Chromium Code Reviews
|
|
Chromium Code Reviews
Issue
2129543003:
HSTS preload list additions and changes for Chrome 54. (Closed)
|
Created:
4 years, 5 months ago by lgarron Modified:
4 years, 3 months ago CC:
akhawe_dropbox.com, cbentzel+watch_chromium.org, chromium-reviews, matthew.holt_gmail.com, Rob Stradling Base URL:
https://chromium.googlesource.com/chromium/src.git@master Target Ref:
refs/pending/heads/master Project:
chromium Visibility:
Public. |
DescriptionHSTS preload list additions and changes for Chrome 54.
R=davidcadrian@gmail.com
TBR=palmer@chromium.org
BUG=638031, 639031, 638953
Committed: https://chromium.googlesource.com/chromium/src/+/3f789c4c557c2c7a75e9c3d92c88fa602f5b67a9
Patch Set 1 #Patch Set 2 : Update Dropbox with expect-staple #
Total comments: 2
Patch Set 3 : Expect the unexpected. #
Total comments: 4
Patch Set 4 : Update expect entries. #Patch Set 5 : HSTS preload list additions and changes for Chrome 54. #Patch Set 6 : Bulk additions. #Patch Set 7 : HSTS preload list additions and changes for Chrome 54. #Messages
Total messages: 22 (8 generated)
https://codereview.chromium.org/2129543003/diff/20001/net/http/transport_secu... File net/http/transport_security_state_static.json (right): https://codereview.chromium.org/2129543003/diff/20001/net/http/transport_secu... net/http/transport_security_state_static.json:898: + { "name": "dropbox.com", "mode": "force-https", "include_subdomains": true, "pins": "dropbox", "expect_staple": true, "expect_staple_report_uri": "https://report.badssl.com/expect-staple", "include_subdomains_for_expect_staple": true }, did you forget to update the report uri? Also, right now, we only want expect staple for www.dropbox.com (include_subdomains on that is fine). We can do others in the future
Description was changed from ========== HSTS preload list additions and changes for Chrome 54. BUG= ========== to ========== HSTS preload list additions and changes for Chrome 54. BUG=638031, 639031, 638953 ==========
lgarron@chromium.org changed reviewers: + palmer@chromium.org
CCing people who are preloading expect-{staple,ct}.
https://codereview.chromium.org/2129543003/diff/20001/net/http/transport_secu...
File net/http/transport_security_state_static.json (right):
https://codereview.chromium.org/2129543003/diff/20001/net/http/transport_secu...
net/http/transport_security_state_static.json:898: + { "name": "dropbox.com",
"mode": "force-https", "include_subdomains": true, "pins": "dropbox",
"expect_staple": true, "expect_staple_report_uri":
"https://report.badssl.com/expect-staple",
"include_subdomains_for_expect_staple": true },
On 2016/08/17 at 02:28:00, devd wrote:
> did you forget to update the report uri?
>
> Also, right now, we only want expect staple for www.dropbox.com
(include_subdomains on that is fine). We can do others in the future
Whoops, you're right, I added the wrong URL to this CL. Fixed in the next patch.
dev.akhawe@gmail.com changed reviewers: + dev.akhawe@gmail.com
https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... File net/http/transport_security_state_static.json (right): https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... net/http/transport_security_state_static.json:906: + { "name": "dropbox.com", "mode": "force-https", "include_subdomains": true, "pins": "dropbox", "expect_staple": true, "expect_staple_report_uri": "https://www.dropbox.com/log/ocsp_expect_staple", "include_subdomains_for_expect_staple": true }, can we only do expect_staple for www.dropbox.com ? (and its subdomains if that's easier)
estark@chromium.org changed reviewers: + estark@chromium.org
https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... File net/http/transport_security_state_static.json (right): https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... net/http/transport_security_state_static.json:13669: + { "name": "caddyserver.com", "expect_ct": true, "expect_ct_report_uri": "https://caddyserver.com/reporting/expect-staple" }, This one should be Expect-Staple, not Expect-CT. I really should not have picked such similar names for these things. :(
davidcadrian@gmail.com changed reviewers: + davidcadrian@gmail.com
https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... File net/http/transport_security_state_static.json (right): https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... net/http/transport_security_state_static.json:13669: + { "name": "caddyserver.com", "expect_ct": true, "expect_ct_report_uri": "https://caddyserver.com/reporting/expect-staple" }, On 2016/08/18 22:45:54, estark wrote: > This one should be Expect-Staple, not Expect-CT. > > I really should not have picked such similar names for these things. :( I'm a little worried that both of these report URI's are at the same domain being reported on, possibly causing an infinite report loop.
