Page MenuHomePhabricator

Add new Cloud Services domains to public suffix list
Closed, ResolvedPublic

Description

Process: https://github.com/publicsuffix/list/wiki/Guidelines
See https://github.com/publicsuffix/list/pull/284 for the wmflabs.org request

The reason for this is twofold:

  • browsers will see 'a.wmcloud.org' and 'b.wmcloud.org' as two completely seperate security domains (i.e. no cookie sharing, no cross-site requests)
  • letsencrypt uses the suffix list for rate limiting (i.e. the number of certs requested per unit time for *.wmcloud.org is limited; if wmcloud.org is in de suffix list, the limit will be for *.A.wmcloud.org, but B.wmcloud.org is not affected

Event Timeline

I just checked and that domain doesn't even have the right nameservers (it's set to ns[0-2].wikimedia.org), so this might be a bit premature :)

bd808 added a subscriber: bd808.

This seems like a good thing to do as we roll out toolforge.org

Bstorm triaged this task as Medium priority.Feb 11 2020, 4:15 PM
Bstorm raised the priority of this task from Medium to High.
Bstorm added a subscriber: Bstorm.

This might be high now if we need to update some public record about new domain names.

Mentioned in SAL (#wikimedia-cloud) [2020-02-17T18:53:53Z] <arturo> T168677 created DNS TXT record _psl.toolforge.org. with value https://github.com/publicsuffix/list/pull/970

I couldn't create the TXT record int he wmcloud.org zone, either using horizon or the cmdline:

root@cloudcontrol1003:~# designate record-create --os-tenant-id cloudinfra --type TXT --name _psl.wmcloud.org. --data https://github.com/publicsuffix/list/pull/970 a5f22422-815c-43d2-95aa-8fbdee95de01
/usr/lib/python2.7/dist-packages/designateclient/cli/base.py:38: DeprecationWarning: The "designate" CLI is being deprecated in favour of the "openstack" CLI plugin. All designate API v2 commands are implemented there. When the v1 API is removed this CLI will stop functioning
  DeprecationWarning)
+---------+---------------------+
| Field   | Value               |
+---------+---------------------+
| Code    | 404                 |
| Type    | zone_not_found      |
| Message | Could not find Zone |
+---------+---------------------+
ERROR: The requested action did not complete successfully
root@cloudcontrol1003:~# designate domain-list --os-project-id cloudinfra
/usr/lib/python2.7/dist-packages/designateclient/cli/base.py:38: DeprecationWarning: The "designate" CLI is being deprecated in favour of the "openstack" CLI plugin. All designate API v2 commands are implemented there. When the v1 API is removed this CLI will stop functioning
  DeprecationWarning)
+--------------------------------------+-------------------------+------------+
| id                                   | name                    |     serial |
+--------------------------------------+-------------------------+------------+
| d863546e-cde7-4a4c-b2e2-a7e89db0f196 | cloudinfra.wmflabs.org. | 1581676299 |
| a5f22422-815c-43d2-95aa-8fbdee95de01 | wmcloud.org.            | 1581676304 |
+--------------------------------------+-------------------------+------------+

It seems to me something is wrong with this particular domain in Designate. I remember doing some database updates by had. I set it up, so I should know, but.... I'd need to review the setup.
Maybe @Andrew is also interested in this issue.

It seems to me something is wrong with this particular domain in Designate. I remember doing some database updates by had.

Something has gone wrong if it's got that far without bug reports being filed here and upstream - creating a domain is not a crazy backend task that should ever require manual database updates by a root. I think we normally do it with some script that just sends the designate API some requests from a sufficiently privileged account.
In this case given the lack of the usual NS/SOA recordsets associated with each domain I suspect the domain is broken, either by the manual database changes or by whatever necessitated them in the first place.

The record for wmcloud.org was created:

arturo@endurance:~ $ dig _psl.wmcloud.org TXT +short
"https://github.com/publicsuffix/list/pull/970"

now it's missing from designate though:

image.png (451×324 px, 30 KB)

Mentioned in SAL (#wikimedia-cloud) [2020-03-30T16:55:12Z] <arturo> dropping _psl.wmcloud.org record (T168677)

Mentioned in SAL (#wikimedia-cloud) [2020-03-30T16:56:03Z] <arturo> dropping _psl.toolforge.org TXT record (T168677)