From 592c46c8b54eca5d1b03e72e6c8def2140cd2cdd Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 10:39:03 +0100 Subject: [PATCH 1/9] Tests: Clarify what InsecureSkipVerify does --- pkg/models/datasource_cache_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/models/datasource_cache_test.go b/pkg/models/datasource_cache_test.go index 5e821ea28c4..8b36cc68e2a 100644 --- a/pkg/models/datasource_cache_test.go +++ b/pkg/models/datasource_cache_test.go @@ -49,7 +49,7 @@ func TestDataSourceCache(t *testing.T) { transport, err := ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should have no cert", func() { + Convey("Should disable TLS certificate verification", func() { So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true) }) @@ -69,7 +69,7 @@ func TestDataSourceCache(t *testing.T) { transport, err = ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should add cert", func() { + Convey("Should add cert and enable TLS certificate verification", func() { So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 1) }) @@ -81,7 +81,7 @@ func TestDataSourceCache(t *testing.T) { transport, err = ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should remove cert", func() { + Convey("Should remove cert and disable TLS certificate vertification", func() { So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true) So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 0) }) From 4719a8c8dd9f22505f1a91a53cd418f5b9e6ee85 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 10:41:12 +0100 Subject: [PATCH 2/9] Tidy spacing in datasource TLS settings --- .../plugins/partials/ds_http_settings.html | 25 +++++-------------- 1 file changed, 6 insertions(+), 19 deletions(-) diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index 62c3e477446..d10b8cbf9bc 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -39,26 +39,13 @@

