<!-- Kamailio Pull Request Template -->
<!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception -->
#### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [X] Commit message has the format required by CONTRIBUTING guide - [X] Commits are split per component (core, individual modules, libs, utils, ...) - [X] Each component has a single commit (if not, squash them into one commit) - [X] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [X] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [ ] PR should be backported to stable branches - [X] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description Not for merging yet.
Package tls_wolfssl as an alternative to OpenSSL 3.x. Depends on PR https://github.com/kamailio/kamailio/pull/3590
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3592
-- Commit Summary --
* pkg: RPM packaging add kamailio-tls_wolfssl subpackage
-- File Changes --
M pkg/kamailio/obs/kamailio.spec (18)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3592.patch https://github.com/kamailio/kamailio/pull/3592.diff
@space88man pushed 1 commit.
53aeaa370b52d06d69d5d45fd54b1de1ab77c24d pkg: RPM packaging add kamailio-tls_wolfssl subpackage
@space88man pushed 1 commit.
4290ca1ee811afde5521d61e1bbe6ccd1a5df787 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
@space88man pushed 1 commit.
24d977802963cc7ad8492f6b3ee5bae45c7470f1 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
@space88man pushed 1 commit.
9fdf843acac2174b9fb442a08103563afd315af5 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
@space88man pushed 1 commit.
a740fb11d8d6a0e14c74a8ca109467025552b028 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
Looks like `wolfssl` sources are statically linked with the module. I have checked `wolfssl` sources and found project already has packaged the project into `.deb` and `.rpm` packages. https://github.com/wolfSSL/wolfssl/tree/master/debian https://github.com/wolfSSL/wolfssl/tree/master/rpm
I prefer package `wolfssl` as the independent package and then dynamically link with the Kamailio module. I have tried to do this and caught an error with the packaging. Details at https://github.com/wolfSSL/wolfssl/issues/6914.
When the packaging issue is resolved then I will drop `wolfssl` rpm into https://rpm.kamailio.org/centos/9/master/master/x86_64/Packages/k/ repo.
I have packaged `wolfssl` and placed at For CentOS 9 - https://rpm.kamailio.org/centos/9/master/master/x86_64/Packages/w/ For CentOS 8 - https://rpm.kamailio.org/centos/8/master/master/x86_64/Packages/w/
If you need another dist, then you rebuild `.src.rpm`.
Could you install packaged wolfssl and update Makefile to use param to allow the use of shared library linking?
As example, you can find [in spec file](https://github.com/kamailio/kamailio/blob/55b3ce67709e56be116bb7077931ba7f4c...) [in Makefile](https://github.com/kamailio/kamailio/blob/master/src/Makefile.radius#L24)
I also packaged `wolssl` for Cent OS 7 https://rpm.kamailio.org/centos/7/master/master/x86_64/Packages/w/
@space88man: master branch introduced 16-byte memory alignment for q_malloc(qm) and f_malloc (fm). Would you be able to test and see if works fine with stock libwolfssl from debian?
The tlsf_malloc (tlsf) seems to be designed only for 8-byte alignment as I could have quickly checked.
Update (WIP):
- 16-byte aligned qm works with wolfSSL compiled without `--disable-aligndata`
@space88man pushed 1 commit.
