From 37f16ca80abf95716805f45e5246fa9c6532a2d1 Mon Sep 17 00:00:00 2001 From: Ramiro Morales Date: Mon, 15 Oct 2018 14:41:46 -0300 Subject: [PATCH 1/6] Add 'encrypt' setting to MSSQL data source. Fixes #13629 --- docs/sources/features/datasources/mssql.md | 6 +----- pkg/tsdb/mssql/mssql.go | 4 +++- .../datasource/mssql/partials/config.html | 16 ++++++++++++++++ 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/docs/sources/features/datasources/mssql.md b/docs/sources/features/datasources/mssql.md index 4a3478b161a..b104a5a1376 100644 --- a/docs/sources/features/datasources/mssql.md +++ b/docs/sources/features/datasources/mssql.md @@ -32,6 +32,7 @@ Name | Description *Database* | Name of your MSSQL database. *User* | Database user's login/username *Password* | Database user's password +*Encrypt* | This option determines whether or to which extent a secure SSL TCP/IP connection will be negotiated with the server, default `false` (Grafana v5.4+). *Max open* | The maximum number of open connections to the database, default `unlimited` (Grafana v5.4+). *Max idle* | The maximum number of connections in the idle connection pool, default `2` (Grafana v5.4+). *Max lifetime* | The maximum amount of time in seconds a connection may be reused, default `14400`/4 hours (Grafana v5.4+). @@ -70,11 +71,6 @@ Example: Make sure the user does not get any unwanted privileges from the public role. -### Known Issues - -MSSQL 2008 and 2008 R2 engine cannot handle login records when SSL encryption is not disabled. Due to this you may receive an `Login error: EOF` error when trying to create your datasource. -To fix MSSQL 2008 R2 issue, install MSSQL 2008 R2 Service Pack 2. To fix MSSQL 2008 issue, install Microsoft MSSQL 2008 Service Pack 3 and Cumulative update package 3 for MSSQL 2008 SP3. - ## Query Editor {{< docs-imagebox img="/img/docs/v51/mssql_query_editor.png" class="docs-image--no-shadow" >}} diff --git a/pkg/tsdb/mssql/mssql.go b/pkg/tsdb/mssql/mssql.go index 72e57d03fa0..e1d6904d58f 100644 --- a/pkg/tsdb/mssql/mssql.go +++ b/pkg/tsdb/mssql/mssql.go @@ -52,12 +52,14 @@ func generateConnectionString(datasource *models.DataSource) string { } server, port := hostParts[0], hostParts[1] - return fmt.Sprintf("server=%s;port=%s;database=%s;user id=%s;password=%s;", + encrypt := datasource.JsonData.Get("sslmode").MustString("false") + return fmt.Sprintf("server=%s;port=%s;database=%s;user id=%s;password=%s;encrypt=%s;", server, port, datasource.Database, datasource.User, password, + encrypt, ) } diff --git a/public/app/plugins/datasource/mssql/partials/config.html b/public/app/plugins/datasource/mssql/partials/config.html index 4cb42e90f7c..d8e1eb1ec00 100644 --- a/public/app/plugins/datasource/mssql/partials/config.html +++ b/public/app/plugins/datasource/mssql/partials/config.html @@ -27,6 +27,22 @@ reset + +
+ +
+ + + Determines whether or to which extent a secure SSL TCP/IP connection will be negotiated with the server. +
    +
  • disable - Data sent between client and server is not encrypted.
    • +
  • false - Data sent between client and server is not encrypted beyond the login packet. (default)
    • +
  • true - Data sent between client and server is encrypted.
    • +
+ If you're using an older version of Microsoft SQL Server like 2008 and 2008R2 you may need to disable encryption to be able to connect. + +
+
Connection limits From d859a6aeb8e26890258c16d0f74d268871b8c431 Mon Sep 17 00:00:00 2001 From: Ramiro Morales Date: Mon, 15 Oct 2018 20:34:03 -0300 Subject: [PATCH 2/6] rename new JSON data attrbute. --- pkg/tsdb/mssql/mssql.go | 2 +- public/app/plugins/datasource/mssql/partials/config.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/tsdb/mssql/mssql.go b/pkg/tsdb/mssql/mssql.go index e1d6904d58f..1d34250a14f 100644 --- a/pkg/tsdb/mssql/mssql.go +++ b/pkg/tsdb/mssql/mssql.go @@ -52,7 +52,7 @@ func generateConnectionString(datasource *models.DataSource) string { } server, port := hostParts[0], hostParts[1] - encrypt := datasource.JsonData.Get("sslmode").MustString("false") + encrypt := datasource.JsonData.Get("encrypt").MustString("false") return fmt.Sprintf("server=%s;port=%s;database=%s;user id=%s;password=%s;encrypt=%s;", server, port, diff --git a/public/app/plugins/datasource/mssql/partials/config.html b/public/app/plugins/datasource/mssql/partials/config.html index d8e1eb1ec00..876e1eb89cb 100644 --- a/public/app/plugins/datasource/mssql/partials/config.html +++ b/public/app/plugins/datasource/mssql/partials/config.html @@ -31,7 +31,7 @@
- + Determines whether or to which extent a secure SSL TCP/IP connection will be negotiated with the server.
    From 90de703ef2987fafbabdae075372e89ad2f6b228 Mon Sep 17 00:00:00 2001 From: Ramiro Morales Date: Mon, 15 Oct 2018 21:40:40 -0300 Subject: [PATCH 3/6] fix new setting default value handling. --- public/app/plugins/datasource/mssql/config_ctrl.ts | 10 ++++++++++ public/app/plugins/datasource/mssql/module.ts | 5 +---- .../app/plugins/datasource/mssql/partials/config.html | 2 +- 3 files changed, 12 insertions(+), 5 deletions(-) create mode 100644 public/app/plugins/datasource/mssql/config_ctrl.ts diff --git a/public/app/plugins/datasource/mssql/config_ctrl.ts b/public/app/plugins/datasource/mssql/config_ctrl.ts new file mode 100644 index 00000000000..c80d657a914 --- /dev/null +++ b/public/app/plugins/datasource/mssql/config_ctrl.ts @@ -0,0 +1,10 @@ +export class MssqlConfigCtrl { + static templateUrl = 'partials/config.html'; + + current: any; + + /** @ngInject */ + constructor($scope) { + this.current.jsonData.encrypt = this.current.jsonData.encrypt || 'false'; + } +} diff --git a/public/app/plugins/datasource/mssql/module.ts b/public/app/plugins/datasource/mssql/module.ts index 478ecadcb3e..bf46b6d0947 100644 --- a/public/app/plugins/datasource/mssql/module.ts +++ b/public/app/plugins/datasource/mssql/module.ts @@ -1,9 +1,6 @@ import { MssqlDatasource } from './datasource'; import { MssqlQueryCtrl } from './query_ctrl'; - -class MssqlConfigCtrl { - static templateUrl = 'partials/config.html'; -} +import { MssqlConfigCtrl } from './config_ctrl'; const defaultQuery = `SELECT as time, diff --git a/public/app/plugins/datasource/mssql/partials/config.html b/public/app/plugins/datasource/mssql/partials/config.html index 876e1eb89cb..db76f60e5e3 100644 --- a/public/app/plugins/datasource/mssql/partials/config.html +++ b/public/app/plugins/datasource/mssql/partials/config.html @@ -31,7 +31,7 @@
    - + Determines whether or to which extent a secure SSL TCP/IP connection will be negotiated with the server.
      From 6a8d1c4546c74854b49147be06b524044d4ded18 Mon Sep 17 00:00:00 2001 From: Ramiro Morales Date: Mon, 15 Oct 2018 21:46:26 -0300 Subject: [PATCH 4/6] update provisioning docs. --- docs/sources/administration/provisioning.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/sources/administration/provisioning.md b/docs/sources/administration/provisioning.md index 862bee3dfe5..dd573e29d9a 100644 --- a/docs/sources/administration/provisioning.md +++ b/docs/sources/administration/provisioning.md @@ -166,6 +166,7 @@ Since not all datasources have the same configuration settings we only have the | tsdbVersion | string | OpenTSDB | Version | | tsdbResolution | string | OpenTSDB | Resolution | | sslmode | string | PostgreSQL | SSLmode. 'disable', 'require', 'verify-ca' or 'verify-full' | +| encrypt | string | MSSQL | Connection SSL encryption handling. 'disable', 'false' or 'true' | | postgresVersion | number | PostgreSQL | Postgres version as a number (903/904/905/906/1000) meaning v9.3, v9.4, ..., v10 | | timescaledb | boolean | PostgreSQL | Enable usage of TimescaleDB extension | | maxOpenConns | number | MySQL, PostgreSQL & MSSQL | Maximum number of open connections to the database (Grafana v5.4+) | From cf6faabd12f0034ce628a99fb17adfb46a1fa5e0 Mon Sep 17 00:00:00 2001 From: Ramiro Morales Date: Mon, 15 Oct 2018 21:51:21 -0300 Subject: [PATCH 5/6] update, don't remove 'Known Issues' docs section. --- docs/sources/features/datasources/mssql.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/sources/features/datasources/mssql.md b/docs/sources/features/datasources/mssql.md index b104a5a1376..cd191f14273 100644 --- a/docs/sources/features/datasources/mssql.md +++ b/docs/sources/features/datasources/mssql.md @@ -71,6 +71,11 @@ Example: Make sure the user does not get any unwanted privileges from the public role. +### Known Issues + +If you're using an older version of Microsoft SQL Server like 2008 and 2008R2 you may need to disable encryption to be able to connect. +If possible, we recommend you to use the latest service pack available for optimal compatibility. + ## Query Editor {{< docs-imagebox img="/img/docs/v51/mssql_query_editor.png" class="docs-image--no-shadow" >}} From 49a3bd30979dbce20d46d5f000ccac62b619ebac Mon Sep 17 00:00:00 2001 From: Ramiro Morales Date: Tue, 16 Oct 2018 13:14:22 -0300 Subject: [PATCH 6/6] add encrypt connstr param conditionally on the value chosen via GUI. --- pkg/tsdb/mssql/mssql.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkg/tsdb/mssql/mssql.go b/pkg/tsdb/mssql/mssql.go index 1d34250a14f..469d6baa5de 100644 --- a/pkg/tsdb/mssql/mssql.go +++ b/pkg/tsdb/mssql/mssql.go @@ -53,14 +53,17 @@ func generateConnectionString(datasource *models.DataSource) string { server, port := hostParts[0], hostParts[1] encrypt := datasource.JsonData.Get("encrypt").MustString("false") - return fmt.Sprintf("server=%s;port=%s;database=%s;user id=%s;password=%s;encrypt=%s;", + connStr := fmt.Sprintf("server=%s;port=%s;database=%s;user id=%s;password=%s;", server, port, datasource.Database, datasource.User, password, - encrypt, ) + if encrypt != "false" { + connStr += fmt.Sprintf("encrypt=%s;", encrypt) + } + return connStr } type mssqlRowTransformer struct {