@@ -47,6 +47,7 @@ pub struct CloudCheck {
4747 max_retries : u32 ,
4848 retry_delay_seconds : u64 ,
4949 force_refresh : bool ,
50+ verify_ssl : bool ,
5051}
5152
5253impl Default for CloudCheck {
@@ -57,14 +58,15 @@ impl Default for CloudCheck {
5758
5859impl CloudCheck {
5960 pub fn new ( ) -> Self {
60- Self :: with_config ( None , None , None , None )
61+ Self :: with_config ( None , None , None , None , None )
6162 }
6263
6364 pub fn with_config (
6465 signature_url : Option < String > ,
6566 max_retries : Option < u32 > ,
6667 retry_delay_seconds : Option < u64 > ,
6768 force_refresh : Option < bool > ,
69+ verify_ssl : Option < bool > ,
6870 ) -> Self {
6971 let url = signature_url
7072 . or_else ( || std:: env:: var ( "CLOUDCHECK_SIGNATURE_URL" ) . ok ( ) )
@@ -78,6 +80,7 @@ impl CloudCheck {
7880 max_retries : max_retries. unwrap_or ( 10 ) ,
7981 retry_delay_seconds : retry_delay_seconds. unwrap_or ( 1 ) ,
8082 force_refresh : force_refresh. unwrap_or ( false ) ,
83+ verify_ssl : verify_ssl. unwrap_or ( true ) ,
8184 }
8285 }
8386
@@ -95,17 +98,28 @@ impl CloudCheck {
9598 let max_retries = self . max_retries ;
9699 let retry_delay_seconds = self . retry_delay_seconds ;
97100 log:: info!(
98- "Fetching data from URL: {} (max_retries={}, retry_delay={}s)" ,
101+ "Fetching data from URL: {} (max_retries={}, retry_delay={}s, verify_ssl={} )" ,
99102 url,
100103 max_retries,
101- retry_delay_seconds
104+ retry_delay_seconds,
105+ self . verify_ssl
102106 ) ;
103107
108+ if !self . verify_ssl {
109+ log:: warn!(
110+ "SSL certificate verification is DISABLED for cloud provider signature fetch"
111+ ) ;
112+ }
113+ let client = reqwest:: Client :: builder ( )
114+ . danger_accept_invalid_certs ( !self . verify_ssl )
115+ . build ( )
116+ . map_err ( |e| Box :: new ( e) as Error ) ?;
117+
104118 let mut last_error = None ;
105119
106120 for attempt in 0 ..=max_retries {
107121 log:: info!( "Fetch attempt {}/{}" , attempt + 1 , max_retries + 1 ) ;
108- let result = match reqwest :: get ( url) . await {
122+ let result = match client . get ( url) . send ( ) . await {
109123 Ok ( response) => {
110124 let status = response. status ( ) ;
111125 log:: info!(
@@ -479,6 +493,19 @@ mod tests {
479493 ) ;
480494 }
481495
496+ #[ tokio:: test]
497+ async fn test_lookup_with_ssl_verification_disabled ( ) {
498+ // verify_ssl=false should still succeed against a host with a valid cert
499+ let cloudcheck = CloudCheck :: with_config ( None , None , None , Some ( true ) , Some ( false ) ) ;
500+ let results = cloudcheck. lookup ( "8.8.8.8" ) . await . unwrap ( ) ;
501+ let names: Vec < String > = results. iter ( ) . map ( |p| p. name . clone ( ) ) . collect ( ) ;
502+ assert ! (
503+ names. contains( & "Google" . to_string( ) ) ,
504+ "Expected Google in results: {:?}" ,
505+ names
506+ ) ;
507+ }
508+
482509 #[ tokio:: test]
483510 async fn test_lookup_windows_blob_domain ( ) {
484511 let cloudcheck = CloudCheck :: new ( ) ;
0 commit comments