<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi Ovidiu,</div><div dir="ltr"><br></div><div>I solved this problem by hardcoding the cert address in the my_con.c address. Guess the cert setup in the config file can't be loaded correctly when my_con.c calls it.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 27, 2022 at 7:34 AM Ovidiu Sas <<a href="mailto:osas@voipembedded.com">osas@voipembedded.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I encountered a crash related to TLS connections and I was wondering<br>
if it's a similar issue.<br>
It seems not, the crash that I encountered happens only on 3.3.<br>
<br>
If you installed opensips from a package, you need to install<br>
opensips-dbg package to get the debug symbols.<br>
After that, you can locate the core file on your server and inspect it with gdb.<br>
Everything should be detailed here:<br>
<a href="https://www.opensips.org/Documentation/TroubleShooting-Crash" rel="noreferrer" target="_blank">https://www.opensips.org/Documentation/TroubleShooting-Crash</a><br>
<br>
-ovidiu<br>
<br>
On Mon, Sep 26, 2022 at 2:54 AM jacky z <<a href="mailto:zjack0992@gmail.com" target="_blank">zjack0992@gmail.com</a>> wrote:<br>
><br>
> Hi Ovidiu,<br>
><br>
> The version I am using is 3.2. I am not familiar with the debug symbols, but guess this can be reproduced easily. With ?tls_domain=dom1 attached after the mysql address, it happens. Can you simply check if it is the same behavior? If not, I will dig further by learning how to use the debug symbols. Thanks!<br>
><br>
> On Mon, Sep 26, 2022 at 12:30 AM Ovidiu Sas <<a href="mailto:osas@voipembedded.com" target="_blank">osas@voipembedded.com</a>> wrote:<br>
>><br>
>> Which version of opensips are you using?<br>
>> Can you install the debug symbols and get a backtrace from the core file?<br>
>> <a href="https://www.opensips.org/Documentation/TroubleShooting-Crash" rel="noreferrer" target="_blank">https://www.opensips.org/Documentation/TroubleShooting-Crash</a><br>
>><br>
>> Regards,<br>
>> Ovidiu Sas<br>
>><br>
>> On Sun, Sep 25, 2022 at 6:32 AM jacky z <<a href="mailto:zjack0992@gmail.com" target="_blank">zjack0992@gmail.com</a>> wrote:<br>
>> ><br>
>> > Hi Vlad,<br>
>> ><br>
>> > It seems opensips crashed when I set ?tls_domain=dom1 to enable tls connection to mysql db. I followed the method in the manual.<br>
>> ><br>
>> > modparam("usrloc", "db_url", "mysql://root:1234@localhost/opensips?tls_domain=dom1")<br>
>> ><br>
>> ><br>
>> > Here is the log.<br>
>> ><br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:tls_mgm:mod_init: initializing TLS management<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:tls_mgm:init_tls_dom: Processing TLS domain 'dom'<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: NOTICE:tls_mgm:init_tls_dom: no CA dir for tls 'dom' defined, using default '/etc/pki/CA/'<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: NOTICE:tls_mgm:init_tls_dom: no crl for tls, using none<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: NOTICE:tls_openssl:openssl_init_tls_dom: No EC curve defined<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:tls_openssl:get_ssl_ctx_verify_mode: client verification NOT activated. Weaker security.<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:tls_mgm:init_tls_dom: Processing TLS domain 'dom1'<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: NOTICE:tls_mgm:init_tls_dom: no CA dir for tls 'dom1' defined, using default '/etc/pki/CA/'<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: NOTICE:tls_mgm:init_tls_dom: no crl for tls, using none<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: NOTICE:tls_openssl:openssl_init_tls_dom: No EC curve defined<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:tls_openssl:get_ssl_ctx_verify_mode: server verification NOT activated. Weaker security.