sr-dev February 2024

sr-dev@lists.kamailio.org

19 participants
234 discussions

[kamailio/kamailio] broken TLS ciphersuite lookup (Issue #3765)

by Michael Furmur

### Description after some nearest changes, there are problems with the TLS handshake (for at least ECDHE-RSA-AES256-GCM-SHA384) because of the missed `OPENSSL_init_ssl()` call for TCP workers #### Reproduction try to send any SIP message over TLS to the server which accepts ECDHE-RSA-AES256-GCM-SHA384 in Server Hello during handshake the simplest way to reproduce is to add microsoft teams server to the dispatcher and enable probing to send OPTIONS kamailio.cfg: ``` loadmodule "tls.so" modparam("tls", "config", "/etc/kamailio/tls.cfg") loadmodule "dispatcher.so" modparam("dispatcher","flags",2) modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list") modparam("dispatcher", "ds_ping_method","OPTIONS") modparam("dispatcher", "ds_ping_interval",5) modparam("dispatcher", "ds_probing_mode",1) ``` tls.cfg: ``` [server:default] certificate = /etc/kamailio/ssl/ssl-cert-snakeoil.pem private_key = /etc/kamailio/ssl/ssl-cert-snakeoil.key [client:default] certificate = /etc/kamailio/ssl/ssl-cert-snakeoil.pem private_key = /etc/kamailio/ssl/ssl-cert-snakeoil.key ``` dispatcher.list: ``` 1 sip:sip.pstnhub.microsoft.com;transport=tls 0 0 ``` #### Debugging Data backtrace for the cipher suite lookup: ``` (gdb) bt #0 ssl_cipher_id_cmp_BSEARCH_CMP_FN (a_=0x7ffd2a0aade0, b_=0x7fa110ceeec0 <ssl3_ciphers+11680>) at ../ssl/ssl_lib.c:4985 #1 0x00007fa110832a95 in ossl_bsearch (key=key@entry=0x7ffd2a0aade0, base=base@entry=0x7fa110cec120 <ssl3_ciphers>, num=num@entry=167, size=size@entry=80, cmp=cmp@entry=0x7fa110c7cac0 <ssl_cipher_id_cmp_BSEARCH_CMP_FN>, flags=flags@entry=0) at ../crypto/bsearch.c:28 #2 0x00007fa1108fc229 in OBJ_bsearch_ex_ (key=key@entry=0x7ffd2a0aade0, base=base@entry=0x7fa110cec120 <ssl3_ciphers>, num=num@entry=167, size=size@entry=80, cmp=cmp@entry=0x7fa110c7cac0 <ssl_cipher_id_cmp_BSEARCH_CMP_FN>, flags=flags@entry=0) at ../crypto/objects/obj_dat.c:699 #3 0x00007fa1108fc23c in OBJ_bsearch_ (key=key@entry=0x7ffd2a0aade0, base=base@entry=0x7fa110cec120 <ssl3_ciphers>, num=num@entry=167, size=size@entry=80, cmp=cmp@entry=0x7fa110c7cac0 <ssl_cipher_id_cmp_BSEARCH_CMP_FN>) at ../crypto/objects/obj_dat.c:691 #4 0x00007fa110c7fb95 in OBJ_bsearch_ssl_cipher_id (key=key@entry=0x7ffd2a0aade0, base=base@entry=0x7fa110cec120 <ssl3_ciphers>, num=num@entry=167) at ../ssl/ssl_lib.c:4985 #5 0x00007fa110c6ed4c in ssl3_get_cipher_by_id (id=<optimized out>) at ../ssl/s3_lib.c:4075 #6 0x00007fa110c76077 in ssl_get_cipher_by_char (ssl=ssl@entry=0x7fa10cfca900, ptr=ptr@entry=0x7fa10cfcc767 "\3000", all=all@entry=0) at ../ssl/ssl_ciph.c:2102 #7 0x00007fa110cae0ee in set_client_ciphersuite (s=s@entry=0x7fa10cfca900, cipherchars=cipherchars@entry=0x7fa10cfcc767 "\3000") at ../ssl/statem/statem_clnt.c:1310 #8 0x00007fa110cb03b3 in tls_process_server_hello (s=0x7fa10cfca900, pkt=<optimized out>) at ../ssl/statem/statem_clnt.c:1614 #9 0x00007fa110cace72 in read_state_machine (s=0x7fa10cfca900) at ../ssl/statem/statem.c:647 #10 state_machine (s=0x7fa10cfca900, server=0) at ../ssl/statem/statem.c:442 #11 0x00007fa110d33aaa in tls_connect (c=c@entry=0x7fa10cfc64e0, error=error@entry=0x7ffd2a0ab0e4) at ./src/modules/tls/tls_server.c:542 #12 0x00007fa110d01edd