31 Mar
2017
31 Mar
'17
1:17 p.m.
It was reported https://github.com/kamailio/kamailio/issues/662#issuecomment-261920382 but
I think is not related to that issue, so opening another one.
```
Configuring OpenSSL version 1.1.0e (0x1010005fL)
no-asan [default] OPENSSL_NO_ASAN
no-crypto-mdebug [default] OPENSSL_NO_CRYPTO_MDEBUG
no-crypto-mdebug-backtrace [default] OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE
no-dynamic-engine [forced]
no-egd [default] OPENSSL_NO_EGD
no-fuzz-afl [default] OPENSSL_NO_FUZZ_AFL
no-fuzz-libfuzzer [default] OPENSSL_NO_FUZZ_LIBFUZZER
no-heartbeats [default] OPENSSL_NO_HEARTBEATS
no-idea [option] OPENSSL_NO_IDEA (skip dir)
no-md2 [default] OPENSSL_NO_MD2 (skip dir)
no-mdc2 [option] OPENSSL_NO_MDC2 (skip dir)
no-msan [default] OPENSSL_NO_MSAN
no-rc5 [option] OPENSSL_NO_RC5 (skip dir)
no-sctp [default] OPENSSL_NO_SCTP
no-shared [option]
no-ssl-trace [default] OPENSSL_NO_SSL_TRACE
no-ssl3 [option(ssl3-method)] OPENSSL_NO_SSL3
no-ssl3-method [option] OPENSSL_NO_SSL3_METHOD
no-ubsan [default] OPENSSL_NO_UBSAN
no-weak-ssl-ciphers [default] OPENSSL_NO_WEAK_SSL_CIPHERS
no-zlib [option]
no-zlib-dynamic [default]
Configuring for debian-amd64
```
so openssl 1.1.0e has kerberos support
but trying to start kamailio 4.4.4-2 (from Debian stretch) with TLS enabled
```
Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: INFO: tls [tls_mod.c:368]: mod_init():
With Diffie Hellman
Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: INFO: tls [tls_init.c:633]: init_tls_h():
tls: _init_tls_h: compiled with openssl version "OpenSSL 1.1.0d 26 Jan
2017" (0x10100
04f), kerberos support: on, compression: on
Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: INFO: tls [tls_init.c:641]: init_tls_h():
tls: init_tls_h: installed openssl library version "OpenSSL 1.1.0e 16 Feb 2017"
(0x101000
5f), kerberos support: off, zlib compression: off
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H
-DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2
-D
OPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM
-DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM
-DECP_NISTZ25
6_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR="\"/usr/lib/ssl\""
-DENGINESDIR="\"/usr/lib/x86_64-linux-gnu/engines-1.1\""
Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: : tls [tls_init.c:651]: init_tls_h():
ERROR: tls: init_tls_h: openssl compile options mismatch: library has kerberos support
disabled and Kamailio tls enabled (unstable configuration)
(tls_force_run in kamailio.cfg will
override this check)
Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: CRITICAL: <core> [main.c:2592]:
main(): could not initialize tls, exiting...
```
A rebuild version with the same openssl version doesn't help
```
Mar 31 11:20:41 spce lb[17194]: INFO: tls [tls_init.c:633]: init_tls_h(): tls:
_init_tls_h: compiled with openssl version "OpenSSL 1.1.0e 16 Feb 2017"
(0x1010005f), kerberos support: on, compression: on
Mar 31 11:20:41 spce lb[17194]: INFO: tls [tls_init.c:641]: init_tls_h(): tls: init_tls_h:
installed openssl library version "OpenSSL 1.1.0e 16 Feb 2017" (0x1010005f),
kerberos support: off, zlib compression: off#012 compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H
-DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2
-DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM
-DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM
-DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM
-DOPENSSLDIR="\"/usr/lib/ssl\""
-DENGINESDIR="\"/usr/lib/x86_64-linux-gnu/engines-1.1\""
Mar 31 11:20:41 spce lb[17194]: : tls [tls_init.c:651]: init_tls_h(): ERROR: tls:
init_tls_h: openssl compile options mismatch: library has kerberos support disabled and
Kamailio tls enabled (unstable configuration)#012 (tls_force_run in kamailio.cfg will
override this check)
Mar 31 11:20:41 spce lb[17194]: CRITICAL: <core> [main.c:2592]: main(): could not
initialize tls, exiting...
```
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050
31 Mar
31 Mar
1:22 p.m.
Reported at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844548
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-290676263
1:25 p.m.