<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:proto_tls:mod_init: initializing TLS protocol<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:proto_bin:mod_init: initializing BIN protocol<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: INFO:clusterer:mod_init: Clusterer module - initializing<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 /usr/sbin/opensips[4935]: CRITICAL:core:sig_usr: segfault in attendant (starter) process!<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 kernel: [39023.653243] opensips[4935]: segfault at 0 ip 0000000000000000 sp 00007ffececa3d08 error 14 in opensips[558b5bb75000+1c000]<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 kernel: [39023.666503] Code: Bad RIP value.<br>
>> > Sep 25 10:14:01 ip-10-100-20-35 opensips: INFO:core:daemonize: pre-daemon process exiting with -1<br>
>> ><br>
>> > and my client domain settings<br>
>> ><br>
>> > #client domain<br>
>> > modparam("tls_mgm", "client_domain", "dom1")<br>
>> > modparam("tls_mgm", "match_ip_address", "[dom1]*")<br>
>> > modparam("tls_mgm", "match_sip_domain", "[dom1]*")<br>
>> > modparam("tls_mgm","certificate", "[dom1]/etc/ssl/certs/rootCACert.pem")<br>
>> > modparam("tls_mgm","private_key", "[dom1]/etc/ssl/private/rootCAKey.pem")<br>
>> > modparam("tls_mgm","ca_list", "[dom1]/etc/ssl/certs/rootCACert.pem")<br>
>> > modparam("tls_mgm","tls_method", "[dom1]SSLv23")<br>
>> > modparam("tls_mgm","verify_cert", "[dom1]0")<br>
>> > modparam("tls_mgm","require_cert", "[dom1]0")<br>
>> ><br>
>> > It is expected to see some other errors such as invalid cert but not crash in pre-daemon process. Any clue on this for me to debug? If I remove "?tls_domain=dom1", there is no such crash though the opensips server still couldn't start because I forced the mysql db to use ssl connection. Thanks!<br>
>> ><br>
>> > On Mon, Sep 19, 2022 at 9:09 PM Vlad Patrascu <<a href="mailto:vladp@opensips.org" target="_blank">vladp@opensips.org</a>> wrote:<br>
>> >><br>
>> >> Hi Jacky,<br>
>> >><br>
>> >> I cant think of any workaround unfortunately.<br>
>> >><br>
>> >> Regards,<br>
>> >><br>
>> >> --<br>
>> >> Vlad Patrascu<br>
>> >> OpenSIPS Core Developer<br>
>> >> <a href="http://www.opensips-solutions.com" rel="noreferrer" target="_blank">http://www.opensips-solutions.com</a><br>
>> >><br>
>> >> On 17.09.2022 18:46, jacky z wrote:<br>
>> >><br>
>> >> Hi Vlad,<br>
>> >><br>
>> >> Is there any workaround to disable the client cert? Thanks!<br>
>> >><br>
>> >> On Wed, Sep 14, 2022 at 9:16 PM Vlad Patrascu <<a href="mailto:vladp@opensips.org" target="_blank">vladp@opensips.org</a>> wrote:<br>
>> >>><br>
>> >>> Hi Jacky,<br>
>> >>><br>
>> >>> OpenSIPS will always require you to configure a client certificate for TLS client domains and will also present that certificate when connecting. But normally, a TLS server can simply choose not to verify the client certificate. I don't have any experience with AWS RDS though but it seems odd to not accept a connection only because the client did present a certificate.<br>
>> >>><br>
>> >>> Regards,<br>
>> >>><br>
>> >>> --<br>
>> >>> Vlad Patrascu<br>
>> >>> OpenSIPS Core Developer<br>
>> >>> <a href="http://www.opensips-solutions.com" rel="noreferrer" target="_blank">http://www.opensips-solutions.com</a><br>
>> >>><br>
>> >>> On 14.09.2022 05:42, jacky z wrote:<br>
>> >>><br>
>> >>> Hi Bogdan-Andrei,<br>
>> >>><br>