in ssl_flush (size=413, buf=0x7fa10cfdafdc, error=<synthetic pointer>, tcp_c=0x7fa10cfc64e0) at ./src/modules/tls/tls_ct_wrq.c:101 #13 sbufq_flush (flush_f=<optimized out>, flush_p2=<synthetic pointer>, flush_p1=0x7fa10cfc64e0, flags=0x7ffd2a0ab1ac, q=0x7fa10cfb43a0) at ./src/modules/tls/sbufq.h:247 #14 tls_ct_q_flush (flush_p2=<synthetic pointer>, flush_p1=0x7fa10cfc64e0, flush_f=<optimized out>, flags=0x7ffd2a0ab1ac, tc_q=0x18) at ./src/modules/tls/tls_ct_q.h:122 #15 tls_ct_wq_flush (c=c@entry=0x7fa10cfc64e0, ct_q=ct_q@entry=0x7fa10cfb34c0, flags=flags@entry=0x7ffd2a0ab1ac, ssl_err=ssl_err@entry=0x7ffd2a0ab1a8) at ./src/modules/tls/tls_ct_wrq.c:147 #16 0x00007fa110d386f4 in tls_h_read_f (c=0x7fa10cfc64e0, flags=0x7ffd2a0cb5d0) at ./src/modules/tls/tls_server.c:1140 #17 0x0000562ad6b0c46e in tcp_read_headers (c=c@entry=0x7fa10cfc64e0, read_flags=read_flags@entry=0x7ffd2a0cb5d0) at core/tcp_read.c:445 #18 0x0000562ad6b0f543 in tcp_read_req (con=0x7fa10cfc64e0, bytes_read=bytes_read@entry=0x7ffd2a0cb5cc, read_flags=read_flags@entry=0x7ffd2a0cb5d0) at core/tcp_read.c:1508 #19 0x0000562ad6b14879 in handle_io (fm=fm@entry=0x7fa110ed31c8, events=events@entry=1, idx=idx@entry=-1) at core/tcp_read.c:1832 #20 0x0000562ad6b1a7fd in io_wait_loop_epoll (repeat=repeat@entry=0, t=2, h=0x562ad6de8c20 <io_w>) at core/io_wait.h:1073 #21 0x0000562ad6b1b017 in tcp_receive_loop (unix_sock=<optimized out>) at core/tcp_read.c:2032 #22 0x0000562ad6b02df5 in tcp_init_children (woneinit=woneinit@entry=0x7ffd2a0cbb0c) at core/tcp_main.c:5364 #23 0x0000562ad6928b60 in main_loop () at ./src/main.c:1936 #24 0x0000562ad691a463 in main (argc=<optimized out>, argv=<optimized out>) at ./src/main.c:3212 ``` part of the `ssl3_ciphers` array that should be sorted by id ascending: ``` }, { valid = 1, name = 0x7fa110cc3720 "ECDHE-RSA-AES256-GCM-SHA384", stdname = 0x7fa110cc89f8 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", id = 50380848, ... }, { valid = 1, name = 0x7fa110cc3770 "PSK-NULL-SHA", stdname = 0x7fa110cc373c "TLS_PSK_WITH_NULL_SHA", id = 50331692, ... ``` * `ossl_bsearch` assumes that it works with sorted `ssl3_ciphers` * `ssl3_ciphers` sorting performed by `OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS * settings)` -> `ossl_init_ssl_base()` -> `ssl_sort_cipher_list()` -> `qsort(ssl3_ciphers...` #### Log Messages ``` ERROR: tls [tls_util.h:49]: tls_err_ret(): TLS write:error:0A0000F8:SSL routines::unknown cipher returned (sni: unknown) ``` ### Possible Solutions * ensure `OPENSSL_init_ssl()` to be called (directly or using OPENSSL_INIT_ATFORK) for TCP workers * fixed by `OPENSSL_init_ssl(0, NULL);` call in `tls_init.c:int tls_h_mod_init_f(void)` but it's hardly the fully correct solution ### Additional Information * **Kamailio Version** - output of `kamailio -v` ``` # kamailio -v version: kamailio 5.7.4 (x86_64/linux) flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB poll method support: poll, epoll_lt, epoll_et, sigio_rt, select. id: unknown compiled with gcc 13.2.0 ``` ``` # apt list kamailio --installed Listing... Done kamailio/testing,now 5.7.4-1 amd64 [installed] ``` * **Operating System**: Debian GNU/Linux trixie/sid (reproduced on Debian bookworm either) -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3765 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/3765(a)github.com>

