AU: Restrict the CA certificates to a smaller trusted set.

libcurl_http_fetcher.cc

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "update_engine/libcurl_http_fetcher.h"
 #include <algorithm>
 #include "base/logging.h"
 
 using std::max;
 using std::make_pair;
 
 // This is a concrete implementation of HttpFetcher that uses libcurl to do the
 // http work.
 
 namespace chromeos_update_engine {
 
 namespace {
 const int kMaxRetriesCount = 20;
+const char kCACertificatesPath[] = "/usr/share/update_engine/ca-certificates";

[Chris Masone, 2010/09/28 18:16:41]

I forget...is /usr/share on the stateful partition or not?

[petkov, 2010/09/28 19:17:18]

/usr/share is not a special mount -- it's off of / (i.e., it's read-only, not
part of stateful). Also, according to
http://www.pathname.com/fhs/2.2/fhs-4.11.html, /usr/share is for read-only data
files, so I think it all makes sense.

 }
 
 LibcurlHttpFetcher::~LibcurlHttpFetcher() {
   CleanUp();
 }
 
 void LibcurlHttpFetcher::ResumeTransfer(const std::string& url) {
   LOG(INFO) << "Starting/Resuming transfer";
   CHECK(!transfer_in_progress_);
   url_ = url;
@@ skipping 27 matching lines @@
   CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_URL, url_.c_str()), CURLE_OK);
 
   // If the connection drops under 10 bytes/sec for 3 minutes, reconnect.
   CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_LOW_SPEED_LIMIT, 10),
            CURLE_OK);
   CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_LOW_SPEED_TIME, 3 * 60),
            CURLE_OK);
 
   // By default, libcurl doesn't follow redirections. Allow up to
   // |kMaxRedirects| redirections.
-  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_FOLLOWLOCATION, 1),
+  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_FOLLOWLOCATION, 1), CURLE_OK);
+  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_MAXREDIRS, kMaxRedirects),
            CURLE_OK);
-  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_MAXREDIRS, kMaxRedirects),
+
+  // Makes sure that peer certificate verification is enabled and restricts the
+  // set of trusted certificates.
+  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_VERIFYPEER, 1), CURLE_OK);
+  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_CAPATH, kCACertificatesPath),
            CURLE_OK);
 
   CHECK_EQ(curl_multi_add_handle(curl_multi_handle_, curl_handle_), CURLM_OK);
   transfer_in_progress_ = true;
 }
 
 // Begins the transfer, which must not have already been started.
 void LibcurlHttpFetcher::BeginTransfer(const std::string& url) {
   transfer_size_ = -1;
   bytes_downloaded_ = 0;
@@ skipping 203 matching lines @@
     curl_handle_ = NULL;
   }
   if (curl_multi_handle_) {
     CHECK_EQ(curl_multi_cleanup(curl_multi_handle_), CURLM_OK);
     curl_multi_handle_ = NULL;
   }
   transfer_in_progress_ = false;
 }
 
 }  // namespace chromeos_update_engine