#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
This patch introduces a new "time" field for JSON logging to stderr. The CEE format already includes this field, but the Kamailio-specific format doesn't. If you need timestamps in your structured logs, but don't want to use the CEE format due to its limitations, this patch'd give you the best of both worlds.
I know this comes a little out of the blue, so any feedback is welcome.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3795
-- Commit Summary --
* core: dprint - include time in stderr json log
-- File Changes --
M src/core/dprint.c (44)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3795.patchhttps://github.com/kamailio/kamailio/pull/3795.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3795
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3795(a)github.com>
Module: kamailio
Branch: master
Commit: 3c16c13acdf95924636c4d938abe13dcb3707b73
URL: https://github.com/kamailio/kamailio/commit/3c16c13acdf95924636c4d938abe13d…
Author: Kamailio Dev <kamailio.dev(a)kamailio.org>
Committer: Kamailio Dev <kamailio.dev(a)kamailio.org>
Date: 2024-04-04T13:01:21+02:00
modules: readme files regenerated - db_redis ... [skip ci]
---
Modified: src/modules/db_redis/README
Modified: src/modules/ndb_redis/README
---
Diff: https://github.com/kamailio/kamailio/commit/3c16c13acdf95924636c4d938abe13d…
Patch: https://github.com/kamailio/kamailio/commit/3c16c13acdf95924636c4d938abe13d…
---
diff --git a/src/modules/db_redis/README b/src/modules/db_redis/README
index d2baa50e72d..4cfdcaa5b4f 100644
--- a/src/modules/db_redis/README
+++ b/src/modules/db_redis/README
@@ -39,7 +39,7 @@ Joel Centelles Martin
4.3. verbosity (int)
4.4. opt_tls (int)
4.5. db_pass (string)
- 4.6. ac_path (string)
+ 4.6. ca_path (string)
5. Usage
6. Module Specific Considerations
@@ -75,7 +75,7 @@ Chapter 1. Admin Guide
4.3. verbosity (int)
4.4. opt_tls (int)
4.5. db_pass (string)
- 4.6. ac_path (string)
+ 4.6. ca_path (string)
5. Usage
6. Module Specific Considerations
@@ -203,7 +203,7 @@ allid,time_hires&cid:callid
4.3. verbosity (int)
4.4. opt_tls (int)
4.5. db_pass (string)
- 4.6. ac_path (string)
+ 4.6. ca_path (string)
4.1. schema_path (string)
@@ -247,6 +247,12 @@ modparam("db_redis", "verbosity", 0)
Controls TLS usage while connecting to a remote DB. If set to 1, TLS is
used to connect to the DB.
+ If TLS is enabled, the module will validate the Redis server
+ certificate against the ca_path. There is currently no way to connect
+ with a specified client certificate, the corresponding configuration to
+ check client certificates in the Redis server must therefore be turned
+ off.
+
Default value: 0.
Example 1.4. Enabling TLS connection
@@ -265,9 +271,10 @@ modparam("db_redis", "opt_tls", 1)
modparam("db_redis", "db_pass", "r3d1sPass")
...
-4.6. ac_path (string)
+4.6. ca_path (string)
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the Redis server
+ certificate are stored.
Default value: "" (empty).
diff --git a/src/modules/ndb_redis/README b/src/modules/ndb_redis/README
index 1cdfc842db3..90071f5e3f0 100644
--- a/src/modules/ndb_redis/README
+++ b/src/modules/ndb_redis/README
@@ -55,7 +55,7 @@ Joel Centelles Martin
3.8. flush_on_reconnect (integer)
3.9. allow_dynamic_nodes (integer)
3.10. debug (integer)
- 3.11. ac_path (string)
+ 3.11. ca_path (string)
4. Functions
@@ -103,7 +103,7 @@ Chapter 1. Admin Guide
3.8. flush_on_reconnect (integer)
3.9. allow_dynamic_nodes (integer)
3.10. debug (integer)
- 3.11. ac_path (string)
+ 3.11. ca_path (string)
4. Functions
@@ -149,7 +149,7 @@ Chapter 1. Admin Guide
3.8. flush_on_reconnect (integer)
3.9. allow_dynamic_nodes (integer)
3.10. debug (integer)
- 3.11. ac_path (string)
+ 3.11. ca_path (string)
3.1. server (str)
@@ -168,6 +168,12 @@ Chapter 1. Admin Guide
many REDIS servers, just give different attributes and use the specific
server name when querying the REDIS instance.
