Fix certificate checker callback lifetime.
OpenSSL's SSL_CTX_set_verify() function allows us to set a callback
called after certificate validation but doesn't provide a way to pass
private data to this callback. CL:183832 was passing the pointer to the
CertificateChecker instance using a global pointer, nevertheless the
lifetime of this pointer was wrong since libcurl can trigger this
callback asynchronously when the SSL certificates are downloaded.
This patch converts the CertificateChecker into a singleton class and
uses the same trick previously used to pass the ServerToCheck value
using different callbacks.
Bug: 25818567
Test: Run an update on edison-userdebug; FEATURES=test emerge-link update_engine
Change-Id: I84cdb2f8c5ac86d1463634e73e867f213f7a2f5a
diff --git a/common/libcurl_http_fetcher.cc b/common/libcurl_http_fetcher.cc
index 51643a4..13784fa 100644
--- a/common/libcurl_http_fetcher.cc
+++ b/common/libcurl_http_fetcher.cc
@@ -44,13 +44,9 @@
const int kNoNetworkRetrySeconds = 10;
} // namespace
-LibcurlHttpFetcher::LibcurlHttpFetcher(
- ProxyResolver* proxy_resolver,
- HardwareInterface* hardware,
- std::unique_ptr<CertificateChecker> certificate_checker)
- : HttpFetcher(proxy_resolver),
- hardware_(hardware),
- certificate_checker_(std::move(certificate_checker)) {
+LibcurlHttpFetcher::LibcurlHttpFetcher(ProxyResolver* proxy_resolver,
+ HardwareInterface* hardware)
+ : HttpFetcher(proxy_resolver), hardware_(hardware) {
// Dev users want a longer timeout (180 seconds) because they may
// be waiting on the dev server to build an image.
if (!hardware_->IsOfficialBuild())
@@ -237,10 +233,10 @@
CURLE_OK);
CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_CIPHER_LIST, "HIGH:!ADH"),
CURLE_OK);
- if (certificate_checker_ != nullptr) {
- CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_CTX_DATA,
- certificate_checker_.get()),
- CURLE_OK);
+ if (server_to_check_ != ServerToCheck::kNone) {
+ CHECK_EQ(
+ curl_easy_setopt(curl_handle_, CURLOPT_SSL_CTX_DATA, &server_to_check_),
+ CURLE_OK);
CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_SSL_CTX_FUNCTION,
CertificateChecker::ProcessSSLContext),
CURLE_OK);