httpclient: add a configuration parameter to skip TLS certificate val…

…idation In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing.
devopsmakers · May 3, 2020 · f369fdf · f369fdf
1 parent 510a95b
commit f369fdf
Show file tree

Hide file tree

Showing 5 changed files with 12 additions and 3 deletions.
diff --git a/config/config.go b/config/config.go
@@ -103,6 +103,7 @@ func init() {
 		HTTPConfig: httpclient.Config{
 			Timeout:        20,
 			CACertificates: nil,
+			SkipTLSVerify:  false,
 		},
 	}
 

diff --git a/docs/full-configuration.md b/docs/full-configuration.md
@@ -111,6 +111,7 @@ The configuration file contains the following sections:
 - **"http"**, the configuration for HTTP clients. HTTP clients are used for executing hooks such as the ones used for custom actions, external authentication and pre-login user modifications
   - `timeout`, integer. Timeout specifies a time limit, in seconds, for requests.
   - `ca_certificates`, list of strings. List of paths to extra CA certificates to trust. The paths can be absolute or relative to the config dir. Adding trusted CA certificates is a convenient way to use self-signed certificates without defeating the purpose of using TLS.
+  - `skip_tls_verify`, boolean. if enabled the HTTP client accepts any TLS certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing.
 
 A full example showing the default config (in JSON format) can be found [here](../sftpgo.json).
 

diff --git a/httpclient/httpclient.go b/httpclient/httpclient.go
@@ -22,7 +22,12 @@ type Config struct {
 	// The paths can be absolute or relative to the config dir.
 	// Adding trusted CA certificates is a convenient way to use self-signed
 	// certificates without defeating the purpose of using TLS
-	CACertificates  []string `json:"ca_certificates" mapstructure:"ca_certificates"`
+	CACertificates []string `json:"ca_certificates" mapstructure:"ca_certificates"`
+	// if enabled the HTTP client accepts any TLS certificate presented by
+	// the server and any host name in that certificate.
+	// In this mode, TLS is susceptible to man-in-the-middle attacks.
+	// This should be used only for testing.
+	SkipTLSVerify   bool `json:"skip_tls_verify" mapstructure:"skip_tls_verify"`
 	customTransport *http.Transport
 }
 
@@ -42,6 +47,7 @@ func (c Config) Initialize(configDir string) {
 			RootCAs: rootCAs,
 		}
 	}
+	customTransport.TLSClientConfig.InsecureSkipVerify = c.SkipTLSVerify
 	httpConfig.customTransport = customTransport
 }
 

diff --git a/sftpgo.json b/sftpgo.json
@@ -68,6 +68,7 @@
   },
   "http": {
     "timeout": 20,
-    "ca_certificates": []
+    "ca_certificates": [],
+    "skip_tls_verify": false
   }
 }
diff --git a/vfs/vfs.go b/vfs/vfs.go
@@ -52,7 +52,7 @@ type Fs interface {
 type VirtualFolder struct {
 	VirtualPath string `json:"virtual_path"`
 	MappedPath  string `json:"mapped_path"`
-	// This folder will be excluded from user quota
+	// Enable to exclude this folder from the user quota
 	ExcludeFromQuota bool `json:"exclude_from_quota"`
 }