<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 22/01/15 16:51, Matthew Jordan
wrote:<br>
</div>
<blockquote
cite="mid:CAN2PU+52JWej+9O6+yYoe5OHbtCYNLUC-QPVLuME539iGS9HqA@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Jan 22, 2015 at 2:47 AM, Olle
E. Johansson <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:oej@edvina.net" target="_blank">oej@edvina.net</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><span class=""><br>
On 21 Jan 2015, at 21:52, Juha Heinanen <<a
moz-do-not-send="true" href="mailto:jh@tutpro.com">jh@tutpro.com</a>>
wrote:<br>
<br>
> Juha Heinanen writes:<br>
><br>
>> when [group] thing didn't work, i added<br>
>><br>
>> ssl-ca=/etc/mysql/cacert.pem<br>
>><br>
>> to [client] section of my.cfg that kamailio
according to db_mysql/README<br>
>> is reading.<br>
>><br>
>> after that, kamailio started ok, but didn't use
ssl for mysql queries.<br>
>><br>
>> what is it that i'm missing? has anyone
succeeded in making kamailio to<br>
>> query mysql server over ssl?<br>
><br>
> based on zero responses, i guess the answer is
"no". if so, that pretty<br>
> much prevents using kamailio in an environment
where mysql service is<br>
> provided by a cloud service, such as amazon ec2.<br>
><br>
> should i put a note in db_mysql module README
telling that we don't<br>
> currently know, which [client] params of my.cfg the
module supports?<br>
<br>
</span>We've seen reports of issues with Postgresql with
TLS too, I don't know<br>
what happened, but I think we need to focus on both and
fix this.<br>
<br>
There is a known geneal problem with libraries using
OpenSSL - I don't know if<br>
this has been looked at in Kamailio, but we did a fix in
Asterisk a while ago.<br>
If you have modules using libraries that use OpenSSL -
like we have in<br>
Curl, Mysql, Postgres and possibly other modules - as well
as our own use in<br>
the TLS module - there's a risk that OpenSSL gets
initialized too many<br>
times and bad things happen. ("Bad things" need to be
defined here).<br>
<br>
I think Kevin did a library trick with the linker so that
Asterisk<br>
catch these initialization calls first and use just one.
Asterisk is<br>
multithreaded and Kamailio is multiprocess, so I don't
know how this<br>
affects Kamailio or if we can get some inspiration by this
fix.<br>
<br>
Rambling a bit, but trying to point in some sort of
general direction. :-)<br>
<br>
I will put on my list to set up a lab with Mysql TLS
connections and try.<br>
<span class=""></span><br>
</blockquote>
</div>
<br>
</div>
<div class="gmail_extra">Just chiming in to point out the magic
module Olle is referring to:<br>
<br>
<a moz-do-not-send="true"
href="http://svn.asterisk.org/svn/asterisk/trunk/main/libasteriskssl.c">http://svn.asterisk.org/svn/asterisk/trunk/main/libasteriskssl.c</a><br>
<br>
</div>
<div class="gmail_extra">For context, the peer review for the
patch that fixed this issue is here:<br>
<br>
<a moz-do-not-send="true"
href="https://reviewboard.asterisk.org/r/1006/">https://reviewboard.asterisk.org/r/1006/</a><br>
<br>
</div>
<div class="gmail_extra">Although due to some issues in review
board, part of the patch doesn't show up (hence the link to
the actual source).<br>
<br>
</div>
</div>
</blockquote>
Interesting approach by temporarily replacing the libssl functions
and call the original ones later.<br>
<br>
In this case it wouldn't have worked because the postgress module is
used to connect to database (e.g., some modules load records from
database during module initialization), so libssl must be properly
initialized to the phase of opening a tls connection.<br>
<br>
I broke the initialization process in few phases that allows to get
libssl initialized before any other module and seems to work, based
on the feedback of who reported the issue.<br>
<br>
MySQL issue was something different, related more to mysql client
config.<br>
<br>
Cheers,<br>
Daniel<br>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla
<a class="moz-txt-link-freetext" href="http://twitter.com/#!/miconda">http://twitter.com/#!/miconda</a> - <a class="moz-txt-link-freetext" href="http://www.linkedin.com/in/miconda">http://www.linkedin.com/in/miconda</a></pre>
</body>
</html>