<div dir="ltr">Thank you so much for the quick reply , Henning Westerholt.<div><br></div><div>I understand the work around suggested, but i dont have the control on it.</div><div><br></div><div>Thank you for considering to do an improvement on parallelization wrt the problem stated.</div><div><br></div><div>I have raised the issue <a href="https://github.com/kamailio/kamailio/issues/2312">https://github.com/kamailio/kamailio/issues/2312</a> with all the required details, i dint find a way to assign the new feature request label to it. Please do the needful.</div><div>The stated problem in load_crl , is also present in other load functions as well <span style="color:black;font-family:Calibri,sans-serif;font-size:11pt">load_cert, </span><span style="color:black;font-family:Calibri,sans-serif;font-size:11pt">load_ca_list, </span><span style="color:black;font-size:11pt;font-family:Calibri,sans-serif">set_cipher_list, </span><span style="color:black;font-family:Calibri,sans-serif;font-size:11pt">set_verification, </span><span style="color:black;font-family:Calibri,sans-serif;font-size:11pt">set_ssl_options, </span><span style="color:black;font-family:Calibri,sans-serif;font-size:11pt">set_session_cache, </span><span style="color:black;font-family:Calibri,sans-serif;font-size:11pt">ksr_tls_fix_domain.</span></div><div><span style="color:black;font-family:Calibri,sans-serif;font-size:11pt"><br></span></div><div><br></div><div>Regards,</div><div>Mahesh.B </div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, May 3, 2020 at 2:06 PM Henning Westerholt <<a href="mailto:hw@skalatan.de">hw@skalatan.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="DE">
<div class="gmail-m_-2873808867607998276WordSection1">
<p class="MsoNormal"><span>Hello,<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">I noticed a similar behaviour, long startup times if you use multi-megabyte CRL files (like the system default one).<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">One simple workaround is to use a smaller CRL file that just includes the necessary Cas.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">But the code could be probably also improved, maybe it is possible to parallelize it. You can open a feature request about it, or even better, a pull request.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Cheers,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Henning<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">-- <u></u>
<u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Henning Westerholt –
</span><span><a href="https://skalatan.de/blog/" target="_blank"><span lang="EN-GB" style="color:rgb(5,99,193)">https://skalatan.de/blog/</span></a></span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Kamailio services –
</span><span><a href="https://gilawa.com/" target="_blank"><span lang="EN-GB" style="color:rgb(5,99,193)">https://gilawa.com</span></a></span><span>
<span lang="EN-GB"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> sr-users <<a href="mailto:sr-users-bounces@lists.kamailio.org" target="_blank">sr-users-bounces@lists.kamailio.org</a>>
<b>On Behalf Of </b>mahesh b<br>
<b>Sent:</b> Sunday, May 3, 2020 4:30 AM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a>><br>
<b>Subject:</b> [SR-Users] load_crl takes 90 seconds to complete it execution with crl file size of 4MB !!!<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hi All,<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Am using Kamailio 5.1.9 version, In my tls.cfg i have one client and server profile,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">along with default client and server profile.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I have crl enabled for the non default client and server profile , the crl file size is 4 MB in my case.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I have 22 child tcp process.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">With this what i observe is load_crl is taking close to 90 seconds to finish its execution and return.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">It is very clear from the code, its because of this for loop.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> procs_no=get_max_procs();<br>
for(i = 0; i < procs_no; i++) {<br>
if (SSL_CTX_load_verify_locations(d->ctx[i], d->crl_file.s, 0) != 1) {<br>
ERR("%s: Unable to load certificate revocation list '%s'\n",<br>
tls_domain_str(d), d->crl_file.s);<br>
TLS_ERR("load_crl:");<br>
return -1;<br>
}<br>
store = SSL_CTX_get_cert_store(d->ctx[i]);<br>
X509_STORE_set_flags(store,<br>
X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);<br>
}<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Is there a way this can be enhanced or as per the current kamailio design this is a must to do for each and every profile and the child process array list.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Please suggest, is it justifiable for load_crl to take 90 seconds , to complete its execution, with one client and server profile and 22 child tcp process and crl file size of 4MB.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">More info of my setup:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">-----------------------------<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Kamailio 5.1.9 version is running on the below <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">Linux Kernel version : 3.10.0-693.el7.x86_64<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
Centos version : CentOS Linux release 7.4.1708 (Core)<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
CPU : 2 cores with model name : Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
[root@miv5000 ~]# cat /proc/meminfo<br>
MemTotal: 3882076 kB<br>
MemFree: 811244 kB<br>
MemAvailable: 2320356 kB<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">Openssl verison : OpenSSL 1.0.2k-fips 26 Jan 2017<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">Regards,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">Mahesh.B<u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div>