IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

add support for periodically reloading mysql client certs (#14892)

Browse Source
This commit is contained in:
Tom Petr 2019-05-16 07:45:23 -04:00 committed by Carl Bergquist
parent 3dbc3251d1
commit 73e405978b
2 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/services/sqlstore/sqlstore.go
View File

@ -171,7 +171,7 @@ func (ss *SqlStore) buildConnectionString() (string, error) {
ss.dbCfg.User, ss.dbCfg.Pwd, protocol, ss.dbCfg.Host, ss.dbCfg.Name) ss.dbCfg.User, ss.dbCfg.Pwd, protocol, ss.dbCfg.Host, ss.dbCfg.Name)
if ss.dbCfg.SslMode == "true" || ss.dbCfg.SslMode == "skip-verify" { if ss.dbCfg.SslMode == "true" || ss.dbCfg.SslMode == "skip-verify" {
tlsCert, err := makeCert("custom", ss.dbCfg) tlsCert, err := makeCert(ss.dbCfg)
if err != nil { if err != nil {
return "", err return "", err
} }

24
pkg/services/sqlstore/tls_mysql.go
View File

@ -5,9 +5,13 @@ import (
"crypto/x509" "crypto/x509"
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"github.com/grafana/grafana/pkg/infra/log"
) )
func makeCert(tlsPoolName string, config DatabaseConfig) (*tls.Config, error) { var tlslog = log.New("tls_mysql")
func makeCert(config DatabaseConfig) (*tls.Config, error) {
rootCertPool := x509.NewCertPool() rootCertPool := x509.NewCertPool()
pem, err := ioutil.ReadFile(config.CaCertPath) pem, err := ioutil.ReadFile(config.CaCertPath)
if err != nil { if err != nil {
@ -16,18 +20,16 @@ func makeCert(tlsPoolName string, config DatabaseConfig) (*tls.Config, error) {
if ok := rootCertPool.AppendCertsFromPEM(pem); !ok { if ok := rootCertPool.AppendCertsFromPEM(pem); !ok {
return nil, err return nil, err
} }
clientCert := make([]tls.Certificate, 0, 1)
if config.ClientCertPath != "" && config.ClientKeyPath != "" {
certs, err := tls.LoadX509KeyPair(config.ClientCertPath, config.ClientKeyPath)
if err != nil {
return nil, err
}
clientCert = append(clientCert, certs)
}
tlsConfig := &tls.Config{ tlsConfig := &tls.Config{
RootCAs: rootCertPool, RootCAs: rootCertPool,
Certificates: clientCert, }
if config.ClientCertPath != "" && config.ClientKeyPath != "" {
tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
tlslog.Debug("Loading client certificate")
cert, err := tls.LoadX509KeyPair(config.ClientCertPath, config.ClientKeyPath)
return &cert, err
}
} }
tlsConfig.ServerName = config.ServerCertName tlsConfig.ServerName = config.ServerCertName
if config.SslMode == "skip-verify" { if config.SslMode == "skip-verify" {