+ If tls is enabled, the module will validate the REDIS server
+ certificate against the ca_path. There is currently no way to connect
+ with a specified client certificate, the corresponding configuration to
+ check client certificates in the REDIS server must therefore be turned
+ off.
+
Default value is NULL.
Example 1.1. Set server parameter
@@ -346,9 +352,10 @@ modparam("ndb_redis", "allow_dynamic_nodes", 1)
modparam("ndb_redis", "debug", 1)
...
-3.11. ac_path (string)
+3.11. ca_path (string)
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the REDIS server
+ certificate are stored.
Default value: "" (empty).
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
Enhance xhttp_prom module to export pkgmem stats.
The new stats can be enabled via a new module parameter: `xhttp_prom_pkgmem_stats_enabled`.
Default value for the new module parameter: 0 (no pkg mem stats are generated).
Any value different then 0 will export the pkg mem statistics.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3793
-- Commit Summary --
* kex: expose access to pkg mem stats
* xhttp_prom: export pkg mem stats
-- File Changes --
A src/modules/kex/api.c (54)
A src/modules/kex/api.h (69)
M src/modules/kex/kex_mod.c (2)
M src/modules/kex/pkg_stats.c (24)
M src/modules/kex/pkg_stats.h (17)
M src/modules/xhttp_prom/prom.c (66)
M src/modules/xhttp_prom/xhttp_prom.c (44)
M src/modules/xhttp_prom/xhttp_prom.h (16)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3793.patchhttps://github.com/kamailio/kamailio/pull/3793.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3793
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3793(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
The created ssl context in the `db_redis` and `ndb_redis` modules does not use client certificates [1], [2] which is against the default in current Redis configurations [3]. The used Redis server therefore needs to be configured to not use tls-auth-clients [3]. Without setting this configuration in Redis, no TLS connection to the Redis server can be established, since Redis will not accept unsigned/not-validated client certificates.
There is also a small typo in "ac_path" in both docs which was fixed to "ca_path", added with some more specification to _which_ certificate is validated.
[1]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[2]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[3]: https://redis.io/docs/management/security/encryption/#client-certificate-au…
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3804
-- Commit Summary --
* db_redis: docs - refine docs regarding client certificates [skip ci]
* ndb_redis: docs - refine docs regarding client certificates [skip ci]
-- File Changes --
M src/modules/db_redis/doc/db_redis_admin.xml (10)
M src/modules/ndb_redis/doc/ndb_redis_admin.xml (10)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3804.patchhttps://github.com/kamailio/kamailio/pull/3804.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3804
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3804(a)github.com>
Module: kamailio
Branch: master
Commit: 6faa180661e799187eff3a498f8b13e96719fa92
URL: https://github.com/kamailio/kamailio/commit/6faa180661e799187eff3a498f8b13e…
Author: Jannik Volkland <volkland(a)sipgate.de>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-04-04T12:55:38+02:00
ndb_redis: docs - refine docs regarding client certificates [skip ci]
The created ssl context does not use client certificates [1,2] which is against the default in current Redis configurations [3]. The used Redis server therefore needs to be configured to not use tls-auth-clients [3].
There is also a small typo in "ac_path" which was fixed to "ca_path".
