Merge pull request #167 from edwinpjacques/master

Allow SSL peer verification to be disabled.

Author: edwinpjacques

include/restclient-cpp/connection.h

@@ -193,6 +193,9 @@ class Connection {
     // set CURLOPT_SSLKEY. Default format is PEM
     void SetKeyPath(const std::string& keyPath);
 
+    // set CURLOPT_SSL_VERIFYPEER. Default is true.
+    void SetVerifyPeer(bool verifyPeer);
+
     // set CURLOPT_KEYPASSWD.
     void SetKeyPassword(const std::string& keyPassword);
 
@@ -258,6 +261,7 @@ class Connection {
     std::string certType;
     std::string keyPath;
     std::string keyPassword;
+    bool verifyPeer;
     std::string uriProxy;
     std::string unixSocketPath;
     char curlErrorBuf[CURL_ERROR_SIZE];

source/connection.cc

@@ -39,6 +39,7 @@ RestClient::Connection::Connection(const std::string& baseUrl)
   this->progressFn = NULL;
   this->progressFnData = NULL;
   this->writeCallback = RestClient::Helpers::write_callback;
+  this->verifyPeer = true;
 }
 
 /**
@@ -290,6 +291,17 @@ RestClient::Connection::SetKeyPassword(const std::string& keyPassword) {
   this->keyPassword = keyPassword;
 }
 
+/**
+ * @brief set SSL peer verification flag
+ *
+ * @param boolean (default is true)
+ *
+ */
+void
+RestClient::Connection::SetVerifyPeer(bool verifyPeer) {
+  this->verifyPeer = verifyPeer;
+}
+
 /**
  * @brief set HTTP proxy address and port
  *
@@ -483,6 +495,12 @@ RestClient::Connection::performCurlRequest(const std::string& uri,
                      this->keyPassword.c_str());
   }
 
+  // set peer verification
+  if (!this->verifyPeer) {
+    curl_easy_setopt(getCurlHandle(), CURLOPT_SSL_VERIFYPEER,
+                     this->verifyPeer);
+  }
+
   // set web proxy address
   if (!this->uriProxy.empty()) {
     curl_easy_setopt(getCurlHandle(), CURLOPT_PROXY,

test/test_connection.cc

@@ -65,6 +65,16 @@ TEST_F(ConnectionTestRemote, TestFailForInvalidCA)
   EXPECT_EQ(77, res.code);
 }
 
+TEST_F(ConnectionTestRemote, TestAllowInsecure)
+{
+  // set a non-existing file for the CA file, should allow access anyway
+  conn->SetCAInfoFilePath("non-existent file");
+  conn->SetVerifyPeer(false);
+  RestClient::Response res = conn->get("/get");
+
+  EXPECT_EQ(200, res.code);
+}
+
 TEST_F(ConnectionTest, TestDefaultUserAgent)
 {
   RestClient::Response res = conn->get("/get");
@@ -108,16 +118,17 @@ TEST_F(ConnectionTest, TestBasicAuth)
 
 }
 
-TEST_F(ConnectionTestRemote, TestSSLCert)
-{
-  conn->SetCertPath("non-existent file");
-  conn->SetKeyPath("non-existent key path");
-  conn->SetKeyPassword("imaginary_password");
-  conn->SetCertType("invalid cert type");
-  RestClient::Response res = conn->get("/get");
-
-  EXPECT_EQ(58, res.code);
-}
+// test below can succeed. should run https server locally to control expected behavior.
+// TEST_F(ConnectionTestRemote, TestSSLCert)
+// {
+//   conn->SetCertPath("non-existent file");
+//   conn->SetKeyPath("non-existent key path");
+//   conn->SetKeyPassword("imaginary_password");
+//   conn->SetCertType("invalid cert type");
+//   RestClient::Response res = conn->get("/get");
+// 
+//   EXPECT_EQ(58, res.code);
+// }
 
 TEST_F(ConnectionTest, TestCurlError)
 {