1373582 - Firefox applies HSTS to ftp and "upgrades" it to https

Status: RESOLVED FIXED

(Core Graveyard :: Networking: FTP, defect)

Description

[Tom Hughes]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Build ID: 20170526184742

Steps to reproduce:

Visited https://sourceware.org/ and then tried to download ftp://sourceware.org/pub/valgrind/valgrind-3.13.0.tar.bz2.


Actual results:

The browser tried to load https://sourceware.org/pub/valgrind/valgrind-3.13.0.tar.bz2 instead, which is not a functional link.


Expected results:

It should have loaded ftp://sourceware.org/pub/valgrind/valgrind-3.13.0.tar.bz2 as requested.

Comment 1

[Tom Hughes]

Further tested by using "forget this site" on sourceware.org, after which the ftp link works correctly until I visit https://sourceware.org/ again.

All using the Fedora build of Firefox 53.0.3 on Fedora 25.

Comment 2

[Loic]

Attachment: screenshot.jpg

WFM with FF54 on Win 7.

Are you able to reproduce it with a new profile?
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles

Comment 3

[Tom Hughes]

I am able to reproduce it with a clean profile yes. I started firefox with a new, clean, profile and loaded the ftp link then the https link and then when I tried to load the ftp link again it converted it to https and 404ed.

Comment 4

[Frank Ch. Eigler]

WFM with FF53.0.2 on Fedora 25.
Tom, are you using some outgoing web proxy by any chance?

Comment 5

[Tom Hughes]

Yes I am, and disabling it stops this happening ;-)

Comment 6

[Tom Hughes]

Just a warning - the https version of the link now works because sourceware.org have mapped that directory to the web root.

Comment 7

[Mark Wielaard]

So this is apparently not a ff issue, but some proxies might not implement HSTS correctly?

Note that since a short while ago sourceware now mirrors ftp://sourceware.org/pub/ at https://sourceware.org/pub/ to help people that get such incorrect redirects (making it not a good example of this bug anymore).

Comment 8

[Tom Hughes]

No it's still a bug I think, it's just that because it is proxied firefox is seeing it as an http request when it decides whether to apply the HSTS upgrade, but using the HSTS status of the target host to upgrade an http connection to a proxy doesn't seem right.

Comment 9

[Dragana Damjanovic [:dragana]]

Attachment: bug_1373582.patch

"When establishing an HTTP connection to a given host, however
 instigated, the UA examines its cache of Known HSTS Hosts to see if
 there are any with domain names that are superdomains of the given
 host's domain name. ..."

Comment 10

[Patrick McManus [:mcmanus]]

even better..

https://tools.ietf.org/html/rfc6797#section-8.3
Whenever the UA prepares to "load" (also known as "dereference") any
   "http" URI [RFC3986] (including when following HTTP redirects
   [RFC2616]), the UA MUST first determine whether a domain name is
   given in the URI and whether it matches a Known HSTS Host, using
   these steps:

Comment 11

[Patrick McManus [:mcmanus]]

Comment on attachment 8881958 [details] [diff] [review]
bug_1373582.patch

Review of attachment 8881958 [details] [diff] [review]:
-----------------------------------------------------------------

I think you need both sts priming and regular sts - ProcessSingleSecurityHeader() drives the latter.

Comment 12

[Dragana Damjanovic [:dragana]]

Attachment: bug_1373582.patch

Comment 13

[Dragana Damjanovic [:dragana]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=328078fba7953f2cb7b6d2f59fa5cb9ba2d2c3b5

Comment 14

[Patrick McManus [:mcmanus]]

Comment on attachment 8882032 [details] [diff] [review]
bug_1373582.patch

Review of attachment 8882032 [details] [diff] [review]:
-----------------------------------------------------------------

you can skip the call to secureupgrade.. with that r+

Comment 15

[Dragana Damjanovic [:dragana]]

Attachment: bug_1373582.patch

Comment 16

[Dragana Damjanovic [:dragana]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b05a69e4f185f2dd95eb85e66c1599cf089320eb

Comment 17

[Dragana Damjanovic [:dragana]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/28661214cd0cca6e60b2001af71eb4977fa950b6
Bug 1373582 - Do not apply HSTS to non http. r=mcmanus

Comment 18

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/28661214cd0c