3 months, 1 week

git:5.7:88e1dce9: tls: fix restore early init

by S-P Chan

Module: kamailio Branch: 5.7 Commit: 88e1dce91b2db99bf24a01e910dc5f2d78e62e1a URL: https://github.com/kamailio/kamailio/commit/88e1dce91b2db99bf24a01e910dc5f2… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-25T12:59:22+08:00 tls: fix restore early init Cherry-pick from a02ca644e8 --- Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/88e1dce91b2db99bf24a01e910dc5f2… Patch: https://github.com/kamailio/kamailio/commit/88e1dce91b2db99bf24a01e910dc5f2… --- diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index 6058592aa01..664e35f7c33 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -468,19 +468,13 @@ static int mod_child(int rank) if(tls_disable || (tls_domains_cfg == 0)) return 0; -#if OPENSSL_VERSION_NUMBER >= 0x010101000L /* * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in thread executor - * to avoid init of libssl in thread#1 + * to avoid init of libssl in thread#1: ksr_tls_threads_mode = 1 */ - if(rank == PROC_INIT && ksr_tls_threads_mode != 0) { - return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); - } -#else if(rank == PROC_INIT) { - return mod_child_hook(&rank, NULL); + return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); } -#endif /* OPENSSL_VERSION_NUMBER */ #ifndef OPENSSL_NO_ENGINE /*

3 months, 1 week

git:5.8:aa8fcf9e: tls: fix restore early init

by S-P Chan

Module: kamailio Branch: 5.8 Commit: aa8fcf9ec76e7c4543db22de6de5ef62374c80be URL: https://github.com/kamailio/kamailio/commit/aa8fcf9ec76e7c4543db22de6de5ef6… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-25T12:57:19+08:00 tls: fix restore early init --- Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/aa8fcf9ec76e7c4543db22de6de5ef6… Patch: https://github.com/kamailio/kamailio/commit/aa8fcf9ec76e7c4543db22de6de5ef6… --- diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index 463814720b8..136f0e2deb2 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -468,19 +468,13 @@ static int mod_child(int rank) if(tls_disable || (tls_domains_cfg == 0)) return 0; -#if OPENSSL_VERSION_NUMBER >= 0x010101000L /* * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in thread executor - * to avoid init of libssl in thread#1 + * to avoid init of libssl in thread#1: ksr_tls_threads_mode = 1 */ - if(rank == PROC_INIT && ksr_tls_threads_mode != 0) { - return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); - } -#else if(rank == PROC_INIT) { - return mod_child_hook(&rank, NULL); + return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); } -#endif /* OPENSSL_VERSION_NUMBER */ #ifndef OPENSSL_NO_ENGINE /*

