[v9.3.x] Plugins: add option to proxy ds connections through a secure socks proxy (#59254) (#60643)

Plugins: add option to proxy ds connections through a secure socks proxy (#59254)

* Plugins: add feature to proxy data source connections

(cherry picked from commit 6805c951e9)

pkg/setting/setting.go

@@ -468,6 +468,8 @@ type Cfg struct {
 
 	Search SearchSettings
 
+	SecureSocksDSProxy SecureSocksDSProxySettings
+
 	// Access Control
 	RBACEnabled         bool
 	RBACPermissionCache bool
@@ -1070,6 +1072,13 @@ func (cfg *Cfg) Load(args CommandLineArgs) error {
 	cfg.Storage = readStorageSettings(iniFile)
 	cfg.Search = readSearchSettings(iniFile)
 
+	cfg.SecureSocksDSProxy, err = readSecureSocksDSProxySettings(iniFile)
+	if err != nil {
+		// if the proxy is misconfigured, disable it rather than crashing
+		cfg.SecureSocksDSProxy.Enabled = false
+		cfg.Logger.Error("secure_socks_datasource_proxy unable to start up", "err", err.Error())
+	}
+
 	if VerifyEmailEnabled && !cfg.Smtp.Enabled {
 		cfg.Logger.Warn("require_email_validation is enabled but smtp is disabled")
 	}

pkg/setting/setting_secure_socks_proxy.go

@@ -0,0 +1,44 @@
+package setting
+
+import (
+	"errors"
+
+	"gopkg.in/ini.v1"
+)
+
+type SecureSocksDSProxySettings struct {
+	Enabled      bool
+	ClientCert   string
+	ClientKey    string
+	RootCA       string
+	ProxyAddress string
+	ServerName   string
+}
+
+func readSecureSocksDSProxySettings(iniFile *ini.File) (SecureSocksDSProxySettings, error) {
+	s := SecureSocksDSProxySettings{}
+	secureSocksProxySection := iniFile.Section("secure_socks_datasource_proxy")
+	s.Enabled = secureSocksProxySection.Key("enabled").MustBool(false)
+	s.ClientCert = secureSocksProxySection.Key("client_cert").MustString("")
+	s.ClientKey = secureSocksProxySection.Key("client_key").MustString("")
+	s.RootCA = secureSocksProxySection.Key("root_ca_cert").MustString("")
+	s.ProxyAddress = secureSocksProxySection.Key("proxy_address").MustString("")
+	s.ServerName = secureSocksProxySection.Key("server_name").MustString("")
+
+	if !s.Enabled {
+		return s, nil
+	}
+
+	// all fields must be specified to use the proxy
+	if s.RootCA == "" {
+		return s, errors.New("rootCA required")
+	} else if s.ClientCert == "" || s.ClientKey == "" {
+		return s, errors.New("client key pair required")
+	} else if s.ServerName == "" {
+		return s, errors.New("server name required")
+	} else if s.ProxyAddress == "" {
+		return s, errors.New("proxy address required")
+	}
+
+	return s, nil
+}