It was reported https://github.com/kamailio/kamailio/issues/662#issuecomment-261920382 but I think is not related to that issue, so opening another one.
From https://buildd.debian.org/status/fetch.php?pkg=openssl&arch=amd64&ve...
``` Configuring OpenSSL version 1.1.0e (0x1010005fL) no-asan [default] OPENSSL_NO_ASAN no-crypto-mdebug [default] OPENSSL_NO_CRYPTO_MDEBUG no-crypto-mdebug-backtrace [default] OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE no-dynamic-engine [forced] no-egd [default] OPENSSL_NO_EGD no-fuzz-afl [default] OPENSSL_NO_FUZZ_AFL no-fuzz-libfuzzer [default] OPENSSL_NO_FUZZ_LIBFUZZER no-heartbeats [default] OPENSSL_NO_HEARTBEATS no-idea [option] OPENSSL_NO_IDEA (skip dir) no-md2 [default] OPENSSL_NO_MD2 (skip dir) no-mdc2 [option] OPENSSL_NO_MDC2 (skip dir) no-msan [default] OPENSSL_NO_MSAN no-rc5 [option] OPENSSL_NO_RC5 (skip dir) no-sctp [default] OPENSSL_NO_SCTP no-shared [option] no-ssl-trace [default] OPENSSL_NO_SSL_TRACE no-ssl3 [option(ssl3-method)] OPENSSL_NO_SSL3 no-ssl3-method [option] OPENSSL_NO_SSL3_METHOD no-ubsan [default] OPENSSL_NO_UBSAN no-weak-ssl-ciphers [default] OPENSSL_NO_WEAK_SSL_CIPHERS no-zlib [option] no-zlib-dynamic [default] Configuring for debian-amd64 ``` so openssl 1.1.0e has kerberos support
but trying to start kamailio 4.4.4-2 (from Debian stretch) with TLS enabled ``` Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: INFO: tls [tls_mod.c:368]: mod_init(): With Diffie Hellman Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: INFO: tls [tls_init.c:633]: init_tls_h(): tls: _init_tls_h: compiled with openssl version "OpenSSL 1.1.0d 26 Jan 2017" (0x10100 04f), kerberos support: on, compression: on Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: INFO: tls [tls_init.c:641]: init_tls_h(): tls: init_tls_h: installed openssl library version "OpenSSL 1.1.0e 16 Feb 2017" (0x101000 5f), kerberos support: off, zlib compression: off compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -D OPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ25 6_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR=""/usr/lib/ssl"" -DENGINESDIR=""/usr/lib/x86_64-linux-gnu/engines-1.1"" Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: : tls [tls_init.c:651]: init_tls_h(): ERROR: tls: init_tls_h: openssl compile options mismatch: library has kerberos support disabled and Kamailio tls enabled (unstable configuration) (tls_force_run in kamailio.cfg will override this check) Mar 31 09:05:14 router /usr/sbin/kamailio[4375]: CRITICAL: <core> [main.c:2592]: main(): could not initialize tls, exiting... ```
A rebuild version with the same openssl version doesn't help
``` Mar 31 11:20:41 spce lb[17194]: INFO: tls [tls_init.c:633]: init_tls_h(): tls: _init_tls_h: compiled with openssl version "OpenSSL 1.1.0e 16 Feb 2017" (0x1010005f), kerberos support: on, compression: on Mar 31 11:20:41 spce lb[17194]: INFO: tls [tls_init.c:641]: init_tls_h(): tls: init_tls_h: installed openssl library version "OpenSSL 1.1.0e 16 Feb 2017" (0x1010005f), kerberos support: off, zlib compression: off#012 compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR=""/usr/lib/ssl"" -DENGINESDIR=""/usr/lib/x86_64-linux-gnu/engines-1.1"" Mar 31 11:20:41 spce lb[17194]: : tls [tls_init.c:651]: init_tls_h(): ERROR: tls: init_tls_h: openssl compile options mismatch: library has kerberos support disabled and Kamailio tls enabled (unstable configuration)#012 (tls_force_run in kamailio.cfg will override this check) Mar 31 11:20:41 spce lb[17194]: CRITICAL: <core> [main.c:2592]: main(): could not initialize tls, exiting... ```
Reported at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844548
From modules/tls/tls_init.c
