Merge "Merge remote-tracking branch 'couchbase/cheshire-cat'"

src/cb_dist.erl

@@ -709,7 +709,7 @@ conf(Prop, Conf) ->
     %% See comments for how we determine defaults.
     proplists:get_value(Prop, Conf, proplists:get_value(Prop, defaults(Conf))).
 
-%% From 7.0,
+%% From 6.6.4,
 %% 1. we do not start both [inet_tcp_dist, inet6_tcp_dist] protos for
 %% local_listeners and external_listeners by default as we introduced the
 %% address family only feature.

src/misc.erl

@@ -1494,6 +1494,13 @@ try_with_maybe_ignorant_after(TryBody, AfterBody) ->
 letrec(Args, F) ->
     erlang:apply(F, [F | Args]).
 
+%% Artifact of backporting enforce TLS project, MB-48047, to 6.6.4.
+%% This is to workaround the cluster_compat_mode check of 7_0.
+%% Should git rid off when 6.6.x is unsupported.
+-spec is_strict_possible() -> true | false.
+is_strict_possible() ->
+    ns_config:read_key_fast(can_enable_strict_encryption, false).
+
 -spec is_ipv6() -> true | false.
 is_ipv6() ->
     get_net_family() == inet6.

src/netconfig_updater.erl

@@ -423,7 +423,9 @@ wait_for_exit(Port, Output) ->
 
 maybe_kill_epmd() ->
     NoEpmdFile = path_config:component_path(data, "no_epmd"),
-    case ?CAN_KILL_EPMD andalso cluster_compat_mode:is_cluster_70() andalso
+    case ?CAN_KILL_EPMD andalso
+         (misc:is_strict_possible() orelse
+          cluster_compat_mode:is_cluster_70()) andalso
          (misc:get_afamily_only() orelse misc:disable_non_ssl_ports()) of
         true ->
             try

src/ns_cluster.erl

@@ -1496,6 +1496,7 @@ perform_actual_join(RemoteNode, NewCookie, ChronicleInfo) ->
     ns_ssl_services_setup:update_node_cert_epoch(),
 
     misc:remove_marker(join_marker_path()),
+    netconfig_updater:maybe_kill_epmd(),
 
     ?cluster_debug("Join succeded, starting ns_server_cluster back", []),
     case ns_server_cluster_sup:start_ns_server() of