[SR-Users] Re: [sr-dev] Re: Roadmap to next major Kamailio release series v5.8.x

Hi Daniel =============================== For the upgrading notes, some ideas — "tls.so: fixing GH#3635 new global config tls_threads_mode = 0 | 1 0: is the default and is the existing Kamailio behaviour 1: run some initialization functions(libcurl, database) in a thread to avoid creating thread-locals in thread#1 before fork On platforms with OpenSSL 3 "tls_threads_mode = 1" is needed to avoid shared memory contention, especially if other modules (eg. db_mysql, http_async_client, dispatcher with SIPS URIs) that might use TLS are loaded. On platforms with OpenSSL 1.1.1 — shared memory contention is much harder to trigger — but this setting is recommended when other modules that use TLS are loaded" =============================== Deployment note (for the wiki?) Here is an SRE/deployment note — not sure of a good place to put this (maybe the wiki) "To validate the config for OpenSSL 3/1.1.1 memory contention potential run the main kamailio process under gdb (don't follow child forks: "set follow-fork-mode parent" — the default setting anyway) # ** EITHER ** # deb-based: install dbgsym for libssl3 / libssl1.1 # RPM-based: install debuginfo for openssl, openssl-libs # ** OR ** # configure gdb to use debuginfod for debug symbols # STEP 1 # stop at main(), this step is required because the next breakpoint requires knowledge # of thread#1 gdb> break main gdb> run # STEP 2 # this breakpoint detects if OpenSSL 3 initializes the thread-local err_thread_local # in process#0.thread#1 — this causes shared memory contention gdb> breakpoint CRYPTO_THREAD_set_local thread 1 if $_caller_is("ossl_err_get_state_int", 32) gdb> commands backtrace 32 continue end ##For OpenSSL 1.1.1 gdb> breakpoint CRYPTO_THREAD_set_local thread 1 if $_caller_is("ERR_get_state", 32) gdb> commands backtrace 32 continue end # continue execution of Kamailio gdb> continue If this breakpoint is triggered then the configuration has potential for shared memory contention. Do file an issue at GH with your configuration and the gdb output. " Dev note: I have completed an "audit" of all in-tree modules that load libssl — libcurl, libmariadb, libcrypto, libpq etc. The only one not touched is DIAMETER cdp.so with TLS. If anyone uses this and can provide me with temporary access that would be great. Regards Richard On Tue, 27 Feb 2024 at 23:55, Daniel-Constantin Mierla via sr-dev < sr-dev(a)lists.kamailio.org&gt; wrote: