Make hash checks mandatory for HTTP downloads.
Currently we've made all the checks for metadata size, metadata signature
and operation hashes as optional. While they are still optional if we use
HTTPS for downloading the payload, we want to make them mandatory in case
of HTTP, so as to support HTTP downloads.
In this CL, we make these checks mandatory if the Omaha response has a
HTTP URL. This will not affect any scenarios of our test team because they
always use HTTPS URLs for payload URLs. But this would break the dev tools
and our hardware test lab scenarios because they use HTTP URLs and do not
generate the required manifest signature yet. So we waive this requirement
for dev/test images even though they use HTTP.
This CL will not have any effect until we decide to add a HTTP rule in
Omaha, which serves as a safety knob till we are confident with our
testing.
BUG=chromium-os:36808
TEST=Existing unit tests pass. Added new unit tests for most new code.
TEST=Ran manual tests on ZGB for every type of hash failure for HTTP.
TEST=Tested image_to_live to make sure hash checks are waived as expected.
Change-Id: I8c4408e3052635ccf4bee0c848781733c1f8e984
Reviewed-on: https://gerrit.chromium.org/gerrit/39293
Reviewed-by: Gaurav Shah <gauravsh@chromium.org>
Commit-Ready: Jay Srinivasan <jaysri@chromium.org>
Reviewed-by: Jay Srinivasan <jaysri@chromium.org>
Tested-by: Jay Srinivasan <jaysri@chromium.org>
diff --git a/libcurl_http_fetcher.cc b/libcurl_http_fetcher.cc
index 4f66a54..59f065e 100644
--- a/libcurl_http_fetcher.cc
+++ b/libcurl_http_fetcher.cc
@@ -8,6 +8,7 @@
#include <string>
#include <base/logging.h>
+#include <base/string_util.h>
#include <base/stringprintf.h>
#include "update_engine/certificate_checker.h"
@@ -168,16 +169,16 @@
CHECK_EQ(curl_easy_setopt(curl_handle_, CURLOPT_MAXREDIRS, kMaxRedirects),
CURLE_OK);
- // If we are running in test mode or dev mode (the call to IsOfficialBuild is
- // a misnomer that needs to be fixed), then lock down the appropriate curl
- // options for HTTP or HTTPS depending on the url.
+ // If we are running in test mode or using a dev/test build, then lock down
+ // the appropriate curl options for HTTP or HTTPS depending on the url.
if (!is_test_mode_ && IsOfficialBuild()) {
- if (url_to_use.find("http://") == 0)
+ if (StartsWithASCII(url_to_use, "http://", false))
SetCurlOptionsForHttp();
else
SetCurlOptionsForHttps();
} else {
- LOG(INFO) << "Not setting http(s) curl options for test/dev mode";
+ LOG(INFO) << "Not setting http(s) curl options because we are in "
+ << "test mode or running a dev/test image";
}
CHECK_EQ(curl_multi_add_handle(curl_multi_handle_, curl_handle_), CURLM_OK);