sr-dev January 2024

sr-dev@lists.kamailio.org

19 participants
304 discussions

git:master:689de273: outbound: OpenSSL 1.1.1 thread-local, init libssl in thread

by S-P Chan

Module: kamailio Branch: master Commit: 689de2736f5c92f11860e5854ccd95c84239f032 URL: https://github.com/kamailio/kamailio/commit/689de2736f5c92f11860e5854ccd95c… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-01-04T21:47:23+08:00 outbound: OpenSSL 1.1.1 thread-local, init libssl in thread --- Modified: src/modules/outbound/outbound_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/689de2736f5c92f11860e5854ccd95c… Patch: https://github.com/kamailio/kamailio/commit/689de2736f5c92f11860e5854ccd95c… --- diff --git a/src/modules/outbound/outbound_mod.c b/src/modules/outbound/outbound_mod.c index 00c0a66f73b..a797eb8132e 100644 --- a/src/modules/outbound/outbound_mod.c +++ b/src/modules/outbound/outbound_mod.c @@ -110,7 +110,7 @@ static int mod_init(void) } ob_key.len = OB_KEY_LEN; -#if OPENSSL_VERSION_NUMBER < 0x030000000L +#if OPENSSL_VERSION_NUMBER < 0x010101000L mod_init_openssl(NULL); #else pthread_t tid;

4 months, 2 weeks

[kamailio/kamailio] WIP: RFC OpenSSL 3 fixes (PR #3696)

by space88man

#### Pre-Submission Checklist - [X] Commit message has the format required by CONTRIBUTING guide - [X ] Commits are split per component (core, individual modules, libs, utils, ...) - [X] Each component has a single commit (if not, squash them into one commit) - [X] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [X] Breaking change (fix or feature that would change existing functionality) #### Checklist:  - [ ] PR should be backported to stable branches - [x] Tested changes locally - [X] Related to issue #3695 , #3635 #### Description - changes to avoid setting `ERR_STATE *` in rank 0 main thread - all config is done in a transient worker thread - `tls_fix_domains_cfg()` is performed in `PROC_SIPINIT` instead of `PROC_INIT` (could also be done in worker thread) - changes to a module `outbound.so`: OpenSSL config is done in a transient worker thread You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/3696 -- Commit Summary -- * tls: POC for OpenSSL 3 * outbound: OpenSSL 3 POC * tls: skip OPENSSL_init_ssl -- File Changes -- M src/modules/outbound/outbound_mod.c (38) M src/modules/tls/tls_init.c (89) M src/modules/tls/tls_mod.c (6) -- Patch Links -- https://github.com/kamailio/kamailio/pull/3696.patch https://github.com/kamailio/kamailio/pull/3696.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/3696 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/3696(a)github.com>

4 months, 2 weeks

git:master:4742c813: outbound: OpenSSL 3.x thread-local, init libssl in thread

by S-P Chan

Module: kamailio Branch: master Commit: 4742c8131aba878c4fc954e42b656b9d4bafdd24 URL: https://github.com/kamailio/kamailio/commit/4742c8131aba878c4fc954e42b656b9… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-01-04T20:28:41+08:00 outbound: OpenSSL 3.x thread-local, init libssl in thread --- Modified: src/modules/outbound/outbound_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/4742c8131aba878c4fc954e42b656b9… Patch: https://github.com/kamailio/kamailio/commit/4742c8131aba878c4fc954e42b656b9… --- diff --git a/src/modules/outbound/outbound_mod.c b/src/modules/outbound/outbound_mod.c index 4e408e22356..00c0a66f73b 100644 --- a/src/modules/outbound/outbound_mod.c +++ b/src/modules/outbound/outbound_mod.c @@ -75,6 +75,23 @@ struct module_exports exports = { destroy /* destroy function */ }; +static void *mod_init_openssl(void *) { + if(flow_token_secret.s) { + assert(ob_key.len == SHA_DIGEST_LENGTH); + LM_DBG("flow_token_secret mod param set. use persistent ob_key"); + SHA1((const unsigned char *)flow_token_secret.s, flow_token_secret.len, + (unsigned char *)ob_key.s); + } else { + if(RAND_bytes((unsigned char *)ob_key.s, ob_key.len) == 0) { + LM_ERR("unable to get %d cryptographically strong pseudo-" + "random bytes\n", + ob_key.len); + } + } + + return NULL; +} + static int mod_init(void) { if(ob_force_flag != -1 && !flag_in_range(ob_force_flag)) { @@ -93,18 +110,14 @@ static int mod_init(void) } ob_key.len = OB_KEY_LEN; - if(flow_token_secret.s) { - assert(ob_key.len == SHA_DIGEST_LENGTH); - LM_DBG("flow_token_secret mod param set. use persistent ob_key"); - SHA1((const unsigned char *)flow_token_secret.s, flow_token_secret.len, - (unsigned char *)ob_key.s); - } else { - if(RAND_bytes((unsigned char *)ob_key.s, ob_key.len) == 0) { - LM_ERR("unable to get %d cryptographically strong pseudo-" - "random bytes\n", - ob_key.len); - } - } +#if OPENSSL_VERSION_NUMBER < 0x030000000L + mod_init_openssl(NULL); +#else + pthread_t tid; + void *retval; + pthread_create(&tid, NULL, mod_init_openssl, NULL); + pthread_join(tid, &retval); +#endif if(cfg_declare("outbound", outbound_cfg_def, &default_outbound_cfg, cfg_sizeof(outbound), &outbound_cfg)) {