On 2016/08/19 21:22:45, davidcadrian wrote: > https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... > File net/http/transport_security_state_static.json (right): > > https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... > net/http/transport_security_state_static.json:13669: + { "name": > "caddyserver.com", "expect_ct": true, "expect_ct_report_uri": > "https://caddyserver.com/reporting/expect-staple" }, > On 2016/08/18 22:45:54, estark wrote: > > This one should be Expect-Staple, not Expect-CT. > > > > I really should not have picked such similar names for these things. :( > > I'm a little worried that both of these report URI's are at the same domain > being reported on, possibly causing an infinite report loop. Nice catch. Matt changed it to https://reporting.caddyserver.com/expect-staple
https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... File net/http/transport_security_state_static.json (right): https://codereview.chromium.org/2129543003/diff/40001/net/http/transport_secu... net/http/transport_security_state_static.json:906: + { "name": "dropbox.com", "mode": "force-https", "include_subdomains": true, "pins": "dropbox", "expect_staple": true, "expect_staple_report_uri": "https://www.dropbox.com/log/ocsp_expect_staple", "include_subdomains_for_expect_staple": true }, On 2016/08/18 22:39:56, devd wrote: > can we only do expect_staple for http://www.dropbox.com ? (and its subdomains if that's > easier) Same problem here: report_uri would cause infinite loop of reports.
Alright, got a new URL from Dropbox, so to summarize, here are the changes we'll need: - Dropbox should be Expect-Staple for www.dropbox.com only (not dropbox.com), and the report URL should be https://log.getdropbox.com/log/ocsp_expect_staple. - caddyserver.com should be Expect-Staple, not Expect-CT.
On 2016/08/24 at 04:25:03, estark wrote: > Alright, got a new URL from Dropbox, so to summarize, here are the changes we'll need: > > - Dropbox should be Expect-Staple for www.dropbox.com only (not dropbox.com), and the report URL should be https://log.getdropbox.com/log/ocsp_expect_staple. > > - caddyserver.com should be Expect-Staple, not Expect-CT. And also the caddyserver.com needed the updated URL. ;-) Fixed in the latest patch, although I wouldn't mind a sanity check.
On 2016/08/24 07:08:43, lgarron wrote: > On 2016/08/24 at 04:25:03, estark wrote: > > Alright, got a new URL from Dropbox, so to summarize, here are the changes > we'll need: > > > > - Dropbox should be Expect-Staple for http://www.dropbox.com only (not http://dropbox.com), > and the report URL should be https://log.getdropbox.com/log/ocsp_expect_staple. > > > > - http://caddyserver.com should be Expect-Staple, not Expect-CT. > > And also the http://caddyserver.com needed the updated URL. ;-) > > Fixed in the latest patch, although I wouldn't mind a sanity check. What's the deadline on getting changes in for Chrome 54?
