Subject: [Uta] Google TLSRPTs

From: Grant Taylor <[email-masked]>
Date: Fri, 26 Apr 2019 11:39:16 -0600

Is anyone else seeing policy type of "no-policy-found" in the TLSRPTs 
that they are receiving from Google?

I'm seeing said policy with a "total-successful-session-count" of 
exactly one each day in addition to the other policies.

For a week now, I've had one or more successful counts on my "sts" 
policy and exactly one hit on a "no-policy-found", every day.

I was curious if anyone had any thoughts before I go tilt at the Google 
windmill.

{
	"organization-name": "Google Inc.",
	"date-range": {
		REDACTED
	},
	"contact-info": "[email-masked]",
	"report-id": REDACTED
	"policies": [
		{
			"policy": {
				"policy-type": "sts",
				"policy-string": [
					"version: STSv1",
					"mode: testing",
					REDACTED
					"max_age: 604800"
				],
				"policy-domain": REDACTED
			},
			"summary": {
				"total-successful-session-count": 24
			}
		},
		{
			"policy": {
				"policy-type": "no-policy-found"
			},
			"summary": {
				"total-successful-session-count": 1
			}
		}
	]
}

-- 
Grant. . . .
unix || die

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 26 Apr 2019 16:36:40 -0400

> On Apr 26, 2019, at 1:39 PM, Grant Taylor <gtaylor=[email-masked]> wrote:
> 
> Is anyone else seeing policy type of "no-policy-found" in the TLSRPTs that they are receiving from Google?
> 
> I'm seeing said policy with a "total-successful-session-count" of exactly one each day in addition to the other policies.
> 
> For a week now, I've had one or more successful counts on my "sts" policy and exactly one hit on a "no-policy-found", every day.
> 
> I was curious if anyone had any thoughts before I go tilt at the Google windmill.

If I were to hazard an inspired guess, this would for the delivery
of the previous day's tlsrpt.  Report delivery deliberately avoids
enforcing TLS policy.

-- 
	Viktor.

---

From: Grant Taylor <[email-masked]>
Date: Sat, 27 Apr 2019 10:41:53 -0600

On 4/26/19 2:36 PM, Viktor Dubrovnik wrote:
> If I were to hazard an inspired guess, this would for the delivery of 
> the previous day's tlsrpt.  Report delivery deliberately avoids enforcing 
> TLS policy.

That makes logical sense.

Thank you for hazarding a guess Viktor.

-- 
Grant. . . .
unix || die