[kamailio/kamailio] TLS module deadlocks with libssl 1.1.x on systems with multiple OpenSSL versions (e.g. CentOS7) (Issue #3458)
The current build of kamailio (master) does not set `TLS_PTHREAD_MUTEX_SHARED` when building with `--with-openssl11` on systems with multiple versions of OpenSSL installed resulting in deadlocks in the TLS module.
All module Makefiles look for the `SSL_BUILDER` environment variable to provide a `pkg-config` command to find the `libssl` to link against. The variable is set to `pkg-config libssl11` by the RPM build when specifying `--with-openssl11`. Unfortunately, in `src/Makefile.defs`, there is an alternative way to look for a similar `pkg-config` command. However, this one always uses the `pkg-config libssl`, which - on systems with multiple versions of OpenSSL - usually points to OpenSSL 1.0.x. In turn the build thinks it will link against OpenSSL 1.0.x and will not set `KSR_PTHREAD_MUTEX_SHARED`.
Maybe we can just make it default to set KSR_PTHREAD_MUTEX_SHARED, since it is anyhow in the context of kamailio and even if libssl1.1 is not used, then it should be no much impact anyhow.
Switching it on to default, then one would have the option to disable it if wanted.
I would be ok with that, it would probably also fix #3384
However, I guess simply renaming `LIBSSL_PKGCONFIG` to `SSL_BUILDER` in `src/Makefile.defs` could also do the trick.
I pushed the change to make KSR_PTHREAD_MUTEX_SHARED set by default, because many do the compilation from sources, not using packages.
Further improvements can be added, if anyone is up to it. It will be backported to 5.7 as well and later considered for older branches if nothing else comes around.
Closed #3458 as completed.
-
Daniel-Constantin Mierla -
Tobias Schlager