| 1317 | } |
| 1318 | |
| 1319 | void Net2::initTLS(ETLSInitState targetState) { |
| 1320 | if (tlsInitializedState >= targetState) { |
| 1321 | return; |
| 1322 | } |
| 1323 | // Any target state must be higher than NONE so if the current state is NONE |
| 1324 | // then initialize the TLS config |
| 1325 | if (tlsInitializedState == ETLSInitState::NONE) { |
| 1326 | auto onPolicyFailure = [this]() { this->countTLSPolicyFailures++; }; |
| 1327 | try { |
| 1328 | boost::asio::ssl::context newContext(boost::asio::ssl::context::tls); |
| 1329 | const LoadedTLSConfig& loaded = tlsConfig.loadSync(); |
| 1330 | TraceEvent("Net2TLSConfig") |
| 1331 | .detail("CAPath", tlsConfig.getCAPathSync()) |
| 1332 | .detail("CertificatePath", tlsConfig.getCertificatePathSync()) |
| 1333 | .detail("KeyPath", tlsConfig.getKeyPathSync()) |
| 1334 | .detail("HasPassword", !loaded.getPassword().empty()) |
| 1335 | .detail("VerifyPeers", boost::algorithm::join(loaded.getVerifyPeers(), "|")); |
| 1336 | auto loadedTlsConfig = tlsConfig.loadSync(); |
| 1337 | ConfigureSSLContext(loadedTlsConfig, newContext); |
| 1338 | activeTlsPolicy = makeReference<TLSPolicy>(loadedTlsConfig, onPolicyFailure); |
| 1339 | sslContextVar.set(ReferencedObject<boost::asio::ssl::context>::from(std::move(newContext))); |
| 1340 | } catch (Error& e) { |
| 1341 | TraceEvent("Net2TLSInitError").error(e); |
| 1342 | } |
| 1343 | backgroundCertRefresh = |
| 1344 | reloadCertificatesOnChange(tlsConfig, onPolicyFailure, &sslContextVar, &activeTlsPolicy); |
| 1345 | } |
| 1346 | |
| 1347 | // If a TLS connection is actually going to be used then start background threads if configured |
| 1348 | if (targetState > ETLSInitState::CONFIG) { |
| 1349 | int threadsToStart; |
| 1350 | switch (targetState) { |
| 1351 | case ETLSInitState::CONNECT: |
| 1352 | threadsToStart = FLOW_KNOBS->TLS_CLIENT_HANDSHAKE_THREADS; |
| 1353 | break; |
| 1354 | case ETLSInitState::LISTEN: |
| 1355 | threadsToStart = FLOW_KNOBS->TLS_SERVER_HANDSHAKE_THREADS; |
| 1356 | break; |
| 1357 | default: |
| 1358 | threadsToStart = 0; |
| 1359 | }; |
| 1360 | threadsToStart -= sslHandshakerThreadsStarted; |
| 1361 | |
| 1362 | if (threadsToStart > 0) { |
| 1363 | if (sslHandshakerThreadsStarted == 0) { |
| 1364 | #if defined(__linux__) |
| 1365 | if (mallopt(M_ARENA_MAX, FLOW_KNOBS->TLS_MALLOC_ARENA_MAX) != 1) { |
| 1366 | TraceEvent(SevWarn, "TLSMallocSetMaxArenasFailure") |
| 1367 | .detail("MaxArenas", FLOW_KNOBS->TLS_MALLOC_ARENA_MAX); |
| 1368 | }; |
| 1369 | #endif |
| 1370 | sslHandshakerPool = createGenericThreadPool(FLOW_KNOBS->TLS_HANDSHAKE_THREAD_STACKSIZE); |
| 1371 | } |
| 1372 | |
| 1373 | for (int i = 0; i < threadsToStart; ++i) { |
| 1374 | ++sslHandshakerThreadsStarted; |
| 1375 | sslHandshakerPool->addThread(new SSLHandshakerThread(), "fdb-ssl-connect"); |
| 1376 | } |
no test coverage detected