``` /* attempt to guess if the library was compiled with kerberos or * compression support from the cflags */ lib_cflags=SSLeay_version(SSLEAY_CFLAGS); lib_kerberos=0; lib_zlib=0; if ((lib_cflags==0) || strstr(lib_cflags, "not available")){ lib_kerberos=-1; lib_zlib=-1; }else{ if (strstr(lib_cflags, "-DZLIB")) lib_zlib=1; if (strstr(lib_cflags, "-DKRB5_")) lib_kerberos=1; } LOG(L_INFO, "tls: _init_tls_h: compiled with openssl version " ""%s" (0x%08lx), kerberos support: %s, compression: %s\n", OPENSSL_VERSION_TEXT, (long)OPENSSL_VERSION_NUMBER, kerberos_support?"on":"off", comp_support?"on":"off"); LOG(L_INFO, "tls: init_tls_h: installed openssl library version " ""%s" (0x%08lx), kerberos support: %s, " " zlib compression: %s" "\n %s\n", SSLeay_version(SSLEAY_VERSION), ssl_version, (lib_kerberos==1)?"on":(lib_kerberos==0)?"off":"unknown", (lib_zlib==1)?"on":(lib_zlib==0)?"off":"unknown", SSLeay_version(SSLEAY_CFLAGS)); if (lib_kerberos!=kerberos_support){ if (lib_kerberos!=-1){ LOG(L_CRIT, "ERROR: tls: init_tls_h: openssl compile options" " mismatch: library has kerberos support" " %s and Kamailio tls %s (unstable configuration)\n" " (tls_force_run in kamailio.cfg will override this" " check)\n", lib_kerberos?"enabled":"disabled", kerberos_support?"enabled":"disabled" ); if (cfg_get(tls, tls_cfg, force_run)) LOG(L_WARN, "tls: init_tls_h: tls_force_run turned on, " "ignoring kerberos support mismatch\n"); else return -1; /* exit, is safer */ }else{ LOG(L_WARN, "WARNING: tls: init_tls_h: openssl compile options" " missing -- cannot detect if kerberos support is" " enabled. Possible unstable configuration\n"); } } ```
I think all those extra checks should be done only for older versions. Relying on matching inside the compile flags is probably no longer a safe bet. I think that just matching on version should be ok, so we can add an ifdef on OPENSSL_VERSION_NUMBER to enclose these checks only for versions older than libssl 1.1.0
like this? ``` diff --git a/modules/tls/tls_init.c b/modules/tls/tls_init.c index af2d4c54e..053cd2adc 100644 --- a/modules/tls/tls_init.c +++ b/modules/tls/tls_init.c @@ -613,6 +613,7 @@ int init_tls_h(void) #else comp_support=0; #endif + #if OPENSSL_VERSION_NUMBER < 0x010100000L /* attempt to guess if the library was compiled with kerberos or * compression support from the cflags */ lib_cflags=SSLeay_version(SSLEAY_CFLAGS); @@ -660,7 +661,7 @@ int init_tls_h(void) " enabled. Possible unstable configuration\n"); } } - + #endif #ifdef TLS_KSSL_WORKARROUND /* if openssl compiled with kerberos support, and openssl < 0.9.8e-dev * or openssl between 0.9.9-dev and 0.9.9-beta1 apply workaround for ```
Somehow similar, but it should include more code -- I am preparing right now a patch.
Closed #1050.
thanks
Reopened #1050.
Sadly this still seems to be an issue:
kamailio[4041]: INFO: tls [tls_init.c:633]: init_tls_h(): tls: _init_tls_h: compiled with openssl version "OpenSSL 1.1.0f 25 May 2017" (0x1010006f), kerberos support: on, compression: on kamailio[4041]: INFO: tls [tls_init.c:641]: init_tls_h(): tls: init_tls_h: installed openssl library version "OpenSSL 1.1.0j 20 Nov 2018" (0x101000af), kerberos support: off, zlib compression: off
compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR=""/usr/lib/ssl"" -DENGINESDIR=""/usr/lib/x86_64-linux-gnu/engines-1.1""
kamailio[4041]: : tls [tls_init.c:651]: init_tls_h(): ERROR: tls: init_tls_h: openssl compile options mismatch: library has kerberos support disabled and Kamailio tls enabled (unstable configuration)
(tls_force_run in kamailio.cfg will override this check)
kamailio[4041]: CRITICAL: <core> [main.c:2592]: main(): could not initialize tls, exiting... kamailio[4041]: INFO: <core> [sctp_core.c:53]: sctp_core_destroy(): SCTP API not initialized
Reported at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902452
My bad, this fix is not in 4.4.4, I will backport and fix it on Debian. Sorry for the noise.
Closed #1050.
-
Daniel-Constantin Mierla -
Victor Seva