Module: kamailio
Branch: 5.7
Commit: 3eb545779876265f4587ff8ff627530b70c761dc
URL: https://github.com/kamailio/kamailio/commit/3eb545779876265f4587ff8ff627530…
Author: Kamailio Dev <kamailio.dev(a)kamailio.org>
Committer: Kamailio Dev <kamailio.dev(a)kamailio.org>
Date: 2024-03-07T10:17:45+01:00
modules: readme files regenerated - modules ... [skip ci]
---
Modified: src/modules/db_mysql/README
---
Diff: https://github.com/kamailio/kamailio/commit/3eb545779876265f4587ff8ff627530…
Patch: https://github.com/kamailio/kamailio/commit/3eb545779876265f4587ff8ff627530…
---
diff --git a/src/modules/db_mysql/README b/src/modules/db_mysql/README
index 8d9f526cbe1..b1ae13eca1b 100644
--- a/src/modules/db_mysql/README
+++ b/src/modules/db_mysql/README
@@ -32,6 +32,7 @@ Daniel-Constantin Mierla
3.5. insert_delayed (integer)
3.6. update_affected_found (integer)
3.7. opt_ssl_mode (integer)
+ 3.8. opt_ssl_ca (string)
4. Functions
5. Installation
@@ -46,9 +47,10 @@ Daniel-Constantin Mierla
1.5. Set insert_delayed parameter
1.6. Set update_affected_found parameter
1.7. Set opt_ssl_mode parameter
- 1.8. Set a my.cnf group in db_url parameter
- 1.9. Adding a kamailio group to my.cnf
- 1.10. Using [client] and specific group
+ 1.8. Set opt_ssl_ca parameter
+ 1.9. Set a my.cnf group in db_url parameter
+ 1.10. Adding a kamailio group to my.cnf
+ 1.11. Using [client] and specific group
Chapter 1. Admin Guide
@@ -69,6 +71,7 @@ Chapter 1. Admin Guide
3.5. insert_delayed (integer)
3.6. update_affected_found (integer)
3.7. opt_ssl_mode (integer)
+ 3.8. opt_ssl_ca (string)
4. Functions
5. Installation
@@ -105,6 +108,7 @@ Chapter 1. Admin Guide
3.5. insert_delayed (integer)
3.6. update_affected_found (integer)
3.7. opt_ssl_mode (integer)
+ 3.8. opt_ssl_ca (string)
3.1. ping_interval (integer)
@@ -209,6 +213,21 @@ modparam("db_mysql", "update_affected_found", 1)
modparam("db_mysql", "opt_ssl_mode", 1)
...
+3.8. opt_ssl_ca (string)
+
+ Configures the CA certs used to verify the MySQL server cert when SSL
+ is enabled.
+
+ Required when opt_ssl_mode = 4 or 5 and db_mysql is built with
+ libmysqlclient.
+
+ Default value is NULL (NULL - not configured).
+
+ Example 1.8. Set opt_ssl_ca parameter
+...
+modparam("db_mysql", "opt_ssl_ca", "/etc/ssl/certs/mysql-ca.pem")
+...
+
4. Functions
No function exported to be used from configuration file.
@@ -235,12 +254,12 @@ modparam("db_mysql", "opt_ssl_mode", 1)
* mysql://user:pass@[group]/db
* mysql://[group]/db
- Example 1.8. Set a my.cnf group in db_url parameter
+ Example 1.9. Set a my.cnf group in db_url parameter
...
modparam("usrloc", "db_url", "mysql://[kamailio]/kamailio)
...
- Example 1.9. Adding a kamailio group to my.cnf
+ Example 1.10. Adding a kamailio group to my.cnf
...
[kamailio]
socket = /path/to/mysql.sock
@@ -254,7 +273,7 @@ default-character-set = utf8
both your specific group and the client group, then the value is taken
from the last one.
- Example 1.10. Using [client] and specific group
+ Example 1.11. Using [client] and specific group
...