4 months, 2 weeks

git:master:e49a60e1: tls: OpenSSL 3.x thread-local, init libssl in thread or PROC_SIPINIT

by S-P Chan

Module: kamailio Branch: master Commit: e49a60e1052c6c1dcebe7f78f2ac970338eabe2e URL: https://github.com/kamailio/kamailio/commit/e49a60e1052c6c1dcebe7f78f2ac970… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-01-04T20:28:41+08:00 tls: OpenSSL 3.x thread-local, init libssl in thread or PROC_SIPINIT - avoid initialising ERR_STATE in rank 0(thread#1) --- Modified: src/modules/tls/tls_init.c Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/e49a60e1052c6c1dcebe7f78f2ac970… Patch: https://github.com/kamailio/kamailio/commit/e49a60e1052c6c1dcebe7f78f2ac970… --- diff --git a/src/modules/tls/tls_init.c b/src/modules/tls/tls_init.c index 9be5e1d4fab..ec62cf7669e 100644 --- a/src/modules/tls/tls_init.c +++ b/src/modules/tls/tls_init.c @@ -771,6 +771,44 @@ int tls_pre_init(void) * tls mod pre-init function * - executed before any mod_init() */ +long tls_h_mod_randctx(void *) { + do { + OSSL_LIB_CTX *osslglobal = NULL; + EVP_RAND_CTX *randctx = NULL; + + LM_DBG("enabling locking for rand ctx\n"); + + osslglobal = OSSL_LIB_CTX_get0_global_default(); + if(osslglobal == NULL) { + LM_ERR("failed to get lib ssl global ctx\n"); + return -1L; + } + + randctx = RAND_get0_primary(osslglobal); + if(randctx == NULL) { + LM_ERR("primary rand ctx is null\n"); + return -1L; + } + EVP_RAND_enable_locking(randctx); + + randctx = RAND_get0_public(osslglobal); + if(randctx == NULL) { + LM_ERR("public rand ctx is null\n"); + return -1L; + } + EVP_RAND_enable_locking(randctx); + + randctx = RAND_get0_private(osslglobal); + if(randctx == NULL) { + LM_ERR("private rand ctx is null\n"); + return -1L; + } + EVP_RAND_enable_locking(randctx); + } while(0); + + return 0L; +} + int tls_h_mod_pre_init_f(void) { if(tls_mod_preinitialized == 1) { @@ -784,7 +822,9 @@ int tls_h_mod_pre_init_f(void) LM_DBG("preparing tls env for modules initialization\n"); #if OPENSSL_VERSION_NUMBER >= 0x010100000L && !defined(LIBRESSL_VERSION_NUMBER) LM_DBG("preparing tls env for modules initialization (libssl >=1.1)\n"); -#if OPENSSL_VERSION_NUMBER >= 0x010101000L +#if OPENSSL_VERSION_NUMBER >= 0x030000000L + // skip init for 3.x +#elif OPENSSL_VERSION_NUMBER >= 0x010101000L OPENSSL_init_ssl(OPENSSL_INIT_ATFORK, NULL); #else OPENSSL_init_ssl(0, NULL); @@ -793,42 +833,17 @@ int tls_h_mod_pre_init_f(void) LM_DBG("preparing tls env for modules initialization (libssl <=1.0)\n"); SSL_library_init(); #endif +#if OPENSSL_VERSION_NUMBER < 0x030000000L SSL_load_error_strings(); +#endif #if OPENSSL_VERSION_NUMBER >= 0x030000000L - do { - OSSL_LIB_CTX *osslglobal = NULL; - EVP_RAND_CTX *randctx = NULL; - - LM_DBG("enabling locking for rand ctx\n"); - - osslglobal = OSSL_LIB_CTX_get0_global_default(); - if(osslglobal == NULL) { - LM_ERR("failed to get lib ssl global ctx\n"); - return -1; - } - - randctx = RAND_get0_primary(osslglobal); - if(randctx == NULL) { - LM_ERR("primary rand ctx is null\n"); - return -1; - } - EVP_RAND_enable_locking(randctx); - - randctx = RAND_get0_public(osslglobal); - if(randctx == NULL) { - LM_ERR("public rand ctx is null\n"); - return -1; - } - EVP_RAND_enable_locking(randctx); - - randctx = RAND_get0_private(osslglobal); - if(randctx == NULL) { - LM_ERR("private rand ctx is null\n"); - return -1; - } - EVP_RAND_enable_locking(randctx); - } while(0); + pthread_t tid; + long rl; + pthread_create(&tid, NULL, (void *(*)(void *))tls_h_mod_randctx, NULL); + pthread_join(tid, (void **)&rl); + if ((int)rl) + return (int)rl; #endif tls_mod_preinitialized = 1; diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index 3a047769ca4..1e74ba0e309 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -440,7 +440,16 @@ static int mod_child(int rank) /* fix tls config only from the main proc/PROC_INIT., when we know * the exact process number and before any other process starts*/ - if(rank == PROC_INIT) { + +#if OPENSSL_VERSION_NUMBER >= 0x030000000L + /* + * OpenSSL 3.x: create shared SSL_CTX* in worker to avoid init of + * libssl in rank 0(thread#1) + */ + if(rank == PROC_SIPINIT) { +#else + if(rank == PROC_INIT) { +#endif if(cfg_get(tls, tls_cfg, config_file).s) { if(tls_fix_domains_cfg( *tls_domains_cfg, &srv_defaults, &cli_defaults)

