crash-reporter: use HTTPS when sending crashes

crash_sender

 #!/bin/sh
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 set -e
 
 # Product ID in crash report
 CHROMEOS_PRODUCT=ChromeOS
@@ skipping 28 matching lines @@
 
 # File whose existence mocks crash sending.  If empty we pretend the
 # crash sending was successful, otherwise unsuccessful.
 MOCK_CRASH_SENDING="/tmp/mock-crash-sending"
 
 # File whose existence causes crash sending to be delayed (for testing).
 # Must be stateful to enable testing kernel crashes.
 PAUSE_CRASH_SENDING="/var/lib/crash_sender_paused"
 
 # URL to send official build crash reports to.
-REPORT_UPLOAD_PROD_URL="http://clients2.google.com/cr/report"
+REPORT_UPLOAD_PROD_URL="https://clients2.google.com/cr/report"
 
 # File whose existence implies we're running and not to start again.
 RUN_FILE="/var/run/crash_sender.pid"
 
 # Maximum time to sleep between sends.
 SECONDS_SEND_SPREAD=${SECONDS_SEND_SPREAD:-600}
 
 # The syslog tag for all logging we emit.
 TAG="$(basename $0)[$$]"
 
 # Directory to store timestamp files indicating the uploads in the past 24
 # hours.
 TIMESTAMPS_DIR="/var/lib/crash_sender"
 
+# Path to a directory of restricted certificates which includes
+# a certificate for ${REPORT_UPLOAD_PROD_URL}.
+RESTRICTED_CERTIFICATES_PATH="/usr/share/chromeos-ca-certificates"
+
 # Temp directory for this process.
 TMP_DIR=""
 
 lecho() {
   logger -t "${TAG}" "$@"
 }
 
 # Returns true if mock is enabled.
 is_mock() {
   [ -f "${MOCK_CRASH_SENDING}" ] && return 0
@@ skipping 173 matching lines @@
   if ! sleep ${sleep_time}; then
     lecho "Sleep failed"
     return 1
   fi
 
   local report_id="${TMP_DIR}/report_id"
   local curl_stderr="${TMP_DIR}/curl_stderr"
 
   set +e
   curl "${url}" \
+    --capath "${RESTRICTED_CERTIFICATES_PATH}" --ciphers HIGH \
     -F "prod=${CHROMEOS_PRODUCT}" \
     -F "ver=${chromeos_version}" \
     -F "upload_file_${kind}=@${report_payload}" \
     -F "board=${board}" \
     -F "hwclass=${hwclass}" \
     -F "exec_name=${exec_name}" \
     -F "${extra_key1}=${extra_value1}" \
     -F "${extra_key2}=${extra_value2}" \
     -F "guid=<${CONSENT_ID}" -o "${report_id}" 2>"${curl_stderr}"
   curl_result=$?
@@ skipping 108 matching lines @@
 main() {
   trap cleanup EXIT INT TERM
   if [ -e "${PAUSE_CRASH_SENDING}" ] && \
      [ ${OVERRIDE_PAUSE_SENDING} -eq 0 ]; then
     lecho "Exiting early due to ${PAUSE_CRASH_SENDING}."
     exit 1
   fi
 
   check_not_already_running
 
-  for dependency in "${FIND}" "${METRICS_CLIENT}"; do
+  for dependency in "${FIND}" "${METRICS_CLIENT}" \
+                    "${RESTRICTED_CERTIFICATES_PATH}"; do
     if [ ! -x "${dependency}" ]; then
       lecho "Fatal: Crash sending disabled: ${dependency} not found."
       exit 1
     fi
   done
 
   TMP_DIR="$(mktemp -d /tmp/crash_sender.XXXX)"
 
   # Send system-wide crashes
   send_crashes "/var/spool/crash"
 
   # Send user-specific crashes
   send_crashes "/home/chronos/user/crash"
 }
 
 main