[client]
socket = /run/mysql/mysqld.sock
Module: kamailio
Branch: 5.8
Commit: ed99a5e2648c39e29fbbc7842c86425147c607c6
URL: https://github.com/kamailio/kamailio/commit/ed99a5e2648c39e29fbbc7842c86425…
Author: Kamailio Dev <kamailio.dev(a)kamailio.org>
Committer: Kamailio Dev <kamailio.dev(a)kamailio.org>
Date: 2024-03-07T10:17:15+01:00
modules: readme files regenerated - modules ... [skip ci]
---
Modified: src/modules/tls/README
---
Diff: https://github.com/kamailio/kamailio/commit/ed99a5e2648c39e29fbbc7842c86425…
Patch: https://github.com/kamailio/kamailio/commit/ed99a5e2648c39e29fbbc7842c86425…
---
diff --git a/src/modules/tls/README b/src/modules/tls/README
index 78af3bdcc77..d98f94eb8ed 100644
--- a/src/modules/tls/README
+++ b/src/modules/tls/README
@@ -263,8 +263,9 @@ Chapter 1. Admin Guide
profiles of tls.cfg file.
When installing tls module of kamailio, a sample 'tls.cfg' file is
- deployed in the same folder with 'kamailio.cfg', along with freshly
- generated self signed certificates.
+ deployed in the same folder with 'kamailio.cfg'. For freshly generated
+ self signed certificates make must be called from tls folder
+make install-tls-cert
HINT: be sure you have enable_tls=yes to your kamailio.cfg.
@@ -402,9 +403,6 @@ make -C modules/tls extra_defs="-DTLS_WR_DEBUG -DTLS_RD_DEBUG"
standard conforming (the verification should happen during TLS
connection establishment and not after).
- TLS specific config reloading is not safe, so for now better don't use
- it, especially under heavy traffic.
-
This documentation is incomplete. The provided selects are not
documented in this file. A list with all the ones implemented by the
TLS module can be found in the Cookbook
@@ -1683,6 +1681,10 @@ verify_client = optional_no_ca
are not terminated and they continue to use the old certificates. The
new configuration will be used for new connections.
+ Reload is generally safe and usable in production environments. If
+ possible should be done in a time where the service has lower
+ usage/connections.
+
This RPC command is exported with "RPC_EXEC_DELTA" flag, therefore its
execution rate can be restricted to specific time intervals by setting
the "rpc_exec_delta" core parameter.
Module: kamailio
Branch: 5.8
Commit: 22f274513a98cc081d44a6694e35c3e96844dae3
URL: https://github.com/kamailio/kamailio/commit/22f274513a98cc081d44a6694e35c3e…
Author: Xenofon Karamanos <22965395+xkaraman(a)users.noreply.github.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-03-07T10:07:03+01:00
tls/docs: Update certificate generation docs
(cherry picked from commit 67785fea8f906236e4a30bc09bb11b3292c46572)
---
Modified: src/modules/tls/doc/tls.xml
---
Diff: https://github.com/kamailio/kamailio/commit/22f274513a98cc081d44a6694e35c3e…
Patch: https://github.com/kamailio/kamailio/commit/22f274513a98cc081d44a6694e35c3e…
---
diff --git a/src/modules/tls/doc/tls.xml b/src/modules/tls/doc/tls.xml
index 9b3f4eaacb3..5697792655a 100644
--- a/src/modules/tls/doc/tls.xml
+++ b/src/modules/tls/doc/tls.xml
@@ -93,7 +93,10 @@
</para>
<para>
When installing tls module of kamailio, a sample 'tls.cfg' file is deployed in the same
- folder with 'kamailio.cfg', along with freshly generated self signed certificates.
+ folder with 'kamailio.cfg'. For freshly generated self signed certificates make must be called from tls folder
+ <programlisting>
+make install-tls-cert
+ </programlisting>
</para>
<para>
HINT: be sure you have <emphasis>enable_tls=yes</emphasis> to your kamailio.cfg.
