[sr-dev] [kamailio/kamailio] tls: fix OpenSSL engine in child processes (#2840)

tls_init.c calls OPENSSL_init_ssl(); this initializes the global engine linked-list and this cannot be reset in the child. To avoid linked-list corruption we manually instantiate the engine object required for loading private keys instead of relying on CONF_modules_load_file(). Updates to doc/. Addresses #2839 <!-- Kamailio Pull Request Template --> <!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception --> #### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [X] Commit message has the format required by CONTRIBUTING guide - [X] Commits are split per component (core, individual modules, libs, utils, ...) - [X] Each component has a single commit (if not, squash them into one commit) - [X] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [X] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality) #### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [X] PR should be backported to stable branches - [X] Tested changes locally - [X] Related to issue #2839 #### Description The call to `OPENSSL_init_ssl()` in `tls_init.c` results in the creation of the engine linked-list in the parent. This affects per-child engine private keys as there is no api to reinitialize the engine linked-list in the child. This PR removes the call to `CONF_modules_load_file()` which causes linked-list corruption and replaces the initialization of engine private keys in the child with with other api calls which do not manipulate global objects. You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/2840 -- Commit Summary -- * tls: fix OpenSSL engine in child processes -- File Changes -- M src/modules/tls/doc/hsm_howto.xml (15) M src/modules/tls/tls_mod.c (93) -- Patch Links -- https://github.com/kamailio/kamailio/pull/2840.patch https://github.com/kamailio/kamailio/pull/2840.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/2840