Http Auth

- -
- - - - -
- - - - + + +
+
+ +
From 43169e4302a6e0ffcc01d9108965b1b4feaad5d6 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 11:04:01 +0100 Subject: [PATCH 3/9] Verify datasource TLS and split client auth and CA --- pkg/models/datasource_cache.go | 21 ++++---- pkg/models/datasource_cache_test.go | 12 ++--- .../plugins/partials/ds_http_settings.html | 48 ++++++++++--------- 3 files changed, 41 insertions(+), 40 deletions(-) diff --git a/pkg/models/datasource_cache.go b/pkg/models/datasource_cache.go index 158018b0f0a..14d3c6c2fc1 100644 --- a/pkg/models/datasource_cache.go +++ b/pkg/models/datasource_cache.go @@ -47,8 +47,7 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { transport := &http.Transport{ TLSClientConfig: &tls.Config{ - InsecureSkipVerify: true, - Renegotiation: tls.RenegotiateFreelyAsClient, + Renegotiation: tls.RenegotiateFreelyAsClient, }, Proxy: http.ProxyFromEnvironment, Dial: (&net.Dialer{ @@ -62,15 +61,13 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { IdleConnTimeout: 90 * time.Second, } - var tlsAuth, tlsAuthWithCACert bool + var tlsClientAuth, tlsAuthWithCACert bool if ds.JsonData != nil { - tlsAuth = ds.JsonData.Get("tlsAuth").MustBool(false) + tlsClientAuth = ds.JsonData.Get("tlsClientAuth").MustBool(false) tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false) } - if tlsAuth { - transport.TLSClientConfig.InsecureSkipVerify = false - + if tlsClientAuth || tlsAuthWithCACert { decrypted := ds.SecureJsonData.Decrypt() if tlsAuthWithCACert && len(decrypted["tlsCACert"]) > 0 { @@ -81,11 +78,13 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { } } - cert, err := tls.X509KeyPair([]byte(decrypted["tlsClientCert"]), []byte(decrypted["tlsClientKey"])) - if err != nil { - return nil, err + if tlsClientAuth { + cert, err := tls.X509KeyPair([]byte(decrypted["tlsClientCert"]), []byte(decrypted["tlsClientKey"])) + if err != nil { + return nil, err + } + transport.TLSClientConfig.Certificates = []tls.Certificate{cert} } - transport.TLSClientConfig.Certificates = []tls.Certificate{cert} } ptc.cache[ds.Id] = cachedTransport{ diff --git a/pkg/models/datasource_cache_test.go b/pkg/models/datasource_cache_test.go index 8b36cc68e2a..bbd1c563ad1 100644 --- a/pkg/models/datasource_cache_test.go +++ b/pkg/models/datasource_cache_test.go @@ -36,7 +36,7 @@ func TestDataSourceCache(t *testing.T) { setting.SecretKey = "password" json := simplejson.New() - json.Set("tlsAuth", true) + json.Set("tlsClientAuth", true) json.Set("tlsAuthWithCACert", true) t := time.Now() @@ -49,8 +49,8 @@ func TestDataSourceCache(t *testing.T) { transport, err := ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should disable TLS certificate verification", func() { - So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true) + Convey("Should verify TLS certificates by default", func() { + So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) }) ds.JsonData = json @@ -69,7 +69,7 @@ func TestDataSourceCache(t *testing.T) { transport, err = ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should add cert and enable TLS certificate verification", func() { + Convey("Should add cert and verify TLS certificates", func() { So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 1) }) @@ -81,8 +81,8 @@ func TestDataSourceCache(t *testing.T) { transport, err = ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should remove cert and disable TLS certificate vertification", func() { - So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true) + Convey("Should remove cert but still verify TLS certificates", func() { + So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 0) }) }) diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index d10b8cbf9bc..6ea3a3cde1a 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -44,7 +44,7 @@
- +
@@ -66,7 +66,7 @@ -
+
TLS Auth Details
TLS Certs are encrypted and stored in the Grafana database. @@ -87,29 +87,31 @@
-
-
- +
+
+
+ +
+
+ +
+
+ + reset +
-
- -
-
- - reset -
-
-
-
- -
-
- -
-
- - reset +
+
+ +
+
+ +
+
+ + reset +
From a286ffa5f2ad2280ffcc060f02c291dc2f229241 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 11:14:12 +0100 Subject: [PATCH 4/9] Alias macron package in app_routes.go ...to make this file compatible with goimports: https://godoc.org/golang.org/x/tools/cmd/goimports --- pkg/api/app_routes.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkg/api/app_routes.go b/pkg/api/app_routes.go index 8992f8f66d6..2baa9ddd75a 100644 --- a/pkg/api/app_routes.go +++ b/pkg/api/app_routes.go @@ -6,14 +6,13 @@ import ( "net/http" "time" - "gopkg.in/macaron.v1" - "github.com/grafana/grafana/pkg/api/pluginproxy" "github.com/grafana/grafana/pkg/log" "github.com/grafana/grafana/pkg/middleware" m "github.com/grafana/grafana/pkg/models" "github.com/grafana/grafana/pkg/plugins" "github.com/grafana/grafana/pkg/util" + macaron "gopkg.in/macaron.v1" ) var pluginProxyTransport = &http.Transport{ From ef52d956bfc6fdb2f371f68b0b25f0a20d4c4ed4 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 11:25:20 +0100 Subject: [PATCH 5/9] Make URL capitalisation consistent in UI URL is an acronym, it should be all caps. --- .../features/plugins/partials/ds_http_settings.html | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index 6ea3a3cde1a..c11a44578a3 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -5,19 +5,19 @@
- Url + URL -

Specify a complete HTTP url (for example http://your_server:8080)

+

Specify a complete HTTP URL (for example http://your_server:8080)

