IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Verify datasource TLS and split client auth and CA

Browse Source
This commit is contained in:
Matt Bostock
2017-09-28 11:04:01 +01:00
parent 4719a8c8dd
commit 43169e4302
3 changed files with 41 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/models/datasource_cache.go
View File

@@ -47,8 +47,7 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) {
transport := &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
Renegotiation: tls.RenegotiateFreelyAsClient,
Renegotiation: tls.RenegotiateFreelyAsClient,
},
Proxy: http.ProxyFromEnvironment,
Dial: (&net.Dialer{
@@ -62,15 +61,13 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) {
IdleConnTimeout: 90 * time.Second,
}
var tlsAuth, tlsAuthWithCACert bool
var tlsClientAuth, tlsAuthWithCACert bool
if ds.JsonData != nil {
tlsAuth = ds.JsonData.Get("tlsAuth").MustBool(false)
tlsClientAuth = ds.JsonData.Get("tlsClientAuth").MustBool(false)
tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false)
}
if tlsAuth {
transport.TLSClientConfig.InsecureSkipVerify = false
if tlsClientAuth || tlsAuthWithCACert {
decrypted := ds.SecureJsonData.Decrypt()
if tlsAuthWithCACert && len(decrypted["tlsCACert"]) > 0 {
@@ -81,11 +78,13 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) {
}
}
cert, err := tls.X509KeyPair([]byte(decrypted["tlsClientCert"]), []byte(decrypted["tlsClientKey"]))
if err != nil {
return nil, err
if tlsClientAuth {
cert, err := tls.X509KeyPair([]byte(decrypted["tlsClientCert"]), []byte(decrypted["tlsClientKey"]))
if err != nil {
return nil, err
}
transport.TLSClientConfig.Certificates = []tls.Certificate{cert}
}
transport.TLSClientConfig.Certificates = []tls.Certificate{cert}
}
ptc.cache[ds.Id] = cachedTransport{

12
pkg/models/datasource_cache_test.go
View File

@@ -36,7 +36,7 @@ func TestDataSourceCache(t *testing.T) {
setting.SecretKey = "password"
json := simplejson.New()
json.Set("tlsAuth", true)
json.Set("tlsClientAuth", true)
json.Set("tlsAuthWithCACert", true)
t := time.Now()
@@ -49,8 +49,8 @@ func TestDataSourceCache(t *testing.T) {
transport, err := ds.GetHttpTransport()
So(err, ShouldBeNil)
Convey("Should disable TLS certificate verification", func() {
So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true)
Convey("Should verify TLS certificates by default", func() {
So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false)
})
ds.JsonData = json
@@ -69,7 +69,7 @@ func TestDataSourceCache(t *testing.T) {
transport, err = ds.GetHttpTransport()
So(err, ShouldBeNil)
Convey("Should add cert and enable TLS certificate verification", func() {
Convey("Should add cert and verify TLS certificates", func() {
So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false)
So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 1)
})
@@ -81,8 +81,8 @@ func TestDataSourceCache(t *testing.T) {
transport, err = ds.GetHttpTransport()
So(err, ShouldBeNil)
Convey("Should remove cert and disable TLS certificate vertification", func() {
So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true)
Convey("Should remove cert but still verify TLS certificates", func() {
So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false)
So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 0)
})
})