4 months, 2 weeks

git:master:aef9cec3: core: avoid C99 error

by Morten Tryfoss

Module: kamailio Branch: master Commit: aef9cec329893f58b0c7df5aec2050b6c3cecc60 URL: https://github.com/kamailio/kamailio/commit/aef9cec329893f58b0c7df5aec2050b… Author: Morten Tryfoss <morten(a)tryfoss.no> Committer: Morten Tryfoss <morten(a)tryfoss.no> Date: 2024-01-04T13:26:26+01:00 core: avoid C99 error --- Modified: src/core/parser/parse_diversion.c --- Diff: https://github.com/kamailio/kamailio/commit/aef9cec329893f58b0c7df5aec2050b… Patch: https://github.com/kamailio/kamailio/commit/aef9cec329893f58b0c7df5aec2050b… --- diff --git a/src/core/parser/parse_diversion.c b/src/core/parser/parse_diversion.c index d60d0cbdd1f..92690296935 100644 --- a/src/core/parser/parse_diversion.c +++ b/src/core/parser/parse_diversion.c @@ -210,7 +210,8 @@ int parse_diversion_header(struct sip_msg *msg) int free_diversion_body(diversion_body_t *div_b) { - for(int i = 0; i < div_b->num_ids; i++) { + int i = 0; + for(i = 0; i < div_b->num_ids; i++) { /* Free to_body pointer parameters */ if(div_b->id[i].param_lst) { free_to_params(&(div_b->id[i]));

4 months, 2 weeks

git:master:f67bfe4a: rtpengine: clang-format file and skip-wrap of exported structures