Module: kamailio
Branch: 5.8
Commit: 6533c42fc0bba6408376a8f8b41b02b97b04ca1b
URL: https://github.com/kamailio/kamailio/commit/6533c42fc0bba6408376a8f8b41b02b…
Author: Xenofon Karamanos <22965395+xkaraman(a)users.noreply.github.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-03-07T10:06:56+01:00
tls/docs: Update tls.reload docs
(cherry picked from commit 4c9cfa7a6a770a693ecb3b840ad042fb201db675)
---
Modified: src/modules/tls/doc/rpc.xml
Modified: src/modules/tls/doc/tls.xml
---
Diff: https://github.com/kamailio/kamailio/commit/6533c42fc0bba6408376a8f8b41b02b…
Patch: https://github.com/kamailio/kamailio/commit/6533c42fc0bba6408376a8f8b41b02b…
---
diff --git a/src/modules/tls/doc/rpc.xml b/src/modules/tls/doc/rpc.xml
index 495fc7b31c2..d9e75b014b2 100644
--- a/src/modules/tls/doc/rpc.xml
+++ b/src/modules/tls/doc/rpc.xml
@@ -70,6 +70,10 @@
terminated and they continue to use the old certificates. The new configuration
will be used for new connections.
</para>
+ <para>
+ Reload is generally safe and usable in production environments. If possible should
+ be done in a time where the service has lower usage/connections.
+ </para>
<para>
This RPC command is exported with "RPC_EXEC_DELTA" flag, therefore its
execution rate can be restricted to specific time intervals by setting
diff --git a/src/modules/tls/doc/tls.xml b/src/modules/tls/doc/tls.xml
index 9460d73c89f..9b3f4eaacb3 100644
--- a/src/modules/tls/doc/tls.xml
+++ b/src/modules/tls/doc/tls.xml
@@ -284,10 +284,6 @@ make -C modules/tls extra_defs="-DTLS_WR_DEBUG -DTLS_RD_DEBUG"
but also not exactly standard conforming (the verification should happen during TLS
connection establishment and not after).
</para>
- <para>
- TLS specific config reloading is not safe, so for now better don't use it,
- especially under heavy traffic.
- </para>
<para>
This documentation is incomplete.
The provided selects are not documented in this file. A list with all the
@@ -364,4 +360,3 @@ event_route[tls:connection-out] {
</section>
</chapter>
</book>
-
Hello,
discussed a bit during the online Kamailio devel meeting, it is time to
set the milestones towards the next major Kamailio release series v5.8.x.
If no other suggestions that suit more developers, I would propose to
freeze by end of this month or early February, then test for about 4
weeks as usual and release by end of February or during March.
If anyone wants to add new features/modules, they have to be published
till freezing date, either pushed in the git repository or proposed as
pull request.
Cheers,
Daniel
--
Daniel-Constantin Mierla (@ asipto.com)
twitter.com/miconda -- linkedin.com/in/miconda
Kamailio Consultancy, Training and Development Services -- asipto.com
Kamailio Advanced Training, February 20-22, 2024 -- asipto.com
Kamailio World Conference, April 18-19, 2024, Berlin -- kamailioworld.com
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [x] PR should be backported to stable branches
- [x] Tested changes locally
- [x] Related to issue #3717
#### Description
<!-- Describe your changes in detail -->
This PR updates some of the TLS documentation.
tls.reload: See #3717 for details and suggestions from core developers.