- Your access method is Direct, this means the url + Your access method is Direct, this means the URL needs to be accessible from the browser. - Your access method is currently Proxy, this means the url + Your access method is currently Proxy, this means the URL needs to be accessible from the grafana backend. @@ -30,7 +30,7 @@
- Direct = url is used directly from browser
+ Direct = URL is used directly from browser
Proxy = Grafana backend will proxy the request
From 5d312be419b29b1fa0f7fd805a741462a9d45993 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 14:10:14 +0100 Subject: [PATCH 6/9] Datasource HTTP settings: Add TLS skip verify In c04d95f35 I changed the default for datasource HTTP requests so that TLS is always verified. This commit adds a checkbox to allow an admin to explicitly skip TLS verification, for testing purposes. --- pkg/models/datasource_cache.go | 16 +- pkg/models/datasource_cache_test.go | 148 ++++++++++++++---- .../plugins/partials/ds_http_settings.html | 21 ++- 3 files changed, 137 insertions(+), 48 deletions(-) diff --git a/pkg/models/datasource_cache.go b/pkg/models/datasource_cache.go index 14d3c6c2fc1..f6c7ee67c5a 100644 --- a/pkg/models/datasource_cache.go +++ b/pkg/models/datasource_cache.go @@ -45,9 +45,17 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { return t.Transport, nil } + var tlsSkipVerify, tlsClientAuth, tlsAuthWithCACert bool + if ds.JsonData != nil { + tlsClientAuth = ds.JsonData.Get("tlsClientAuth").MustBool(false) + tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false) + tlsSkipVerify = ds.JsonData.Get("tlsSkipVerify").MustBool(false) + } + transport := &http.Transport{ TLSClientConfig: &tls.Config{ - Renegotiation: tls.RenegotiateFreelyAsClient, + InsecureSkipVerify: tlsSkipVerify, + Renegotiation: tls.RenegotiateFreelyAsClient, }, Proxy: http.ProxyFromEnvironment, Dial: (&net.Dialer{ @@ -61,12 +69,6 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { IdleConnTimeout: 90 * time.Second, } - var tlsClientAuth, tlsAuthWithCACert bool - if ds.JsonData != nil { - tlsClientAuth = ds.JsonData.Get("tlsClientAuth").MustBool(false) - tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false) - } - if tlsClientAuth || tlsAuthWithCACert { decrypted := ds.SecureJsonData.Decrypt() diff --git a/pkg/models/datasource_cache_test.go b/pkg/models/datasource_cache_test.go index bbd1c563ad1..d427cc84bf9 100644 --- a/pkg/models/datasource_cache_test.go +++ b/pkg/models/datasource_cache_test.go @@ -29,61 +29,140 @@ func TestDataSourceCache(t *testing.T) { Convey("Should be using the cached proxy", func() { So(t2, ShouldEqual, t1) }) + Convey("Should verify TLS by default", func() { + So(t1.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) + }) + Convey("Should have no TLS client certificate configured", func() { + So(len(t1.TLSClientConfig.Certificates), ShouldEqual, 0) + }) + Convey("Should have no user-supplied TLS CA onfigured", func() { + So(t1.TLSClientConfig.RootCAs, ShouldBeNil) + }) }) - Convey("When getting kubernetes datasource proxy", t, func() { + Convey("When caching a datasource proxy then updating it", t, func() { + clearCache() + setting.SecretKey = "password" + + json := simplejson.New() + json.Set("tlsAuthWithCACert", true) + + tlsCaCert, err := util.Encrypt([]byte(caCert), "password") + So(err, ShouldBeNil) + ds := DataSource{ + Id: 1, + Url: "http://k8s:8001", + Type: "Kubernetes", + SecureJsonData: map[string][]byte{"tlsCACert": tlsCaCert}, + Updated: time.Now().Add(-2 * time.Minute), + } + + t1, err := ds.GetHttpTransport() + So(err, ShouldBeNil) + + Convey("Should verify TLS by default", func() { + So(t1.