Add option to allow connections with invalid ssl certificates

[scottschroeder]

DON'T MERGE, blocked on kornelski/rust-security-framework#46

Motivation

I know this is just... wrong, and everyone should be using letsencrypt, or adding their self-signed cert as a trusted root. Allowing invalid SSL connections is still a "feature" that rust doesn't have, and I'd like to fix that.

Also, this should put #13 to bed.

Changes

Interface

Added danger_disable_certificate_validation_entirely() to the TlsConnectorBuilder, along with a strongly worded doc-string about fire and brimstone. Please let me know if this needs to be more obnoxious.

OpenSSL

Set the provided SSL_VERIFY_NONE flag.

Schannel

Register a validation callback which will validate any certificate.

security-framework

Set a flag in the ClientBuilder to accept invalid certificates. This is blocked on updates to the security-framework crate.

Testing

Built a project using rust-native-tls, and made connections to:

• https://expired.badssl.com/
• https://wrong.host.badssl.com/
• https://self-signed.badssl.com/
• https://untrusted-root.badssl.com/
• https://revoked.badssl.com/
• https://pinning-test.badssl.com/

Verified that each url goes from failure to success by setting danger_disable_certificate_validation_entirely(). This was done on a linux, mac, and windows workstation.

[scottschroeder]

This PR is blocked on updates to the security-framework crate, I'll update the Cargo.toml if/when a new crate gets published there.

[xaocon]

I noticed that kornelski/rust-security-framework#46 is merged. Can this be merged now or is there a wait for sfackler/rust-security-framework to cut a new release?

[scottschroeder]

Yeah, waiting on a new crate to get published. Then I'll update this PR to reflect the new version.

[fulara]

Will this ever go in ? :(
Currently I am building using scott' fork.

Thanks scott btw!