Hi everyone,
Just sharing that the solution was to add these two lines to the [Service] section of the systemd unit file:
Environment=LD_LIBRARY_PATH=/opt/openssl/lib64 Environment=OPENSSL_CONF=/etc/ssl/fips.cnf
And also apply a patch to Kamailio in src/modules/tls/tls_mod.c so that it logs the OpenSSL library at run-time, as well as the default logging of the OpenSSL library at compilation:
448c448,461 < LM_INFO("use OpenSSL version: %08x\n", (uint32_t)(OPENSSL_VERSION_NUMBER)); ---
#if OPENSSL_VERSION_NUMBER < 0x030000000L LM_INFO("compiled with OpenSSL version: %08x\n",
(uint32_t)(OPENSSL_VERSION_NUMBER));
#elif OPENSSL_VERSION_NUMBER >= 0x030000000L LM_INFO("compiled with OpenSSL: %s\n", OPENSSL_VERSION_TEXT); LM_INFO("run-time OpenSSL library: %s\n",
OpenSSL_version(OPENSSL_VERSION));
if(EVP_default_properties_is_fips_enabled(NULL) == 1) { LM_INFO("FIPS mode enabled in OpenSSL library\n"); } else { LM_INFO("FIPS mode not enabled in OpenSSL library\n"); }#endif
Tested with Kamailio 5.8.2. Hope this helps.
On Tue, 27 Aug 2024 at 12:01, David Cunningham dcunningham@voisonics.com wrote:
Hi Henning,
The issue happens even if I run Kamailio directly from the command line, having set LD_LIBRARY_PATH in the environment first. Please see the commands below. OpenSSL 3.0.2 is installed with Ubuntu, and OpenSSL 3.0.9 with FIPS compiled in /opt/openssl.
Setting LD_LIBRARY_PATH does seem to work for Apache, although Apache was compiled with the "--with-ssl=/opt/openssl" option. Would there by any chance be an equivalent for Kamailio? Thanks again for your help.
root@caes8:~# ls /opt/openssl/lib64/ engines-3 libcrypto.a libcrypto.so libcrypto.so.3 libssl.a libssl.so libssl.so.3 ossl-modules pkgconfig
root@caes8:~# export LD_LIBRARY_PATH=/opt/openssl/lib64
root@caes8:~# /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid loading modules under config path: /lib/kamailio/modules/:/lib64/kamailio/modules/ Listening on udp: xx.xx.xx.xx:5060 tls: xx.xx.xx.xx:5061 Aliases:
root@caes8:~# ps -ef | grep kamailio | head product 2905052 1 9 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905078 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905079 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905080 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905081 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905082 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905083 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905084 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905085 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid product 2905087 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
root@caes8:~# grep -i 'OpenSSL version' /var/log/syslog | tail Aug 26 16:55:28 caes8 /sbin/kamailio[2905052]: INFO: tls [tls_mod.c:448]: mod_init(): use OpenSSL version: 30000020
On Sun, 25 Aug 2024 at 18:34, Richard Chan via sr-users < sr-users@lists.kamailio.org> wrote:
Hello David,
Can you present your launcher script here?
LD_LIBRARY_PATH is the correct way to use an ABI compatible(same SONAME) alternative to a system library.
The boilerplate looks like this:
#!/bin/bash # IMPORTANT: intended replacements must have the same SONAME as what # tls.so was built with, i.e., libssl.so.3, libcrypto.so.3 # Your local artifacts libssl.so.3 libcrypto.so.3 installed to /opt/openssl3/lib64 # EITHER export LD_LIBRARY_PATH=/opt/openssl3/lib64 #export is required /usr/sbin/kamailio <args .....>
# OR - same line - LD_LIBRARY_PATH=/opt/openssl3/lib64 /usr/sbin/kamailio <args .....>
Cheers Richard
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
-- David Cunningham, Voisonics Limited http://voisonics.com/ USA: +1 213 221 1092 New Zealand: +64 (0)28 2558 3782