Merge branch 'ssl-for-mysql' of https://github.com/improbable-io/grafana into improbable-io-ssl-for-mysql

pkg/services/sqlstore/sqlstore.go

@@ -14,12 +14,21 @@ import (
 	"github.com/grafana/grafana/pkg/services/sqlstore/migrator"
 	"github.com/grafana/grafana/pkg/setting"
 
+	"github.com/go-sql-driver/mysql"
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/go-xorm/xorm"
 	_ "github.com/lib/pq"
 	_ "github.com/mattn/go-sqlite3"
 )
 
+type MySQLConfig struct {
+	SslMode        string
+	CaCertPath     string
+	ClientKeyPath  string
+	ClientCertPath string
+	ServerCertName string
+}
+
 var (
 	x       *xorm.Engine
 	dialect migrator.Dialect
@@ -30,6 +39,8 @@ var (
 		Type, Host, Name, User, Pwd, Path, SslMode string
 	}
 
+	mysqlConfig MySQLConfig
+
 	UseSQLite3 bool
 )
 
@@ -120,6 +131,15 @@ func getEngine() (*xorm.Engine, error) {
 
 		cnnstr = fmt.Sprintf("%s:%s@%s(%s)/%s?charset=utf8",
 			DbCfg.User, DbCfg.Pwd, protocol, DbCfg.Host, DbCfg.Name)
+
+		if mysqlConfig.SslMode == "true" || mysqlConfig.SslMode == "skip-verify" {
+			tlsCert, err := makeCert("custom", mysqlConfig)
+			if err != nil {
+				return nil, err
+			}
+			mysql.RegisterTLSConfig("custom", tlsCert)
+			cnnstr += "&tls=custom"
+		}
 	case "postgres":
 		var host, port = "127.0.0.1", "5432"
 		fields := strings.Split(DbCfg.Host, ":")
@@ -161,4 +181,12 @@ func LoadConfig() {
 	}
 	DbCfg.SslMode = sec.Key("ssl_mode").String()
 	DbCfg.Path = sec.Key("path").MustString("data/grafana.db")
+
+	if DbCfg.Type == "mysql" {
+		mysqlConfig.SslMode = DbCfg.SslMode
+		mysqlConfig.CaCertPath = sec.Key("ca_cert_path").String()
+		mysqlConfig.ClientKeyPath = sec.Key("client_key_path").String()
+		mysqlConfig.ClientCertPath = sec.Key("client_cert_path").String()
+		mysqlConfig.ServerCertName = sec.Key("server_cert_name").String()
+	}
 }