certificate generation: According to the History section, certificates are no longer generated automatically. Instead, the command `make install-tls-cert` should be used. This was verified to be working as intended and added suggestion in `Quick Start` section.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3776
-- Commit Summary --
* tls/docs: Update tls.reload docs
* tls/docs: Update certificate generation docs
-- File Changes --
M src/modules/tls/doc/rpc.xml (4)
M src/modules/tls/doc/tls.xml (10)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3776.patchhttps://github.com/kamailio/kamailio/pull/3776.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3776
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3776(a)github.com>
Module: kamailio
Branch: master
Commit: 67785fea8f906236e4a30bc09bb11b3292c46572
URL: https://github.com/kamailio/kamailio/commit/67785fea8f906236e4a30bc09bb11b3…
Author: Xenofon Karamanos <22965395+xkaraman(a)users.noreply.github.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-03-06T19:40:26+01:00
tls/docs: Update certificate generation docs
---
Modified: src/modules/tls/doc/tls.xml
---
Diff: https://github.com/kamailio/kamailio/commit/67785fea8f906236e4a30bc09bb11b3…
Patch: https://github.com/kamailio/kamailio/commit/67785fea8f906236e4a30bc09bb11b3…
---
diff --git a/src/modules/tls/doc/tls.xml b/src/modules/tls/doc/tls.xml
index 9b3f4eaacb3..5697792655a 100644
--- a/src/modules/tls/doc/tls.xml
+++ b/src/modules/tls/doc/tls.xml
@@ -93,7 +93,10 @@
</para>
<para>
When installing tls module of kamailio, a sample 'tls.cfg' file is deployed in the same
- folder with 'kamailio.cfg', along with freshly generated self signed certificates.
+ folder with 'kamailio.cfg'. For freshly generated self signed certificates make must be called from tls folder
+ <programlisting>
+make install-tls-cert
+ </programlisting>
</para>
<para>
HINT: be sure you have <emphasis>enable_tls=yes</emphasis> to your kamailio.cfg.
Module: kamailio
Branch: master
Commit: 4c9cfa7a6a770a693ecb3b840ad042fb201db675
URL: https://github.com/kamailio/kamailio/commit/4c9cfa7a6a770a693ecb3b840ad042f…
Author: Xenofon Karamanos <22965395+xkaraman(a)users.noreply.github.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-03-06T19:40:26+01:00
tls/docs: Update tls.reload docs
---
Modified: src/modules/tls/doc/rpc.xml
Modified: src/modules/tls/doc/tls.xml
---
Diff: https://github.com/kamailio/kamailio/commit/4c9cfa7a6a770a693ecb3b840ad042f…
Patch: https://github.com/kamailio/kamailio/commit/4c9cfa7a6a770a693ecb3b840ad042f…
---
diff --git a/src/modules/tls/doc/rpc.xml b/src/modules/tls/doc/rpc.xml
index 495fc7b31c2..d9e75b014b2 100644
--- a/src/modules/tls/doc/rpc.xml
+++ b/src/modules/tls/doc/rpc.xml
@@ -70,6 +70,10 @@
terminated and they continue to use the old certificates. The new configuration
will be used for new connections.
</para>
+ <para>
+ Reload is generally safe and usable in production environments. If possible should
+ be done in a time where the service has lower usage/connections.
+ </para>
<para>
This RPC command is exported with "RPC_EXEC_DELTA" flag, therefore its
execution rate can be restricted to specific time intervals by setting
diff --git a/src/modules/tls/doc/tls.xml b/src/modules/tls/doc/tls.xml
index 9460d73c89f..9b3f4eaacb3 100644
--- a/src/modules/tls/doc/tls.xml
+++ b/src/modules/tls/doc/tls.xml
@@ -284,10 +284,6 @@ make -C modules/tls extra_defs="-DTLS_WR_DEBUG -DTLS_RD_DEBUG"
but also not exactly standard conforming (the verification should happen during TLS
connection establishment and not after).
</para>
- <para>
- TLS specific config reloading is not safe, so for now better don't use it,
- especially under heavy traffic.
- </para>
<para>
This documentation is incomplete.
The provided selects are not documented in this file. A list with all the
@@ -364,4 +360,3 @@ event_route[tls:connection-out] {
</section>
</chapter>
</book>
-