>> >>> I checked the mariadb documentation and found mariadb has two options to set ssl connection: two-way TSL and one-way TSL. It seems AWS RDS only supports one-way TSL, that is, TSL is used without a client cert. Does OPENSIPS support such one-way TSL to connect a database? Thanks!<br>
>> >>><br>
>> >>> On Wed, Sep 14, 2022 at 12:06 AM jacky z <<a href="mailto:zjack0992@gmail.com" target="_blank">zjack0992@gmail.com</a>> wrote:<br>
>> >>>><br>
>> >>>> Hi Bogdan-Andrei,<br>
>> >>>><br>
>> >>>> I have set the "certificate" and "private_key" in my script, as I explained in method 1. However, AWS RDS doesn't support a client cert. Please refer to<br>
>> >>>> <a href="https://stackoverflow.com/questions/53760104/how-to-configure-x509-client-certificate-based-authentication-to-connect-to-aws" rel="noreferrer" target="_blank">https://stackoverflow.com/questions/53760104/how-to-configure-x509-client-certificate-based-authentication-to-connect-to-aws</a><br>
>> >>>><br>
>> >>>> Is there any workaround to use the public cert list provided by AWS? Anyone has successfully used RDS with SSL connections? Thanks!<br>
>> >>>><br>
>> >>>> On Tue, Sep 13, 2022 at 9:54 PM Bogdan-Andrei Iancu <<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>> wrote:<br>
>> >>>>><br>
>> >>>>> Set the certificate and key you have in the tls_mgm module, for the "certificate" and "private_key" parameters.<br>
>> >>>>><br>
>> >>>>> Regards,<br>
>> >>>>><br>
>> >>>>> Bogdan-Andrei Iancu<br>
>> >>>>><br>
>> >>>>> OpenSIPS Founder and Developer<br>
>> >>>>> <a href="https://www.opensips-solutions.com" rel="noreferrer" target="_blank">https://www.opensips-solutions.com</a><br>
>> >>>>> OpenSIPS Summit 27-30 Sept 2022, Athens<br>
>> >>>>> <a href="https://www.opensips.org/events/Summit-2022Athens/" rel="noreferrer" target="_blank">https://www.opensips.org/events/Summit-2022Athens/</a><br>
>> >>>>><br>
>> >>>>> On 9/13/22 2:57 PM, jacky z wrote:<br>
>> >>>>><br>
>> >>>>> Hi Bogdan-Andrei,<br>
>> >>>>><br>
>> >>>>> I tried two methods.<br>
>> >>>>><br>
>> >>>>> Method 1:<br>
>> >>>>><br>
>> >>>>> #enabled TLS connection:<br>
>> >>>>> modparam("db_mysql", "use_tls", 1)<br>
>> >>>>><br>
>> >>>>> #setup a client domain:<br>
>> >>>>> modparam("tls_mgm", "client_domain", "dom1")<br>
>> >>>>> modparam("tls_mgm", "match_ip_address", "[dom1]*")<br>
>> >>>>> modparam("tls_mgm", "match_sip_domain", "[dom1]*")<br>
>> >>>>> modparam("tls_mgm","certificate", "[dom1]/etc/ssl/certs/rootCACert.pem")<br>
>> >>>>> modparam("tls_mgm","private_key", "[dom1]/etc/ssl/private/rootCAKey.pem")<br>
>> >>>>> modparam("tls_mgm","ca_list", "[dom1]/etc/ssl/certs/rootCACert.pem")<br>
>> >>>>> modparam("tls_mgm","tls_method", "[dom1]SSLv23")<br>
>> >>>>> modparam("tls_mgm","verify_cert", "[dom1]0")<br>
>> >>>>> modparam("tls_mgm","require_cert", "[dom1]0")<br>
>> >>>>> # set db_url<br>
>> >>>>> modparam("usrloc", "db_url", "mysql://root:1234@<awsrdsaddress>/opensips?tls_domain=dom1")<br>
>> >>>>> ...<br>
>> >>>>><br>
>> >>>>> I couldn't figure out how to use global-bundle.pem AWS provided with this method. No luck to get a connection with RDS. If I don't use ssl, opensips can connect to RDS without encryption.<br>
>> >>>>><br>
>> >>>>> Method 2:<br>
>> >>>>><br>
>> >>>>> I tried<br>
>> >>>>><br>
>> >>>>> modparam("usrloc", "db_url", "mysql://root:1234@<awsrdsaddress>/opensips?ssl=true&ssl_ca_certs=/etc/ssl/certs/global-bundle.pem")<br>
>> >>>>><br>
>> >>>>> to include the AWS cert. Still no luck.<br>
>> >>>>><br>
>> >>>>> Thanks!<br>
>> >>>>><br>
>> >>>>> On Tue, Sep 13, 2022 at 4:52 PM Bogdan-Andrei Iancu <<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>> wrote:<br>