[1]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[2]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[3]: https://redis.io/docs/management/security/encryption/#client-certificate-au…
---
Modified: src/modules/ndb_redis/doc/ndb_redis_admin.xml
---
Diff: https://github.com/kamailio/kamailio/commit/6faa180661e799187eff3a498f8b13e…
Patch: https://github.com/kamailio/kamailio/commit/6faa180661e799187eff3a498f8b13e…
---
diff --git a/src/modules/ndb_redis/doc/ndb_redis_admin.xml b/src/modules/ndb_redis/doc/ndb_redis_admin.xml
index 74d35c75cc9..024b01315ac 100644
--- a/src/modules/ndb_redis/doc/ndb_redis_admin.xml
+++ b/src/modules/ndb_redis/doc/ndb_redis_admin.xml
@@ -75,6 +75,12 @@
many REDIS servers, just give different attributes and use the specific
server name when querying the REDIS instance.
</para>
+ <para>
+ If tls is enabled, the module will validate the REDIS server certificate against the
+ ca_path. There is currently no way to connect with a specified client certificate, the
+ <ulink url="https://redis.io/docs/management/security/encryption/#client-certificate-au…">corresponding configuration</ulink>
+ to check client certificates in the REDIS server must therefore be turned off.
+ </para>
<para>
<emphasis>
Default value is NULL.
@@ -330,9 +336,9 @@ modparam("ndb_redis", "debug", 1)
</example>
</section>
<section id="ndb_redis.p.ca_path">
- <title><varname>ac_path</varname> (string)</title>
+ <title><varname>ca_path</varname> (string)</title>
<para>
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the REDIS server certificate are stored.
</para>
<para>
Default value: "" (empty).
Module: kamailio
Branch: master
Commit: 40a50243f0bae782b7acd97cf0a9b1138185068b
URL: https://github.com/kamailio/kamailio/commit/40a50243f0bae782b7acd97cf0a9b11…
Author: Jannik Volkland <volkland(a)sipgate.de>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-04-04T12:55:38+02:00
db_redis: docs - refine docs regarding client certificates [skip ci]
The created ssl context does not use client certificates [1,2] which is against the default in current Redis configurations [3]. The used Redis server therefore needs to be configured to not use tls-auth-clients [3].
There is also a small typo in "ac_path" which was fixed to "ca_path".
[1]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[2]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[3]: https://redis.io/docs/management/security/encryption/#client-certificate-au…
---
Modified: src/modules/db_redis/doc/db_redis_admin.xml
---
Diff: https://github.com/kamailio/kamailio/commit/40a50243f0bae782b7acd97cf0a9b11…
Patch: https://github.com/kamailio/kamailio/commit/40a50243f0bae782b7acd97cf0a9b11…
---
diff --git a/src/modules/db_redis/doc/db_redis_admin.xml b/src/modules/db_redis/doc/db_redis_admin.xml
index a7e7c3bb3a9..15ed0ca61e2 100644
--- a/src/modules/db_redis/doc/db_redis_admin.xml
+++ b/src/modules/db_redis/doc/db_redis_admin.xml
@@ -224,6 +224,12 @@ modparam("db_redis", "verbosity", 0)
Controls TLS usage while connecting to a remote DB.
If set to 1, TLS is used to connect to the DB.
</para>
+ <para>
+ If TLS is enabled, the module will validate the Redis server certificate against the
+ ca_path. There is currently no way to connect with a specified client certificate, the
+ <ulink url="https://redis.io/docs/management/security/encryption/#client-certificate-au…">corresponding configuration</ulink>
+ to check client certificates in the Redis server must therefore be turned off.
+ </para>
<para>
Default value: 0.
</para>
@@ -256,9 +262,9 @@ modparam("db_redis", "db_pass", "r3d1sPass")
</section>
<section id="db_redis.p.ca_path">
- <title><varname>ac_path</varname> (string)</title>
+ <title><varname>ca_path</varname> (string)</title>
<para>
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the Redis server certificate are stored.
</para>
<para>
Default value: "" (empty).