| 326 | }; |
| 327 | } |
| 328 | Status ThriftServer::CreateSocket(std::shared_ptr<TServerSocket>* socket) { |
| 329 | if (ssl_enabled()) { |
| 330 | if (!SSLProtoVersions::IsSupported(version_)) { |
| 331 | return Status(TErrorCode::SSL_SOCKET_CREATION_FAILED, |
| 332 | Substitute("TLS ($0) version not supported (maximum supported version is $1)", |
| 333 | version_, MaxSupportedTlsVersion())); |
| 334 | } |
| 335 | try { |
| 336 | // This 'factory' is only called once, since CreateSocket() is only called from |
| 337 | // Start(). The c'tor may throw if there is an error initializing the SSL context. |
| 338 | std::shared_ptr<ImpalaTlsSocketFactory> socket_factory( |
| 339 | new ImpalaPasswordedTlsSocketFactory(version_, key_password_)); |
| 340 | socket_factory->overrideDefaultPasswordCallback(); |
| 341 | |
| 342 | socket_factory->configureCiphers(cipher_list_, tls_ciphersuites_, |
| 343 | disable_tls12_); |
| 344 | socket_factory->loadCertificate(certificate_path_.c_str()); |
| 345 | socket_factory->loadPrivateKey(private_key_path_.c_str()); |
| 346 | ImpalaKeepAliveServerSocket<TSSLServerSocket>* server_socket = |
| 347 | new ImpalaKeepAliveServerSocket<TSSLServerSocket>(host_, port_, socket_factory); |
| 348 | server_socket->setKeepAliveOptions(keepalive_probe_period_s_, |
| 349 | keepalive_retry_period_s_, keepalive_retry_count_); |
| 350 | socket->reset(server_socket); |
| 351 | } catch (const TException& e) { |
| 352 | return Status(TErrorCode::SSL_SOCKET_CREATION_FAILED, e.what()); |
| 353 | } |
| 354 | } else { |
| 355 | ImpalaKeepAliveServerSocket<TServerSocket>* server_socket = |
| 356 | new ImpalaKeepAliveServerSocket<TServerSocket>(host_, port_); |
| 357 | server_socket->setKeepAliveOptions(keepalive_probe_period_s_, |
| 358 | keepalive_retry_period_s_, keepalive_retry_count_); |
| 359 | socket->reset(server_socket); |
| 360 | } |
| 361 | return Status::OK(); |
| 362 | } |
| 363 | |
| 364 | Status ThriftServer::EnableSsl(SSLProtocol version, const string& certificate, |
| 365 | const string& private_key, const string& pem_password_cmd, |
nothing calls this directly
no test coverage detected