AU: Disallow Anonymous Diffie Hellman ciphers

libcurl_http_fetcher.cc

 // Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "update_engine/libcurl_http_fetcher.h"
 
 #include <algorithm>
 #include <string>
 
 #include <base/logging.h>
@@ skipping 122 matching lines @@
     CHECK_EQ(curl_easy_setopt(curl_handle_,
                               CURLOPT_CAPATH,
                               kCACertificatesPath),
              CURLE_OK);
     CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS),
              CURLE_OK);
     CHECK_EQ(curl_easy_setopt(curl_handle_,
                               CURLOPT_REDIR_PROTOCOLS,
                               CURLPROTO_HTTPS),
              CURLE_OK);
-    CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_CIPHER_LIST, "HIGH"),
+    CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_CIPHER_LIST,
+                              "HIGH:!ADH"),
              CURLE_OK);
   }
 
   CHECK_EQ(curl_multi_add_handle(curl_multi_handle_, curl_handle_), CURLM_OK);
   transfer_in_progress_ = true;
 }
 
 // Begins the transfer, which must not have already been started.
 void LibcurlHttpFetcher::BeginTransfer(const std::string& url) {
   transfer_size_ = -1;
@@ skipping 285 matching lines @@
 void LibcurlHttpFetcher::GetHttpResponseCode() {
   long http_response_code = 0;
   if (curl_easy_getinfo(curl_handle_,
                         CURLINFO_RESPONSE_CODE,
                         &http_response_code) == CURLE_OK) {
     http_response_code_ = static_cast<int>(http_response_code);
   }
 }
 
 }  // namespace chromeos_update_engine