3 months, 1 week

git:master:a02ca644: tls: fix restore early init

by S-P Chan

Module: kamailio Branch: master Commit: a02ca644e889d011dd63acbabfc5550904ff7d4d URL: https://github.com/kamailio/kamailio/commit/a02ca644e889d011dd63acbabfc5550… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-25T12:56:19+08:00 tls: fix restore early init --- Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/a02ca644e889d011dd63acbabfc5550… Patch: https://github.com/kamailio/kamailio/commit/a02ca644e889d011dd63acbabfc5550… --- diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index 463814720b8..136f0e2deb2 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -468,19 +468,13 @@ static int mod_child(int rank) if(tls_disable || (tls_domains_cfg == 0)) return 0; -#if OPENSSL_VERSION_NUMBER >= 0x010101000L /* * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in thread executor - * to avoid init of libssl in thread#1 + * to avoid init of libssl in thread#1: ksr_tls_threads_mode = 1 */ - if(rank == PROC_INIT && ksr_tls_threads_mode != 0) { - return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); - } -#else if(rank == PROC_INIT) { - return mod_child_hook(&rank, NULL); + return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); } -#endif /* OPENSSL_VERSION_NUMBER */ #ifndef OPENSSL_NO_ENGINE /*

3 months, 1 week

git:5.7:73b19da1: tls: restore early init for other modules that use TLS

by S-P Chan

Module: kamailio Branch: 5.7 Commit: 73b19da1e0dd512f9eb77ca0606092c545e8fb99 URL: https://github.com/kamailio/kamailio/commit/73b19da1e0dd512f9eb77ca0606092c… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-25T11:04:27+08:00 tls: restore early init for other modules that use TLS Client modules (e.g. dispatcher) that require outbound TLS may race if tls init is too late. Restore tls init to PROC_INIT with a thread executor. Addresses GH #3765 Cherry-pick from 706d7b7ff3 --- Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/73b19da1e0dd512f9eb77ca0606092c… Patch: https://github.com/kamailio/kamailio/commit/73b19da1e0dd512f9eb77ca0606092c… --- diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index 0d8ea3df4c5..6058592aa01 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -42,6 +42,10 @@ #include "../../core/dprint.h" #include "../../core/mod_fix.h" #include "../../core/kemi.h" + +#define KSR_RTHREAD_SKIP_P +#define KSR_RTHREAD_NEED_4PP +#include "../../core/rthreads.h" #include "tls_init.h" #include "tls_server.h" #include "tls_domain.h" @@ -443,6 +447,22 @@ int tls_fix_engine_keys(tls_domains_cfg_t *, tls_domain_t *, tls_domain_t *); * * EC operations do not use pthread_self(), so could use shared SSL_CTX */ +static int mod_child_hook(int *rank, void *dummy) +{ + LM_DBG("Loading SSL_CTX in process_no=%d rank=%d " + "ksr_tls_threads_mode=%d\n", + process_no, *rank, ksr_tls_threads_mode); + if(cfg_get(tls, tls_cfg, config_file).s) { + if(tls_fix_domains_cfg(*tls_domains_cfg, &srv_defaults, &cli_defaults) + < 0) + return -1; + } else { + if(tls_fix_domains_cfg(*tls_domains_cfg, &mod_params, &mod_params) < 0) + return -1; + } + return 0; +} + static int mod_child(int rank) { if(tls_disable || (tls_domains_cfg == 0)) @@ -450,29 +470,17 @@ static int mod_child(int rank) #if OPENSSL_VERSION_NUMBER >= 0x010101000L /* - * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in worker to avoid init of - * libssl in rank 0(thread#1). Requires tls_threads_mode = 1 config. - */ - if((rank == PROC_SIPINIT && ksr_tls_threads_mode) - || (rank == PROC_INIT && !ksr_tls_threads_mode)) { + * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in thread executor + * to avoid init of libssl in thread#1 + */ + if(rank == PROC_INIT && ksr_tls_threads_mode != 0) { + return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); + } #else if(rank == PROC_INIT) { -#endif - LM_DBG("Loading SSL_CTX in process_no=%d rank=%d " - "ksr_tls_threads_mode=%d\n", - process_no, rank, ksr_tls_threads_mode); - if(cfg_get(tls, tls_cfg, config_file).s) { - if(tls_fix_domains_cfg( - *tls_domains_cfg, &srv_defaults, &cli_defaults) - < 0) - return -1; - } else { - if(tls_fix_domains_cfg(*tls_domains_cfg, &mod_params, &mod_params) - < 0) - return -1; - } - return 0; + return mod_child_hook(&rank, NULL); } +#endif /* OPENSSL_VERSION_NUMBER */ #ifndef OPENSSL_NO_ENGINE /*