>> >>>>>><br>
>> >>>>>> Hi,<br>
>> >>>>>><br>
>> >>>>>> sorry for my silly question, but how do you connect from the OpenSIPS side ??<br>
>> >>>>>><br>
>> >>>>>> Regards,<br>
>> >>>>>><br>
>> >>>>>> Bogdan-Andrei Iancu<br>
>> >>>>>><br>
>> >>>>>> OpenSIPS Founder and Developer<br>
>> >>>>>> <a href="https://www.opensips-solutions.com" rel="noreferrer" target="_blank">https://www.opensips-solutions.com</a><br>
>> >>>>>> OpenSIPS Summit 27-30 Sept 2022, Athens<br>
>> >>>>>> <a href="https://www.opensips.org/events/Summit-2022Athens/" rel="noreferrer" target="_blank">https://www.opensips.org/events/Summit-2022Athens/</a><br>
>> >>>>>><br>
>> >>>>>> On 9/13/22 10:41 AM, jacky z wrote:<br>
>> >>>>>><br>
>> >>>>>> Hi Team,<br>
>> >>>>>><br>
>> >>>>>> We hope to connect to aws RDS database with ssl encryption. We have setup a client domain according to OPENSIPS documents. However, AWS RDS does not support client cert as someone has confirmed with AWS <a href="https://stackoverflow.com/questions/53760104/how-to-configure-x509-client-certificate-based-authentication-to-connect-to-aws" rel="noreferrer" target="_blank">https://stackoverflow.com/questions/53760104/how-to-configure-x509-client-certificate-based-authentication-to-connect-to-aws</a><br>
>> >>>>>><br>
>> >>>>>> Is there any way to use the cert provided by AWS to connect? AWS provides a global-bundle.pem (<a href="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html" rel="noreferrer" target="_blank">https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html</a>) for such a connection, but we don't know how to include it in the config file.<br>
>> >>>>>><br>
>> >>>>>> Thanks<br>
>> >>>>>><br>
>> >>>>>> Jacky z<br>
>> >>>>>><br>
>> >>>>>> _______________________________________________<br>
>> >>>>>> Users mailing list<br>
>> >>>>>> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> >>>>>> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
>> >>>>>><br>
>> >>>>>><br>
>> >>>>><br>
>> >>><br>
>> >>> _______________________________________________<br>
>> >>> Users mailing list<br>
>> >>> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> >>> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
>> >>><br>
>> >>> _______________________________________________<br>
>> >>> Users mailing list<br>
>> >>> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> >>> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
>> >><br>
>> >><br>
>> >> _______________________________________________<br>
>> >> Users mailing list<br>
>> >> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> >> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
>> >><br>
>> >> _______________________________________________<br>
>> >> Users mailing list<br>
>> >> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> >> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
>> ><br>
>> > _______________________________________________<br>
>> > Users mailing list<br>
>> > <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> > <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
>><br>
>><br>
>><br>
>> --<br>
>> VoIP Embedded, Inc.<br>
>> <a href="http://www.voipembedded.com" rel="noreferrer" target="_blank">http://www.voipembedded.com</a><br>
>><br>
>> _______________________________________________<br>
>> Users mailing list<br>
>> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
>> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br>
<br>
<br>
-- <br>
VoIP Embedded, Inc.<br>
<a href="http://www.voipembedded.com" rel="noreferrer" target="_blank">http://www.voipembedded.com</a><br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div></div></div>