Today. On Wed, Aug 24, 2016 at 08:27 <davidcadrian@gmail.com> wrote: > On 2016/08/24 07:08:43, lgarron wrote: > > On 2016/08/24 at 04:25:03, estark wrote: > > > Alright, got a new URL from Dropbox, so to summarize, here are the > changes > > we'll need: > > > > > > - Dropbox should be Expect-Staple for http://www.dropbox.com only (not > http://dropbox.com), > > > and the report URL should be > https://log.getdropbox.com/log/ocsp_expect_staple. > > > > > > - http://caddyserver.com should be Expect-Staple, not Expect-CT. > > > > And also the http://caddyserver.com needed the updated URL. ;-) > > > > > Fixed in the latest patch, although I wouldn't mind a sanity check. > > What's the deadline on getting changes in for Chrome 54? > > https://codereview.chromium.org/2129543003/ > -- You received this message because you are subscribed to the Google Groups "Chromium-reviews" group. To unsubscribe from this group and stop receiving emails from it, send an email to chromium-reviews+unsubscribe@chromium.org.
On 2016/08/24 17:02:48, chromium-reviews wrote: > Today. > On Wed, Aug 24, 2016 at 08:27 <mailto:davidcadrian@gmail.com> wrote: > > > On 2016/08/24 07:08:43, lgarron wrote: > > > On 2016/08/24 at 04:25:03, estark wrote: > > > > Alright, got a new URL from Dropbox, so to summarize, here are the > > changes > > > we'll need: > > > > > > > > - Dropbox should be Expect-Staple for http://www.dropbox.com only (not > > http://dropbox.com), > > > > > and the report URL should be > > https://log.getdropbox.com/log/ocsp_expect_staple. > > > > > > > > - http://caddyserver.com should be Expect-Staple, not Expect-CT. > > > > > > And also the http://caddyserver.com needed the updated URL. ;-) > > > > > > > > Fixed in the latest patch, although I wouldn't mind a sanity check. > > > > What's the deadline on getting changes in for Chrome 54? > > > > https://codereview.chromium.org/2129543003/ > > > > -- > You received this message because you are subscribed to the Google Groups > "Chromium-reviews" group. > To unsubscribe from this group and stop receiving emails from it, send an email > to mailto:chromium-reviews+unsubscribe@chromium.org. LGTM. (Not that you need it from me)
Description was changed from ========== HSTS preload list additions and changes for Chrome 54. BUG=638031, 639031, 638953 ========== to ========== HSTS preload list additions and changes for Chrome 54. TBR=palmer@chromium.org BUG=638031, 639031, 638953 ==========
Message was sent while issue was closed.
Description was changed from ========== HSTS preload list additions and changes for Chrome 54. TBR=palmer@chromium.org BUG=638031, 639031, 638953 ========== to ========== HSTS preload list additions and changes for Chrome 54. R=davidcadrian@gmail.com TBR=palmer@chromium.org BUG=638031, 639031, 638953 Committed: https://crrev.com/3f789c4c557c2c7a75e9c3d92c88fa602f5b67a9 Cr-Commit-Position: refs/heads/master@{#414335} ==========
Message was sent while issue was closed.
Patchset 7 (id:??) landed as https://crrev.com/3f789c4c557c2c7a75e9c3d92c88fa602f5b67a9 Cr-Commit-Position: refs/heads/master@{#414335}
Message was sent while issue was closed.
Description was changed from ========== HSTS preload list additions and changes for Chrome 54. R=davidcadrian@gmail.com TBR=palmer@chromium.org BUG=638031, 639031, 638953 Committed: https://crrev.com/3f789c4c557c2c7a75e9c3d92c88fa602f5b67a9 Cr-Commit-Position: refs/heads/master@{#414335} ========== to ========== HSTS preload list additions and changes for Chrome 54. R=davidcadrian@gmail.com TBR=palmer@chromium.org BUG=638031, 639031, 638953 Committed: https://chromium.googlesource.com/chromium/src/+/3f789c4c557c2c7a75e9c3d92c88... ==========
Message was sent while issue was closed.
Committed patchset #7 (id:110001) manually as 3f789c4c557c2c7a75e9c3d92c88fa602f5b67a9 (presubmit successful). |