3 months, 1 week

git:5.8:49a9d8a4: tls: restore early init for other modules that use TLS

by S-P Chan

Module: kamailio Branch: 5.8 Commit: 49a9d8a4fb2f8a03d478aed2a405f812d2c2c5e8 URL: https://github.com/kamailio/kamailio/commit/49a9d8a4fb2f8a03d478aed2a405f81… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-25T10:58:33+08:00 tls: restore early init for other modules that use TLS Client modules (e.g. dispatcher) that require outbound TLS may race if tls init is too late. Restore tls init to PROC_INIT with a thread executor. Addresses GH #3765 Cherry-pick from 706d7b7ff3 --- Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/49a9d8a4fb2f8a03d478aed2a405f81… Patch: https://github.com/kamailio/kamailio/commit/49a9d8a4fb2f8a03d478aed2a405f81… --- diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index beaf1b7b70b..463814720b8 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -42,6 +42,10 @@ #include "../../core/dprint.h" #include "../../core/mod_fix.h" #include "../../core/kemi.h" + +#define KSR_RTHREAD_SKIP_P +#define KSR_RTHREAD_NEED_4PP +#include "../../core/rthreads.h" #include "tls_init.h" #include "tls_server.h" #include "tls_domain.h" @@ -443,32 +447,40 @@ int tls_fix_engine_keys(tls_domains_cfg_t *, tls_domain_t *, tls_domain_t *); * * EC operations do not use pthread_self(), so could use shared SSL_CTX */ +static int mod_child_hook(int *rank, void *dummy) +{ + LM_DBG("Loading SSL_CTX in process_no=%d rank=%d " + "ksr_tls_threads_mode=%d\n", + process_no, *rank, ksr_tls_threads_mode); + if(cfg_get(tls, tls_cfg, config_file).s) { + if(tls_fix_domains_cfg(*tls_domains_cfg, &srv_defaults, &cli_defaults) + < 0) + return -1; + } else { + if(tls_fix_domains_cfg(*tls_domains_cfg, &mod_params, &mod_params) < 0) + return -1; + } + return 0; +} + static int mod_child(int rank) { if(tls_disable || (tls_domains_cfg == 0)) return 0; #if OPENSSL_VERSION_NUMBER >= 0x010101000L - /* - * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in worker to avoid init of - * libssl in rank 0(thread#1) + /* + * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in thread executor + * to avoid init of libssl in thread#1 */ - if(rank == PROC_SIPINIT) { + if(rank == PROC_INIT && ksr_tls_threads_mode != 0) { + return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); + } #else - if(rank == PROC_INIT) { -#endif - if(cfg_get(tls, tls_cfg, config_file).s) { - if(tls_fix_domains_cfg( - *tls_domains_cfg, &srv_defaults, &cli_defaults) - < 0) - return -1; - } else { - if(tls_fix_domains_cfg(*tls_domains_cfg, &mod_params, &mod_params) - < 0) - return -1; - } - return 0; + if(rank == PROC_INIT) { + return mod_child_hook(&rank, NULL); } +#endif /* OPENSSL_VERSION_NUMBER */ #ifndef OPENSSL_NO_ENGINE /* @@ -678,7 +690,7 @@ int mod_register(char *path, int *dlflags, void *p1, void *p2) register_tls_hooks(&tls_h); - /* + /* * GH #3695: OpenSSL 1.1.1 historical note: it is no longer * needed to replace RAND with cryptorand */

