Add insecure option to allow TLS connection without verification

Author: Maciej Szlosarczyk

apps/epp_proxy/src/epp_http_client.erl

@@ -31,7 +31,7 @@ request_builder(Map) -> request_from_map(Map).
 handle_args(#epp_request{method = get, url = URL,
 			 headers = Headers, cookies = Cookies,
 			 epp_verb = ?helloCommand}) ->
-    [get, URL, Headers, "", [{cookie, Cookies}, insecure]];
+    [get, URL, Headers, "", hackney_options(Cookies)];
 %% For error command, we convert the message and code into query parameters,
 %% and append them to the original URL.
 handle_args(#epp_request{method = get, url = URL,
@@ -40,13 +40,13 @@ handle_args(#epp_request{method = get, url = URL,
     QueryString = hackney_url:qs(Payload),
     CompleteURL = [URL, <<"?">>, QueryString],
     [get, CompleteURL, Headers, "",
-     [{cookie, Cookies}, insecure]];
+     hackney_options(Cookies)];
 %% For valid commands, we set the multipart body earlier, now we just pass it on.
 handle_args(#epp_request{method = post, url = URL,
 			 payload = Payload, headers = Headers,
 			 cookies = Cookies}) ->
     [post, URL, Headers, Payload,
-     [{cookie, Cookies}, insecure]].
+     hackney_options(Cookies)].
 
 %% Map request and return values.
 request_from_map(#{command := ?errorCommand,
@@ -82,6 +82,13 @@ request_from_map(#{command := Command,
     lager:info("Request from map: [~p]~n", [Request]),
     Request.
 
+%% Get hackney options
+hackney_options(Cookies) ->
+    case application:get_env(epp_proxy, insecure) of
+	false -> [{cookies, Cookies}, insecure];
+	_ -> [{cookies, Cookies}]
+	end.
+
 %% Return form data or an empty list.
 request_body(?helloCommand, _, _) -> "";
 request_body(_Command, RawFrame, nomatch) ->

config/sys.config

@@ -7,6 +7,9 @@
                %% TLS port, specified in RFC to 700, but can be set to anything else
                %% in case that is needed.
                {tls_port, 700},
+	       %% When set to true, you can connect to  EPP over endpoints without verifying their
+	       %% TLS certificates.
+	       {insecure, false}
                %% URL of EPP endpoints. Can be pointed at a web server (Apache/NGINX)
                %% Can contain port (https://some-host:3000/epp/session)
                %% Honors the prepended protocol (http / https).

config/test.config

@@ -2,6 +2,7 @@
   {epp_proxy, [{dev_mode, true},
                {tcp_port, 1180},
                {tls_port, 1443},
+	       {insecure, false},
 
                {epp_session_url, "http://localhost:9292/session/"},
                {epp_command_url, "http://localhost:9292/command/"},