From modules/tls/tls_init.c
```
/* attempt to guess if the library was compiled with kerberos or
* compression support from the cflags */
lib_cflags=SSLeay_version(SSLEAY_CFLAGS);
lib_kerberos=0;
lib_zlib=0;
if ((lib_cflags==0) || strstr(lib_cflags, "not available")){
lib_kerberos=-1;
lib_zlib=-1;
}else{
if (strstr(lib_cflags, "-DZLIB"))
lib_zlib=1;
if (strstr(lib_cflags, "-DKRB5_"))
lib_kerberos=1;
}
LOG(L_INFO, "tls: _init_tls_h: compiled with openssl version "
"\"%s\" (0x%08lx), kerberos support: %s, compression: %s\n",
OPENSSL_VERSION_TEXT, (long)OPENSSL_VERSION_NUMBER,
kerberos_support?"on":"off",
comp_support?"on":"off");
LOG(L_INFO, "tls: init_tls_h: installed openssl library version "
"\"%s\" (0x%08lx), kerberos support: %s, "
" zlib compression: %s"
"\n %s\n",
SSLeay_version(SSLEAY_VERSION), ssl_version,
(lib_kerberos==1)?"on":(lib_kerberos==0)?"off":"unknown",
(lib_zlib==1)?"on":(lib_zlib==0)?"off":"unknown",
SSLeay_version(SSLEAY_CFLAGS));
if (lib_kerberos!=kerberos_support){
if (lib_kerberos!=-1){
LOG(L_CRIT, "ERROR: tls: init_tls_h: openssl compile options"
" mismatch: library has kerberos support"
" %s and Kamailio tls %s (unstable configuration)\n"
" (tls_force_run in kamailio.cfg will override this"
" check)\n",
lib_kerberos?"enabled":"disabled",
kerberos_support?"enabled":"disabled"
);
if (cfg_get(tls, tls_cfg, force_run))
LOG(L_WARN, "tls: init_tls_h: tls_force_run turned on, "
"ignoring kerberos support mismatch\n");
else
return -1; /* exit, is safer */
}else{
LOG(L_WARN, "WARNING: tls: init_tls_h: openssl compile options"
" missing -- cannot detect if kerberos support is"
" enabled. Possible unstable configuration\n");
}
}
```
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-290676856
1:33 p.m.
I think all those extra checks should be done only for older versions. Relying on matching
inside the compile flags is probably no longer a safe bet. I think that just matching on
version should be ok, so we can add an ifdef on OPENSSL_VERSION_NUMBER to enclose these
checks only for versions older than libssl 1.1.0
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-290678483
1:44 p.m.
like this?
```
diff --git a/modules/tls/tls_init.c b/modules/tls/tls_init.c
index af2d4c54e..053cd2adc 100644
--- a/modules/tls/tls_init.c
+++ b/modules/tls/tls_init.c
@@ -613,6 +613,7 @@ int init_tls_h(void)
#else
comp_support=0;
#endif
+ #if OPENSSL_VERSION_NUMBER < 0x010100000L
/* attempt to guess if the library was compiled with kerberos or
* compression support from the cflags */
lib_cflags=SSLeay_version(SSLEAY_CFLAGS);
@@ -660,7 +661,7 @@ int init_tls_h(void)
" enabled. Possible unstable
configuration\n");
}
}
-
+ #endif
#ifdef TLS_KSSL_WORKARROUND
/* if openssl compiled with kerberos support, and openssl < 0.9.8e-dev
* or openssl between 0.9.9-dev and 0.9.9-beta1 apply workaround for
```
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-290680481
1:48 p.m.
Somehow similar, but it should include more code -- I am preparing right now a patch.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-290681280
2:30 p.m.
Closed #1050.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#event-1023927243
2:30 p.m.
thanks
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-290688604
27 Dec
27 Dec
4:48 p.m.
Reopened #1050.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#event-2046007333
4:48 p.m.
Sadly this still seems to be an issue:
kamailio[4041]: INFO: tls [tls_init.c:633]:
init_tls_h(): tls: _init_tls_h: compiled with openssl version "OpenSSL 1.1.0f 25
May 2017" (0x1010006f), kerberos support: on, compression: on
kamailio[4041]: INFO: tls [tls_init.c:641]: init_tls_h(): tls: init_tls_h: installed
openssl library version "OpenSSL 1.1.0j 20 Nov 2018" (0x101000af), kerberos
support: off, zlib compression: off
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H
-DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2
-DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM
-DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM
-DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM
-DOPENSSLDIR="\"/usr/lib/ssl\""
-DENGINESDIR="\"/usr/lib/x86_64-linux-gnu/engines-1.1\""
kamailio[4041]: : tls [tls_init.c:651]: init_tls_h():
ERROR: tls: init_tls_h: openssl compile options mismatch: library has kerberos support
disabled and Kamailio tls enabled (unstable configuration)
(tls_force_run in
kamailio.cfg will override this check)
kamailio[4041]: CRITICAL: <core> [main.c:2592]:
main(): could not initialize tls, exiting...
kamailio[4041]: INFO: <core> [sctp_core.c:53]: sctp_core_destroy(): SCTP API not
initialized
Reported at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902452
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-450163793
5:11 p.m.
My bad, this fix is not in 4.4.4, I will backport and fix it on Debian. Sorry for the
noise.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#issuecomment-450168403
5:11 p.m.
Closed #1050.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1050#event-2046038263
2186
days inactive
2822
days old
11 comments
2 participants
participants (2)
-
Daniel-Constantin Mierla -
Victor Seva