| 86 | } |
| 87 | |
| 88 | Status MessengerBuilder::Build(shared_ptr<Messenger>* msgr) { |
| 89 | // Initialize SASL library before we start making requests |
| 90 | RETURN_NOT_OK(SaslInit(!keytab_file_.empty())); |
| 91 | |
| 92 | // See docs on Messenger::retain_self_ for info about this odd hack. |
| 93 | // |
| 94 | // Note: can't use make_shared() as it doesn't support custom deleters. |
| 95 | shared_ptr<Messenger> new_msgr(new Messenger(*this), |
| 96 | std::mem_fn(&Messenger::AllExternalReferencesDropped)); |
| 97 | if (jwt_verifier_) { |
| 98 | new_msgr->jwt_verifier_ = std::move(jwt_verifier_); |
| 99 | } |
| 100 | RETURN_NOT_OK(ParseTriState("--rpc_authentication", |
| 101 | rpc_authentication_, |
| 102 | &new_msgr->authentication_)); |
| 103 | RETURN_NOT_OK(ParseTriState("--rpc_encryption", |
| 104 | rpc_encryption_, |
| 105 | &new_msgr->encryption_)); |
| 106 | new_msgr->loopback_encryption_ = rpc_loopback_encryption_; |
| 107 | RETURN_NOT_OK(new_msgr->Init()); |
| 108 | if (new_msgr->encryption_ != RpcEncryption::DISABLED && enable_inbound_tls_) { |
| 109 | auto* tls_context = new_msgr->mutable_tls_context(); |
| 110 | |
| 111 | if (!rpc_certificate_file_.empty()) { |
| 112 | CHECK(!rpc_private_key_file_.empty()); |
| 113 | CHECK(!rpc_ca_certificate_file_.empty()); |
| 114 | |
| 115 | // TODO(KUDU-1920): should we try and enforce that the server |
| 116 | // is in the subject or alt names of the cert? |
| 117 | RETURN_NOT_OK(tls_context->LoadCertificateAuthority(rpc_ca_certificate_file_)); |
| 118 | if (rpc_private_key_password_cmd_.empty()) { |
| 119 | RETURN_NOT_OK(tls_context->LoadCertificateAndKey(rpc_certificate_file_, |
| 120 | rpc_private_key_file_)); |
| 121 | } else { |
| 122 | RETURN_NOT_OK(tls_context->LoadCertificateAndPasswordProtectedKey( |
| 123 | rpc_certificate_file_, rpc_private_key_file_, |
| 124 | [&](){ |
| 125 | string ret; |
| 126 | WARN_NOT_OK(security::GetPasswordFromShellCommand( |
| 127 | rpc_private_key_password_cmd_, &ret), |
| 128 | "could not get RPC password from configured command"); |
| 129 | return ret; |
| 130 | } |
| 131 | )); |
| 132 | } |
| 133 | } else { |
| 134 | RETURN_NOT_OK(tls_context->GenerateSelfSignedCertAndKey()); |
| 135 | } |
| 136 | } |
| 137 | |
| 138 | *msgr = std::move(new_msgr); |
| 139 | return Status::OK(); |
| 140 | } |
| 141 | |
| 142 | // See comment on Messenger::retain_self_ member. |
| 143 | void Messenger::AllExternalReferencesDropped() { |