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) + }) + Convey("Should have no TLS client certificate configured", func() { + So(len(t1.TLSClientConfig.Certificates), ShouldEqual, 0) + }) + Convey("Should have no user-supplied TLS CA configured", func() { + So(t1.TLSClientConfig.RootCAs, ShouldBeNil) + }) + + ds.JsonData = nil + ds.SecureJsonData = map[string][]byte{} + ds.Updated = time.Now() + + t2, err := ds.GetHttpTransport() + So(err, ShouldBeNil) + + Convey("Should have no user-supplied TLS CA configured after the update", func() { + So(t2.TLSClientConfig.RootCAs, ShouldBeNil) + }) + }) + + Convey("When caching a datasource proxy with TLS client authentication enabled", t, func() { clearCache() setting.SecretKey = "password" json := simplejson.New() json.Set("tlsClientAuth", true) + + tlsClientCert, err := util.Encrypt([]byte(clientCert), "password") + So(err, ShouldBeNil) + tlsClientKey, err := util.Encrypt([]byte(clientKey), "password") + So(err, ShouldBeNil) + + ds := DataSource{ + Id: 1, + Url: "http://k8s:8001", + Type: "Kubernetes", + JsonData: json, + SecureJsonData: map[string][]byte{ + "tlsClientCert": tlsClientCert, + "tlsClientKey": tlsClientKey, + }, + } + + tr, err := ds.GetHttpTransport() + So(err, ShouldBeNil) + + Convey("Should verify TLS by default", func() { + So(tr.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) + }) + Convey("Should have a TLS client certificate configured", func() { + So(len(tr.TLSClientConfig.Certificates), ShouldEqual, 1) + }) + }) + + Convey("When caching a datasource proxy with a user-supplied TLS CA", t, func() { + clearCache() + setting.SecretKey = "password" + + json := simplejson.New() json.Set("tlsAuthWithCACert", true) - t := time.Now() + tlsCaCert, err := util.Encrypt([]byte(caCert), "password") + So(err, ShouldBeNil) + ds := DataSource{ - Url: "http://k8s:8001", - Type: "Kubernetes", - Updated: t.Add(-2 * time.Minute), + Id: 1, + Url: "http://k8s:8001", + Type: "Kubernetes", + JsonData: json, + SecureJsonData: map[string][]byte{"tlsCACert": tlsCaCert}, } - transport, err := ds.GetHttpTransport() + tr, err := ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should verify TLS certificates by default", func() { - So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) + Convey("Should verify TLS by default", func() { + So(tr.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) }) + Convey("Should have a TLS CA configured", func() { + So(len(tr.TLSClientConfig.RootCAs.Subjects()), ShouldEqual, 1) + }) + }) - ds.JsonData = json + Convey("When caching a datasource proxy when user skips TLS verification", t, func() { + clearCache() - tlsCaCert, _ := util.Encrypt([]byte(caCert), "password") - tlsClientCert, _ := util.Encrypt([]byte(clientCert), "password") - tlsClientKey, _ := util.Encrypt([]byte(clientKey), "password") + json := simplejson.New() + json.Set("tlsSkipVerify", true) - ds.SecureJsonData = map[string][]byte{ - "tlsCACert": tlsCaCert, - "tlsClientCert": tlsClientCert, - "tlsClientKey": tlsClientKey, + ds := DataSource{ + Id: 1, + Url: "http://k8s:8001", + Type: "Kubernetes", + JsonData: json, } - ds.Updated = t.Add(-1 * time.Minute) - transport, err = ds.GetHttpTransport() + tr, err := ds.GetHttpTransport() So(err, ShouldBeNil) - Convey("Should add cert and verify TLS certificates", func() { - So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) - So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 1) - }) - - ds.JsonData = nil - ds.SecureJsonData = map[string][]byte{} - ds.Updated = t - - transport, err = ds.GetHttpTransport() - So(err, ShouldBeNil) - - Convey("Should remove cert but still verify TLS certificates", func() { - So(transport.TLSClientConfig.InsecureSkipVerify, ShouldEqual, false) - So(len(transport.TLSClientConfig.Certificates), ShouldEqual, 0) + Convey("Should skip TLS verification", func() { + So(tr.TLSClientConfig.InsecureSkipVerify, ShouldEqual, true) }) }) } @@ -115,7 +194,8 @@ FHoXIyGOdq1chmRVocdGBCF8fUoGIbuF14r53rpvcbEKtKnnP8+96luKAZLq0a4n 3lb92xM= -----END CERTIFICATE-----` -const clientCert string = `-----BEGIN CERTIFICATE----- +const clientCert string = ` +-----BEGIN CERTIFICATE----- MIICsjCCAZoCCQCcd8sOfstQLzANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxj YS1rOHMtc3RobG0wHhcNMTYxMTAyMDkyNTE1WhcNMTcxMTAyMDkyNTE1WjAfMR0w GwYDVQQDDBRhZG0tZGFuaWVsLWs4cy1zdGhsbTCCASIwDQYJKoZIhvcNAQEBBQAD diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index c11a44578a3..1aff62e0d20 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -39,13 +39,20 @@

