[pve-devel] [PATCH manager] Status/InfluxDB: add 'ssl-verify' option to disable ssl verification

[Dominik Csapak <d.csapak@proxmox.com>]

Makes it easier to test https without creating a valid certificate or
adding a ca to the ca-certificate store.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 PVE/Status/InfluxDB.pm | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/PVE/Status/InfluxDB.pm b/PVE/Status/InfluxDB.pm
index fcb28800..6f0f8da6 100644
--- a/PVE/Status/InfluxDB.pm
+++ b/PVE/Status/InfluxDB.pm
@@ -55,7 +55,13 @@ sub properties {
 	    type => 'integer',
 	    minimum => 1,
 	    default => 25_000_000,
-	}
+	},
+	'ssl-verify' => {
+	    description => "Set to 0 to disable ssl verification for https endpoints.",
+	    type => 'boolean',
+	    optional => 1,
+	    default => 1,
+	},
     };
 }
 sub options {
@@ -71,6 +77,7 @@ sub options {
 	timeout => { optional => 1},
 	'max-body-size' => { optional => 1 },
 	'api-path-prefix' => { optional => 1 },
+	'ssl-verify' => { optional => 1 },
    };
 }
 
@@ -141,10 +148,17 @@ sub send {
     my ($class, $connection, $data, $cfg) = @_;
 
     my $proto = $cfg->{influxdbproto} // 'udp';
+    my $ssl_verify = $cfg->{'ssl-verify'} // 1;
     if ($proto eq 'udp') {
 	return $class->SUPER::send($connection, $data, $cfg);
     } elsif ($proto =~ m/^https?$/) {
 	my $ua = LWP::UserAgent->new();
+	if (!$ssl_verify) {
+	    $ua->ssl_opts(
+		verify_hostname => 0,
+		SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE,
+	    );
+	}
 	$ua->timeout($cfg->{timeout} // 1);
 	$connection->content($data);
 	my $response = $ua->request($connection);
@@ -223,11 +237,18 @@ sub test_connection {
     my ($class, $cfg, $id) = @_;
 
     my $proto = $cfg->{influxdbproto} // 'udp';
+    my $ssl_verify = $cfg->{'ssl-verify'} // 1;
     if ($proto eq 'udp') {
 	return $class->SUPER::test_connection($cfg, $id);
     } elsif ($proto =~ m/^https?$/) {
 	my $url = _get_v2url($cfg, "health");
 	my $ua = LWP::UserAgent->new();
+	if (!$ssl_verify) {
+	    $ua->ssl_opts(
+		verify_hostname => 0,
+		SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE,
+	    );
+	}
 	$ua->timeout($cfg->{timeout} // 1);
 	# in the initial add connection test, the token may still be in $cfg
 	my $token = $cfg->{token} // get_credentials($id, 1);
-- 
2.30.2