[SR-Users] why kamcmd tls.reload is not safe

[Olle E. Johansson]

22 okt 2013 kl. 05:20 skrev Ding Ma <mading087 at gmail.com>:

> Klaus,
> 
> With the information you provided, I did find the emails initiated by Jan Janak on this topic. Thanks.
Can you please provide a URL so that the rest of us can update ourselves? 

> Guess our test with large RSA keys hits one of the race conditions when reloading TLS config, which results in kamailio crash. One thing I'm not quite clear is whether this is an openssl issue or kamailio TLS module issue. And where to start if we'd like to help fix this.
A problem I have seen and that was fixed in Asterisk was that the application initialized OpenSSL from many different modules instead of from the core application. For instance, using LDAP with TLS will initialize OpenSSL in OpenLDAP libraries that is used by Kamailio - the same for Postgres and possibly other modules. Maybe reloading does something weird here. 

Note that this is just a wild guess, but an area where I think Kamailio may need some improvements. 

Kevin Fleming developed a wrapper library to solve this issue in Asterisk, maybe that's something we need to look into.

/O
> 
> Appreciate your help,
> 
> Ding
> 
> On 10/21/2013 3:14 AM, Klaus Darilion wrote:
>> I remember that long time ago there was an email discussing the problem in details. MAybe it was on one of the old mailing lists (ser, openser). IIRC the feature and the detailed discussion way by Jan Janak. Maybe this helps you to refine your Google search.
>> 
>> regards
>> Klaus
>> 
>> 
>> On 19.10.2013 21:33, Ding Ma wrote:
>>> In the current Kamailio TLS module document, there is a statement about
>>> tls.reload being unsafe. But the only way to periodically update CRL
>>> without restarting Kamailio is to use tls.reload. In our test with
>>> tls.reload for CRL, it seems Kamailio would crash after about 100 times
>>> of tls.reload in 5/6 hours. The core dump indicates memory access
>>> violation, signal 11. We compiled Kamailio with openssl 1.0.0-fips.
>>> Would appreciate some insights on tls.reload and ideas to fix the crash
>>> issue. Thanks,
>>> 
>>> _______________________________________________
>>> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
>>> sr-users at lists.sip-router.org
>>> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
> 
> 
> _______________________________________________
> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
> sr-users at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2374 bytes
Desc: not available
URL: <http://lists.sip-router.org/pipermail/sr-users/attachments/20131022/b6388870/attachment.bin>