7903433297d2a58aa25a139cd0652828d90e00da pkg: RPM packaging add kamailio-tls_wolfssl subpackage
I have tried to build a module on `CentOS 8 Stream` and got an error ``` CC (gcc) [M auth_identity.so] auth_crypt.o CC (gcc) [M auth_identity.so] auth_dynstr.o LD (gcc) [M auth_identity.so] auth_identity.so Makefile:65: sources = tls_util.c tls_domain.c tls_rand.c tls_map.c tls_cfg.c tls_select.c tls_dump_vf.c tls_init.c tls_bio.c tls_config.c tls_server.c tls_rpc.c tls_ct_wrq.c tls_wolfssl_mod.c tls_verify.c , auto_gen = , objs = tls_util.o tls_domain.o tls_rand.o tls_map.o tls_cfg.o tls_select.o tls_dump_vf.o tls_init.o tls_bio.o tls_config.o tls_server.o tls_rpc.o tls_ct_wrq.o tls_wolfssl_mod.o tls_verify.o Makefile:65: sources = tls_util.c tls_domain.c tls_rand.c tls_map.c tls_cfg.c tls_select.c tls_dump_vf.c tls_init.c tls_bio.c tls_config.c tls_server.c tls_rpc.c tls_ct_wrq.c tls_wolfssl_mod.c tls_verify.c , auto_gen = , objs = tls_util.o tls_domain.o tls_rand.o tls_map.o tls_cfg.o tls_select.o tls_dump_vf.o tls_init.o tls_bio.o tls_config.o tls_server.o tls_rpc.o tls_ct_wrq.o tls_wolfssl_mod.o tls_verify.o CC (gcc) [M tls_wolfssl.so] tls_util.o In file included from tls_util.c:36: tls_util.h:37:12: error: unknown type name 'SSL' char *s, SSL *ssl, tls_domains_cfg_t **tls_domains_cfg) ^~~ make[2]: *** [../../Makefile.rules:100: tls_util.o] Error 1 make[1]: *** [Makefile:508: modules] Error 1 make[1]: Leaving directory '/root/rpmbuild/BUILD/kamailio-5.8.0-dev1/src' make: *** [Makefile:34: every-module] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.y2gQNv (%build) Bad exit status from /var/tmp/rpm-tmp.y2gQNv (%build) ``` I used wolfssl 5.6.3. Should I update to wolfssl 5.6.4?
I have tried to build a module on `CentOS 8 Stream` and got an error
error: Bad exit status from /var/tmp/rpm-tmp.y2gQNv (%build) Bad exit status from /var/tmp/rpm-tmp.y2gQNv (%build)
I used wolfssl 5.6.3. Should I update to wolfssl 5.6.4?
I just tried master 26ba1d9f42 with the submodule set to v5.6.3-stable -
``` fssl/openssl' libtool: finish: PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/bin:/sbin" ldconfig -n /builddir/build/kamailio/src/modules/tls_wolfssl/../../../misc/external/wolfssl/build/lib ---------------------------------------------------------------------- Libraries have been installed in: /builddir/build/kamailio/src/modules/tls_wolfssl/../../../misc/external/wolfssl/build/lib
If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the '-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the 'LD_LIBRARY_PATH' environment variable during execution - have your system administrator add LIBDIR to '/etc/ld.so.conf'
See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- CC (gcc) [M tls_wolfssl.so] tls_util.o CC (gcc) [M tls_wolfssl.so] tls_domain.o CC (gcc) [M tls_wolfssl.so] tls_rand.o CC (gcc) [M tls_wolfssl.so] tls_map.o CC (gcc) [M tls_wolfssl.so] tls_cfg.o CC (gcc) [M tls_wolfssl.so] tls_select.o CC (gcc) [M tls_wolfssl.so] tls_dump_vf.o CC (gcc) [M tls_wolfssl.so] tls_init.o CC (gcc) [M tls_wolfssl.so] tls_bio.o CC (gcc) [M tls_wolfssl.so] tls_config.o CC (gcc) [M tls_wolfssl.so] tls_server.o CC (gcc) [M tls_wolfssl.so] tls_rpc.o CC (gcc) [M tls_wolfssl.so] tls_ct_wrq.o CC (gcc) [M tls_wolfssl.so] tls_wolfssl_mod.o CC (gcc) [M tls_wolfssl.so] tls_verify.o LD (gcc) [M tls_wolfssl.so] tls_wolfssl.so make: Leaving directory '/builddir/build/kamailio/src' [root@cf659342ea4c kamailio]# ```
Are you building from an external wolfssl package? If so can you compare your package build flags with https://download.copr.fedorainfracloud.org/results/beaveryoga/wolfSSL/epel-8...