3 months, 1 week

git:master:706d7b7f: tls: restore early init for other modules that use TLS

by S-P Chan

Module: kamailio Branch: master Commit: 706d7b7ff3bc2723614de328611c2100d19bf742 URL: https://github.com/kamailio/kamailio/commit/706d7b7ff3bc2723614de328611c210… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-25T10:41:18+08:00 tls: restore early init for other modules that use TLS Client modules (e.g. dispatcher) that require outbound TLS may race if tls init is too late. Restore tls init to PROC_INIT with a thread executor. Addresses GH #3765 --- Modified: src/modules/tls/tls_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/706d7b7ff3bc2723614de328611c210… Patch: https://github.com/kamailio/kamailio/commit/706d7b7ff3bc2723614de328611c210… --- diff --git a/src/modules/tls/tls_mod.c b/src/modules/tls/tls_mod.c index beaf1b7b70b..463814720b8 100644 --- a/src/modules/tls/tls_mod.c +++ b/src/modules/tls/tls_mod.c @@ -42,6 +42,10 @@ #include "../../core/dprint.h" #include "../../core/mod_fix.h" #include "../../core/kemi.h" + +#define KSR_RTHREAD_SKIP_P +#define KSR_RTHREAD_NEED_4PP +#include "../../core/rthreads.h" #include "tls_init.h" #include "tls_server.h" #include "tls_domain.h" @@ -443,32 +447,40 @@ int tls_fix_engine_keys(tls_domains_cfg_t *, tls_domain_t *, tls_domain_t *); * * EC operations do not use pthread_self(), so could use shared SSL_CTX */ +static int mod_child_hook(int *rank, void *dummy) +{ + LM_DBG("Loading SSL_CTX in process_no=%d rank=%d " + "ksr_tls_threads_mode=%d\n", + process_no, *rank, ksr_tls_threads_mode); + if(cfg_get(tls, tls_cfg, config_file).s) { + if(tls_fix_domains_cfg(*tls_domains_cfg, &srv_defaults, &cli_defaults) + < 0) + return -1; + } else { + if(tls_fix_domains_cfg(*tls_domains_cfg, &mod_params, &mod_params) < 0) + return -1; + } + return 0; +} + static int mod_child(int rank) { if(tls_disable || (tls_domains_cfg == 0)) return 0; #if OPENSSL_VERSION_NUMBER >= 0x010101000L - /* - * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in worker to avoid init of - * libssl in rank 0(thread#1) + /* + * OpenSSL 3.x/1.1.1: create shared SSL_CTX* in thread executor + * to avoid init of libssl in thread#1 */ - if(rank == PROC_SIPINIT) { + if(rank == PROC_INIT && ksr_tls_threads_mode != 0) { + return run_thread4PP((_thread_proto4PP)mod_child_hook, &rank, NULL); + } #else - if(rank == PROC_INIT) { -#endif - if(cfg_get(tls, tls_cfg, config_file).s) { - if(tls_fix_domains_cfg( - *tls_domains_cfg, &srv_defaults, &cli_defaults) - < 0) - return -1; - } else { - if(tls_fix_domains_cfg(*tls_domains_cfg, &mod_params, &mod_params) - < 0) - return -1; - } - return 0; + if(rank == PROC_INIT) { + return mod_child_hook(&rank, NULL); } +#endif /* OPENSSL_VERSION_NUMBER */ #ifndef OPENSSL_NO_ENGINE /* @@ -678,7 +690,7 @@ int mod_register(char *path, int *dlflags, void *p1, void *p2) register_tls_hooks(&tls_h); - /* + /* * GH #3695: OpenSSL 1.1.1 historical note: it is no longer * needed to replace RAND with cryptorand */