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: f67bfe4a183b2b629d3ac741ecb95bcc4b669b37 URL: https://github.com/kamailio/kamailio/commit/f67bfe4a183b2b629d3ac741ecb95bc… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-01-04T12:52:50+01:00 rtpengine: clang-format file and skip-wrap of exported structures --- Modified: src/modules/rtpengine/rtpengine.c --- Diff: https://github.com/kamailio/kamailio/commit/f67bfe4a183b2b629d3ac741ecb95bc… Patch: https://github.com/kamailio/kamailio/commit/f67bfe4a183b2b629d3ac741ecb95bc…

4 months, 2 weeks

git:master:aab734e7: rtpengine: unsigned error field of 1-bit to prevent signness warnings

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: aab734e7a31a9df2dc731e849005ce6bb00d534e URL: https://github.com/kamailio/kamailio/commit/aab734e7a31a9df2dc731e849005ce6… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-01-04T12:46:23+01:00 rtpengine: unsigned error field of 1-bit to prevent signness warnings --- Modified: src/modules/rtpengine/bencode.h --- Diff: https://github.com/kamailio/kamailio/commit/aab734e7a31a9df2dc731e849005ce6… Patch: https://github.com/kamailio/kamailio/commit/aab734e7a31a9df2dc731e849005ce6… --- diff --git a/src/modules/rtpengine/bencode.h b/src/modules/rtpengine/bencode.h index 8f3b434e7ac..1a3562d9d49 100644 --- a/src/modules/rtpengine/bencode.h +++ b/src/modules/rtpengine/bencode.h @@ -47,7 +47,7 @@ struct bencode_buffer { struct __bencode_buffer_piece *pieces; struct __bencode_free_list *free_list; - int error : 1; /* set to !0 if allocation failed at any point */ + unsigned int error : 1; /* set to !0 if allocation failed at any point */ };

4 months, 2 weeks

git:master:ad136593: kamctl: dbtextdb/dbtextdb_test - do not store unused result of query

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: ad1365935e2f021095e6e14aca03da54d3862d5b URL: https://github.com/kamailio/kamailio/commit/ad1365935e2f021095e6e14aca03da5… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-01-04T12:20:56+01:00 kamctl: dbtextdb/dbtextdb_test - do not store unused result of query --- Modified: utils/kamctl/dbtextdb/dbtextdb_test.py --- Diff: https://github.com/kamailio/kamailio/commit/ad1365935e2f021095e6e14aca03da5… Patch: https://github.com/kamailio/kamailio/commit/ad1365935e2f021095e6e14aca03da5… --- diff --git a/utils/kamctl/dbtextdb/dbtextdb_test.py b/utils/kamctl/dbtextdb/dbtextdb_test.py index 54ce274c725..8762de1b3da 100644 --- a/utils/kamctl/dbtextdb/dbtextdb_test.py +++ b/utils/kamctl/dbtextdb/dbtextdb_test.py @@ -500,7 +500,7 @@ def testExecute(self): db_conn.CleanUp() query = ('delete from unsorted_table where id = 5;') - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'id': 1, 'user': 'fred', 'domain': 'test.com', 'number': 2125551234}, {'id': 4, 'user': 'alex', 'domain': @@ -514,7 +514,7 @@ def testExecute(self): # test insert with auto increment query = ("insert into unsorted_table set user='jake', domain='test.com'," 'number = 2125551456;') - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'id': 1, 'user': 'fred', 'domain': 'test.com', 'number': 2125551234}, {'id': 4, 'user': 'alex', 'domain': @@ -531,7 +531,7 @@ def testExecute(self): # test insert with null value query = ("insert into test set col1='asdf';") - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'col2': 'item2', 'id': 1, 'col1': 'item1\\:'}, {'col2': '', 'id': 2, 'col1': @@ -543,7 +543,7 @@ def testExecute(self): # test insert with null value alternate syntax query = ("insert test ( col1) values ('asdf');") - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'col2': 'item2', 'id': 1, 'col1': 'item1\\:'}, {'col2': '', 'id': 2, 'col1': @@ -555,7 +555,7 @@ def testExecute(self): # test insert with colon inside value query = ("insert into test set col1='as:df';") - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'col2': 'item2', 'id': 1, 'col1': 'item1\\:'}, {'col2': '', 'id': 2, 'col1': @@ -567,7 +567,7 @@ def testExecute(self): # test insert with escaped colon inside value query = ("insert into test set col1='as\:df';") - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'col2': 'item2', 'id': 1, 'col1': 'item1\\:'}, {'col2': '', 'id': 2, 'col1': @@ -589,7 +589,7 @@ def testExecute(self): # test update with null value query = ("update test set col2='' where id = 3;") - result = db_conn.Execute(query, writethru) + db_conn.Execute(query, writethru) self.assertEqual(db_conn.data, [{'col2': 'item2', 'id': 1, 'col1': 'item1\\:'}, {'col2': '', 'id': 2, 'col1':