Http Auth

-
- - -
-
- - +
+
+ + +
+
+ + +
+
+ +
+ +
From e23c678df9ef6dd2b7e827372e4317af0d10c693 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 14:20:09 +0100 Subject: [PATCH 7/9] Datasource settings: Make HTTP all caps It's an acronym, so it should be all caps. --- public/app/features/plugins/partials/ds_http_settings.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index 1aff62e0d20..1d8582c06d1 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -1,7 +1,7 @@
-

Http settings

+

HTTP settings

@@ -38,7 +38,7 @@
-

Http Auth

+

HTTP Auth

From f6aa0e41e50ac2b596a7c2e7b33297e5f33c31e1 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Thu, 28 Sep 2017 14:55:32 +0100 Subject: [PATCH 8/9] Return error if datasource TLS CA not parsed --- pkg/models/datasource_cache.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/models/datasource_cache.go b/pkg/models/datasource_cache.go index f6c7ee67c5a..79c67691df7 100644 --- a/pkg/models/datasource_cache.go +++ b/pkg/models/datasource_cache.go @@ -3,6 +3,7 @@ package models import ( "crypto/tls" "crypto/x509" + "errors" "net" "net/http" "sync" @@ -71,13 +72,13 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { if tlsClientAuth || tlsAuthWithCACert { decrypted := ds.SecureJsonData.Decrypt() - if tlsAuthWithCACert && len(decrypted["tlsCACert"]) > 0 { caPool := x509.NewCertPool() ok := caPool.AppendCertsFromPEM([]byte(decrypted["tlsCACert"])) - if ok { - transport.TLSClientConfig.RootCAs = caPool + if !ok { + return nil, errors.New("Failed to parse TLS CA PEM certificate") } + transport.TLSClientConfig.RootCAs = caPool } if tlsClientAuth { From 4f3856adfbfc71f1d779f3dd49994e295098c346 Mon Sep 17 00:00:00 2001 From: Matt Bostock Date: Mon, 2 Oct 2017 15:06:02 +0100 Subject: [PATCH 9/9] Retain old name for TLS client auth I renamed `tlsAuth` to `tlsClientAuth` to better describe the fact that this variable is used to enable TLS client authentication (as opposed to server authentication) in c04d95f35. However, changing the name breaks backwards compatibility for existing installations using this feature and Grafana does not have a standardised way of migrating changes in the schema: https://github.com/grafana/grafana/pull/9377#issuecomment-333063543 For reasons of expediency given the severity of the bug (not verifying TLS), keep the old name. --- pkg/models/datasource_cache.go | 2 +- pkg/models/datasource_cache_test.go | 2 +- public/app/features/plugins/partials/ds_http_settings.html | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/models/datasource_cache.go b/pkg/models/datasource_cache.go index 79c67691df7..b4a4e7f8a4d 100644 --- a/pkg/models/datasource_cache.go +++ b/pkg/models/datasource_cache.go @@ -48,7 +48,7 @@ func (ds *DataSource) GetHttpTransport() (*http.Transport, error) { var tlsSkipVerify, tlsClientAuth, tlsAuthWithCACert bool if ds.JsonData != nil { - tlsClientAuth = ds.JsonData.Get("tlsClientAuth").MustBool(false) + tlsClientAuth = ds.JsonData.Get("tlsAuth").MustBool(false) tlsAuthWithCACert = ds.JsonData.Get("tlsAuthWithCACert").MustBool(false) tlsSkipVerify = ds.JsonData.Get("tlsSkipVerify").MustBool(false) } diff --git a/pkg/models/datasource_cache_test.go b/pkg/models/datasource_cache_test.go index d427cc84bf9..85ece0bbdcc 100644 --- a/pkg/models/datasource_cache_test.go +++ b/pkg/models/datasource_cache_test.go @@ -87,7 +87,7 @@ func TestDataSourceCache(t *testing.T) { setting.SecretKey = "password" json := simplejson.New() - json.Set("tlsClientAuth", true) + json.Set("tlsAuth", true) tlsClientCert, err := util.Encrypt([]byte(clientCert), "password") So(err, ShouldBeNil) diff --git a/public/app/features/plugins/partials/ds_http_settings.html b/public/app/features/plugins/partials/ds_http_settings.html index 1d8582c06d1..ac21c6f9ed8 100644 --- a/public/app/features/plugins/partials/ds_http_settings.html +++ b/public/app/features/plugins/partials/ds_http_settings.html @@ -45,7 +45,7 @@
- +
@@ -73,7 +73,7 @@
-
+
TLS Auth Details
TLS Certs are encrypted and stored in the Grafana database. @@ -94,7 +94,7 @@
-
+