Add the ability to configure the CA bundle for Sigmax connection

delta10 · Feb 20, 2023 · 6dfe8c0 · 6dfe8c0
1 parent 1b0faf7
commit 6dfe8c0
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 2 deletions.
diff --git a/app/signals/apps/sigmax/stuf_protocol/outgoing/stuf.py b/app/signals/apps/sigmax/stuf_protocol/outgoing/stuf.py
@@ -49,12 +49,17 @@ def _send_stuf_message(stuf_msg: str, soap_action: str):
     if settings.SIGMAX_CLIENT_CERT and settings.SIGMAX_CLIENT_KEY:
         cert = (settings.SIGMAX_CLIENT_CERT, settings.SIGMAX_CLIENT_KEY)
 
+    verify = True
+    if settings.SIGMAX_CA_BUNDLE:
+        verify = settings.SIGMAX_CA_BUNDLE
+
     # Send our message to Sigmax. Network problems, and HTTP status codes
     # are all raised as errors.
     try:
         response = requests.post(
             url=settings.SIGMAX_SERVER,
             cert=cert,
+            verify=verify,
             headers=headers,
             data=encoded
         )

diff --git a/app/signals/apps/sigmax/tests/stuf_protocol/outgoing/test_stuf.py b/app/signals/apps/sigmax/tests/stuf_protocol/outgoing/test_stuf.py
@@ -18,7 +18,8 @@
     'SIGMAX_AUTH_TOKEN': 'TEST',
     'SIGMAX_SERVER': 'https://example.com',
     'SIGMAX_CLIENT_CERT': 'test.crt',
-    'SIGMAX_CLIENT_KEY': 'test.key'
+    'SIGMAX_CLIENT_KEY': 'test.key',
+    'SIGMAX_CA_BUNDLE': 'ca.crt'
 }
 
 DATA_DIR = os.path.join(
@@ -83,7 +84,8 @@ def test_send_message(self, mocked_request_post, mocked_stuf_response_ok):
         SIGMAX_AUTH_TOKEN=REQUIRED_ENV['SIGMAX_AUTH_TOKEN'],
         SIGMAX_SERVER=REQUIRED_ENV['SIGMAX_SERVER'],
         SIGMAX_CLIENT_CERT=REQUIRED_ENV['SIGMAX_CLIENT_CERT'],
-        SIGMAX_CLIENT_KEY=REQUIRED_ENV['SIGMAX_CLIENT_KEY']
+        SIGMAX_CLIENT_KEY=REQUIRED_ENV['SIGMAX_CLIENT_KEY'],
+        SIGMAX_CA_BUNDLE=REQUIRED_ENV['SIGMAX_CA_BUNDLE']
     )
     @mock.patch('signals.apps.sigmax.stuf_protocol.outgoing.stuf._stuf_response_ok', autospec=True)
     @mock.patch('requests.post', autospec=True)
@@ -101,6 +103,7 @@ def test_send_message_with_cert(self, mocked_request_post, mocked_stuf_response_
 
         self.assertEqual(mocked_request_post.called, 1)
         self.assertEqual(kwargs['cert'], (REQUIRED_ENV['SIGMAX_CLIENT_CERT'], REQUIRED_ENV['SIGMAX_CLIENT_KEY']))
+        self.assertEqual(kwargs['verify'], REQUIRED_ENV['SIGMAX_CA_BUNDLE'])
 
 
 class TestStufResponseOk(TestCase):

diff --git a/app/signals/settings/base.py b/app/signals/settings/base.py
@@ -310,6 +310,7 @@
 # Sigmax settings
 SIGMAX_AUTH_TOKEN = os.getenv('SIGMAX_AUTH_TOKEN', None)
 SIGMAX_SERVER = os.getenv('SIGMAX_SERVER', None)
+SIGMAX_CA_BUNDLE = os.getenv('SIGMAX_CA_BUNDLE', None)
 SIGMAX_CLIENT_CERT = os.getenv('SIGMAX_CLIENT_CERT', None)
 SIGMAX_CLIENT_KEY = os.getenv('SIGMAX_CLIENT_KEY', None)
 SIGMAX_SEND_FAIL_TIMEOUT_MINUTES = os.getenv('SIGMAX_SEND_FAIL_TIMEOUT_MINUTES', 60*24)  # noqa Default is 24hrs.