Hi everyone,

Just sharing that the solution was to add these two lines to the [Service] section of the systemd unit file:

Environment=LD_LIBRARY_PATH=/opt/openssl/lib64
Environment=OPENSSL_CONF=/etc/ssl/fips.cnf

And also apply a patch to Kamailio in src/modules/tls/tls_mod.c so that it logs the OpenSSL library at run-time, as well as the default logging of the OpenSSL library at compilation:

448c448,461
< LM_INFO("use OpenSSL version: %08x\n", (uint32_t)(OPENSSL_VERSION_NUMBER));
---
>
> #if OPENSSL_VERSION_NUMBER < 0x030000000L
> LM_INFO("compiled with OpenSSL version: %08x\n", (uint32_t)(OPENSSL_VERSION_NUMBER));
> #elif OPENSSL_VERSION_NUMBER >= 0x030000000L
> LM_INFO("compiled with OpenSSL: %s\n", OPENSSL_VERSION_TEXT);
> LM_INFO("run-time OpenSSL library: %s\n", OpenSSL_version(OPENSSL_VERSION));
>
> if(EVP_default_properties_is_fips_enabled(NULL) == 1) {
> LM_INFO("FIPS mode enabled in OpenSSL library\n");
> } else {
> LM_INFO("FIPS mode not enabled in OpenSSL library\n");
> }
> #endif
>

Tested with Kamailio 5.8.2. Hope this helps.

On Tue, 27 Aug 2024 at 12:01, David Cunningham <dcunningham@voisonics.com> wrote:

Hi Henning,

The issue happens even if I run Kamailio directly from the command line, having set LD_LIBRARY_PATH in the environment first. Please see the commands below. OpenSSL 3.0.2 is installed with Ubuntu, and OpenSSL 3.0.9 with FIPS compiled in /opt/openssl.

Setting LD_LIBRARY_PATH does seem to work for Apache, although Apache was compiled with the "--with-ssl=/opt/openssl" option. Would there by any chance be an equivalent for Kamailio? Thanks again for your help.

root@caes8:~# ls /opt/openssl/lib64/
engines-3 libcrypto.a libcrypto.so libcrypto.so.3 libssl.a libssl.so libssl.so.3 ossl-modules pkgconfig

root@caes8:~# export LD_LIBRARY_PATH=/opt/openssl/lib64

root@caes8:~# /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
loading modules under config path: /lib/kamailio/modules/:/lib64/kamailio/modules/
Listening on
udp: xx.xx.xx.xx:5060
tls: xx.xx.xx.xx:5061
Aliases:

root@caes8:~# ps -ef | grep kamailio | head
product 2905052 1 9 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905078 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905079 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905080 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905081 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905082 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905083 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905084 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905085 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid
product 2905087 2905052 0 16:55 ? 00:00:00 /sbin/kamailio -m 512 -M 8 -P /var/run/product/kamailio.pid

root@caes8:~# grep -i 'OpenSSL version' /var/log/syslog | tail
Aug 26 16:55:28 caes8 /sbin/kamailio[2905052]: INFO: tls [tls_mod.c:448]: mod_init(): use OpenSSL version: 30000020

On Sun, 25 Aug 2024 at 18:34, Richard Chan via sr-users <sr-users@lists.kamailio.org> wrote:
Hello David,

Can you present your launcher script here?

LD_LIBRARY_PATH is the correct way to use an ABI compatible(same SONAME)
alternative to a system library.

The boilerplate looks like this:

#!/bin/bash
# IMPORTANT: intended replacements must have the same SONAME as what
# tls.so was built with, i.e., libssl.so.3, libcrypto.so.3
# Your local artifacts libssl.so.3 libcrypto.so.3 installed to /opt/openssl3/lib64
# EITHER
export LD_LIBRARY_PATH=/opt/openssl3/lib64 #export is required
/usr/sbin/kamailio <args .....>

# OR - same line -
LD_LIBRARY_PATH=/opt/openssl3/lib64 /usr/sbin/kamailio <args .....>

Cheers
Richard

__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
To unsubscribe send an email to sr-users-leave@lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe:

--
David Cunningham, Voisonics Limited
http://voisonics.com/
USA: +1 213 221 1092
New Zealand: +64 (0)28 2558 3782