3 months, 1 week

git:5.7:46c0db15: db_mysql: libssl thread guard for db_mysql_query (and libmysqlclient)

by S-P Chan

Module: kamailio Branch: 5.7 Commit: 46c0db156ab12a94419324947b806176b6cc14a8 URL: https://github.com/kamailio/kamailio/commit/46c0db156ab12a94419324947b80617… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-24T23:19:04+08:00 db_mysql: libssl thread guard for db_mysql_query (and libmysqlclient) This function is observed to call SSL_read() when compiled with libmysqlclient.so.21 (but not libmariadb.so.3). Apply a thread executor just in case. Cherry-pick from 1e42364451 --- Modified: src/modules/db_mysql/km_dbase.c --- Diff: https://github.com/kamailio/kamailio/commit/46c0db156ab12a94419324947b80617… Patch: https://github.com/kamailio/kamailio/commit/46c0db156ab12a94419324947b80617… --- diff --git a/src/modules/db_mysql/km_dbase.c b/src/modules/db_mysql/km_dbase.c index 7b65c0a012c..91ace58df5b 100644 --- a/src/modules/db_mysql/km_dbase.c +++ b/src/modules/db_mysql/km_dbase.c @@ -41,6 +41,7 @@ #define KSR_RTHREAD_NEED_4PP #define KSR_RTHREAD_NEED_0P +#define KSR_RTHREAD_NEED_4P5I2P2 #include "../../core/rthreads.h" #include "../../lib/srdb1/db_query.h" #include "../../lib/srdb1/db_ut.h" @@ -348,12 +349,26 @@ int db_mysql_free_result(const db1_con_t *_h, db1_res_t *_r) * \param _r pointer to a structure representing the result * \return zero on success, negative value on failure */ + +/* + * this function observed to invoke SSL_read() under libmysqlclient.so.21 + * but not libmariadb.so.3; apply libssl guard + */ +static int db_mysql_query_impl(const db1_con_t *_h, const db_key_t *_k, + const db_op_t *_op, const db_val_t *_v, const db_key_t *_c, + const int _n, const int _nc, const db_key_t _o, db1_res_t **_r) +{ + return db_do_query(_h, _k, _op, _v, _c, _n, _nc, _o, _r, db_mysql_val2str, + db_mysql_submit_query, db_mysql_store_result); +} + int db_mysql_query(const db1_con_t *_h, const db_key_t *_k, const db_op_t *_op, const db_val_t *_v, const db_key_t *_c, const int _n, const int _nc, const db_key_t _o, db1_res_t **_r) { - return db_do_query(_h, _k, _op, _v, _c, _n, _nc, _o, _r, db_mysql_val2str, - db_mysql_submit_query, db_mysql_store_result); + return run_thread4P5I2P2((_thread_proto4P5I2P2)&db_mysql_query_impl, + (void *)_h, (void *)_k, (void *)_op, (void *)_v, (void *)_c, _n, + _nc, (void *)_o, (void *)_r); } /**

3 months, 1 week

git:5.7:2c082bd1: db_mysql: update docs for opt_ssl_ca

by S-P Chan

Module: kamailio Branch: 5.7 Commit: 2c082bd135203382855b297de736b22fbedee672 URL: https://github.com/kamailio/kamailio/commit/2c082bd135203382855b297de736b22… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-24T23:18:56+08:00 db_mysql: update docs for opt_ssl_ca Cherry-pick from eafd93f057 --- Modified: src/modules/db_mysql/doc/db_mysql_admin.xml --- Diff: https://github.com/kamailio/kamailio/commit/2c082bd135203382855b297de736b22… Patch: https://github.com/kamailio/kamailio/commit/2c082bd135203382855b297de736b22… --- diff --git a/src/modules/db_mysql/doc/db_mysql_admin.xml b/src/modules/db_mysql/doc/db_mysql_admin.xml index 51c9b5b728d..dceb8253eb7 100644 --- a/src/modules/db_mysql/doc/db_mysql_admin.xml +++ b/src/modules/db_mysql/doc/db_mysql_admin.xml @@ -211,6 +211,30 @@ modparam("db_mysql", "update_affected_found", 1) ... modparam("db_mysql", "opt_ssl_mode", 1) ... +</programlisting> + </example> + </section> + <section id="db_mysql.p.opt_ssl_ca"> + <title><varname>opt_ssl_ca</varname> (string)</title> + <para> + Configures the CA certs used to verify the MySQL server cert when + SSL is enabled. + </para> + <para> + Required when opt_ssl_mode = 4 or 5 and db_mysql is built + with libmysqlclient. + </para> + <para> + <emphasis> + Default value is NULL (NULL - not configured). + </emphasis> + </para> + <example> + <title>Set <varname>opt_ssl_ca</varname> parameter</title> + <programlisting format="linespecific"> +... +modparam("db_mysql", "opt_ssl_ca", "/etc/ssl/certs/mysql-ca.pem") +... </programlisting> </example> </section>

