diff --git a/falco.yaml b/falco.yaml index be48a5e2..5ef62edc 100644 --- a/falco.yaml +++ b/falco.yaml @@ -172,9 +172,9 @@ grpc: enabled: false bind_address: "0.0.0.0:5060" threadiness: 8 - private_key: "" - cert_chain: "" - root_certs: "" + private_key: "/etc/falco/certs/server.key" + cert_chain: "/etc/falco/certs/server.crt" + root_certs: "/etc/falco/certs/ca.crt" grpc_output: enabled: true \ No newline at end of file diff --git a/userspace/falco/configuration.cpp b/userspace/falco/configuration.cpp index b1758c87..bfe6512e 100644 --- a/userspace/falco/configuration.cpp +++ b/userspace/falco/configuration.cpp @@ -152,9 +152,9 @@ void falco_configuration::init(string conf_filename, list &cmdline_optio m_grpc_bind_address = m_config->get_scalar("grpc", "bind_address", "0.0.0.0:5060"); m_grpc_threadiness = m_config->get_scalar("grpc", "threadiness", 8); // todo > limit it to avoid overshubscription? std::thread::hardware_concurrency() // todo(fntlnz,leodido) > chose correct paths - m_grpc_private_key = m_config->get_scalar("grpc", "private_key", ""); - m_grpc_cert_chain = m_config->get_scalar("grpc", "cert_chain", ""); - m_grpc_root_certs = m_config->get_scalar("grpc", "root_certs", ""); + m_grpc_private_key = m_config->get_scalar("grpc", "private_key", "/etc/falco/certs/server.key"); + m_grpc_cert_chain = m_config->get_scalar("grpc", "cert_chain", "/etc/falco/certs/server.crt"); + m_grpc_root_certs = m_config->get_scalar("grpc", "root_certs", "/etc/falco/certs/ca.crt"); falco_outputs::output_config grpc_output; grpc_output.name = "grpc"; diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index f5551f9a..8d6a423e 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -1177,7 +1177,7 @@ int falco_init(int argc, char **argv) { // TODO(fntlnz,leodido): when we want to spawn multiple threads we need to have a queue per thread, or implement // different queuing mechanisms, round robin, fanout? What we want to achieve? - grpc_server.init(config.m_grpc_bind_address, config.m_grpc_threadiness); + grpc_server.init(config.m_grpc_bind_address, config.m_grpc_threadiness, config.m_grpc_private_key, config.m_grpc_cert_chain, config.m_grpc_root_certs); grpc_server_thread = std::thread([&grpc_server] { grpc_server.run(); }); diff --git a/userspace/falco/grpc_server.cpp b/userspace/falco/grpc_server.cpp index 42f55573..c1d46ef7 100644 --- a/userspace/falco/grpc_server.cpp +++ b/userspace/falco/grpc_server.cpp @@ -188,10 +188,13 @@ void read(const std::string& filename, std::string& data) return; } -void falco_grpc_server::init(std::string server_addr, int threadiness) +void falco_grpc_server::init(std::string server_addr, int threadiness, std::string private_key, std::string cert_chain, std::string root_certs) { m_server_addr = server_addr; m_threadiness = threadiness; + m_private_key = private_key; + m_cert_chain = cert_chain; + m_root_certs = root_certs; } void falco_grpc_server::run() @@ -200,9 +203,9 @@ void falco_grpc_server::run() string cert_chain; string root_certs; - read("/tmp/server.crt", cert_chain); - read("/tmp/server.key", private_key); - read("/tmp/ca.crt", root_certs); + read(m_cert_chain, cert_chain); + read(m_private_key, private_key); + read(m_root_certs, root_certs); grpc::SslServerCredentialsOptions::PemKeyCertPair cert_pair{private_key, cert_chain}; @@ -266,10 +269,3 @@ void falco_grpc_server::stop() { } } - -bool start_grpc_server(std::string server_address, int threadiness) -{ - falco_grpc_server srv(server_address, threadiness); - srv.run(); - return true; -} diff --git a/userspace/falco/grpc_server.h b/userspace/falco/grpc_server.h index 53c61100..ed8822a9 100644 --- a/userspace/falco/grpc_server.h +++ b/userspace/falco/grpc_server.h @@ -31,14 +31,17 @@ public: falco_grpc_server() { } - falco_grpc_server(std::string server_addr, int threadiness): + falco_grpc_server(std::string server_addr, int threadiness, std::string private_key, std::string cert_chain, std::string root_certs): m_server_addr(server_addr), - m_threadiness(threadiness) + m_threadiness(threadiness), + m_private_key(private_key), + m_cert_chain(cert_chain), + m_root_certs(root_certs) { } virtual ~falco_grpc_server() = default; - void init(std::string server_addr, int threadiness); + void init(std::string server_addr, int threadiness, std::string private_key, std::string cert_chain, std::string root_certs); void thread_process(int thread_index); void run(); void stop(); @@ -47,14 +50,16 @@ public: std::unique_ptr m_completion_queue; private: - std::unique_ptr m_server; std::string m_server_addr; - int m_threadiness = 0; + int m_threadiness; + std::string m_private_key; + std::string m_cert_chain; + std::string m_root_certs; + + std::unique_ptr m_server; std::vector m_threads; }; -bool start_grpc_server(std::string server_address, int threadiness); - class request_context_base { public: