<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">I noticed a similar behaviour, long startup times if you use multi-megabyte CRL files (like the system default one).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">One simple workaround is to use a smaller CRL file that just includes the necessary Cas.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">But the code could be probably also improved, maybe it is possible to parallelize it. You can open a feature request about it, or even better, a pull request.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">-- <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning Westerholt –
</span><span style="mso-fareast-language:EN-US"><a href="https://skalatan.de/blog/"><span lang="EN-GB" style="color:#0563C1">https://skalatan.de/blog/</span></a></span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Kamailio services –
</span><span style="mso-fareast-language:EN-US"><a href="https://gilawa.com/"><span lang="EN-GB" style="color:#0563C1">https://gilawa.com</span></a></span><span style="mso-fareast-language:EN-US">
<span lang="EN-GB"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> sr-users <sr-users-bounces@lists.kamailio.org>
<b>On Behalf Of </b>mahesh b<br>
<b>Sent:</b> Sunday, May 3, 2020 4:30 AM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org><br>
<b>Subject:</b> [SR-Users] load_crl takes 90 seconds to complete it execution with crl file size of 4MB !!!<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hi All,<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Am using Kamailio 5.1.9 version, In my tls.cfg i have one client and server profile,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">along with default client and server profile.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I have crl enabled for the non default client and server profile , the crl file size is 4 MB in my case.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I have 22 child tcp process.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">With this what i observe is load_crl is taking close to 90 seconds to finish its execution and return.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">It is very clear from the code, its because of this for loop.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> procs_no=get_max_procs();<br>
for(i = 0; i < procs_no; i++) {<br>
if (SSL_CTX_load_verify_locations(d->ctx[i], d->crl_file.s, 0) != 1) {<br>
ERR("%s: Unable to load certificate revocation list '%s'\n",<br>
tls_domain_str(d), d->crl_file.s);<br>
TLS_ERR("load_crl:");<br>
return -1;<br>
}<br>
store = SSL_CTX_get_cert_store(d->ctx[i]);<br>
X509_STORE_set_flags(store,<br>
X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);<br>
}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Is there a way this can be enhanced or as per the current kamailio design this is a must to do for each and every profile and the child process array list.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Please suggest, is it justifiable for load_crl to take 90 seconds , to complete its execution, with one client and server profile and 22 child tcp process and crl file size of 4MB.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">More info of my setup:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">-----------------------------<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Kamailio 5.1.9 version is running on the below <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt">Linux Kernel version : 3.10.0-693.el7.x86_64<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
Centos version : CentOS Linux release 7.4.1708 (Core)<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
CPU : 2 cores with model name : Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
[root@miv5000 ~]# cat /proc/meminfo<br>
MemTotal: 3882076 kB<br>
MemFree: 811244 kB<br>
MemAvailable: 2320356 kB<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt">Openssl verison : OpenSSL 1.0.2k-fips 26 Jan 2017<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt">Regards,<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:35.4pt">Mahesh.B<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>