4 months, 2 weeks

git:master:42b22b6e: lcr: added module prefix to db_url global variable

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: 42b22b6e2d91d907cbf80b499b9e4380def2e652 URL: https://github.com/kamailio/kamailio/commit/42b22b6e2d91d907cbf80b499b9e438… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-01-03T22:18:58+01:00 lcr: added module prefix to db_url global variable - safety for symbols overlapping --- Modified: src/modules/lcr/lcr_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/42b22b6e2d91d907cbf80b499b9e438… Patch: https://github.com/kamailio/kamailio/commit/42b22b6e2d91d907cbf80b499b9e438… --- diff --git a/src/modules/lcr/lcr_mod.c b/src/modules/lcr/lcr_mod.c index 4f0cfae70a9..242054ebaa4 100644 --- a/src/modules/lcr/lcr_mod.c +++ b/src/modules/lcr/lcr_mod.c @@ -135,7 +135,7 @@ gen_lock_t *reload_lock; /* database variables */ /* clang-format off */ -static str db_url = str_init(DEFAULT_RODB_URL); +static str lcr_db_url = str_init(DEFAULT_RODB_URL); static str lcr_rule_table = str_init(LCR_RULE_TABLE); static str lcr_rule_target_table = str_init(LCR_RULE_TARGET_TABLE); static str lcr_gw_table = str_init(LCR_GW_TABLE); @@ -313,7 +313,7 @@ static cmd_export_t cmds[] = { * Exported parameters */ static param_export_t params[] = { - {"db_url", PARAM_STR, &db_url}, + {"db_url", PARAM_STR, &lcr_db_url}, {"lcr_rule_table", PARAM_STR, &lcr_rule_table}, {"lcr_rule_target_table", PARAM_STR, &lcr_rule_target_table}, {"lcr_gw_table", PARAM_STR, &lcr_gw_table}, @@ -455,7 +455,7 @@ static int mod_init(void) } /* Bind database */ - if(lcr_db_bind(&db_url)) { + if(lcr_db_bind(&lcr_db_url)) { LM_ERR("no database module found\n"); return -1; } @@ -692,7 +692,7 @@ static int mod_init(void) } /* Check table version */ - if(lcr_db_init(&db_url) < 0) { + if(lcr_db_init(&lcr_db_url) < 0) { LM_ERR("unable to open database connection\n"); return -1; } @@ -1484,7 +1484,7 @@ int reload_tables() request_uri_re = from_uri_re = 0; - if(lcr_db_init(&db_url) < 0) { + if(lcr_db_init(&lcr_db_url) < 0) { LM_ERR("unable to open database connection\n"); return -1; }

4 months, 2 weeks

git:master:f0fbf4d7: dmq: rename global variables with short name

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: f0fbf4d74b8090614469b2a6a16f187275c4f067 URL: https://github.com/kamailio/kamailio/commit/f0fbf4d74b8090614469b2a6a16f187… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-01-03T22:14:32+01:00 dmq: rename global variables with short name - safety for symbols overlapping --- Modified: src/modules/dmq/dmq.c Modified: src/modules/dmq/dmq.h Modified: src/modules/dmq/dmq_funcs.c Modified: src/modules/dmq/message.c Modified: src/modules/dmq/worker.c --- Diff: https://github.com/kamailio/kamailio/commit/f0fbf4d74b8090614469b2a6a16f187… Patch: https://github.com/kamailio/kamailio/commit/f0fbf4d74b8090614469b2a6a16f187…

4 months, 2 weeks

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev January 2024