@sergey-safarov
``` --- wolfssl.spec.0 2023-10-28 10:09:24.000000000 +0000 +++ wolfssl.spec 2023-11-21 23:20:30.449245065 +0000 @@ -1,7 +1,7 @@ Summary: Embedded SSL Library Name: wolfssl Version: 5.6.3 -Release: 1 +Release: 2 License: GPLv2 Group: System Environment/Libraries BuildRequires: gcc @@ -37,7 +37,7 @@ %setup -q
%build -%configure +%configure --enable-pkcs11 --enable-distro --disable-examples --disable-silent-rules %{__make} %{?_smp_mflags} if [ "no" = "yes" ] then @@ -49,8 +49,11 @@ %install %{__rm} -rf %{buildroot} %{__make} install DESTDIR="%{buildroot}" AM_INSTALL_PROGRAM_FLAGS="" +%{__install} -m644 wolfssl/options.h %{buildroot}/%{_includedir}/wolfssl mkdir -p $RPM_BUILD_ROOT/ %{__rm} -f %{buildroot}/%{_libdir}/libwolfssl.la +%{__rm} -f %{buildroot}/%{_libdir}/libwolfssl.a +%{__rm} -rf %{buildroot}/%{_includedir}/cyassl
%check
@@ -78,105 +81,14 @@ %{_docdir}/wolfssl/README.txt %{_docdir}/wolfssl/QUIC.md
-%{_libdir}/libwolfssl.so %{_libdir}/libwolfssl.so.35 %{_libdir}/libwolfssl.so.35.5.1
%files devel %defattr(-,root,root,-) %doc AUTHORS ChangeLog.md COPYING README README.md +%{_libdir}/libwolfssl.so %{_bindir}/wolfssl-config -%{_includedir}/cyassl/callbacks.h -%{_includedir}/cyassl/certs_test.h -%{_includedir}/cyassl/crl.h -%{_includedir}/cyassl/ctaocrypt/aes.h -%{_includedir}/cyassl/ctaocrypt/arc4.h -%{_includedir}/cyassl/ctaocrypt/asn.h -%{_includedir}/cyassl/ctaocrypt/asn_public.h -%{_includedir}/cyassl/ctaocrypt/blake2-impl.h -%{_includedir}/cyassl/ctaocrypt/blake2-int.h -%{_includedir}/cyassl/ctaocrypt/blake2.h -%{_includedir}/cyassl/ctaocrypt/camellia.h -%{_includedir}/cyassl/ctaocrypt/chacha.h -%{_includedir}/cyassl/ctaocrypt/coding.h -%{_includedir}/cyassl/ctaocrypt/compress.h -%{_includedir}/cyassl/ctaocrypt/des3.h -%{_includedir}/cyassl/ctaocrypt/dh.h -%{_includedir}/cyassl/ctaocrypt/dsa.h -%{_includedir}/cyassl/ctaocrypt/ecc.h -%{_includedir}/cyassl/ctaocrypt/error-crypt.h -%{_includedir}/cyassl/ctaocrypt/fips_test.h -%{_includedir}/cyassl/ctaocrypt/hmac.h -%{_includedir}/cyassl/ctaocrypt/integer.h -%{_includedir}/cyassl/ctaocrypt/logging.h -%{_includedir}/cyassl/ctaocrypt/md2.h -%{_includedir}/cyassl/ctaocrypt/md4.h -%{_includedir}/cyassl/ctaocrypt/md5.h -%{_includedir}/cyassl/ctaocrypt/memory.h -%{_includedir}/cyassl/ctaocrypt/misc.h -%{_includedir}/cyassl/ctaocrypt/mpi_class.h -%{_includedir}/cyassl/ctaocrypt/mpi_superclass.h -%{_includedir}/cyassl/ctaocrypt/pkcs7.h -%{_includedir}/cyassl/ctaocrypt/poly1305.h -%{_includedir}/cyassl/ctaocrypt/pwdbased.h -%{_includedir}/cyassl/ctaocrypt/random.h -%{_includedir}/cyassl/ctaocrypt/ripemd.h -%{_includedir}/cyassl/ctaocrypt/rsa.h -%{_includedir}/cyassl/ctaocrypt/settings.h -%{_includedir}/cyassl/ctaocrypt/settings_comp.h -%{_includedir}/cyassl/ctaocrypt/sha.h -%{_includedir}/cyassl/ctaocrypt/sha256.h -%{_includedir}/cyassl/ctaocrypt/sha512.h -%{_includedir}/cyassl/ctaocrypt/tfm.h -%{_includedir}/cyassl/ctaocrypt/types.h -%{_includedir}/cyassl/ctaocrypt/visibility.h -%{_includedir}/cyassl/ctaocrypt/wc_port.h -%{_includedir}/cyassl/error-ssl.h -%{_includedir}/cyassl/ocsp.h -%{_includedir}/cyassl/openssl/asn1.h -%{_includedir}/cyassl/openssl/bio.h -%{_includedir}/cyassl/openssl/bn.h -%{_includedir}/cyassl/openssl/conf.h -%{_includedir}/cyassl/openssl/crypto.h -%{_includedir}/cyassl/openssl/des.h -%{_includedir}/cyassl/openssl/dh.h -%{_includedir}/cyassl/openssl/dsa.h -%{_includedir}/cyassl/openssl/ec.h -%{_includedir}/cyassl/openssl/ec25519.h -%{_includedir}/cyassl/openssl/ec448.h -%{_includedir}/cyassl/openssl/ecdh.h -%{_includedir}/cyassl/openssl/ecdsa.h -%{_includedir}/cyassl/openssl/ed25519.h -%{_includedir}/cyassl/openssl/ed448.h -%{_includedir}/cyassl/openssl/engine.h -%{_includedir}/cyassl/openssl/err.h -%{_includedir}/cyassl/openssl/evp.h -%{_includedir}/cyassl/openssl/hmac.h -%{_includedir}/cyassl/openssl/lhash.h -%{_includedir}/cyassl/openssl/md4.h -%{_includedir}/cyassl/openssl/md5.h -%{_includedir}/cyassl/openssl/ocsp.h -%{_includedir}/cyassl/openssl/opensslconf.h -%{_includedir}/cyassl/openssl/opensslv.h -%{_includedir}/cyassl/openssl/ossl_typ.h -%{_includedir}/cyassl/openssl/pem.h -%{_includedir}/cyassl/openssl/pkcs12.h -%{_includedir}/cyassl/openssl/rand.h -%{_includedir}/cyassl/openssl/ripemd.h -%{_includedir}/cyassl/openssl/rsa.h -%{_includedir}/cyassl/openssl/sha.h -%{_includedir}/cyassl/openssl/ssl.h -%{_includedir}/cyassl/openssl/ssl23.h -%{_includedir}/cyassl/openssl/stack.h -%{_includedir}/cyassl/openssl/ui.h -%{_includedir}/cyassl/openssl/x509.h -%{_includedir}/cyassl/openssl/x509v3.h -%{_includedir}/cyassl/options.h -%{_includedir}/cyassl/sniffer.h -%{_includedir}/cyassl/sniffer_error.h -%{_includedir}/cyassl/ssl.h -%{_includedir}/cyassl/test.h -%{_includedir}/cyassl/version.h %{_includedir}/wolfssl/callbacks.h %{_includedir}/wolfssl/certs_test.h %{_includedir}/wolfssl/crl.h @@ -328,6 +240,8 @@ %if "no" != "no" %{_includedir}/wolfssl/wolfcrypt/fips.h %endif +%{_includedir}/wolfssl/wolfcrypt/pkcs11.h +%{_includedir}/wolfssl/wolfcrypt/wc_pkcs11.h
%changelog * Mon Oct 17 2022 Juliusz Sosinowicz juliusz@wolfssl.com ```
@space88man pushed 1 commit.
faea6215c5abfc414a675f425dd2f51cbeec44f6 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
Most of spec diffs introduced in the commit https://github.com/wolfSSL/wolfssl/commit/7a12202675d04299464d091255028a48fa...
I will repackage wolfssl 5.6.4 in the Kamailio repo.
For packaging I use instructions specified at https://github.com/wolfSSL/wolfssl/issues/6914
@space88man pushed 1 commit.
16c10e35c71a166c0495b2fc742a426ccab912d2 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
@space88man pushed 1 commit.
ab0c64c092ce25dbfd7e58d018a5b6a2b5ad1596 pkg: RPM packaging add kamailio-tls_wolfssl subpackage
@space88man I have update `wolfssl` to 5.6.4 version and added `--enable-distro` in vanila spec file. This resolved build issue.
