Hi Daniel
===============================
For the upgrading notes, some ideas —
"tls.so: fixing GH#3635 new global config tls_threads_mode = 0 | 1
0: is the default and is the existing Kamailio behaviour
1: run some initialization functions(libcurl, database) in a thread to avoid creating thread-locals in thread#1 before fork
On platforms with OpenSSL 3 "tls_threads_mode = 1" is needed to avoid shared memory contention, especially if other modules (eg. db_mysql, http_async_client, dispatcher with SIPS URIs) that might use TLS are loaded.
On platforms with OpenSSL 1.1.1 — shared memory contention is much harder to trigger — but this setting is recommended when other modules that use TLS are loaded"
===============================
Deployment note (for the wiki?)
Here is an SRE/deployment note — not sure of a good place to put this (maybe the wiki)
"To validate the config for OpenSSL 3/1.1.1 memory contention potential run the main kamailio process
under gdb (don't follow child forks: "set follow-fork-mode parent" — the default setting anyway)
# ** EITHER **
# deb-based: install dbgsym for libssl3 / libssl1.1
# RPM-based: install debuginfo for openssl, openssl-libs
# ** OR **
# configure gdb to use debuginfod for debug symbols
# STEP 1
# stop at main(), this step is required because the next breakpoint requires knowledge
# of thread#1
gdb> break main
gdb> run
# STEP 2
# this breakpoint detects if OpenSSL 3 initializes the thread-local err_thread_local
# in process#0.thread#1 — this causes shared memory contention
gdb> breakpoint CRYPTO_THREAD_set_local thread 1 if $_caller_is("ossl_err_get_state_int", 32)
gdb> commands
backtrace 32
continue
end
##For OpenSSL 1.1.1
gdb> breakpoint CRYPTO_THREAD_set_local thread 1 if $_caller_is("ERR_get_state", 32)
gdb> commands
backtrace 32
continue
end
# continue execution of Kamailio
gdb> continue
If this breakpoint is triggered then the configuration has potential for shared memory contention.
Do file an issue at GH with your configuration and the gdb output.
"
Dev note: I have completed an "audit" of all in-tree modules that load libssl — libcurl, libmariadb, libcrypto, libpq etc. The only one not touched is DIAMETER cdp.so with TLS. If anyone uses this and can provide me with temporary access that would be great.
Regards
Richard