[3.0] Apply certificate pinning

- Tizen 3.0 platform requirement
- Needs to be applied to modules using libcurl
- See more: https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

Change-Id: I859c5ebf8f9b203e8666d350bdb2905619866e2a

diff --git a/build/tizen/adaptor/Makefile.am b/build/tizen/adaptor/Makefile.am
index 517d8ae19e5f2f7514249cd0fcfc37a7ff969882..6992d49164a08fe96e55bf789a11a1b157646629 100644 (file)
--- a/build/tizen/adaptor/Makefile.am
+++ b/build/tizen/adaptor/Makefile.am
@@ -356,6 +356,9 @@ endif
 if UBUNTU_PROFILE
 libdali_adaptor_la_LIBADD += -ljpeg
 CFLAGS += -fPIC
+else
+libdali_adaptor_la_CXXFLAGS += $(TPKP_CURL_CFLAGS)
+libdali_adaptor_la_LIBADD += $(TPKP_CURL_LIBS)
 endif
 
 if !UBUNTU_PROFILE

diff --git a/build/tizen/configure.ac b/build/tizen/configure.ac
index c2766269ca91ccda756a4c2e4548511745ab204f..3c49128987c1bac403105053843922ec63fecd54 100644 (file)
--- a/build/tizen/configure.ac
+++ b/build/tizen/configure.ac
@@ -203,6 +203,7 @@ PKG_CHECK_MODULES(SENSOR, sensor)
 PKG_CHECK_MODULES(TTS, tts)
 PKG_CHECK_MODULES(VCONF, vconf)
 PKG_CHECK_MODULES(CAPI_SYSTEM_SYSTEM_SETTINGS, capi-system-system-settings)
+PKG_CHECK_MODULES(TPKP_CURL, tpkp-curl)
 
 if test "x$enable_wayland" != "xyes"; then
 PKG_CHECK_MODULES(UTILX, utilX)

diff --git a/packaging/dali-adaptor.spec b/packaging/dali-adaptor.spec
index e961db49e0c8add6ab6d59c5735418365c828e63..be4139bd4c38a5c577febca0bb9dcdabbbc99df7 100644 (file)
--- a/packaging/dali-adaptor.spec
+++ b/packaging/dali-adaptor.spec
@@ -62,6 +62,7 @@ BuildRequires:  pkgconfig(libpng)
 BuildRequires:  pkgconfig(glesv2)
 BuildRequires:  pkgconfig(egl)
 BuildRequires:  libcurl-devel
+BuildRequires:  pkgconfig(tpkp-curl)
 
 
 %if 0%{?over_tizen_2_2}

diff --git a/platform-abstractions/tizen/resource-loader/network/file-download.cpp b/platform-abstractions/tizen/resource-loader/network/file-download.cpp
index 9f91eb68ec0191591d858ecf1267ea28a133acdd..362fb7f13a695c2105cbb9564ce551f04ea00724 100755 (executable)
--- a/platform-abstractions/tizen/resource-loader/network/file-download.cpp
+++ b/platform-abstractions/tizen/resource-loader/network/file-download.cpp
@@ -25,6 +25,9 @@
 // INTERNAL INCLUDES
 #include "portable/file-closer.h"
 
+#ifndef DALI_PROFILE_UBUNTU
+#include <tpkp_curl.h>
+#endif // DALI_PROFILE_UBUNTU
 
 using namespace Dali::Integration;
 
@@ -55,6 +58,11 @@ void ConfigureCurlOptions( CURL* curl_handle, const std::string& url )
   curl_easy_setopt( curl_handle, CURLOPT_CONNECTTIMEOUT, CONNECTION_TIMEOUT_SECONDS );
   curl_easy_setopt( curl_handle, CURLOPT_HEADER, INCLUDE_HEADER );
   curl_easy_setopt( curl_handle, CURLOPT_NOBODY, EXCLUDE_BODY );
+
+#ifndef DALI_PROFILE_UBUNTU
+  // Apply certificate pinning on Tizen
+  curl_easy_setopt( curl_handle, CURLOPT_SSL_CTX_FUNCTION, tpkp_curl_ssl_ctx_callback );
+#endif // DALI_PROFILE_UBUNTU
 }
 
 // Without a write function or a buffer (file descriptor) to write to, curl will pump out
@@ -155,6 +163,11 @@ bool Network::DownloadRemoteFileIntoMemory( const std::string& url,
   // clean up session
   curl_easy_cleanup( curl_handle );
 
+#ifndef DALI_PROFILE_UBUNTU
+  // Clean up tpkp(the module for certificate pinning) resources on Tizen
+  tpkp_curl_cleanup();
+#endif // DALI_PROFILE_UBUNTU
+
   return result;
 }