix this until ec2 instances support ipv6-only hosts.

Comment 3

[Chris AtLee [:catlee]]

Yeah, right now none of our infra is ipv6 aware. We'd have to make use of some kind of ipv6 gateway.

Comment 4

[Chris AtLee [:catlee]]

EC2 now supports ipv6 in some regions:
https://aws.amazon.com/blogs/aws/new-ipv6-support-for-ec2-instances-in-virtual-private-clouds/

Comment 5

[Darkspirit]

"Today I am happy to share the news that IPv6 support for EC2 instances in VPCs is now available in a total of fifteen regions, along with Application Load Balancer support for IPv6 in nine of those regions."
https://aws.amazon.com/de/blogs/aws/aws-ipv6-update-global-support-spanning-15-regions-multiple-aws-services/

Comment 6

[[e-mail] (:bhearsum)]

I believe this is long fixed, and I see terrax.net in the preload list (https://searchfox.org/mozilla-central/source/security/manager/ssl/nsSTSPreloadList.inc) now.