HI devs,
In trying to solve the libssl3 issue the original attempt with tls_threads_mode=1 turns out to be not quite correct.
Since the release of 5.8 we have consistently recommended tls_threads_mode=2 for users of libssl 1.1.1 and 3.
For master/6.0.0-pre I will start to revert the changes of tls_threads_mode=1.
I will also add a new simpler mode tls_threads_mode=3 based on the diff by Ondrej Jirman megi@xff.cz (@meengu).
Regards Richard
Hello Richard,
as we are in the code freeze for 6.0 already, it would be great if you could quickly outline how intrusive the proposed tls_thread mode 3 would be, e.g. would it touch all the modules etc.. We might consider maybe then adding it later.
Thank you,
Henning
From: Richard Chan via sr-dev sr-dev@lists.kamailio.org Sent: Freitag, 20. Dezember 2024 03:25 To: Kamailio (SER) - Development Mailing List sr-dev@lists.kamailio.org Cc: Richard Chan shihping.chan@gmail.com Subject: [sr-dev] Heads-up: master/libssl - going to revert tls_threads_mode=1
HI devs,
In trying to solve the libssl3 issue the original attempt with tls_threads_mode=1 turns out to be not quite correct.
Since the release of 5.8 we have consistently recommended tls_threads_mode=2 for users of libssl 1.1.1 and 3.
For master/6.0.0-pre I will start to revert the changes of tls_threads_mode=1.
I will also add a new simpler mode tls_threads_mode=3 based on the diff by Ondrej Jirman <megi@xff.czmailto:megi@xff.cz> (@meengu).
Regards Richard
Henning - noted about this; I'm looking at how intrusive the diff is but a quick assessment shows that it shouldn't touch any modules outside tls.so.
On Fri, 20 Dec 2024 at 16:42, Henning Westerholt hw@gilawa.com wrote:
Hello Richard,
as we are in the code freeze for 6.0 already, it would be great if you could quickly outline how intrusive the proposed tls_thread mode 3 would be, e.g. would it touch all the modules etc..
We might consider maybe then adding it later.
Thank you,
Henning
*From:* Richard Chan via sr-dev sr-dev@lists.kamailio.org *Sent:* Freitag, 20. Dezember 2024 03:25 *To:* Kamailio (SER) - Development Mailing List <sr-dev@lists.kamailio.org
*Cc:* Richard Chan shihping.chan@gmail.com *Subject:* [sr-dev] Heads-up: master/libssl - going to revert tls_threads_mode=1
HI devs,
In trying to solve the libssl3 issue the original attempt with tls_threads_mode=1 turns out to be not quite correct.
Since the release of 5.8 we have consistently recommended tls_threads_mode=2 for users of libssl 1.1.1 and 3.
For master/6.0.0-pre I will start to revert the changes of tls_threads_mode=1.
I will also add a new simpler mode tls_threads_mode=3 based on the diff by
Ondrej Jirman megi@xff.cz (@meengu).
Regards
Richard
Hi Richard,
thanks, sounds fine then.
We probably should add some logic to detect the tls_thread mode 1 setting for existing configuration, and then log a WARNING and use the mode 2 or so.
Cheers,
Henning
From: Richard Chan shihping.chan@gmail.com Sent: Freitag, 20. Dezember 2024 13:14 To: Henning Westerholt hw@gilawa.com Cc: Kamailio (SER) - Development Mailing List sr-dev@lists.kamailio.org Subject: Re: [sr-dev] Heads-up: master/libssl - going to revert tls_threads_mode=1
Henning - noted about this; I'm looking at how intrusive the diff is but a quick assessment shows that it shouldn't touch any modules outside tls.so.
On Fri, 20 Dec 2024 at 16:42, Henning Westerholt <hw@gilawa.commailto:hw@gilawa.com> wrote: Hello Richard,
as we are in the code freeze for 6.0 already, it would be great if you could quickly outline how intrusive the proposed tls_thread mode 3 would be, e.g. would it touch all the modules etc.. We might consider maybe then adding it later.
Thank you,
Henning
From: Richard Chan via sr-dev <sr-dev@lists.kamailio.orgmailto:sr-dev@lists.kamailio.org> Sent: Freitag, 20. Dezember 2024 03:25 To: Kamailio (SER) - Development Mailing List <sr-dev@lists.kamailio.orgmailto:sr-dev@lists.kamailio.org> Cc: Richard Chan <shihping.chan@gmail.commailto:shihping.chan@gmail.com> Subject: [sr-dev] Heads-up: master/libssl - going to revert tls_threads_mode=1
HI devs,
In trying to solve the libssl3 issue the original attempt with tls_threads_mode=1 turns out to be not quite correct.
Since the release of 5.8 we have consistently recommended tls_threads_mode=2 for users of libssl 1.1.1 and 3.
For master/6.0.0-pre I will start to revert the changes of tls_threads_mode=1.
I will also add a new simpler mode tls_threads_mode=3 based on the diff by Ondrej Jirman <megi@xff.czmailto:megi@xff.cz> (@meengu).
Regards Richard
Yes - I will do that (re: warning on tls_threads_mode=1).
On further study I will not implement tls_threads_mode=3 for 6.x; I'll merely leave it in the docs. It uses a function that is actually deprecated in libssl3 - so is fragile with respect to the build of OpenSSL.
Regards Richard
-
Henning Westerholt -
Richard Chan