[sr-dev] OpenSSL and LibreSSL - food for thought

[Daniel-Constantin Mierla]

Hello,

I haven't looked recently at libressl, so I cannot comment about it
right now.

But there is already tls_wolfssl module, which may still need testing to
get it in pair with tls, but it is in workable state (see presentation
at KW 2022).

Then, Kamailio is released under GPLv2 or later:

❯ head src/main.c

/*
 * Copyright (C) 2001-2003 FhG Fokus
 *
 * This file is part of Kamailio, a free SIP server.
 *
 * Kamailio is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version

That means it can be considered under GPLv3 as well, should it be
decided that the Apache 2.0 license is not compatible with GPLv2.

Cheers,
Daniel

On 30.09.22 08:46, Olle E. Johansson wrote:
> Hi!
>
> A few years ago Daniel and I checked the possibility of supporting LibreSSL in addition to OpenSSL. I might not remember all the details, but I think it failed on LibreSSL not willing to support the memory allocation API we use in OpenSSL.
>
> There has been a lot of discussion about the OpenSSL project lately, their focus and lack of communication skills. AlpineLinux has tried moving away from OpenSSL but failed in the first attempt and now discuss making another attempt. It they do and we want to run Kamailio in Alpine - which is used in many container environments - we need to pay attention.
>
> https://gitlab.alpinelinux.org/alpine/tsc/-/issues/28
>
> Some quotes:
>
> "Meanwhile, there are more problems: it turns out that OpenSSL 3.x will not have LTS releases of the same length as past branches of OpenSSL. In addition, there are governance problems, as outlined by Rich Salz in his email to the openssl-project mailing list: the OpenSSL developers appear to want to focus on developing new features rather than cleaning up the mess of regressions they have created with OpenSSL 3.”
>
> "However, it is the opinion of the Alpine license review community that the Apache 2.0 license is not compatible with GPLv2. It is also the opinion of the Alpine license review community that the OpenSSL 1.x license was alreadycompatible with both GPLv2 and GPLv3 due to the system library exception: it is generally not possible to install an Alpine system without having an OpenSSL implementation, so it clearly qualifies as a system library.”
>
> Kamailio has GPLv2 - if we parse the license the same way, we can’t support OpenSSL 3.
>
> We have many third-party libraries we use, like Curl, that also use OpenSSL. Curl may be a bad example, since the support of various TLS stacks is huge in Curl, but other libraries may have to make a decision here too.
>
> Do you have any feeling if other Open Source projects discuss this?
>
> Should we take another look at using LibreSSL?
>
> Personally I’m rather worried about all the discussions around the OpenSSL project. There has been meetings at IETF with this as a topic. It is a very important building block for a lot of what we work with.
>
> Cheers,
> /O
> _______________________________________________
> Kamailio (SER) - Development Mailing List
> sr-dev at lists.kamailio.org
> https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-dev

-- 
Daniel-Constantin Mierla -- www.asipto.com
www.twitter.com/miconda -- www.linkedin.com/in/miconda
Kamailio Advanced Training - Online
  Nov 7-10, 2022 (Europe Timezone)
  * https://www.asipto.com/sw/kamailio-advanced-training-online/