AU: Restrict SSL ciphers to HIGH in official builds.

libcurl_http_fetcher.cc

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "update_engine/libcurl_http_fetcher.h"
 
 #include <algorithm>
 #include <string>
 
 #include <base/logging.h>
@@ skipping 83 matching lines @@
            CURLE_OK);
   CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_LOW_SPEED_TIME, 3 * 60),
            CURLE_OK);
 
   // By default, libcurl doesn't follow redirections. Allow up to
   // |kMaxRedirects| redirections.
   CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_FOLLOWLOCATION, 1), CURLE_OK);
   CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_MAXREDIRS, kMaxRedirects),
            CURLE_OK);
 
-  // Makes sure that peer certificate verification is enabled and restricts the
-  // set of trusted certificates.
-  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_VERIFYPEER, 1), CURLE_OK);
-  CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_CAPATH, kCACertificatesPath),
-           CURLE_OK);
-
-  // Restrict protocols to HTTPS in official builds.
+  // Security lock-down in official builds: makes sure that peer certificate
+  // verification is enabled, restricts the set of trusted certificates,
+  // restricts protocols to HTTPS, restricts ciphers to HIGH.
   if (IsOfficialBuild()) {
+    CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_VERIFYPEER, 1),
+             CURLE_OK);
+    CHECK_EQ(curl_easy_setopt(curl_handle_,
+                              CURLOPT_CAPATH,
+                              kCACertificatesPath),
+             CURLE_OK);
     CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS),
              CURLE_OK);
     CHECK_EQ(curl_easy_setopt(curl_handle_,
                               CURLOPT_REDIR_PROTOCOLS,
                               CURLPROTO_HTTPS),
              CURLE_OK);
+    CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_CIPHER_LIST, "HIGH"),
+             CURLE_OK);
   }
 
   CHECK_EQ(curl_multi_add_handle(curl_multi_handle_, curl_handle_), CURLM_OK);
   transfer_in_progress_ = true;
 }
 
 // Begins the transfer, which must not have already been started.
 void LibcurlHttpFetcher::BeginTransfer(const std::string& url) {
   transfer_size_ = -1;
   resume_offset_ = 0;
@@ skipping 236 matching lines @@
 void LibcurlHttpFetcher::GetHttpResponseCode() {
   long http_response_code = 0;
   if (curl_easy_getinfo(curl_handle_,
                         CURLINFO_RESPONSE_CODE,
                         &http_response_code) == CURLE_OK) {
     http_response_code_ = static_cast<int>(http_response_code);
   }
 }
 
 }  // namespace chromeos_update_engine