3 months, 1 week

git:5.7:29f848c9: db_mysql: new module param opt_ssl_ca to configure CA certs

by S-P Chan

Module: kamailio Branch: 5.7 Commit: 29f848c9a658af33b6a9693d709edf3a340c95d0 URL: https://github.com/kamailio/kamailio/commit/29f848c9a658af33b6a9693d709edf3… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: S-P Chan <shihping.chan(a)gmail.com> Date: 2024-02-24T23:18:31+08:00 db_mysql: new module param opt_ssl_ca to configure CA certs ERROR: db_mysql [km_my_con.c:200]: db_mysql_new_connection(): driver error: SSL connection error: CA certificate is required if ssl-mode is VERIFY_CA or VERIFY_IDENTITY When opt_ssl_mode = 4 | 5 libmysqlclient.so.21 requires that the trusted CAs be configured. Fixed with: mysql_options(ptr->con, MYSQL_OPT_SSL_CA, (void *)db_mysql_opt_ssl_ca) Note: libmariadb.so.3 doesn't require this setting and uses the system trust store. Cherry-pick from ea81e6cb8b --- Modified: src/modules/db_mysql/db_mysql.c Modified: src/modules/db_mysql/km_my_con.c --- Diff: https://github.com/kamailio/kamailio/commit/29f848c9a658af33b6a9693d709edf3… Patch: https://github.com/kamailio/kamailio/commit/29f848c9a658af33b6a9693d709edf3… --- diff --git a/src/modules/db_mysql/db_mysql.c b/src/modules/db_mysql/db_mysql.c index 1a698329bac..9a7aa8673b5 100644 --- a/src/modules/db_mysql/db_mysql.c +++ b/src/modules/db_mysql/db_mysql.c @@ -47,6 +47,7 @@ unsigned int my_server_timezone = unsigned long my_client_ver = 0; int db_mysql_unsigned_type = 0; int db_mysql_opt_ssl_mode = 0; +char *db_mysql_opt_ssl_ca = NULL; struct mysql_counters_h mysql_cnts_h; counter_def_t mysql_cnt_defs[] = { @@ -100,6 +101,7 @@ static param_export_t params[] = { {"insert_delayed", INT_PARAM, &db_mysql_insert_all_delayed}, {"update_affected_found", INT_PARAM, &db_mysql_update_affected_found}, {"unsigned_type", PARAM_INT, &db_mysql_unsigned_type}, + {"opt_ssl_ca", PARAM_STRING, &db_mysql_opt_ssl_ca}, {"opt_ssl_mode", PARAM_INT, &db_mysql_opt_ssl_mode}, {0, 0, 0}}; diff --git a/src/modules/db_mysql/km_my_con.c b/src/modules/db_mysql/km_my_con.c index b4c4dca33b0..226d724f1ae 100644 --- a/src/modules/db_mysql/km_my_con.c +++ b/src/modules/db_mysql/km_my_con.c @@ -41,6 +41,7 @@ #include "db_mysql.h" extern int db_mysql_opt_ssl_mode; +extern char *db_mysql_opt_ssl_ca; /*! \brief * Create a new connection structure, @@ -167,6 +168,9 @@ struct my_con *db_mysql_new_connection(const struct db_id *id) } #endif /* MYSQL_VERSION_ID */ #endif /* MARIADB_BASE_VERSION */ + if(db_mysql_opt_ssl_ca) + mysql_options( + ptr->con, MYSQL_OPT_SSL_CA, (const void *)db_mysql_opt_ssl_ca); #if MYSQL_VERSION_ID > 50012 /* set reconnect flag if enabled */

3 months, 1 week

← Newer
1
...
5
6
7
8
9
10
11
...
24
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev February 2024