844527 - Update nsSTSPreloadList with latest Chromium additions (2013-03-20 edition)

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Reed Loden [:reed]]

Attachment: patch - v1

In order to keep up with changes to Chromium's HSTS preload list, as well as ensure that gPreloadListExpirationTime stays up-to-date, security/manager/tools/getHSTSPreloadList.js occasionally needs to be run and changes committed. This is one of those such times. Once bug 836097 has been fixed, this process will no longer be required.

Comment 1

[Reed Loden [:reed]]

This patch also adds the first Mozilla-owned site to the HSTS preload list. Yay!

Comment 2

[Matt Brubeck (:mbrubeck)]

We should make sure this lands on Aurora and Beta too, otherwise Firefox 20 and 21 will ship with the old, expired preload list.

Comment 3

[Honza Bambas (:mayhemer)]

Attachment: result of my run

a bit different, but it may be just that the situation changed in the mean time?

(BTW, some update to the preload js script, like some progress indication or at least a message "I'm working!" at the begining would be good.)

Comment 4

[Alex Keybl [:akeybl]]

Should we clone this out already for 21/22 to update to the latest just in case bug 836097 isn't resolved/uplifted sooner?

Comment 5

[Reed Loden [:reed]]

(In reply to Honza Bambas (:mayhemer) from comment #3)
> a bit different, but it may be just that the situation changed in the mean
> time?

Can you run it again? I'm seeing factor.cc working for me.

> (BTW, some update to the preload js script, like some progress indication or
> at least a message "I'm working!" at the begining would be good.)

File a bug? :)

Comment 6

[Honza Bambas (:mayhemer)]

Attachment: another results of my runs

The result has changed from what I was getting 5 those days ago.

Today, most notably crate.io and jottit.com are not very reliable when connecting them, among others...    

I'm running the script on two machines in the same (local) net: win7 box and osx 10.7 box.  OSX has google's dns servers (8.8.8.8, 8.8.4.4), win7 has provider's (czech o2).

I'm running the script on both machines repeatedly (3 runs each).

Results on win7 machine gives the same list (regarding each other), however errors are a bit different (for the two hosts mentioned mainly).

The mac result are however more jittering.

The final .inc file is in all cases different for mac and for win.

Hard to say what to do.  The script might have an option to try to connect some hosts that are unreachable more times.  Also the batch size should be lowered to say 10 hosts at one moment tops.

Comment 7

[Honza Bambas (:mayhemer)]

Comment on attachment 717561 [details] [diff] [review]
patch - v1

For now, please run the script few times (like 4 times or so) and try to merge the results to a single one.

We must do the best to make the script stable automatically and give the same results all around the world under any configuration.  This should be done in a followup bug, we don't need to block this bug on it.  The script should do the best to reach the servers and give up only after a number of connection failure attempts.

Reed, do you agree?

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

Reed, we're about to go to build on our second-to-last beta.  Can you do the manual parts needed here this week?

Comment 10

[Reed Loden [:reed]]

Need some of the work in bug 847621 first, though I can just run stuff manually...

Comment 11

[Reed Loden [:reed]]

Attachment: patch - v2

Ran the script four times using keeler's patch in bug 847621, and here's the updated result.

One issue that needs to be worked out (but I don't think it should block landing this)... the script says https://mega.co.nz isn't reachable, but I can definitely connect to it using curl, and it does have a valid HSTS header.

Comment 12

[Lukas Blakk [:lsblakk] use ?needinfo]

Since we're going to our last beta of FF20 without this being reviewed and we'll want to ensure proper testing both internally and externally occurs we'll have to push this back to FF21 and keep the FF19 list for FF20 unless someone can make a case that this will seriously break a significant number of users' experience. Our understanding is that this will just cause a slight delay in the redirection to https which is minor.

Comment 13

[Lukas Blakk [:lsblakk] use ?needinfo]

Changing the wontfix back to affected since Brian is working on getting this landed now.

Comment 14

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/021d69679f43

I made one change to the patch: mega.co.nz was reachable and sending a two-year HSTS header when I tried it, so I added that site to the list.

Comment 15

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e89c06192e6c
https://hg.mozilla.org/releases/mozilla-beta/rev/544488751514

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/021d69679f43