I fine to merge thi PR.
Closed via 870e4dc86d
Closed #3592.
I just now tried to update my systems to Kamailio 5.8.0 and encountered the problem that the RPM file can no longer be built without installing the 3rd party wolfSSL package (actually 4th-party, as we have me, RHEL, Kamailio and now a 4th party is added to the soup).
I wish that you've added the `wolfssl` subpackage as an optional feature that can be turned off (like is done for many other modules), so I can choose not to use it (seeing as it isn't mandatory for Kamailio).
I've added `%bcond_without wolfssl` and `%if %{with wolfssl}` where appropriate and now it builds well for me with `--without wolfssl`. I'd appreciate it if these flags can be added to the current spec file.
@space88man, I've added a PR with the requested change, for your convenience.
I have tried to build a module on `CentOS 8 Stream` and got an error
CC (gcc) [M auth_identity.so] auth_crypt.o CC (gcc) [M auth_identity.so] auth_dynstr.o LD (gcc) [M auth_identity.so] auth_identity.so Makefile:65: sources = tls_util.c tls_domain.c tls_rand.c tls_map.c tls_cfg.c tls_select.c tls_dump_vf.c tls_init.c tls_bio.c tls_config.c tls_server.c tls_rpc.c tls_ct_wrq.c tls_wolfssl_mod.c tls_verify.c , auto_gen = , objs = tls_util.o tls_domain.o tls_rand.o tls_map.o tls_cfg.o tls_select.o tls_dump_vf.o tls_init.o tls_bio.o tls_config.o tls_server.o tls_rpc.o tls_ct_wrq.o tls_wolfssl_mod.o tls_verify.o Makefile:65: sources = tls_util.c tls_domain.c tls_rand.c tls_map.c tls_cfg.c tls_select.c tls_dump_vf.c tls_init.c tls_bio.c tls_config.c tls_server.c tls_rpc.c tls_ct_wrq.c tls_wolfssl_mod.c tls_verify.c , auto_gen = , objs = tls_util.o tls_domain.o tls_rand.o tls_map.o tls_cfg.o tls_select.o tls_dump_vf.o tls_init.o tls_bio.o tls_config.o tls_server.o tls_rpc.o tls_ct_wrq.o tls_wolfssl_mod.o tls_verify.o CC (gcc) [M tls_wolfssl.so] tls_util.o In file included from tls_util.c:36: tls_util.h:37:12: error: unknown type name 'SSL' char *s, SSL *ssl, tls_domains_cfg_t **tls_domains_cfg) ^~~ make[2]: *** [../../Makefile.rules:100: tls_util.o] Error 1 make[1]: *** [Makefile:508: modules] Error 1 make[1]: Leaving directory '/root/rpmbuild/BUILD/kamailio-5.8.0-dev1/src' make: *** [Makefile:34: every-module] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.y2gQNv (%build) Bad exit status from /var/tmp/rpm-tmp.y2gQNv (%build)
I used wolfssl 5.6.3. Should I update to wolfssl 5.6.4?
Hi @sergey-safarov,
I'm facing the same issue when building for `CentOS 7`. I'm using the `wolfssl-devel` package available on `kamailio` repo: `v5.6.3`. Can you please update the version for `CentOS 7`?
@guss77 you rebuild wolfssl using srpm package https://rpm.kamailio.org/centos/9/master/master/x86_64/Packages/w/wolfssl-5....
And update wolfssl on your local PC.
@guss77 you rebuild wolfssl using srpm package https://rpm.kamailio.org/centos/9/master/master/x86_64/Packages/w/wolfssl-5....
And update wolfssl on your local PC.
Was that a question? I'm not sure I understand your comment either way, but no - I don't have or want to use wolfssl, that's the whole point of PR #3781
Yes, my topic isn't about the changes made by @guss77 But I noticed that the version of `wolfssl` differs between `CentOS` versions in the `kamailio` repo. For` CentOS 8` and `9`, we have `5.6.6`, for `CentOS 7` `5.6.3`. And I observed the same problems that @sergey-safarov identified at the time. Ideally, in the `Kamailio` repo, the version should be uniform between the multiple versions of `CentOS`.