From 99cab46f38bc96b95cb7f8670286737cf937b328 Mon Sep 17 00:00:00 2001
From: Steven Fackler <sfackler@palantir.com>
Date: Fri, 13 Jan 2017 13:02:03 -0800
Subject: [PATCH] Allow verification to be disabled in OpenSsl

---
 postgres/Cargo.toml         |  2 +-
 postgres/src/tls/openssl.rs | 32 ++++++++++++++++++++++++++------
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/postgres/Cargo.toml b/postgres/Cargo.toml
index 0d247869..eccfe55a 100644
--- a/postgres/Cargo.toml
+++ b/postgres/Cargo.toml
@@ -43,7 +43,7 @@ hex = "0.2"
 log = "0.3"
 postgres-protocol = "0.2"
 
-openssl = { version = "0.9", optional = true }
+openssl = { version = "0.9.2", optional = true }
 native-tls = { version = "0.1", optional = true }
 rustc-serialize = { version = "0.3", optional = true }
 schannel = { version = "0.1", optional = true }
diff --git a/postgres/src/tls/openssl.rs b/postgres/src/tls/openssl.rs
index f1a8b0e5..9c443d4e 100644
--- a/postgres/src/tls/openssl.rs
+++ b/postgres/src/tls/openssl.rs
@@ -21,7 +21,10 @@ impl TlsStream for SslStream<Stream> {
 /// A `TlsHandshake` implementation that uses OpenSSL.
 ///
 /// Requires the `with-openssl` feature.
-pub struct OpenSsl(SslConnector);
+pub struct OpenSsl {
+    connector: SslConnector,
+    disable_verification: bool,
+}
 
 impl fmt::Debug for OpenSsl {
     fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
@@ -33,23 +36,36 @@ impl OpenSsl {
     /// Creates a `OpenSsl` with `SslConnector`'s default configuration.
     pub fn new() -> Result<OpenSsl, ErrorStack> {
         let connector = try!(SslConnectorBuilder::new(SslMethod::tls())).build();
-        Ok(OpenSsl(connector))
+        Ok(OpenSsl::from(connector))
     }
 
     /// Returns a reference to the inner `SslConnector`.
     pub fn connector(&self) -> &SslConnector {
-        &self.0
+        &self.connector
     }
 
     /// Returns a mutable reference to the inner `SslConnector`.
     pub fn connector_mut(&mut self) -> &mut SslConnector {
-        &mut self.0
+        &mut self.connector
+    }
+
+    /// If set, the
+    /// `SslConnector::danger_connect_without_providing_domain_for_certificate_verification_and_server_name_indication`
+    /// method will be used to connect.
+    ///
+    /// If certificate verification has been disabled in the `SslConnector`, verification must be
+    /// additionally disabled here for that setting to take effect.
+    pub fn danger_disable_hostname_verification(&mut self, disable_verification: bool) {
+        self.disable_verification = disable_verification;
     }
 }
 
 impl From<SslConnector> for OpenSsl {
     fn from(connector: SslConnector) -> OpenSsl {
-        OpenSsl(connector)
+        OpenSsl {
+            connector: connector,
+            disable_verification: false,
+        }
     }
 }
 
@@ -58,7 +74,11 @@ impl TlsHandshake for OpenSsl {
                      domain: &str,
                      stream: Stream)
                      -> Result<Box<TlsStream>, Box<Error + Send + Sync>> {
-        let stream = try!(self.0.connect(domain, stream));
+        let stream = if self.disable_verification {
+            try!(self.connector.danger_connect_without_providing_domain_for_certificate_verification_and_server_name_indication(stream))
+        } else {
+            try!(self.connector.connect(domain, stream))
+        };
         Ok(Box::new(stream))
     }
 }